# Vulnerabilities published in 2026


- [CVE-2026-62571](https://insights.sbomify.com/CVE-2026-62571/): Missing authorization in Oracle Hyperion Calculation Manager (high 7.7)
- [CVE-2026-62570](https://insights.sbomify.com/CVE-2026-62570/): Other in Oracle Hyperion Infrastructure Technology (low 3.0)
- [CVE-2026-6257](https://insights.sbomify.com/CVE-2026-6257/): Vvveb CMS < v1.0.8.2 Remote Code Execution via Media Management (critical 9.2)
- [CVE-2026-62569](https://insights.sbomify.com/CVE-2026-62569/): Missing authorization in Oracle Hyperion Infrastructure Technology (low 3.4)
- [CVE-2026-62568](https://insights.sbomify.com/CVE-2026-62568/): Missing authorization in Oracle Hyperion Infrastructure Technology (medium 6.1)
- [CVE-2026-62567](https://insights.sbomify.com/CVE-2026-62567/): Missing authorization in Oracle HRMS (UK) (high 7.7)
- [CVE-2026-62566](https://insights.sbomify.com/CVE-2026-62566/): Missing authorization in Oracle Hyperion Infrastructure Technology (medium 5.3)
- [CVE-2026-62565](https://insights.sbomify.com/CVE-2026-62565/): Missing authorization in Oracle HRMS (US) (high 7.1)
- [CVE-2026-62564](https://insights.sbomify.com/CVE-2026-62564/): Missing authorization in Oracle Hyperion Infrastructure Technology (medium 5.5)
- [CVE-2026-62563](https://insights.sbomify.com/CVE-2026-62563/): Open redirect in Oracle Work in Process (medium 5.4)
- [CVE-2026-62562](https://insights.sbomify.com/CVE-2026-62562/): Missing authorization in Oracle HRMS (US) (medium 6.5)
- [CVE-2026-62561](https://insights.sbomify.com/CVE-2026-62561/): Privilege escalation in Oracle HRMS (US) (high 7.8)
- [CVE-2026-62560](https://insights.sbomify.com/CVE-2026-62560/): Missing authorization in Oracle HRMS (Norway) (high 7.7)
- [CVE-2026-6256](https://insights.sbomify.com/CVE-2026-6256/): Credits Shortcode <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Shortcode Attribute (medium 6.4)
- [CVE-2026-62559](https://insights.sbomify.com/CVE-2026-62559/): Missing authorization in Oracle HRMS (US) (medium 6.8)
- [CVE-2026-62558](https://insights.sbomify.com/CVE-2026-62558/): Missing authorization in Oracle Hyperion Infrastructure Technology (medium 6.3)
- [CVE-2026-62557](https://insights.sbomify.com/CVE-2026-62557/): Missing authorization in Oracle HRMS (UK) (high 7.1)
- [CVE-2026-62556](https://insights.sbomify.com/CVE-2026-62556/): Missing authorization in Oracle HRMS (US) (medium 6.5)
- [CVE-2026-62555](https://insights.sbomify.com/CVE-2026-62555/): Missing authorization in Oracle Hyperion Infrastructure Technology (medium 6.5)
- [CVE-2026-62554](https://insights.sbomify.com/CVE-2026-62554/): Missing authorization in Oracle Hyperion Infrastructure Technology (high 7.5)
- [CVE-2026-62553](https://insights.sbomify.com/CVE-2026-62553/): Missing authorization in Oracle Hyperion Infrastructure Technology (medium 5.5)
- [CVE-2026-62552](https://insights.sbomify.com/CVE-2026-62552/): Missing authorization in Oracle Hyperion Infrastructure Technology (high 7.5)
- [CVE-2026-62551](https://insights.sbomify.com/CVE-2026-62551/): Missing authorization in Oracle Hyperion Infrastructure Technology (high 7.3)
- [CVE-2026-62550](https://insights.sbomify.com/CVE-2026-62550/): Missing authorization in Oracle Hyperion Infrastructure Technology (high 7.5)
- [CVE-2026-6255](https://insights.sbomify.com/CVE-2026-6255/): Simple Owl Shortcodes <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'num' Shortcode Attribute (medium 6.4)
- [CVE-2026-62549](https://insights.sbomify.com/CVE-2026-62549/): Missing authorization in Oracle HRMS (UK) (critical 9.6)
- [CVE-2026-62548](https://insights.sbomify.com/CVE-2026-62548/): Privilege escalation in Oracle HRMS (US) (high 7.2)
- [CVE-2026-62547](https://insights.sbomify.com/CVE-2026-62547/): Auth bypass in Oracle Workflow (high 8.1)
- [CVE-2026-62546](https://insights.sbomify.com/CVE-2026-62546/): Missing authorization in Oracle Applications Framework (critical 9.1)
- [CVE-2026-62545](https://insights.sbomify.com/CVE-2026-62545/): Missing authorization in Oracle Hyperion Infrastructure Technology (high 7.5)
- [CVE-2026-62544](https://insights.sbomify.com/CVE-2026-62544/): Missing authorization in Oracle Hyperion Infrastructure Technology (critical 9.8)
- [CVE-2026-62543](https://insights.sbomify.com/CVE-2026-62543/): Missing authorization in Oracle Hyperion Infrastructure Technology (critical 9.8)
- [CVE-2026-62542](https://insights.sbomify.com/CVE-2026-62542/): Missing authorization in Oracle Advanced Benefits (medium 6.3)
- [CVE-2026-62541](https://insights.sbomify.com/CVE-2026-62541/): Missing authorization in Oracle Hyperion Infrastructure Technology (critical 9.8)
- [CVE-2026-62540](https://insights.sbomify.com/CVE-2026-62540/): Missing authorization in Oracle Cost Management (high 7.2)
- [CVE-2026-62539](https://insights.sbomify.com/CVE-2026-62539/): Missing authorization in Oracle Hyperion Infrastructure Technology (critical 9.8)
- [CVE-2026-62538](https://insights.sbomify.com/CVE-2026-62538/): Missing authorization in Oracle Hyperion Infrastructure Technology (high 7.4)
- [CVE-2026-62537](https://insights.sbomify.com/CVE-2026-62537/): Missing authorization in Oracle Hyperion Infrastructure Technology (high 7.1)
- [CVE-2026-62536](https://insights.sbomify.com/CVE-2026-62536/): Missing authorization in Oracle Hyperion Infrastructure Technology (high 7.1)
- [CVE-2026-62535](https://insights.sbomify.com/CVE-2026-62535/): Missing authorization in Oracle Hyperion Infrastructure Technology (high 8.6)
- [CVE-2026-62534](https://insights.sbomify.com/CVE-2026-62534/): Auth bypass in Oracle Applications Framework (high 8.8)
- [CVE-2026-62533](https://insights.sbomify.com/CVE-2026-62533/): Missing authorization in Oracle Hyperion Calculation Manager (low 3.7)
- [CVE-2026-62532](https://insights.sbomify.com/CVE-2026-62532/): Missing authorization in Oracle Hyperion Calculation Manager (low 3.8)
- [CVE-2026-62531](https://insights.sbomify.com/CVE-2026-62531/): Missing authorization in Oracle Hyperion Infrastructure Technology (high 8.1)
- [CVE-2026-62530](https://insights.sbomify.com/CVE-2026-62530/): Missing authorization in Oracle HRMS (France) (high 8.1)
- [CVE-2026-6253](https://insights.sbomify.com/CVE-2026-6253/): proxy credentials leak over redirect-to proxy (medium 5.9)
- [CVE-2026-62529](https://insights.sbomify.com/CVE-2026-62529/): Missing authorization in Oracle Hyperion Calculation Manager (low 3.5)
- [CVE-2026-62528](https://insights.sbomify.com/CVE-2026-62528/): SQL injection in Oracle HCM Configuration Workbench (medium 6.3)
- [CVE-2026-62527](https://insights.sbomify.com/CVE-2026-62527/): SQL injection in Oracle Learning Management (medium 6.3)
- [CVE-2026-62526](https://insights.sbomify.com/CVE-2026-62526/): Missing authorization in Oracle Hyperion Infrastructure Technology (low 3.3)
- [CVE-2026-62525](https://insights.sbomify.com/CVE-2026-62525/): Missing authorization in Oracle Quality (medium 6.3)
- [CVE-2026-62524](https://insights.sbomify.com/CVE-2026-62524/): Missing authorization in Oracle HRMS (US) (medium 6.3)
- [CVE-2026-62523](https://insights.sbomify.com/CVE-2026-62523/): Missing authorization in Oracle Hyperion Infrastructure Technology (medium 6.5)
- [CVE-2026-62522](https://insights.sbomify.com/CVE-2026-62522/): Missing authorization in Oracle Hyperion Infrastructure Technology (high 7.1)
- [CVE-2026-62521](https://insights.sbomify.com/CVE-2026-62521/): Missing authorization in Oracle HRMS (US) (high 7.5)
- [CVE-2026-62520](https://insights.sbomify.com/CVE-2026-62520/): Missing authorization in Oracle Hyperion Infrastructure Technology (medium 4.8)
- [CVE-2026-6252](https://insights.sbomify.com/CVE-2026-6252/): Meta Field Block <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tagName' Block Attribute (medium 6.4)
- [CVE-2026-62519](https://insights.sbomify.com/CVE-2026-62519/): Missing authorization in Oracle Succession planning (medium 6.3)
- [CVE-2026-62518](https://insights.sbomify.com/CVE-2026-62518/): Missing authorization in Oracle Production Scheduling (high 7.6)
- [CVE-2026-62517](https://insights.sbomify.com/CVE-2026-62517/): Open redirect in Oracle Production Scheduling (medium 5.3)
- [CVE-2026-62516](https://insights.sbomify.com/CVE-2026-62516/): SQL injection in Oracle Demantra Demand Management (high 8.8)
- [CVE-2026-62515](https://insights.sbomify.com/CVE-2026-62515/): Missing authorization in Oracle Advanced Planning Command Center (high 7.6)
- [CVE-2026-62514](https://insights.sbomify.com/CVE-2026-62514/): Missing authorization in Oracle Process Manufacturing Regulatory Management (high 8.1)
- [CVE-2026-62513](https://insights.sbomify.com/CVE-2026-62513/): Missing authorization in Oracle Process Manufacturing Regulatory Management (high 8.5)
- [CVE-2026-62512](https://insights.sbomify.com/CVE-2026-62512/): Missing authorization in Siebel CRM Cloud Applications (critical 9.9)
- [CVE-2026-62511](https://insights.sbomify.com/CVE-2026-62511/): Missing authorization in Oracle Hyperion Infrastructure Technology (low 3.0)
- [CVE-2026-62510](https://insights.sbomify.com/CVE-2026-62510/): Missing authorization in Oracle Hyperion Infrastructure Technology (medium 5.3)
- [CVE-2026-6251](https://insights.sbomify.com/CVE-2026-6251/): Chaty Pro <= 3.5.5 - Authenticated (Subscriber+) SQL Injection via 'widget_id' Parameter (medium 6.5)
- [CVE-2026-62509](https://insights.sbomify.com/CVE-2026-62509/): Missing authorization in Oracle Hyperion Infrastructure Technology (medium 5.3)
- [CVE-2026-62508](https://insights.sbomify.com/CVE-2026-62508/): Denial of service in Oracle Time and Labor (low 3.1)
- [CVE-2026-62507](https://insights.sbomify.com/CVE-2026-62507/): Missing authorization in Oracle Time and Labor (medium 5.3)
- [CVE-2026-62506](https://insights.sbomify.com/CVE-2026-62506/): Missing authorization in Oracle Hyperion Infrastructure Technology (medium 6.5)
- [CVE-2026-62505](https://insights.sbomify.com/CVE-2026-62505/): Missing authorization in Oracle Time and Labor (medium 6.1)
- [CVE-2026-62504](https://insights.sbomify.com/CVE-2026-62504/): Missing authorization in Oracle Time and Labor (high 8.1)
- [CVE-2026-62503](https://insights.sbomify.com/CVE-2026-62503/): Missing authorization in Oracle Time and Labor (medium 6.7)
- [CVE-2026-62502](https://insights.sbomify.com/CVE-2026-62502/): Missing authorization in Oracle Hyperion Infrastructure Technology (high 8.1)
- [CVE-2026-62501](https://insights.sbomify.com/CVE-2026-62501/): Missing authorization in Oracle Hyperion Infrastructure Technology (high 8.1)
- [CVE-2026-62500](https://insights.sbomify.com/CVE-2026-62500/): Missing authorization in Oracle Hyperion Infrastructure Technology (high 8.8)
- [CVE-2026-6250](https://insights.sbomify.com/CVE-2026-6250/): Authenticated Format String Injection on TP-Link Tapo C110 (high 7.0)
- [CVE-2026-62499](https://insights.sbomify.com/CVE-2026-62499/): Missing authorization in Oracle Hyperion Infrastructure Technology (medium 6.1)
- [CVE-2026-62498](https://insights.sbomify.com/CVE-2026-62498/): Auth bypass in Oracle Flow Manufacturing (high 8.8)
- [CVE-2026-62497](https://insights.sbomify.com/CVE-2026-62497/): Missing authorization in Oracle Flow Manufacturing (high 8.1)
- [CVE-2026-62496](https://insights.sbomify.com/CVE-2026-62496/): Auth bypass in Oracle Yard Management (high 8.8)
- [CVE-2026-62495](https://insights.sbomify.com/CVE-2026-62495/): Missing authorization in Oracle Process Manufacturing Process Execution (high 7.5)
- [CVE-2026-62494](https://insights.sbomify.com/CVE-2026-62494/): Missing authorization in Oracle Time and Labor (high 8.1)
- [CVE-2026-62493](https://insights.sbomify.com/CVE-2026-62493/): Auth bypass in Oracle Purchasing (high 7.5)
- [CVE-2026-62492](https://insights.sbomify.com/CVE-2026-62492/): Missing authorization in Oracle Hyperion Infrastructure Technology (high 7.4)
- [CVE-2026-62491](https://insights.sbomify.com/CVE-2026-62491/): Missing authorization in Oracle Purchasing (high 8.1)
- [CVE-2026-62490](https://insights.sbomify.com/CVE-2026-62490/): Information disclosure in Oracle Contracts Integration (medium 5.3)
- [CVE-2026-6249](https://insights.sbomify.com/CVE-2026-6249/): Vvveb CMS 1.0.8.2 Remote Code Execution via Media Upload (high 8.7)
- [CVE-2026-62489](https://insights.sbomify.com/CVE-2026-62489/): Missing authorization in Oracle Contracts Integration (medium 4.2)
- [CVE-2026-62488](https://insights.sbomify.com/CVE-2026-62488/): Missing authorization in Oracle Contracts Integration (medium 6.5)
- [CVE-2026-62487](https://insights.sbomify.com/CVE-2026-62487/): Cross-site request forgery in Oracle Contracts Integration (medium 6.1)
- [CVE-2026-62486](https://insights.sbomify.com/CVE-2026-62486/): Other in Oracle Contracts Integration (medium 5.0)
- [CVE-2026-62485](https://insights.sbomify.com/CVE-2026-62485/): Missing authorization in Oracle Hyperion Infrastructure Technology (high 8.2)
- [CVE-2026-62484](https://insights.sbomify.com/CVE-2026-62484/): Missing authorization in Oracle Contracts Integration (medium 5.9)
- [CVE-2026-62483](https://insights.sbomify.com/CVE-2026-62483/): Missing authorization in Oracle Project Contracts (medium 4.3)
- [CVE-2026-62482](https://insights.sbomify.com/CVE-2026-62482/): Missing authorization in Oracle Public Sector Financials (medium 5.4)
- [CVE-2026-62481](https://insights.sbomify.com/CVE-2026-62481/): Missing authorization in Oracle Hyperion Infrastructure Technology (high 7.5)
- [CVE-2026-62480](https://insights.sbomify.com/CVE-2026-62480/): Missing authorization in Oracle Public Sector Financials (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/486/