# Vulnerabilities published in 2026


- [CVE-2026-91637](https://insights.sbomify.com/CVE-2026-91637/): Missing authorization in Oracle Essbase (critical 9.9)
- [CVE-2026-91636](https://insights.sbomify.com/CVE-2026-91636/): Information disclosure in Oracle Essbase (high 7.7)
- [CVE-2026-91635](https://insights.sbomify.com/CVE-2026-91635/): Missing authorization in Oracle Essbase (high 8.1)
- [CVE-2026-91634](https://insights.sbomify.com/CVE-2026-91634/): Information disclosure in Oracle Essbase (medium 5.3)
- [CVE-2026-91633](https://insights.sbomify.com/CVE-2026-91633/): Missing authorization in Oracle Essbase (medium 6.0)
- [CVE-2026-91632](https://insights.sbomify.com/CVE-2026-91632/): Information disclosure in Oracle Essbase (high 7.7)
- [CVE-2026-91631](https://insights.sbomify.com/CVE-2026-91631/): Information disclosure in Oracle Essbase (medium 5.0)
- [CVE-2026-91630](https://insights.sbomify.com/CVE-2026-91630/): Information disclosure in Oracle Essbase (medium 6.8)
- [CVE-2026-9163](https://insights.sbomify.com/CVE-2026-9163/): SQLi in GIS Informatics' GisLab Laboratory Management System (critical 9.8)
- [CVE-2026-91629](https://insights.sbomify.com/CVE-2026-91629/): Information disclosure in Oracle Communications Billing and Revenue Management (medium 4.7)
- [CVE-2026-91628](https://insights.sbomify.com/CVE-2026-91628/): Information disclosure in Oracle Communications Billing and Revenue Management (medium 5.5)
- [CVE-2026-91627](https://insights.sbomify.com/CVE-2026-91627/): Privilege escalation in Oracle Communications Billing and Revenue Management (high 7.8)
- [CVE-2026-91625](https://insights.sbomify.com/CVE-2026-91625/): Missing authorization in Oracle Agile Product Lifecycle Management for Process (high 8.2)
- [CVE-2026-91624](https://insights.sbomify.com/CVE-2026-91624/): Auth bypass in Oracle Agile Product Lifecycle Management for Process (critical 9.1)
- [CVE-2026-91623](https://insights.sbomify.com/CVE-2026-91623/): Missing authorization in Oracle Agile Product Lifecycle Management for Process (high 7.4)
- [CVE-2026-91622](https://insights.sbomify.com/CVE-2026-91622/): Missing authorization in Oracle Agile Product Lifecycle Management for Process (critical 9.3)
- [CVE-2026-9162](https://insights.sbomify.com/CVE-2026-9162/): Global session revocation does not invalidate active WebSocket connections (medium 4.3)
- [CVE-2026-91617](https://insights.sbomify.com/CVE-2026-91617/): Information disclosure in Oracle Middleware Common Libraries and Tools (medium 5.5)
- [CVE-2026-91616](https://insights.sbomify.com/CVE-2026-91616/): Information disclosure in Oracle Middleware Common Libraries and Tools (low 3.7)
- [CVE-2026-91615](https://insights.sbomify.com/CVE-2026-91615/): Missing authorization in Oracle Database Server (medium 6.3)
- [CVE-2026-91614](https://insights.sbomify.com/CVE-2026-91614/): Information disclosure in Oracle Communications Unified Inventory Management (low 3.3)
- [CVE-2026-91613](https://insights.sbomify.com/CVE-2026-91613/): Information disclosure in Oracle Communications Unified Inventory Management (low 3.3)
- [CVE-2026-91612](https://insights.sbomify.com/CVE-2026-91612/): Information disclosure in Oracle Communications Unified Inventory Management (low 3.3)
- [CVE-2026-91610](https://insights.sbomify.com/CVE-2026-91610/): Missing authorization in Oracle REST Data Services (high 8.8)
- [CVE-2026-9161](https://insights.sbomify.com/CVE-2026-9161/): User Enumeration in DernekPlus' Website Template (medium 5.3)
- [CVE-2026-91609](https://insights.sbomify.com/CVE-2026-91609/): Information disclosure in Oracle REST Data Services (medium 6.5)
- [CVE-2026-91608](https://insights.sbomify.com/CVE-2026-91608/): Information disclosure in Oracle BI Publisher (high 7.5)
- [CVE-2026-91607](https://insights.sbomify.com/CVE-2026-91607/): Information disclosure in Oracle Business Intelligence Enterprise Edition (medium 4.3)
- [CVE-2026-91604](https://insights.sbomify.com/CVE-2026-91604/): Missing authorization in Oracle Agile Product Lifecycle Management for Process (high 7.5)
- [CVE-2026-91600](https://insights.sbomify.com/CVE-2026-91600/): Information disclosure in Oracle Business Intelligence Enterprise Edition (medium 4.3)
- [CVE-2026-9160](https://insights.sbomify.com/CVE-2026-9160/): CSTI in Arma Digital's Website Template (medium 4.3)
- [CVE-2026-91598](https://insights.sbomify.com/CVE-2026-91598/): Information disclosure in Oracle Business Intelligence Enterprise Edition (medium 4.3)
- [CVE-2026-91597](https://insights.sbomify.com/CVE-2026-91597/): Missing authorization in Oracle Business Intelligence Enterprise Edition (high 8.3)
- [CVE-2026-91590](https://insights.sbomify.com/CVE-2026-91590/): Missing authorization in Oracle BI Publisher (medium 5.4)
- [CVE-2026-91588](https://insights.sbomify.com/CVE-2026-91588/): Other in Oracle Business Intelligence Enterprise Edition (medium 6.5)
- [CVE-2026-91582](https://insights.sbomify.com/CVE-2026-91582/): Denial of service in Oracle Business Intelligence Enterprise Edition (low 3.7)
- [CVE-2026-9158](https://insights.sbomify.com/CVE-2026-9158/): Use after free in Eclipse 4diac (medium 5.2)
- [CVE-2026-91579](https://insights.sbomify.com/CVE-2026-91579/): Open redirect in Oracle BI Publisher (high 8.8)
- [CVE-2026-91577](https://insights.sbomify.com/CVE-2026-91577/): Missing authorization in Oracle Business Intelligence Enterprise Edition (medium 6.4)
- [CVE-2026-91576](https://insights.sbomify.com/CVE-2026-91576/): Missing authorization in Oracle Business Intelligence Enterprise Edition (medium 6.5)
- [CVE-2026-91574](https://insights.sbomify.com/CVE-2026-91574/): Missing authorization in Oracle BI Publisher (medium 6.5)
- [CVE-2026-91573](https://insights.sbomify.com/CVE-2026-91573/): Missing authorization in Oracle Agile Product Lifecycle Management for Process (high 8.2)
- [CVE-2026-9157](https://insights.sbomify.com/CVE-2026-9157/): Remote Code Execution in Gmission Web FAX (high 8.6)
- [CVE-2026-91568](https://insights.sbomify.com/CVE-2026-91568/): Missing authorization in Oracle Database Server (high 7.7)
- [CVE-2026-91565](https://insights.sbomify.com/CVE-2026-91565/): Missing authorization in Oracle Agile Product Lifecycle Management for Process (medium 6.4)
- [CVE-2026-91563](https://insights.sbomify.com/CVE-2026-91563/): Privilege escalation in Oracle OLAP (high 8.8)
- [CVE-2026-91562](https://insights.sbomify.com/CVE-2026-91562/): Missing authorization in PeopleSoft Enterprise FIN Inventory Brazil (medium 4.4)
- [CVE-2026-9156](https://insights.sbomify.com/CVE-2026-9156/): Tanium addressed a denial of service vulnerability in Tanium Server. (medium 6.5)
- [CVE-2026-91559](https://insights.sbomify.com/CVE-2026-91559/): Missing authorization in PeopleSoft Enterprise FIN Manufacturing Brazil (medium 4.4)
- [CVE-2026-91557](https://insights.sbomify.com/CVE-2026-91557/): Privilege escalation in Oracle Business Intelligence Enterprise Edition (high 7.0)
- [CVE-2026-91555](https://insights.sbomify.com/CVE-2026-91555/): Cross-site request forgery in Oracle BI Publisher (medium 6.1)
- [CVE-2026-91554](https://insights.sbomify.com/CVE-2026-91554/): Missing authorization in Oracle BI Publisher (medium 6.5)
- [CVE-2026-91553](https://insights.sbomify.com/CVE-2026-91553/): Missing authorization in PeopleSoft Enterprise FIN Product Configurator Brazil (medium 4.4)
- [CVE-2026-91552](https://insights.sbomify.com/CVE-2026-91552/): Information disclosure in Oracle WebCenter Sites (high 7.5)
- [CVE-2026-91550](https://insights.sbomify.com/CVE-2026-91550/): Missing authorization in Oracle Agile Product Lifecycle Management for Process (high 8.8)
- [CVE-2026-9155](https://insights.sbomify.com/CVE-2026-9155/): OS Command Injection in Rapid7 InsightConnect Sed Plugin via expression parameter. (high 8.8)
- [CVE-2026-91549](https://insights.sbomify.com/CVE-2026-91549/): Open redirect in Oracle Business Intelligence Enterprise Edition (high 7.8)
- [CVE-2026-91547](https://insights.sbomify.com/CVE-2026-91547/): Privilege escalation in Oracle GoldenGate (medium 5.5)
- [CVE-2026-91546](https://insights.sbomify.com/CVE-2026-91546/): Auth bypass in Oracle Business Intelligence Enterprise Edition (high 8.1)
- [CVE-2026-91545](https://insights.sbomify.com/CVE-2026-91545/): Missing authorization in Oracle Business Intelligence Enterprise Edition (high 7.8)
- [CVE-2026-91542](https://insights.sbomify.com/CVE-2026-91542/): Information disclosure in Oracle WebCenter Sites (high 7.5)
- [CVE-2026-91541](https://insights.sbomify.com/CVE-2026-91541/): Missing authorization in PeopleSoft Enterprise FIN Common Objects Brazil (medium 6.5)
- [CVE-2026-9154](https://insights.sbomify.com/CVE-2026-9154/): Arbitrary File Write in Rapid7 InsightConnect Sed Plugin (high 7.1)
- [CVE-2026-91539](https://insights.sbomify.com/CVE-2026-91539/): Privilege escalation in Oracle Business Intelligence Enterprise Edition (high 7.8)
- [CVE-2026-91537](https://insights.sbomify.com/CVE-2026-91537/): Privilege escalation in Oracle Solaris (high 7.8)
- [CVE-2026-91536](https://insights.sbomify.com/CVE-2026-91536/): Missing authorization in Oracle SOA Suite (medium 5.0)
- [CVE-2026-91535](https://insights.sbomify.com/CVE-2026-91535/): Missing authorization in Oracle Business Intelligence Enterprise Edition (high 8.8)
- [CVE-2026-91534](https://insights.sbomify.com/CVE-2026-91534/): Missing authorization in Oracle Business Intelligence Enterprise Edition (high 8.6)
- [CVE-2026-91532](https://insights.sbomify.com/CVE-2026-91532/): Missing authorization in Oracle Applications Manager (high 8.8)
- [CVE-2026-91530](https://insights.sbomify.com/CVE-2026-91530/): Missing authorization in Oracle GoldenGate (medium 4.4)
- [CVE-2026-9153](https://insights.sbomify.com/CVE-2026-9153/): Arbitrary File Read in Rapid7 InsightConnect Sed Plugin (medium 6.5)
- [CVE-2026-91528](https://insights.sbomify.com/CVE-2026-91528/): Information disclosure in Oracle BI Publisher (medium 4.3)
- [CVE-2026-91527](https://insights.sbomify.com/CVE-2026-91527/): Missing authorization in Oracle ZFS Storage Appliance Kit (high 8.8)
- [CVE-2026-91526](https://insights.sbomify.com/CVE-2026-91526/): Open redirect in Oracle BI Publisher (medium 4.7)
- [CVE-2026-91524](https://insights.sbomify.com/CVE-2026-91524/): Denial of service in Oracle Business Intelligence Enterprise Edition (medium 4.3)
- [CVE-2026-91523](https://insights.sbomify.com/CVE-2026-91523/): Missing authorization in Oracle Business Intelligence Enterprise Edition (medium 5.4)
- [CVE-2026-91521](https://insights.sbomify.com/CVE-2026-91521/): Missing authorization in Oracle Agile Product Lifecycle Management for Process (high 8.8)
- [CVE-2026-91520](https://insights.sbomify.com/CVE-2026-91520/): Missing authorization in Oracle Agile Product Lifecycle Management for Process (high 8.8)
- [CVE-2026-9152](https://insights.sbomify.com/CVE-2026-9152/): Unauthenticated SOAP Endpoint in Altium 365 SearchService Allows Cross-Tenant Data Exfiltration and Index Destruction (critical 10.0)
- [CVE-2026-91519](https://insights.sbomify.com/CVE-2026-91519/): Missing authorization in PeopleSoft Enterprise PeopleTools (medium 6.5)
- [CVE-2026-91518](https://insights.sbomify.com/CVE-2026-91518/): Missing authorization in Oracle BI Publisher (medium 5.4)
- [CVE-2026-91517](https://insights.sbomify.com/CVE-2026-91517/): Missing authorization in Oracle Management Pack for Oracle GoldenGate (high 8.0)
- [CVE-2026-91515](https://insights.sbomify.com/CVE-2026-91515/): Missing authorization in Oracle Agile Product Lifecycle Management for Process (high 7.5)
- [CVE-2026-91514](https://insights.sbomify.com/CVE-2026-91514/): Information disclosure in Oracle BI Publisher (medium 6.5)
- [CVE-2026-91512](https://insights.sbomify.com/CVE-2026-91512/): Missing authorization in Oracle Agile Product Lifecycle Management for Process (high 7.2)
- [CVE-2026-91511](https://insights.sbomify.com/CVE-2026-91511/): Missing authorization in Oracle Purchasing (high 7.1)
- [CVE-2026-9151](https://insights.sbomify.com/CVE-2026-9151/): Command Injection Vulnerability in OpenVPN on Multiple TP-Link Archer Routers (high 8.5)
- [CVE-2026-91506](https://insights.sbomify.com/CVE-2026-91506/): Missing authorization in Workflow (high 8.1)
- [CVE-2026-91505](https://insights.sbomify.com/CVE-2026-91505/): Missing authorization in PeopleSoft Enterprise PeopleTools (medium 6.0)
- [CVE-2026-91504](https://insights.sbomify.com/CVE-2026-91504/): Missing authorization in Oracle WebCenter Content (high 7.5)
- [CVE-2026-91503](https://insights.sbomify.com/CVE-2026-91503/): Missing authorization in Oracle Database Server (high 8.1)
- [CVE-2026-91502](https://insights.sbomify.com/CVE-2026-91502/): Missing authorization in Oracle WebLogic Server (high 7.3)
- [CVE-2026-91501](https://insights.sbomify.com/CVE-2026-91501/): Missing authorization in Oracle Identity Manager (medium 5.5)
- [CVE-2026-9150](https://insights.sbomify.com/CVE-2026-9150/): Libsolv: stack-based buffer overflow in libsolv's debian metadata parser when handling sha384/sha512 checksums (medium 6.5)
- [CVE-2026-91499](https://insights.sbomify.com/CVE-2026-91499/): Privilege escalation in Oracle Database Server (high 8.8)
- [CVE-2026-91497](https://insights.sbomify.com/CVE-2026-91497/): Missing authorization in PeopleSoft Enterprise PeopleTools (medium 5.3)
- [CVE-2026-91496](https://insights.sbomify.com/CVE-2026-91496/): Missing authorization in Workflow (high 7.5)
- [CVE-2026-91495](https://insights.sbomify.com/CVE-2026-91495/): Auth bypass in Oracle WebCenter Content (critical 9.8)
- [CVE-2026-91494](https://insights.sbomify.com/CVE-2026-91494/): Missing authorization in Oracle Identity Manager Connector (high 7.4)
- [CVE-2026-91493](https://insights.sbomify.com/CVE-2026-91493/): Auth bypass in Oracle Identity Manager Connector (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/255/