The most featured CVEs in this week’s security newsletters, with public Proof-of-Concepts, ordered by mention count.

For the most up-to-date and accurate info, visit the NIST links. Always audit PoCs thoroughly before running them. I don’t vouch for any links in this list: follow them with caution.

CVE-2026-46817 NEW

• Severity: 9.8 CRITICAL
• Impacted Products: Oracle Payments 12.2.3 through 12.2.15
• Description: Oracle Payments, a component of Oracle E-Business Suite, is affected by a vulnerability in its File Transmission component that allows an unauthenticated remote attacker to take full control of the application. This flaw stems from missing authentication controls and improper privilege management when processing requests over HTTP.
• Remediation:
  • Oracle Critical Security Patch Update Advisory - May 2026
• More Info: NVD - CVE-2026-46817
• PoC:
  • https://github.com/HORKimhab/CVE-2026-46817
  • https://github.com/0xBlackash/CVE-2026-46817

CVE-2026-8451 NEW

• Severity: 9.4 CRITICAL
• Impacted Products: NetScaler ADC, NetScaler Gateway
• Description: Insufficient input validation in NetScaler ADC and NetScaler Gateway leading to memory overread if NetScaler ADC or NetScaler Gateway is configured as a SAML IDP
• Remediation: Follow vendor security advisories and apply the latest patches. Review affected systems and prioritize patching based on exploitability and business impact.
• More Info: NVD - CVE-2026-8451
• PoC:
  • https://github.com/attarwahyup/Netscaler-CVE-2026-8451
  • https://github.com/0xBlackash/CVE-2026-8451
  • https://github.com/watchtowrlabs/watchTowr-vs-Netscaler-CVE-2026-8451

CVE-2026-35273

• Severity: 9.8 CRITICAL
• Impacted Products: Oracle PeopleSoft Enterprise PeopleTools 8.61, Oracle PeopleSoft Enterprise PeopleTools 8.62
• Description: Oracle PeopleSoft Enterprise PeopleTools is affected by a missing authentication vulnerability in the Updates Environment Management component that allows for remote code execution. This flaw enables an unauthenticated attacker to gain full control over the PeopleSoft environment via network access over HTTP.
• Remediation:
  • Oracle Security Alert Advisory - CVE-2026-35273
  • Oracle Security Alert Advisory - CVE-2026-35273
• More Info: NVD - CVE-2026-35273
• PoC:
  • https://github.com/0xBlackash/CVE-2026-35273
  • https://github.com/ekomsSavior/POC_cve_2026_35273
  • https://github.com/HORKimhab/CVE-2026-35273

References

This list was scraped from the quite amazing and highly recommended newsletters below:

• ~this week in security~
• Unsupervised Learning
• @RISK
• Hive Five
• Vulnerable U
• tl;dr sec

Thanks for reading! For corrections, omissions (e.g. newsletter recs) feel free to get in touch.