# Vulnerabilities published in 2026


- [CVE-2026-91492](https://insights.sbomify.com/CVE-2026-91492/): Missing authorization in Oracle Identity Manager Connector (high 8.7)
- [CVE-2026-91491](https://insights.sbomify.com/CVE-2026-91491/): Auth bypass in Oracle Identity Manager Connector (critical 9.8)
- [CVE-2026-91490](https://insights.sbomify.com/CVE-2026-91490/): Auth bypass in Oracle Identity Manager Connector (critical 9.1)
- [CVE-2026-9149](https://insights.sbomify.com/CVE-2026-9149/): Libsolv: heap buffer overflow in libsolv repo_add_solv via negative maxsize from crafted .solv file (medium 6.5)
- [CVE-2026-91489](https://insights.sbomify.com/CVE-2026-91489/): Missing authorization in Oracle Identity Manager Connector (high 7.1)
- [CVE-2026-91488](https://insights.sbomify.com/CVE-2026-91488/): Missing authorization in Oracle Identity Manager Connector (high 7.1)
- [CVE-2026-91487](https://insights.sbomify.com/CVE-2026-91487/): Other in Oracle Java SE (medium 4.8)
- [CVE-2026-91486](https://insights.sbomify.com/CVE-2026-91486/): Missing authorization in PeopleSoft Enterprise FIN General Ledger Brazil (medium 4.4)
- [CVE-2026-91485](https://insights.sbomify.com/CVE-2026-91485/): Missing authorization in PeopleSoft Enterprise FIN Cash Management (low 3.8)
- [CVE-2026-91484](https://insights.sbomify.com/CVE-2026-91484/): Other in Oracle Java SE (high 7.5)
- [CVE-2026-91483](https://insights.sbomify.com/CVE-2026-91483/): Deserialization in Oracle Outside In Technology (high 7.8)
- [CVE-2026-91482](https://insights.sbomify.com/CVE-2026-91482/): Missing authorization in PeopleSoft Enterprise SCM Strategic Sourcing (medium 6.5)
- [CVE-2026-91481](https://insights.sbomify.com/CVE-2026-91481/): Missing authorization in PeopleSoft Enterprise SCM Purchasing (medium 5.4)
- [CVE-2026-91480](https://insights.sbomify.com/CVE-2026-91480/): Missing authorization in PeopleSoft Enterprise SCM Strategic Sourcing (medium 6.5)
- [CVE-2026-9148](https://insights.sbomify.com/CVE-2026-9148/): Comments <= 7.6.56 - Unauthenticated Stored Cross-Site Scripting via 'Website' Field (high 7.2)
- [CVE-2026-91479](https://insights.sbomify.com/CVE-2026-91479/): Denial of service in Oracle Database Server (medium 6.5)
- [CVE-2026-91478](https://insights.sbomify.com/CVE-2026-91478/): Missing authorization in PeopleSoft Enterprise SCM Strategic Sourcing (high 8.8)
- [CVE-2026-91477](https://insights.sbomify.com/CVE-2026-91477/): Information disclosure in Oracle JavaFX (low 3.1)
- [CVE-2026-91476](https://insights.sbomify.com/CVE-2026-91476/): Missing authorization in PeopleSoft Enterprise FIN Common Objects Brazil (medium 5.3)
- [CVE-2026-91475](https://insights.sbomify.com/CVE-2026-91475/): Missing authorization in Oracle Outside In Technology (medium 6.6)
- [CVE-2026-91474](https://insights.sbomify.com/CVE-2026-91474/): Missing authorization in PeopleSoft Enterprise FIN Common Objects Brazil (medium 6.1)
- [CVE-2026-91473](https://insights.sbomify.com/CVE-2026-91473/): Privilege escalation in Oracle HTTP Server (high 7.8)
- [CVE-2026-91471](https://insights.sbomify.com/CVE-2026-91471/): Missing authorization in PeopleSoft Enterprise CC Common Application Objects (low 3.7)
- [CVE-2026-9147](https://insights.sbomify.com/CVE-2026-9147/): uproot 5.7.4 and prior Code Injection via TStreamerInfo Metadata (high 8.5)
- [CVE-2026-91468](https://insights.sbomify.com/CVE-2026-91468/): Missing authorization in PeopleSoft Enterprise PeopleTools (medium 6.5)
- [CVE-2026-91467](https://insights.sbomify.com/CVE-2026-91467/): Auth bypass in Oracle Fusion Middleware Control (medium 6.6)
- [CVE-2026-91466](https://insights.sbomify.com/CVE-2026-91466/): Missing authorization in PeopleSoft Enterprise FIN Common Objects Argentina (medium 6.4)
- [CVE-2026-91465](https://insights.sbomify.com/CVE-2026-91465/): Information disclosure in PeopleSoft Enterprise FIN Common Objects Argentina (high 7.5)
- [CVE-2026-91464](https://insights.sbomify.com/CVE-2026-91464/): Use after free in Oracle GraalVM Enterprise Edition (medium 5.3)
- [CVE-2026-91463](https://insights.sbomify.com/CVE-2026-91463/): Use after free in Oracle GraalVM Enterprise Edition (medium 5.3)
- [CVE-2026-91462](https://insights.sbomify.com/CVE-2026-91462/): Other in Oracle GraalVM Enterprise Edition (medium 5.9)
- [CVE-2026-91461](https://insights.sbomify.com/CVE-2026-91461/): Security feature bypass in Oracle GraalVM Enterprise Edition (low 3.7)
- [CVE-2026-91460](https://insights.sbomify.com/CVE-2026-91460/): Deserialization in Oracle Outside In Technology (high 7.8)
- [CVE-2026-91459](https://insights.sbomify.com/CVE-2026-91459/): Deserialization in Oracle Outside In Technology (high 7.8)
- [CVE-2026-91458](https://insights.sbomify.com/CVE-2026-91458/): Other in Oracle Outside In Technology (high 7.8)
- [CVE-2026-91457](https://insights.sbomify.com/CVE-2026-91457/): Other in Oracle Outside In Technology (high 7.8)
- [CVE-2026-91455](https://insights.sbomify.com/CVE-2026-91455/): Open redirect in JD Edwards EnterpriseOne Tools (medium 5.4)
- [CVE-2026-91453](https://insights.sbomify.com/CVE-2026-91453/): Other in Oracle GraalVM Enterprise Edition (medium 5.3)
- [CVE-2026-91452](https://insights.sbomify.com/CVE-2026-91452/): Other in Oracle GraalVM Enterprise Edition (medium 5.3)
- [CVE-2026-91451](https://insights.sbomify.com/CVE-2026-91451/): Other in Oracle Java SE (medium 5.3)
- [CVE-2026-91450](https://insights.sbomify.com/CVE-2026-91450/): Missing authorization in Siebel CRM Deployment (high 7.4)
- [CVE-2026-9145](https://insights.sbomify.com/CVE-2026-9145/): Path traversal in Database for Contact Form 7, WPforms, Elementor forms (medium 6.5)
- [CVE-2026-91449](https://insights.sbomify.com/CVE-2026-91449/): Missing authorization in Siebel CRM Deployment (high 7.4)
- [CVE-2026-91448](https://insights.sbomify.com/CVE-2026-91448/): Information disclosure in Siebel CRM Deployment (high 7.5)
- [CVE-2026-91447](https://insights.sbomify.com/CVE-2026-91447/): Missing authorization in Siebel CRM Deployment (high 7.5)
- [CVE-2026-91446](https://insights.sbomify.com/CVE-2026-91446/): Privilege escalation in Siebel CRM Deployment (medium 6.7)
- [CVE-2026-91445](https://insights.sbomify.com/CVE-2026-91445/): Missing authorization in Siebel CRM End User (high 8.2)
- [CVE-2026-91444](https://insights.sbomify.com/CVE-2026-91444/): Privilege escalation in Siebel CRM Deployment (medium 6.7)
- [CVE-2026-91443](https://insights.sbomify.com/CVE-2026-91443/): Information disclosure in Siebel CRM Deployment (medium 6.5)
- [CVE-2026-91442](https://insights.sbomify.com/CVE-2026-91442/): Missing authorization in Siebel CRM Deployment (high 8.8)
- [CVE-2026-91441](https://insights.sbomify.com/CVE-2026-91441/): Missing authorization in Siebel Apps - Customer Order Management (medium 6.5)
- [CVE-2026-91440](https://insights.sbomify.com/CVE-2026-91440/): Missing authorization in Siebel CRM Deployment (medium 6.5)
- [CVE-2026-9144](https://insights.sbomify.com/CVE-2026-9144/): Taiko AG1000-01A Rev 7.3/8 Stored XSS via Web Configuration Interface (high 8.4)
- [CVE-2026-91439](https://insights.sbomify.com/CVE-2026-91439/): Privilege escalation in Siebel CRM Deployment (medium 5.5)
- [CVE-2026-91438](https://insights.sbomify.com/CVE-2026-91438/): Missing authorization in Siebel CRM Deployment (high 7.1)
- [CVE-2026-91437](https://insights.sbomify.com/CVE-2026-91437/): Missing authorization in Siebel CRM Deployment (high 8.7)
- [CVE-2026-91436](https://insights.sbomify.com/CVE-2026-91436/): Missing authorization in Siebel CRM Deployment (low 3.9)
- [CVE-2026-91435](https://insights.sbomify.com/CVE-2026-91435/): Denial of service in Siebel CRM Deployment (medium 6.5)
- [CVE-2026-91434](https://insights.sbomify.com/CVE-2026-91434/): Privilege escalation in Siebel CRM Deployment (medium 6.7)
- [CVE-2026-91433](https://insights.sbomify.com/CVE-2026-91433/): Missing authorization in Siebel Apps - Field Service (high 7.2)
- [CVE-2026-91432](https://insights.sbomify.com/CVE-2026-91432/): Missing authorization in Siebel CRM End User (medium 6.5)
- [CVE-2026-91431](https://insights.sbomify.com/CVE-2026-91431/): Missing authorization in Siebel CRM End User (medium 5.5)
- [CVE-2026-91430](https://insights.sbomify.com/CVE-2026-91430/): Missing authorization in Siebel Apps - Financial Services (medium 6.5)
- [CVE-2026-9143](https://insights.sbomify.com/CVE-2026-9143/): Incorrect Conversion between Numeric Types in NI grpc-device due to missing range checks in CodeGen (medium 6.3)
- [CVE-2026-91429](https://insights.sbomify.com/CVE-2026-91429/): Missing authorization in Siebel CRM Deployment (medium 6.5)
- [CVE-2026-91428](https://insights.sbomify.com/CVE-2026-91428/): Open redirect in Siebel CRM End User (medium 4.3)
- [CVE-2026-91427](https://insights.sbomify.com/CVE-2026-91427/): Denial of service in Siebel CRM Deployment (low 2.3)
- [CVE-2026-91426](https://insights.sbomify.com/CVE-2026-91426/): Privilege escalation in Siebel CRM Deployment (medium 5.5)
- [CVE-2026-91424](https://insights.sbomify.com/CVE-2026-91424/): Missing authorization in Siebel CRM Deployment (medium 6.4)
- [CVE-2026-91423](https://insights.sbomify.com/CVE-2026-91423/): Missing authorization in Siebel CRM Deployment (medium 6.0)
- [CVE-2026-91422](https://insights.sbomify.com/CVE-2026-91422/): Missing authorization in Siebel CRM Deployment (medium 5.3)
- [CVE-2026-91421](https://insights.sbomify.com/CVE-2026-91421/): Denial of service in Siebel CRM Deployment (medium 5.9)
- [CVE-2026-91420](https://insights.sbomify.com/CVE-2026-91420/): Missing authorization in Siebel CRM Deployment (medium 6.5)
- [CVE-2026-9142](https://insights.sbomify.com/CVE-2026-9142/): Insecure Default Credentials vulnerability in NI grpc-device when TLS configuration is not present (critical 9.3)
- [CVE-2026-91419](https://insights.sbomify.com/CVE-2026-91419/): Privilege escalation in Oracle HTTP Server (high 7.8)
- [CVE-2026-91418](https://insights.sbomify.com/CVE-2026-91418/): Denial of service in Oracle GraalVM Enterprise Edition (medium 5.3)
- [CVE-2026-91417](https://insights.sbomify.com/CVE-2026-91417/): Denial of service in Oracle GraalVM Enterprise Edition (medium 5.3)
- [CVE-2026-91415](https://insights.sbomify.com/CVE-2026-91415/): Other in Oracle GraalVM Enterprise Edition (high 7.0)
- [CVE-2026-91414](https://insights.sbomify.com/CVE-2026-91414/): Missing authorization in Siebel CRM Deployment (medium 5.3)
- [CVE-2026-91413](https://insights.sbomify.com/CVE-2026-91413/): Missing authorization in Siebel CRM Development (medium 6.0)
- [CVE-2026-91412](https://insights.sbomify.com/CVE-2026-91412/): Missing authorization in Siebel CRM End User (medium 6.5)
- [CVE-2026-91411](https://insights.sbomify.com/CVE-2026-91411/): Other in Oracle GraalVM Enterprise Edition (medium 6.5)
- [CVE-2026-91410](https://insights.sbomify.com/CVE-2026-91410/): Denial of service in Oracle Java SE (medium 5.3)
- [CVE-2026-9141](https://insights.sbomify.com/CVE-2026-9141/): Taiko AG1000-01A Rev 7.3/8 Authentication Bypass via Web Interface (critical 9.3)
- [CVE-2026-91409](https://insights.sbomify.com/CVE-2026-91409/): Denial of service in Oracle Java SE (low 3.7)
- [CVE-2026-91408](https://insights.sbomify.com/CVE-2026-91408/): Auth bypass in Oracle Identity Manager (critical 9.8)
- [CVE-2026-91407](https://insights.sbomify.com/CVE-2026-91407/): Missing authorization in Oracle Identity Manager (high 8.8)
- [CVE-2026-91406](https://insights.sbomify.com/CVE-2026-91406/): Other in Oracle Outside In Technology (high 7.5)
- [CVE-2026-91405](https://insights.sbomify.com/CVE-2026-91405/): Other in Oracle Outside In Technology (high 7.5)
- [CVE-2026-91404](https://insights.sbomify.com/CVE-2026-91404/): Information disclosure in Oracle Outside In Technology (medium 4.0)
- [CVE-2026-91403](https://insights.sbomify.com/CVE-2026-91403/): Weak cryptography in Oracle GraalVM Enterprise Edition (critical 9.1)
- [CVE-2026-91402](https://insights.sbomify.com/CVE-2026-91402/): Security feature bypass in Oracle GraalVM Enterprise Edition (low 3.1)
- [CVE-2026-91400](https://insights.sbomify.com/CVE-2026-91400/): Denial of service in Oracle GraalVM Enterprise Edition (low 3.1)
- [CVE-2026-9140](https://insights.sbomify.com/CVE-2026-9140/): 1718-AENTR/1719-AENTR - Denial of Service (high 8.7)
- [CVE-2026-91399](https://insights.sbomify.com/CVE-2026-91399/): Missing authorization in Primavera P6 Enterprise Project Portfolio Management (medium 4.3)
- [CVE-2026-91398](https://insights.sbomify.com/CVE-2026-91398/): Other in Oracle GraalVM Enterprise Edition (medium 6.8)
- [CVE-2026-91397](https://insights.sbomify.com/CVE-2026-91397/): Other in Oracle GraalVM Enterprise Edition (low 3.6)
- [CVE-2026-91396](https://insights.sbomify.com/CVE-2026-91396/): Other in Oracle GraalVM Enterprise Edition (medium 6.5)
- [CVE-2026-91395](https://insights.sbomify.com/CVE-2026-91395/): Other in Oracle GraalVM Enterprise Edition (medium 6.5)
- [CVE-2026-91394](https://insights.sbomify.com/CVE-2026-91394/): Information disclosure in Oracle GraalVM for JDK (medium 5.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/256/