# Vulnerabilities published in 2026


- [CVE-2026-61211](https://insights.sbomify.com/CVE-2026-61211/): Missing authorization in Oracle Database Server (critical 9.9)
- [CVE-2026-61210](https://insights.sbomify.com/CVE-2026-61210/): Missing authorization in PeopleSoft Enterprise SCM Manufacturing (high 7.4)
- [CVE-2026-6121](https://insights.sbomify.com/CVE-2026-6121/): Tenda F451 httpd WrlclientSet stack-based overflow (high 8.7)
- [CVE-2026-61209](https://insights.sbomify.com/CVE-2026-61209/): Privilege escalation in PeopleSoft In-Memory Project Discovery (critical 9.9)
- [CVE-2026-61208](https://insights.sbomify.com/CVE-2026-61208/): Missing authorization in Oracle WebCenter Portal (high 7.6)
- [CVE-2026-61207](https://insights.sbomify.com/CVE-2026-61207/): Missing authorization in PeopleSoft Enterprise SCM eProcurement (critical 9.3)
- [CVE-2026-61206](https://insights.sbomify.com/CVE-2026-61206/): Missing authorization in Oracle Hyperion Calculation Manager (critical 9.9)
- [CVE-2026-61205](https://insights.sbomify.com/CVE-2026-61205/): Missing authorization in PeopleSoft Enterprise SCM Purchasing (high 8.2)
- [CVE-2026-61204](https://insights.sbomify.com/CVE-2026-61204/): Cross-site request forgery in PeopleSoft Enterprise FIN Program Management (critical 9.0)
- [CVE-2026-61203](https://insights.sbomify.com/CVE-2026-61203/): Missing authorization in PeopleSoft Enterprise FIN Expenses (critical 9.4)
- [CVE-2026-61202](https://insights.sbomify.com/CVE-2026-61202/): Other in Oracle Solaris (high 7.5)
- [CVE-2026-61201](https://insights.sbomify.com/CVE-2026-61201/): Missing authorization in PeopleSoft Enterprise CRM Common Objects (critical 9.0)
- [CVE-2026-61200](https://insights.sbomify.com/CVE-2026-61200/): Missing authorization in Oracle Labor Distribution (medium 5.4)
- [CVE-2026-6120](https://insights.sbomify.com/CVE-2026-6120/): Tenda F451 httpd DhcpListClient fromDhcpListClient stack-based overflow (high 8.7)
- [CVE-2026-61199](https://insights.sbomify.com/CVE-2026-61199/): Missing authorization in Oracle WebCenter Portal (high 7.7)
- [CVE-2026-61198](https://insights.sbomify.com/CVE-2026-61198/): Missing authorization in Oracle Learning Management (medium 6.5)
- [CVE-2026-61197](https://insights.sbomify.com/CVE-2026-61197/): Missing authorization in Oracle Identity Manager (critical 9.1)
- [CVE-2026-61196](https://insights.sbomify.com/CVE-2026-61196/): Auth bypass in Oracle Identity Manager (critical 9.8)
- [CVE-2026-61195](https://insights.sbomify.com/CVE-2026-61195/): Denial of service in Oracle Agile Engineering Data Management (medium 6.5)
- [CVE-2026-61194](https://insights.sbomify.com/CVE-2026-61194/): Denial of service in Oracle Agile Engineering Data Management (medium 6.5)
- [CVE-2026-61193](https://insights.sbomify.com/CVE-2026-61193/): Missing authorization in Oracle WebCenter Portal (high 8.7)
- [CVE-2026-61192](https://insights.sbomify.com/CVE-2026-61192/): Denial of service in Oracle Agile Engineering Data Management (medium 5.3)
- [CVE-2026-61191](https://insights.sbomify.com/CVE-2026-61191/): Missing authorization in Oracle Agile Engineering Data Management (medium 4.4)
- [CVE-2026-61190](https://insights.sbomify.com/CVE-2026-61190/): Missing authorization in Oracle Agile Engineering Data Management (medium 6.4)
- [CVE-2026-6119](https://insights.sbomify.com/CVE-2026-6119/): AstrBotDevs AstrBot API Endpoint post_data.get server-side request forgery (medium 5.3)
- [CVE-2026-61189](https://insights.sbomify.com/CVE-2026-61189/): Missing authorization in Oracle Agile Engineering Data Management (medium 6.5)
- [CVE-2026-61188](https://insights.sbomify.com/CVE-2026-61188/): Auth bypass in Oracle Agile Product Lifecycle Management for Process (high 7.5)
- [CVE-2026-61187](https://insights.sbomify.com/CVE-2026-61187/): Denial of service in Oracle Agile Engineering Data Management (low 2.8)
- [CVE-2026-61186](https://insights.sbomify.com/CVE-2026-61186/): Missing authorization in Oracle Agile Engineering Data Management (critical 9.4)
- [CVE-2026-61185](https://insights.sbomify.com/CVE-2026-61185/): Information disclosure in Oracle Agile Product Lifecycle Management for Process (high 7.4)
- [CVE-2026-61184](https://insights.sbomify.com/CVE-2026-61184/): Missing authorization in Oracle Agile Product Lifecycle Management for Process (critical 9.1)
- [CVE-2026-61183](https://insights.sbomify.com/CVE-2026-61183/): Auth bypass in Oracle Agile Product Lifecycle Management for Process (critical 9.8)
- [CVE-2026-61182](https://insights.sbomify.com/CVE-2026-61182/): Privilege escalation in Oracle Agile Product Lifecycle Management for Process (medium 6.7)
- [CVE-2026-61181](https://insights.sbomify.com/CVE-2026-61181/): Open redirect in Oracle Agile Product Lifecycle Management for Process (high 7.6)
- [CVE-2026-61180](https://insights.sbomify.com/CVE-2026-61180/): Auth bypass in Oracle Agile Product Lifecycle Management for Process (high 8.8)
- [CVE-2026-6118](https://insights.sbomify.com/CVE-2026-6118/): AstrBotDevs AstrBot MCP Endpoint tools.py add_mcp_server command injection (medium 5.3)
- [CVE-2026-61179](https://insights.sbomify.com/CVE-2026-61179/): Auth bypass in Oracle Agile Product Lifecycle Management for Process (high 8.8)
- [CVE-2026-61178](https://insights.sbomify.com/CVE-2026-61178/): Auth bypass in Oracle Agile Product Lifecycle Management for Process (critical 9.8)
- [CVE-2026-61177](https://insights.sbomify.com/CVE-2026-61177/): Missing authorization in Oracle WebCenter Portal (high 8.1)
- [CVE-2026-61176](https://insights.sbomify.com/CVE-2026-61176/): Missing authorization in Oracle Product Lifecycle Analytics (medium 6.7)
- [CVE-2026-61175](https://insights.sbomify.com/CVE-2026-61175/): Missing authorization in Oracle Product Lifecycle Analytics (critical 9.3)
- [CVE-2026-61174](https://insights.sbomify.com/CVE-2026-61174/): Missing authorization in Oracle Product Lifecycle Analytics (critical 9.0)
- [CVE-2026-61173](https://insights.sbomify.com/CVE-2026-61173/): Missing authorization in Oracle Agile PLM (high 7.4)
- [CVE-2026-61172](https://insights.sbomify.com/CVE-2026-61172/): Missing authorization in Oracle Agile PLM (high 7.5)
- [CVE-2026-61171](https://insights.sbomify.com/CVE-2026-61171/): Missing authorization in Oracle Agile PLM (critical 9.1)
- [CVE-2026-61170](https://insights.sbomify.com/CVE-2026-61170/): Auth bypass in Oracle Agile PLM (high 8.1)
- [CVE-2026-6117](https://insights.sbomify.com/CVE-2026-6117/): AstrBotDevs AstrBot install-upload Endpoint plugin.py install_plugin_upload sandbox (medium 5.3)
- [CVE-2026-61169](https://insights.sbomify.com/CVE-2026-61169/): Missing authorization in Oracle Agile PLM (medium 6.5)
- [CVE-2026-61168](https://insights.sbomify.com/CVE-2026-61168/): Auth bypass in Oracle Agile PLM (high 8.8)
- [CVE-2026-61167](https://insights.sbomify.com/CVE-2026-61167/): Auth bypass in Oracle Agile PLM (critical 9.8)
- [CVE-2026-61166](https://insights.sbomify.com/CVE-2026-61166/): Missing authorization in Oracle Agile PLM (high 8.8)
- [CVE-2026-61165](https://insights.sbomify.com/CVE-2026-61165/): Denial of service in Oracle Commerce Guided Search Platform Services (high 7.1)
- [CVE-2026-61164](https://insights.sbomify.com/CVE-2026-61164/): Missing authorization in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (high 7.4)
- [CVE-2026-61163](https://insights.sbomify.com/CVE-2026-61163/): Auth bypass in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (high 8.1)
- [CVE-2026-61162](https://insights.sbomify.com/CVE-2026-61162/): Missing authorization in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (high 7.1)
- [CVE-2026-61161](https://insights.sbomify.com/CVE-2026-61161/): Auth bypass in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (critical 9.8)
- [CVE-2026-61160](https://insights.sbomify.com/CVE-2026-61160/): Denial of service in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (high 8.1)
- [CVE-2026-6116](https://insights.sbomify.com/CVE-2026-6116/): Totolink A7100RU CGI cstecgi.cgi setDiagnosisCfg os command injection (critical 9.3)
- [CVE-2026-61159](https://insights.sbomify.com/CVE-2026-61159/): Information disclosure in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (high 7.5)
- [CVE-2026-61158](https://insights.sbomify.com/CVE-2026-61158/): Missing authorization in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (high 7.5)
- [CVE-2026-61157](https://insights.sbomify.com/CVE-2026-61157/): Missing authorization in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (high 7.5)
- [CVE-2026-61156](https://insights.sbomify.com/CVE-2026-61156/): Missing authorization in Oracle Commerce Guided Search Platform Services (critical 9.1)
- [CVE-2026-61155](https://insights.sbomify.com/CVE-2026-61155/): Missing authorization in Oracle Commerce Guided Search Platform Services (critical 9.1)
- [CVE-2026-61154](https://insights.sbomify.com/CVE-2026-61154/): Auth bypass in Oracle Commerce Guided Search Platform Services (critical 9.8)
- [CVE-2026-61153](https://insights.sbomify.com/CVE-2026-61153/): Missing authorization in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (critical 9.1)
- [CVE-2026-61152](https://insights.sbomify.com/CVE-2026-61152/): Missing authorization in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (medium 5.4)
- [CVE-2026-61151](https://insights.sbomify.com/CVE-2026-61151/): Missing authorization in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (high 7.1)
- [CVE-2026-61150](https://insights.sbomify.com/CVE-2026-61150/): Missing authorization in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (high 8.1)
- [CVE-2026-6115](https://insights.sbomify.com/CVE-2026-6115/): Totolink A7100RU CGI cstecgi.cgi setAppCfg os command injection (critical 9.3)
- [CVE-2026-61149](https://insights.sbomify.com/CVE-2026-61149/): Auth bypass in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (high 8.8)
- [CVE-2026-61148](https://insights.sbomify.com/CVE-2026-61148/): Missing authorization in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (high 8.8)
- [CVE-2026-61147](https://insights.sbomify.com/CVE-2026-61147/): Denial of service in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (medium 6.2)
- [CVE-2026-61146](https://insights.sbomify.com/CVE-2026-61146/): Missing authorization in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (critical 9.9)
- [CVE-2026-61145](https://insights.sbomify.com/CVE-2026-61145/): Missing authorization in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (critical 9.8)
- [CVE-2026-61144](https://insights.sbomify.com/CVE-2026-61144/): Denial of service in MySQL Cluster (medium 4.9)
- [CVE-2026-61143](https://insights.sbomify.com/CVE-2026-61143/): Other in Oracle Communications Convergent Charging Controller (medium 6.4)
- [CVE-2026-61142](https://insights.sbomify.com/CVE-2026-61142/): Missing authorization in Oracle Payroll (high 7.7)
- [CVE-2026-61141](https://insights.sbomify.com/CVE-2026-61141/): Missing authorization in Oracle Advanced Benefits (high 7.5)
- [CVE-2026-61140](https://insights.sbomify.com/CVE-2026-61140/): Auth bypass in Oracle WebCenter Sites (critical 9.8)
- [CVE-2026-6114](https://insights.sbomify.com/CVE-2026-6114/): Totolink A7100RU CGI cstecgi.cgi setNetworkCfg os command injection (critical 9.3)
- [CVE-2026-61139](https://insights.sbomify.com/CVE-2026-61139/): Missing authorization in Oracle Public Sector Financials (International) (medium 6.3)
- [CVE-2026-61138](https://insights.sbomify.com/CVE-2026-61138/): Missing authorization in Oracle Complex Maintenance, Repair and Overhaul (high 7.5)
- [CVE-2026-61137](https://insights.sbomify.com/CVE-2026-61137/): Auth bypass in Oracle Commerce Platform (high 8.1)
- [CVE-2026-61136](https://insights.sbomify.com/CVE-2026-61136/): Missing authorization in Oracle Commerce Platform (high 7.3)
- [CVE-2026-61135](https://insights.sbomify.com/CVE-2026-61135/): Missing authorization in Oracle Commerce Platform (high 7.4)
- [CVE-2026-61134](https://insights.sbomify.com/CVE-2026-61134/): Missing authorization in Oracle Commerce Platform (medium 6.8)
- [CVE-2026-61133](https://insights.sbomify.com/CVE-2026-61133/): Information disclosure in Oracle Commerce Platform (high 7.5)
- [CVE-2026-61132](https://insights.sbomify.com/CVE-2026-61132/): Cross-site request forgery in Oracle Commerce Platform (high 7.6)
- [CVE-2026-61131](https://insights.sbomify.com/CVE-2026-61131/): Auth bypass in Oracle Commerce Platform (critical 9.8)
- [CVE-2026-61130](https://insights.sbomify.com/CVE-2026-61130/): Missing authorization in Oracle Commerce Platform (critical 9.1)
- [CVE-2026-6113](https://insights.sbomify.com/CVE-2026-6113/): Totolink A7100RU CGI cstecgi.cgi setTtyServiceCfg os command injection (critical 9.3)
- [CVE-2026-61129](https://insights.sbomify.com/CVE-2026-61129/): Auth bypass in Oracle Commerce Platform (critical 9.8)
- [CVE-2026-61128](https://insights.sbomify.com/CVE-2026-61128/): Denial of service in MySQL Cluster (medium 4.9)
- [CVE-2026-61127](https://insights.sbomify.com/CVE-2026-61127/): Auth bypass in Oracle Communications Service Catalog and Design (high 8.8)
- [CVE-2026-61126](https://insights.sbomify.com/CVE-2026-61126/): Privilege escalation in Oracle Communications Billing and Revenue Management (high 7.8)
- [CVE-2026-61125](https://insights.sbomify.com/CVE-2026-61125/): Information disclosure in Oracle Configure to Order (high 7.7)
- [CVE-2026-61124](https://insights.sbomify.com/CVE-2026-61124/): Missing authorization in Oracle WebCenter Portal (high 7.1)
- [CVE-2026-61123](https://insights.sbomify.com/CVE-2026-61123/): Denial of service in Oracle HRMS (US) (medium 4.2)
- [CVE-2026-61122](https://insights.sbomify.com/CVE-2026-61122/): Missing authorization in Oracle HRMS (UK) (high 8.1)
- [CVE-2026-61121](https://insights.sbomify.com/CVE-2026-61121/): Auth bypass in Oracle HRMS (UK) (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/497/