# Vulnerabilities published in 2026


- [CVE-2026-91393](https://insights.sbomify.com/CVE-2026-91393/): Cross-site request forgery in Siebel CRM End User (low 3.1)
- [CVE-2026-91392](https://insights.sbomify.com/CVE-2026-91392/): Missing authorization in Siebel CRM End User (low 3.7)
- [CVE-2026-91391](https://insights.sbomify.com/CVE-2026-91391/): Information disclosure in Siebel CRM End User (low 3.7)
- [CVE-2026-91390](https://insights.sbomify.com/CVE-2026-91390/): Missing authorization in Siebel CRM End User (medium 5.4)
- [CVE-2026-9139](https://insights.sbomify.com/CVE-2026-9139/): Taiko AG1000-01A Rev 7.3/8 Hard-coded Credentials via login.zhtml (critical 9.3)
- [CVE-2026-91389](https://insights.sbomify.com/CVE-2026-91389/): Missing authorization in Siebel CRM End User (medium 5.4)
- [CVE-2026-91388](https://insights.sbomify.com/CVE-2026-91388/): Missing authorization in Siebel CRM End User (medium 4.7)
- [CVE-2026-91387](https://insights.sbomify.com/CVE-2026-91387/): Missing authorization in Siebel CRM End User (medium 5.4)
- [CVE-2026-91386](https://insights.sbomify.com/CVE-2026-91386/): Missing authorization in JD Edwards EnterpriseOne Orchestrator (medium 6.8)
- [CVE-2026-91385](https://insights.sbomify.com/CVE-2026-91385/): Use after free in Oracle GraalVM Enterprise Edition (medium 5.4)
- [CVE-2026-91384](https://insights.sbomify.com/CVE-2026-91384/): Information disclosure in JD Edwards EnterpriseOne Tools (medium 6.5)
- [CVE-2026-91383](https://insights.sbomify.com/CVE-2026-91383/): Missing authorization in JD Edwards EnterpriseOne Tools (medium 6.6)
- [CVE-2026-91382](https://insights.sbomify.com/CVE-2026-91382/): Other in Oracle GraalVM Enterprise Edition (medium 6.5)
- [CVE-2026-91381](https://insights.sbomify.com/CVE-2026-91381/): Other in Oracle GraalVM Enterprise Edition (low 3.7)
- [CVE-2026-91380](https://insights.sbomify.com/CVE-2026-91380/): Other in Oracle GraalVM Enterprise Edition (medium 4.0)
- [CVE-2026-9138](https://insights.sbomify.com/CVE-2026-9138/): Path traversal in Langflow OSS (medium 6.5)
- [CVE-2026-91379](https://insights.sbomify.com/CVE-2026-91379/): Use after free in Oracle GraalVM Enterprise Edition (medium 4.7)
- [CVE-2026-91378](https://insights.sbomify.com/CVE-2026-91378/): Missing authorization in Siebel CRM Integration (medium 6.1)
- [CVE-2026-91377](https://insights.sbomify.com/CVE-2026-91377/): Information disclosure in Siebel CRM Integration (high 7.5)
- [CVE-2026-91376](https://insights.sbomify.com/CVE-2026-91376/): Missing authorization in Primavera P6 Enterprise Project Portfolio Management (medium 6.5)
- [CVE-2026-91375](https://insights.sbomify.com/CVE-2026-91375/): Other in Oracle Java SE (medium 4.7)
- [CVE-2026-91374](https://insights.sbomify.com/CVE-2026-91374/): Other in Oracle GraalVM Enterprise Edition (medium 4.8)
- [CVE-2026-91373](https://insights.sbomify.com/CVE-2026-91373/): Denial of service in Oracle Java SE (medium 5.3)
- [CVE-2026-91372](https://insights.sbomify.com/CVE-2026-91372/): Information disclosure in Siebel CRM Cloud Applications (low 3.3)
- [CVE-2026-91371](https://insights.sbomify.com/CVE-2026-91371/): Information disclosure in Siebel CRM Cloud Applications (medium 5.8)
- [CVE-2026-91370](https://insights.sbomify.com/CVE-2026-91370/): Information disclosure in Siebel CRM Cloud Applications (medium 5.3)
- [CVE-2026-9137](https://insights.sbomify.com/CVE-2026-9137/): CSP Report Endpoint Log Flooding in MISP via Incorrect Size Limit (medium 5.1)
- [CVE-2026-91369](https://insights.sbomify.com/CVE-2026-91369/): Missing authorization in Siebel CRM Cloud Applications (medium 5.3)
- [CVE-2026-91368](https://insights.sbomify.com/CVE-2026-91368/): Missing authorization in Siebel CRM Cloud Applications (medium 4.1)
- [CVE-2026-91367](https://insights.sbomify.com/CVE-2026-91367/): Missing authorization in Siebel CRM Cloud Applications (medium 6.5)
- [CVE-2026-91366](https://insights.sbomify.com/CVE-2026-91366/): Missing authorization in Siebel CRM Cloud Applications (medium 4.7)
- [CVE-2026-91365](https://insights.sbomify.com/CVE-2026-91365/): Information disclosure in Siebel CRM Cloud Applications (medium 5.9)
- [CVE-2026-91364](https://insights.sbomify.com/CVE-2026-91364/): Missing authorization in Siebel CRM Cloud Applications (medium 6.8)
- [CVE-2026-91363](https://insights.sbomify.com/CVE-2026-91363/): Information disclosure in Siebel CRM Cloud Applications (low 3.7)
- [CVE-2026-91362](https://insights.sbomify.com/CVE-2026-91362/): Information disclosure in Siebel CRM Cloud Applications (medium 5.3)
- [CVE-2026-91361](https://insights.sbomify.com/CVE-2026-91361/): Missing authorization in Siebel CRM Cloud Applications (medium 5.3)
- [CVE-2026-91360](https://insights.sbomify.com/CVE-2026-91360/): Information disclosure in Siebel CRM Cloud Applications (medium 6.5)
- [CVE-2026-9136](https://insights.sbomify.com/CVE-2026-9136/): Unauthorized ShadowAttribute modification in MISP via client-supplied identifier (high 8.3)
- [CVE-2026-91359](https://insights.sbomify.com/CVE-2026-91359/): Information disclosure in Siebel CRM Cloud Applications (medium 5.3)
- [CVE-2026-91358](https://insights.sbomify.com/CVE-2026-91358/): Missing authorization in Oracle Business Process Management Suite (high 8.2)
- [CVE-2026-91357](https://insights.sbomify.com/CVE-2026-91357/): Information disclosure in Oracle Order Management (medium 5.3)
- [CVE-2026-91356](https://insights.sbomify.com/CVE-2026-91356/): Missing authorization in PeopleSoft Enterprise HCM Global Payroll Switzerland (medium 4.2)
- [CVE-2026-91355](https://insights.sbomify.com/CVE-2026-91355/): Privilege escalation in Oracle Outside In Technology (high 8.4)
- [CVE-2026-91354](https://insights.sbomify.com/CVE-2026-91354/): Missing authorization in Oracle Outside In Technology (critical 9.9)
- [CVE-2026-91353](https://insights.sbomify.com/CVE-2026-91353/): Information disclosure in Oracle Outside In Technology (high 8.6)
- [CVE-2026-91352](https://insights.sbomify.com/CVE-2026-91352/): Denial of service in Oracle Outside In Technology (medium 5.3)
- [CVE-2026-91351](https://insights.sbomify.com/CVE-2026-91351/): Missing authorization in Oracle Outside In Technology (medium 6.1)
- [CVE-2026-91350](https://insights.sbomify.com/CVE-2026-91350/): Denial of service in Oracle Outside In Technology (high 7.5)
- [CVE-2026-9135](https://insights.sbomify.com/CVE-2026-9135/): Policies Component Dynamic CodeInput Fields Bypass Custom Component Validation (critical 9.9)
- [CVE-2026-91349](https://insights.sbomify.com/CVE-2026-91349/): Denial of service in Oracle Outside In Technology (high 7.5)
- [CVE-2026-91348](https://insights.sbomify.com/CVE-2026-91348/): Privilege escalation in Oracle Solaris (high 8.4)
- [CVE-2026-91347](https://insights.sbomify.com/CVE-2026-91347/): Missing authorization in iSupport (high 8.5)
- [CVE-2026-91346](https://insights.sbomify.com/CVE-2026-91346/): Other in Oracle Outside In Technology (high 8.2)
- [CVE-2026-91345](https://insights.sbomify.com/CVE-2026-91345/): Denial of service in Oracle Outside In Technology (high 7.5)
- [CVE-2026-91344](https://insights.sbomify.com/CVE-2026-91344/): Denial of service in Oracle Outside In Technology (high 7.5)
- [CVE-2026-91343](https://insights.sbomify.com/CVE-2026-91343/): Missing authorization in Oracle Outside In Technology (high 8.6)
- [CVE-2026-91342](https://insights.sbomify.com/CVE-2026-91342/): Other in Oracle Outside In Technology (high 8.2)
- [CVE-2026-91341](https://insights.sbomify.com/CVE-2026-91341/): Missing authorization in Oracle Outside In Technology (critical 9.1)
- [CVE-2026-91340](https://insights.sbomify.com/CVE-2026-91340/): Missing authorization in Oracle Outside In Technology (high 8.8)
- [CVE-2026-9134](https://insights.sbomify.com/CVE-2026-9134/): Cross-site scripting in Photo Gallery by FooGallery : Responsive Image Gallery, Masonry Gallery & Carousel (medium 6.4)
- [CVE-2026-91339](https://insights.sbomify.com/CVE-2026-91339/): Information disclosure in iSupport (medium 6.5)
- [CVE-2026-91338](https://insights.sbomify.com/CVE-2026-91338/): Missing authorization in iSupport (high 7.1)
- [CVE-2026-91337](https://insights.sbomify.com/CVE-2026-91337/): Missing authorization in iProcurement (high 7.4)
- [CVE-2026-91336](https://insights.sbomify.com/CVE-2026-91336/): Missing authorization in Oracle Solaris (medium 6.5)
- [CVE-2026-91335](https://insights.sbomify.com/CVE-2026-91335/): Information disclosure in Oracle GraalVM Enterprise Edition (low 2.6)
- [CVE-2026-91334](https://insights.sbomify.com/CVE-2026-91334/): Information disclosure in Oracle GraalVM Enterprise Edition (low 3.7)
- [CVE-2026-91333](https://insights.sbomify.com/CVE-2026-91333/): Deserialization in Oracle Java SE (low 3.7)
- [CVE-2026-91332](https://insights.sbomify.com/CVE-2026-91332/): Other in Oracle Java SE (medium 5.3)
- [CVE-2026-91331](https://insights.sbomify.com/CVE-2026-91331/): Missing authorization in PeopleSoft Enterprise CC Common Application Objects (low 3.8)
- [CVE-2026-91330](https://insights.sbomify.com/CVE-2026-91330/): Denial of service in JD Edwards EnterpriseOne Tools (low 3.3)
- [CVE-2026-9133](https://insights.sbomify.com/CVE-2026-9133/): Arbitrary file read in rabbitmq-aws plugin (high 8.3)
- [CVE-2026-91329](https://insights.sbomify.com/CVE-2026-91329/): Missing authorization in JD Edwards EnterpriseOne Tools (medium 6.5)
- [CVE-2026-91328](https://insights.sbomify.com/CVE-2026-91328/): Open redirect in JD Edwards EnterpriseOne Tools (high 7.8)
- [CVE-2026-91327](https://insights.sbomify.com/CVE-2026-91327/): Missing authorization in JD Edwards EnterpriseOne Tools (high 7.5)
- [CVE-2026-91326](https://insights.sbomify.com/CVE-2026-91326/): Missing authorization in JD Edwards EnterpriseOne Tools (high 8.8)
- [CVE-2026-91325](https://insights.sbomify.com/CVE-2026-91325/): Information disclosure in JD Edwards EnterpriseOne Tools (high 7.5)
- [CVE-2026-91324](https://insights.sbomify.com/CVE-2026-91324/): Denial of service in Oracle Solaris (medium 4.7)
- [CVE-2026-91323](https://insights.sbomify.com/CVE-2026-91323/): Auth bypass in Oracle WebLogic Server (critical 9.8)
- [CVE-2026-91322](https://insights.sbomify.com/CVE-2026-91322/): Information disclosure in Oracle JDeveloper (low 3.3)
- [CVE-2026-91321](https://insights.sbomify.com/CVE-2026-91321/): Missing authorization in iProcurement (high 7.5)
- [CVE-2026-91320](https://insights.sbomify.com/CVE-2026-91320/): Other in Oracle JDeveloper (medium 5.7)
- [CVE-2026-9132](https://insights.sbomify.com/CVE-2026-9132/): Missing authorization in Enterprise Server (medium 6.0)
- [CVE-2026-91319](https://insights.sbomify.com/CVE-2026-91319/): Missing authorization in Oracle JDeveloper (medium 5.9)
- [CVE-2026-91318](https://insights.sbomify.com/CVE-2026-91318/): Open redirect in Oracle JDeveloper (medium 6.5)
- [CVE-2026-91317](https://insights.sbomify.com/CVE-2026-91317/): Information disclosure in Oracle JDeveloper (medium 5.9)
- [CVE-2026-91316](https://insights.sbomify.com/CVE-2026-91316/): Missing authorization in iProcurement (high 7.2)
- [CVE-2026-91315](https://insights.sbomify.com/CVE-2026-91315/): Other in JD Edwards EnterpriseOne Tools (high 7.8)
- [CVE-2026-91314](https://insights.sbomify.com/CVE-2026-91314/): Missing authorization in JD Edwards EnterpriseOne Tools (high 7.8)
- [CVE-2026-91313](https://insights.sbomify.com/CVE-2026-91313/): Auth bypass in JD Edwards EnterpriseOne Tools (high 8.1)
- [CVE-2026-91312](https://insights.sbomify.com/CVE-2026-91312/): Missing authorization in JD Edwards EnterpriseOne Tools (medium 6.5)
- [CVE-2026-91311](https://insights.sbomify.com/CVE-2026-91311/): Privilege escalation in JD Edwards EnterpriseOne Tools (high 7.8)
- [CVE-2026-91310](https://insights.sbomify.com/CVE-2026-91310/): Missing authorization in JD Edwards EnterpriseOne Tools (high 8.8)
- [CVE-2026-91309](https://insights.sbomify.com/CVE-2026-91309/): Information disclosure in JD Edwards EnterpriseOne Tools (medium 5.9)
- [CVE-2026-91308](https://insights.sbomify.com/CVE-2026-91308/): Information disclosure in JD Edwards EnterpriseOne Tools (high 7.5)
- [CVE-2026-91307](https://insights.sbomify.com/CVE-2026-91307/): Information disclosure in JD Edwards EnterpriseOne Tools (high 7.5)
- [CVE-2026-91306](https://insights.sbomify.com/CVE-2026-91306/): Privilege escalation in JD Edwards EnterpriseOne Tools (high 7.8)
- [CVE-2026-91305](https://insights.sbomify.com/CVE-2026-91305/): Auth bypass in JD Edwards EnterpriseOne Tools (critical 9.1)
- [CVE-2026-91304](https://insights.sbomify.com/CVE-2026-91304/): Missing authorization in JD Edwards EnterpriseOne Tools (high 7.8)
- [CVE-2026-91303](https://insights.sbomify.com/CVE-2026-91303/): Missing authorization in JD Edwards EnterpriseOne Tools (high 8.8)
- [CVE-2026-91302](https://insights.sbomify.com/CVE-2026-91302/): Denial of service in JD Edwards EnterpriseOne Tools (low 3.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/257/