CVE WatchAug 7, 2026

CVE-2026-21954

Vulnerability in the Oracle Retail Xstore Point of Service product of Oracle Retail Applications (component: Xstore Mobile). The supported

CVSS

4.3

Medium

EPSS

0.2%

p10

KEV

—

Exploit Today

0-100

Published: Jul 21, 2026 · Last modified: Aug 7, 2026 · CWE-284

EPSS · 30d

0.2%EPSS · 30 days0.2%

2026-07-222026-08-12

Technical description

Vulnerability in the Oracle Retail Xstore Point of Service product of Oracle Retail Applications (component: Xstore Mobile). The supported version that is affected is 21.0.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Retail Xstore Point of Service. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Retail Xstore Point of Service accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).

Official references

www.oracle.comhttps://www.oracle.com/security-alerts/cpujul2026.html

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-595058.6 HIG

—

——0CWE-284: Improper Access Control3h CVE-2026-595018.2 HIG

—

——0CWE-284: Improper Access Control3h CVE-2026-133677.8 HIG

—

——0IBM Informix Dynamic Server 14.10, and 15.0 contain a local privilege escalation vulnerability in the oninit setuid-root utility.16h CVE-2026-599177.8 HIG

—

——0Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges and arbitrary code execution.8h CVE-2026-599147.8 HIG

—

——0Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain an Authentication Bypass by Spoofing vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges and arbitrary code execution.8h CVE-2026-67287—

—

——0Joomla Extension - joomshaper.com - Unauthenticated comment creation in SP Page Builder < 6.8.0 - An unauthenticated attacker can create comments on instances with disabled guest commenting by overriding the setting in question with user supplied input.22h