# Vulnerabilities published in 2026


- [CVE-2026-61120](https://insights.sbomify.com/CVE-2026-61120/): Privilege escalation in Oracle HRMS (US) (high 7.0)
- [CVE-2026-6112](https://insights.sbomify.com/CVE-2026-6112/): Totolink A7100RU CGI cstecgi.cgi setRadvdCfg os command injection (critical 9.3)
- [CVE-2026-61119](https://insights.sbomify.com/CVE-2026-61119/): Missing authorization in Oracle HRMS (UK) (high 7.1)
- [CVE-2026-61118](https://insights.sbomify.com/CVE-2026-61118/): Missing authorization in Oracle Identity Manager (high 8.8)
- [CVE-2026-61117](https://insights.sbomify.com/CVE-2026-61117/): Missing authorization in Oracle HRMS (UK) (medium 6.3)
- [CVE-2026-61116](https://insights.sbomify.com/CVE-2026-61116/): Information disclosure in Oracle Application Object Library (high 7.5)
- [CVE-2026-61115](https://insights.sbomify.com/CVE-2026-61115/): Missing authorization in Oracle Order Management (high 7.2)
- [CVE-2026-61114](https://insights.sbomify.com/CVE-2026-61114/): Privilege escalation in Oracle Application Object Library (high 7.5)
- [CVE-2026-61113](https://insights.sbomify.com/CVE-2026-61113/): Missing authorization in Oracle Application Object Library (high 7.4)
- [CVE-2026-61112](https://insights.sbomify.com/CVE-2026-61112/): Missing authorization in Oracle Order Management (medium 6.5)
- [CVE-2026-61111](https://insights.sbomify.com/CVE-2026-61111/): Missing authorization in Oracle Application Object Library (medium 6.5)
- [CVE-2026-61110](https://insights.sbomify.com/CVE-2026-61110/): Auth bypass in Oracle Applications DBA (high 8.8)
- [CVE-2026-6111](https://insights.sbomify.com/CVE-2026-6111/): FoundationAgents MetaGPT common.py decode_image server-side request forgery (medium 5.3)
- [CVE-2026-61109](https://insights.sbomify.com/CVE-2026-61109/): Denial of service in MySQL Cluster (medium 6.5)
- [CVE-2026-61108](https://insights.sbomify.com/CVE-2026-61108/): Denial of service in MySQL Cluster (medium 6.5)
- [CVE-2026-61107](https://insights.sbomify.com/CVE-2026-61107/): Privilege escalation in Oracle Applications DBA (high 7.2)
- [CVE-2026-61106](https://insights.sbomify.com/CVE-2026-61106/): Missing authorization in Oracle GoldenGate (high 8.1)
- [CVE-2026-61105](https://insights.sbomify.com/CVE-2026-61105/): Missing authorization in Oracle Banking Trade Finance (high 8.1)
- [CVE-2026-61104](https://insights.sbomify.com/CVE-2026-61104/): Information disclosure in PeopleSoft Enterprise CS Student Records (low 3.7)
- [CVE-2026-61103](https://insights.sbomify.com/CVE-2026-61103/): Missing authorization in PeopleSoft Enterprise CS Campus Community (medium 5.9)
- [CVE-2026-61102](https://insights.sbomify.com/CVE-2026-61102/): Missing authorization in Oracle Banking Trade Finance (high 8.1)
- [CVE-2026-61101](https://insights.sbomify.com/CVE-2026-61101/): Cross-site request forgery in Oracle MES for Process Manufacturing (high 8.2)
- [CVE-2026-61100](https://insights.sbomify.com/CVE-2026-61100/): Auth bypass in Oracle WebCenter Enterprise Capture (critical 9.8)
- [CVE-2026-6110](https://insights.sbomify.com/CVE-2026-6110/): FoundationAgents MetaGPT Tree-of-Thought Solver tot.py generate_thoughts code injection (medium 6.9)
- [CVE-2026-61099](https://insights.sbomify.com/CVE-2026-61099/): Auth bypass in Oracle WebCenter Enterprise Capture (high 8.8)
- [CVE-2026-61098](https://insights.sbomify.com/CVE-2026-61098/): Auth bypass in Oracle WebCenter Enterprise Capture (high 8.8)
- [CVE-2026-61097](https://insights.sbomify.com/CVE-2026-61097/): Open redirect in Oracle Banking Trade Finance Process Management (critical 9.6)
- [CVE-2026-61096](https://insights.sbomify.com/CVE-2026-61096/): Missing authorization in MySQL Cluster (low 2.9)
- [CVE-2026-61095](https://insights.sbomify.com/CVE-2026-61095/): Missing authorization in Oracle Communications Unified Inventory Management (high 7.1)
- [CVE-2026-61094](https://insights.sbomify.com/CVE-2026-61094/): Missing authorization in MySQL Cluster (high 7.2)
- [CVE-2026-61093](https://insights.sbomify.com/CVE-2026-61093/): Denial of service in MySQL Cluster (medium 6.5)
- [CVE-2026-61092](https://insights.sbomify.com/CVE-2026-61092/): Auth bypass in Oracle WebCenter Enterprise Capture (high 8.1)
- [CVE-2026-61091](https://insights.sbomify.com/CVE-2026-61091/): Privilege escalation in Oracle Communications Billing and Revenue Management (high 7.8)
- [CVE-2026-61090](https://insights.sbomify.com/CVE-2026-61090/): Privilege escalation in Oracle Project Foundation (high 7.8)
- [CVE-2026-6109](https://insights.sbomify.com/CVE-2026-6109/): FoundationAgents MetaGPT Mineflayer HTTP API index.js evaluateCode cross-site request forgery (medium 5.3)
- [CVE-2026-61089](https://insights.sbomify.com/CVE-2026-61089/): Missing authorization in PeopleSoft Enterprise SCM Inventory (high 8.2)
- [CVE-2026-61088](https://insights.sbomify.com/CVE-2026-61088/): Missing authorization in PeopleSoft Enterprise SCM Manufacturing (high 7.5)
- [CVE-2026-61087](https://insights.sbomify.com/CVE-2026-61087/): Missing authorization in PeopleSoft Enterprise FIN Payables (high 7.5)
- [CVE-2026-61086](https://insights.sbomify.com/CVE-2026-61086/): Missing authorization in PeopleSoft Enterprise SCM Order Management (high 7.5)
- [CVE-2026-61085](https://insights.sbomify.com/CVE-2026-61085/): Missing authorization in PeopleSoft Enterprise SCM Inventory (high 7.5)
- [CVE-2026-61084](https://insights.sbomify.com/CVE-2026-61084/): Missing authorization in Oracle GoldenGate (medium 4.4)
- [CVE-2026-61083](https://insights.sbomify.com/CVE-2026-61083/): Missing authorization in Oracle Performance Management (medium 5.4)
- [CVE-2026-61082](https://insights.sbomify.com/CVE-2026-61082/): Open redirect in MySQL Connectors (medium 6.5)
- [CVE-2026-61081](https://insights.sbomify.com/CVE-2026-61081/): Information disclosure in MySQL Cluster (low 2.7)
- [CVE-2026-61080](https://insights.sbomify.com/CVE-2026-61080/): Missing authorization in Oracle Public Sector Human Resources (medium 5.4)
- [CVE-2026-6108](https://insights.sbomify.com/CVE-2026-6108/): 1Panel-dev MaxKB Model Context Protocol Node base_mcp_node.py execute os command injection (medium 5.3)
- [CVE-2026-61079](https://insights.sbomify.com/CVE-2026-61079/): Race condition in Oracle GoldenGate (medium 5.8)
- [CVE-2026-61078](https://insights.sbomify.com/CVE-2026-61078/): Open redirect in PeopleSoft Enterprise CC Common Application Objects (high 8.7)
- [CVE-2026-61077](https://insights.sbomify.com/CVE-2026-61077/): Missing authorization in PeopleSoft Enterprise SCM Mobile Inventory Management (high 7.5)
- [CVE-2026-61076](https://insights.sbomify.com/CVE-2026-61076/): Privilege escalation in PeopleSoft Enterprise HCM Talent Acquisition Manager (critical 9.9)
- [CVE-2026-61075](https://insights.sbomify.com/CVE-2026-61075/): Missing authorization in Oracle Self-Service Human Resources (medium 5.4)
- [CVE-2026-61074](https://insights.sbomify.com/CVE-2026-61074/): Auth bypass in PeopleSoft Enterprise FIN Common Objects Brazil (high 8.1)
- [CVE-2026-61073](https://insights.sbomify.com/CVE-2026-61073/): Missing authorization in PeopleSoft Enterprise FIN Common Objects Brazil (high 7.5)
- [CVE-2026-61072](https://insights.sbomify.com/CVE-2026-61072/): Missing authorization in PeopleSoft Enterprise FIN Staffing Front Office Brazil (critical 9.9)
- [CVE-2026-61071](https://insights.sbomify.com/CVE-2026-61071/): Missing authorization in PeopleSoft Enterprise FIN Engineering Argentina (low 3.3)
- [CVE-2026-61070](https://insights.sbomify.com/CVE-2026-61070/): Denial of service in PeopleSoft Enterprise FIN Common Objects Argentina (medium 5.3)
- [CVE-2026-6107](https://insights.sbomify.com/CVE-2026-6107/): 1Panel-dev MaxKB ChatHeadersMiddleware chat_headers_middleware.py cross site scripting (medium 5.1)
- [CVE-2026-61069](https://insights.sbomify.com/CVE-2026-61069/): Missing authorization in PeopleSoft Enterprise FIN General Ledger Argentina (medium 5.9)
- [CVE-2026-61068](https://insights.sbomify.com/CVE-2026-61068/): Missing authorization in PeopleSoft Enterprise FIN Billing Argentina (high 7.2)
- [CVE-2026-61067](https://insights.sbomify.com/CVE-2026-61067/): Auth bypass in Oracle Access Manager (high 8.0)
- [CVE-2026-61066](https://insights.sbomify.com/CVE-2026-61066/): Missing authorization in Oracle Identity Manager (critical 9.9)
- [CVE-2026-61065](https://insights.sbomify.com/CVE-2026-61065/): Auth bypass in Oracle Access Manager (critical 9.8)
- [CVE-2026-61064](https://insights.sbomify.com/CVE-2026-61064/): Missing authorization in Oracle iRecruitment (medium 5.4)
- [CVE-2026-61063](https://insights.sbomify.com/CVE-2026-61063/): Privilege escalation in PeopleSoft Enterprise SCM Supplier Contract Management (high 8.8)
- [CVE-2026-61062](https://insights.sbomify.com/CVE-2026-61062/): Privilege escalation in PeopleSoft Enterprise FIN Cash Management (high 8.8)
- [CVE-2026-61061](https://insights.sbomify.com/CVE-2026-61061/): Privilege escalation in Oracle JDeveloper (high 7.0)
- [CVE-2026-61060](https://insights.sbomify.com/CVE-2026-61060/): Missing authorization in Oracle E-Business Suite Secure Enterprise Search (medium 5.4)
- [CVE-2026-6106](https://insights.sbomify.com/CVE-2026-6106/): 1Panel-dev MaxKB Public Chat static_headers_middleware.py StaticHeadersMiddleware cross site scripting (medium 5.1)
- [CVE-2026-61059](https://insights.sbomify.com/CVE-2026-61059/): Missing authorization in PeopleSoft Enterprise SCM Order Management (critical 9.1)
- [CVE-2026-61058](https://insights.sbomify.com/CVE-2026-61058/): Missing authorization in Oracle WebCenter Sites (high 8.8)
- [CVE-2026-61057](https://insights.sbomify.com/CVE-2026-61057/): Missing authorization in PeopleSoft Enterprise FIN eSettlements (medium 4.8)
- [CVE-2026-61056](https://insights.sbomify.com/CVE-2026-61056/): Missing authorization in PeopleSoft Enterprise FIN Grants (medium 4.8)
- [CVE-2026-61055](https://insights.sbomify.com/CVE-2026-61055/): Privilege escalation in PeopleSoft Enterprise SCM Order Management (high 7.8)
- [CVE-2026-61054](https://insights.sbomify.com/CVE-2026-61054/): Missing authorization in Oracle WebCenter Sites (high 8.2)
- [CVE-2026-61053](https://insights.sbomify.com/CVE-2026-61053/): Privilege escalation in Oracle Communications BRM - Elastic Charging Engine (high 7.8)
- [CVE-2026-61052](https://insights.sbomify.com/CVE-2026-61052/): Denial of service in Oracle Solaris (medium 5.5)
- [CVE-2026-61051](https://insights.sbomify.com/CVE-2026-61051/): Missing authorization in Oracle Concurrent Processing (medium 6.3)
- [CVE-2026-61050](https://insights.sbomify.com/CVE-2026-61050/): Information disclosure in Oracle Production Scheduling (medium 5.3)
- [CVE-2026-6105](https://insights.sbomify.com/CVE-2026-6105/): perfree go-fastdfs-web doInstall InstallController.java improper authorization (medium 6.9)
- [CVE-2026-61049](https://insights.sbomify.com/CVE-2026-61049/): Auth bypass in Oracle Production Scheduling (high 7.1)
- [CVE-2026-61048](https://insights.sbomify.com/CVE-2026-61048/): Denial of service in Oracle Inventory Optimization (low 3.1)
- [CVE-2026-61047](https://insights.sbomify.com/CVE-2026-61047/): Missing authorization in Oracle Production Scheduling (low 1.9)
- [CVE-2026-61046](https://insights.sbomify.com/CVE-2026-61046/): Missing authorization in Oracle Production Scheduling (medium 6.6)
- [CVE-2026-61045](https://insights.sbomify.com/CVE-2026-61045/): Missing authorization in Oracle WebCenter Sites (high 8.6)
- [CVE-2026-61044](https://insights.sbomify.com/CVE-2026-61044/): Missing authorization in Oracle Production Scheduling (medium 4.7)
- [CVE-2026-61043](https://insights.sbomify.com/CVE-2026-61043/): Missing authorization in Oracle Production Scheduling (medium 6.7)
- [CVE-2026-61042](https://insights.sbomify.com/CVE-2026-61042/): Missing authorization in Oracle WebCenter Sites (high 8.8)
- [CVE-2026-61041](https://insights.sbomify.com/CVE-2026-61041/): Missing authorization in Oracle Demantra Demand Management (critical 9.9)
- [CVE-2026-61040](https://insights.sbomify.com/CVE-2026-61040/): Missing authorization in Oracle WebCenter Sites (high 8.8)
- [CVE-2026-6104](https://insights.sbomify.com/CVE-2026-6104/): Global buffer over-read in mb_convert_encoding() with attacker-supplied encoding (medium 6.3)
- [CVE-2026-61039](https://insights.sbomify.com/CVE-2026-61039/): Missing authorization in Oracle Advanced Supply Chain Planning (high 7.2)
- [CVE-2026-61038](https://insights.sbomify.com/CVE-2026-61038/): Missing authorization in Oracle WebCenter Sites (high 8.2)
- [CVE-2026-61037](https://insights.sbomify.com/CVE-2026-61037/): Missing authorization in Oracle Loans (high 8.1)
- [CVE-2026-61036](https://insights.sbomify.com/CVE-2026-61036/): Missing authorization in Oracle HRMS (Norway) (low 3.8)
- [CVE-2026-61035](https://insights.sbomify.com/CVE-2026-61035/): Missing authorization in Oracle Financials for the Americas (high 7.2)
- [CVE-2026-61034](https://insights.sbomify.com/CVE-2026-61034/): Missing authorization in Oracle WebCenter Sites (critical 9.1)
- [CVE-2026-61033](https://insights.sbomify.com/CVE-2026-61033/): Missing authorization in Oracle WebCenter Sites (high 8.6)
- [CVE-2026-61032](https://insights.sbomify.com/CVE-2026-61032/): Missing authorization in Oracle WebCenter Sites (high 8.8)
- [CVE-2026-61031](https://insights.sbomify.com/CVE-2026-61031/): Missing authorization in Oracle Financials Common Country (high 8.1)
- [CVE-2026-61030](https://insights.sbomify.com/CVE-2026-61030/): Missing authorization in Oracle Process Manufacturing Product Development (high 8.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/498/