# Vulnerabilities published in 2026


- [CVE-2026-61302](https://insights.sbomify.com/CVE-2026-61302/): Missing authorization in Oracle Business Intelligence Enterprise Edition (high 8.2)
- [CVE-2026-61301](https://insights.sbomify.com/CVE-2026-61301/): Missing authorization in Oracle Process Manufacturing Financials (high 8.1)
- [CVE-2026-61300](https://insights.sbomify.com/CVE-2026-61300/): Missing authorization in Oracle Enterprise Manager Base Platform (high 7.8)
- [CVE-2026-6130](https://insights.sbomify.com/CVE-2026-6130/): Command injection in chatbox (medium 6.9)
- [CVE-2026-61299](https://insights.sbomify.com/CVE-2026-61299/): Missing authorization in Oracle Process Manufacturing Logistics (high 7.1)
- [CVE-2026-61298](https://insights.sbomify.com/CVE-2026-61298/): Missing authorization in Oracle Enterprise Manager Base Platform (medium 5.6)
- [CVE-2026-61297](https://insights.sbomify.com/CVE-2026-61297/): Missing authorization in Oracle Customers Online (high 8.1)
- [CVE-2026-61296](https://insights.sbomify.com/CVE-2026-61296/): Missing authorization in Oracle Enterprise Asset Management (high 7.6)
- [CVE-2026-61295](https://insights.sbomify.com/CVE-2026-61295/): Missing authorization in Oracle WebCenter Content (high 7.1)
- [CVE-2026-61294](https://insights.sbomify.com/CVE-2026-61294/): SQL injection in Oracle Common Applications Calendar (medium 6.3)
- [CVE-2026-61293](https://insights.sbomify.com/CVE-2026-61293/): Missing authorization in Oracle Hyperion Calculation Manager (high 8.1)
- [CVE-2026-61292](https://insights.sbomify.com/CVE-2026-61292/): Information disclosure in Oracle U.S. Federal Financials (medium 4.3)
- [CVE-2026-61291](https://insights.sbomify.com/CVE-2026-61291/): Missing authorization in Oracle WebCenter Content (high 7.8)
- [CVE-2026-61290](https://insights.sbomify.com/CVE-2026-61290/): Missing authorization in Oracle WebCenter Content (high 7.1)
- [CVE-2026-6129](https://insights.sbomify.com/CVE-2026-6129/): zhayujie chatgpt-on-wechat CowAgent Agent Mode Service missing authentication (medium 6.9)
- [CVE-2026-61289](https://insights.sbomify.com/CVE-2026-61289/): Missing authorization in Oracle Process Manufacturing Product Development (high 8.8)
- [CVE-2026-61288](https://insights.sbomify.com/CVE-2026-61288/): Missing authorization in Oracle WebCenter Content (high 7.1)
- [CVE-2026-61287](https://insights.sbomify.com/CVE-2026-61287/): Missing authorization in Oracle Process Manufacturing Systems (high 8.1)
- [CVE-2026-61286](https://insights.sbomify.com/CVE-2026-61286/): Missing authorization in Oracle Enterprise Manager Base Platform (high 8.6)
- [CVE-2026-61285](https://insights.sbomify.com/CVE-2026-61285/): Missing authorization in Oracle Process Manufacturing Systems (high 7.2)
- [CVE-2026-61284](https://insights.sbomify.com/CVE-2026-61284/): Missing authorization in Oracle Enterprise Manager Base Platform (high 8.8)
- [CVE-2026-61283](https://insights.sbomify.com/CVE-2026-61283/): Missing authorization in Oracle Bills of Material (medium 6.3)
- [CVE-2026-61282](https://insights.sbomify.com/CVE-2026-61282/): Missing authorization in Oracle Advanced Benefits (medium 6.3)
- [CVE-2026-61281](https://insights.sbomify.com/CVE-2026-61281/): Missing authorization in Oracle Hyperion Calculation Manager (high 8.1)
- [CVE-2026-61280](https://insights.sbomify.com/CVE-2026-61280/): Missing authorization in Oracle Sales for Handhelds (medium 6.3)
- [CVE-2026-6128](https://insights.sbomify.com/CVE-2026-6128/): Cross-site scripting in All-in-One WP Migration Unlimited Extension (medium 6.4)
- [CVE-2026-61279](https://insights.sbomify.com/CVE-2026-61279/): Information disclosure in Oracle Proposals (medium 6.3)
- [CVE-2026-61278](https://insights.sbomify.com/CVE-2026-61278/): Missing authorization in Oracle Workflow (medium 6.3)
- [CVE-2026-61277](https://insights.sbomify.com/CVE-2026-61277/): Missing authorization in Oracle Marketing (medium 6.3)
- [CVE-2026-61276](https://insights.sbomify.com/CVE-2026-61276/): Missing authorization in Oracle Hyperion Calculation Manager (high 8.8)
- [CVE-2026-61275](https://insights.sbomify.com/CVE-2026-61275/): Missing authorization in Oracle Product Hub (medium 6.3)
- [CVE-2026-61274](https://insights.sbomify.com/CVE-2026-61274/): Missing authorization in Oracle Product Hub (medium 6.3)
- [CVE-2026-61273](https://insights.sbomify.com/CVE-2026-61273/): Missing authorization in JD Edwards EnterpriseOne Tools (high 8.8)
- [CVE-2026-61272](https://insights.sbomify.com/CVE-2026-61272/): Missing authorization in JD Edwards EnterpriseOne Tools (critical 9.8)
- [CVE-2026-61271](https://insights.sbomify.com/CVE-2026-61271/): Missing authorization in Oracle Document Management and Collaboration (high 7.3)
- [CVE-2026-61270](https://insights.sbomify.com/CVE-2026-61270/): Missing authorization in JD Edwards EnterpriseOne Orchestrator (high 8.1)
- [CVE-2026-6127](https://insights.sbomify.com/CVE-2026-6127/): Elementor Website Builder <= 4.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API (medium 6.4)
- [CVE-2026-61269](https://insights.sbomify.com/CVE-2026-61269/): Missing authorization in Oracle Product Workbench (medium 6.3)
- [CVE-2026-61268](https://insights.sbomify.com/CVE-2026-61268/): Missing authorization in JD Edwards EnterpriseOne Tools (high 8.1)
- [CVE-2026-61267](https://insights.sbomify.com/CVE-2026-61267/): Missing authorization in Oracle HCM Configuration Workbench (high 7.3)
- [CVE-2026-61266](https://insights.sbomify.com/CVE-2026-61266/): SQL injection in Oracle Supply Chain Globalization (medium 6.3)
- [CVE-2026-61265](https://insights.sbomify.com/CVE-2026-61265/): Missing authorization in JD Edwards EnterpriseOne Orchestrator (high 8.1)
- [CVE-2026-61264](https://insights.sbomify.com/CVE-2026-61264/): Missing authorization in Oracle Call Center Technology (medium 5.4)
- [CVE-2026-61263](https://insights.sbomify.com/CVE-2026-61263/): Missing authorization in Oracle Scripting (medium 5.4)
- [CVE-2026-61262](https://insights.sbomify.com/CVE-2026-61262/): Missing authorization in Oracle Teleservice (medium 6.5)
- [CVE-2026-61261](https://insights.sbomify.com/CVE-2026-61261/): Missing authorization in Oracle Knowledge Management (medium 5.4)
- [CVE-2026-61260](https://insights.sbomify.com/CVE-2026-61260/): Missing authorization in Oracle HRMS (UK) (medium 5.4)
- [CVE-2026-6126](https://insights.sbomify.com/CVE-2026-6126/): zhayujie chatgpt-on-wechat CowAgent Administrative HTTP Endpoint missing authentication (medium 6.9)
- [CVE-2026-61259](https://insights.sbomify.com/CVE-2026-61259/): Missing authorization in Oracle Hyperion Calculation Manager (high 7.1)
- [CVE-2026-61258](https://insights.sbomify.com/CVE-2026-61258/): Missing authorization in Oracle Internet Directory (critical 9.8)
- [CVE-2026-61257](https://insights.sbomify.com/CVE-2026-61257/): Missing authorization in Oracle iSupport (medium 5.4)
- [CVE-2026-61256](https://insights.sbomify.com/CVE-2026-61256/): Missing authorization in Oracle Advanced Inbound Telephony (medium 6.3)
- [CVE-2026-61255](https://insights.sbomify.com/CVE-2026-61255/): Missing authorization in Oracle HRMS (New Zealand) (medium 5.4)
- [CVE-2026-61254](https://insights.sbomify.com/CVE-2026-61254/): Open redirect in Oracle HRMS (Republic of Korea) (medium 5.4)
- [CVE-2026-61253](https://insights.sbomify.com/CVE-2026-61253/): Cross-site request forgery in Oracle HRMS (Japanese) (medium 5.4)
- [CVE-2026-61252](https://insights.sbomify.com/CVE-2026-61252/): Missing authorization in Oracle HRMS (Hong Kong) (medium 5.4)
- [CVE-2026-61251](https://insights.sbomify.com/CVE-2026-61251/): Information disclosure in HRMS (Australia) (medium 6.5)
- [CVE-2026-61250](https://insights.sbomify.com/CVE-2026-61250/): Missing authorization in Oracle Payroll (medium 6.5)
- [CVE-2026-6125](https://insights.sbomify.com/CVE-2026-6125/): Dromara warm-flow Workflow Definition save-json SpelHelper.parseExpression code injection (medium 5.3)
- [CVE-2026-61249](https://insights.sbomify.com/CVE-2026-61249/): Information disclosure in Oracle Learning Management (medium 6.5)
- [CVE-2026-61248](https://insights.sbomify.com/CVE-2026-61248/): Missing authorization in Oracle Internet Directory (critical 9.9)
- [CVE-2026-61247](https://insights.sbomify.com/CVE-2026-61247/): Missing authorization in Oracle Workflow (medium 4.8)
- [CVE-2026-61246](https://insights.sbomify.com/CVE-2026-61246/): Deserialization in Oracle Platform Security for Java (high 8.8)
- [CVE-2026-61245](https://insights.sbomify.com/CVE-2026-61245/): Auth bypass in PeopleSoft Enterprise FIN Manufacturing Brazil (critical 9.8)
- [CVE-2026-61244](https://insights.sbomify.com/CVE-2026-61244/): Missing authorization in PeopleSoft Enterprise FIN Manufacturing Argentina (critical 9.1)
- [CVE-2026-61243](https://insights.sbomify.com/CVE-2026-61243/): Auth bypass in PeopleSoft Enterprise FIN Common Objects Argentina (high 8.8)
- [CVE-2026-61242](https://insights.sbomify.com/CVE-2026-61242/): Missing authorization in PeopleSoft Enterprise FIN Common Objects Argentina (critical 9.9)
- [CVE-2026-61241](https://insights.sbomify.com/CVE-2026-61241/): Missing authorization in Oracle Internet Directory (critical 10.0)
- [CVE-2026-61240](https://insights.sbomify.com/CVE-2026-61240/): Missing authorization in PeopleSoft Enterprise FIN Common Objects Argentina (high 8.2)
- [CVE-2026-6124](https://insights.sbomify.com/CVE-2026-6124/): Tenda F451 httpd SafeMacFilter fromSafeMacFilter stack-based overflow (high 8.7)
- [CVE-2026-61239](https://insights.sbomify.com/CVE-2026-61239/): Missing authorization in PeopleSoft Enterprise FIN Common Objects Argentina (critical 9.9)
- [CVE-2026-61238](https://insights.sbomify.com/CVE-2026-61238/): Missing authorization in PeopleSoft Enterprise FIN Common Objects Argentina (critical 9.1)
- [CVE-2026-61237](https://insights.sbomify.com/CVE-2026-61237/): Missing authorization in PeopleSoft Enterprise FIN Common Objects Argentina (critical 9.9)
- [CVE-2026-61236](https://insights.sbomify.com/CVE-2026-61236/): Missing authorization in PeopleSoft Enterprise FIN Common Objects Brazil (high 7.5)
- [CVE-2026-61235](https://insights.sbomify.com/CVE-2026-61235/): Missing authorization in PeopleSoft Enterprise HCM Global Payroll Switzerland (critical 9.1)
- [CVE-2026-61234](https://insights.sbomify.com/CVE-2026-61234/): Missing authorization in PeopleSoft Enterprise FIN Common Objects Brazil (high 7.4)
- [CVE-2026-61233](https://insights.sbomify.com/CVE-2026-61233/): Auth bypass in PeopleSoft Enterprise FIN Common Objects Brazil (critical 9.8)
- [CVE-2026-61232](https://insights.sbomify.com/CVE-2026-61232/): Missing authorization in PeopleSoft Enterprise FIN Common Objects Brazil (high 7.5)
- [CVE-2026-61231](https://insights.sbomify.com/CVE-2026-61231/): Privilege escalation in Oracle Virtual Directory (high 8.8)
- [CVE-2026-61230](https://insights.sbomify.com/CVE-2026-61230/): Missing authorization in Oracle WebCenter Portal (high 8.6)
- [CVE-2026-6123](https://insights.sbomify.com/CVE-2026-6123/): Tenda F451 httpd addressNat fromAddressNat stack-based overflow (high 8.7)
- [CVE-2026-61229](https://insights.sbomify.com/CVE-2026-61229/): Missing authorization in Oracle WebCenter Portal (high 8.1)
- [CVE-2026-61228](https://insights.sbomify.com/CVE-2026-61228/): Missing authorization in Oracle WebCenter Portal (high 8.6)
- [CVE-2026-61227](https://insights.sbomify.com/CVE-2026-61227/): Missing authorization in Oracle WebCenter Portal (high 7.6)
- [CVE-2026-61226](https://insights.sbomify.com/CVE-2026-61226/): Other in Oracle Communications Converged Application Server (high 7.5)
- [CVE-2026-61225](https://insights.sbomify.com/CVE-2026-61225/): Auth bypass in Oracle Communications Converged Application Server (high 8.1)
- [CVE-2026-61224](https://insights.sbomify.com/CVE-2026-61224/): Missing authorization in Oracle Communications Converged Application Server (high 8.0)
- [CVE-2026-61223](https://insights.sbomify.com/CVE-2026-61223/): Missing authorization in Oracle Communications Converged Application Server (critical 9.0)
- [CVE-2026-61222](https://insights.sbomify.com/CVE-2026-61222/): Missing authorization in Oracle WebCenter Portal (high 8.2)
- [CVE-2026-61221](https://insights.sbomify.com/CVE-2026-61221/): Missing authorization in Oracle Item Master (medium 5.4)
- [CVE-2026-61220](https://insights.sbomify.com/CVE-2026-61220/): Missing authorization in Oracle Banking Origination (medium 6.1)
- [CVE-2026-6122](https://insights.sbomify.com/CVE-2026-6122/): Tenda F451 httpd L7Prot frmL7ProtForm stack-based overflow (high 8.7)
- [CVE-2026-61219](https://insights.sbomify.com/CVE-2026-61219/): Missing authorization in Oracle WebCenter Portal (high 8.7)
- [CVE-2026-61218](https://insights.sbomify.com/CVE-2026-61218/): Missing authorization in Oracle E-Business Suite Secure Enterprise Search (high 8.1)
- [CVE-2026-61217](https://insights.sbomify.com/CVE-2026-61217/): Cross-site request forgery in Oracle Security Service (medium 6.4)
- [CVE-2026-61216](https://insights.sbomify.com/CVE-2026-61216/): Missing authorization in Oracle Payroll (medium 6.3)
- [CVE-2026-61215](https://insights.sbomify.com/CVE-2026-61215/): Missing authorization in Oracle WebCenter Portal (high 8.7)
- [CVE-2026-61214](https://insights.sbomify.com/CVE-2026-61214/): Information disclosure in Oracle HRMS (UK) (low 2.2)
- [CVE-2026-61213](https://insights.sbomify.com/CVE-2026-61213/): Missing authorization in Oracle WebCenter Portal (high 8.8)
- [CVE-2026-61212](https://insights.sbomify.com/CVE-2026-61212/): Missing authorization in Oracle WebCenter Portal (high 8.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/496/