# Vulnerabilities published in 2026


- [CVE-2026-6103](https://insights.sbomify.com/CVE-2026-6103/): Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection (medium 4.3)
- [CVE-2026-61029](https://insights.sbomify.com/CVE-2026-61029/): Missing authorization in Oracle WebCenter Sites (critical 9.0)
- [CVE-2026-61028](https://insights.sbomify.com/CVE-2026-61028/): Denial of service in Oracle Inventory Management (low 1.9)
- [CVE-2026-61027](https://insights.sbomify.com/CVE-2026-61027/): Missing authorization in Oracle Cost Management (high 7.2)
- [CVE-2026-61026](https://insights.sbomify.com/CVE-2026-61026/): Missing authorization in Oracle iRecruitment (high 7.5)
- [CVE-2026-61025](https://insights.sbomify.com/CVE-2026-61025/): Missing authorization in Oracle iRecruitment (high 7.2)
- [CVE-2026-61024](https://insights.sbomify.com/CVE-2026-61024/): Missing authorization in Oracle iRecruitment (high 8.1)
- [CVE-2026-61023](https://insights.sbomify.com/CVE-2026-61023/): Privilege escalation in Oracle Inventory Management (medium 6.4)
- [CVE-2026-61022](https://insights.sbomify.com/CVE-2026-61022/): Missing authorization in Oracle WebCenter Sites (high 8.8)
- [CVE-2026-61021](https://insights.sbomify.com/CVE-2026-61021/): Missing authorization in Oracle WebCenter Sites (critical 9.9)
- [CVE-2026-61020](https://insights.sbomify.com/CVE-2026-61020/): Missing authorization in Oracle Customers Online (high 8.1)
- [CVE-2026-6102](https://insights.sbomify.com/CVE-2026-6102/): MSI Center NTIOLib_X64 Origin Validation Error Local Privilege Escalation Vulnerability (high 7.8)
- [CVE-2026-61019](https://insights.sbomify.com/CVE-2026-61019/): Missing authorization in Oracle Customers Online (high 8.1)
- [CVE-2026-61018](https://insights.sbomify.com/CVE-2026-61018/): Missing authorization in Oracle WebCenter Sites (critical 9.8)
- [CVE-2026-61017](https://insights.sbomify.com/CVE-2026-61017/): Missing authorization in Oracle WebCenter Sites (high 8.8)
- [CVE-2026-61016](https://insights.sbomify.com/CVE-2026-61016/): Missing authorization in Oracle WebCenter Sites (high 8.2)
- [CVE-2026-61015](https://insights.sbomify.com/CVE-2026-61015/): Information disclosure in Oracle Time and Labor (low 3.7)
- [CVE-2026-61014](https://insights.sbomify.com/CVE-2026-61014/): Information disclosure in Oracle Inventory Management (high 7.7)
- [CVE-2026-61013](https://insights.sbomify.com/CVE-2026-61013/): Missing authorization in Oracle Time and Labor (medium 6.6)
- [CVE-2026-61012](https://insights.sbomify.com/CVE-2026-61012/): Missing authorization in Oracle Time and Labor (high 7.1)
- [CVE-2026-61011](https://insights.sbomify.com/CVE-2026-61011/): Missing authorization in Oracle WebCenter Sites (high 8.2)
- [CVE-2026-61010](https://insights.sbomify.com/CVE-2026-61010/): Auth bypass in Oracle Process Manufacturing Systems (high 8.8)
- [CVE-2026-6101](https://insights.sbomify.com/CVE-2026-6101/): Path traversal in AMP for WP – Accelerated Mobile Pages (high 7.5)
- [CVE-2026-61009](https://insights.sbomify.com/CVE-2026-61009/): Missing authorization in Oracle Process Manufacturing Logistics (high 8.0)
- [CVE-2026-61008](https://insights.sbomify.com/CVE-2026-61008/): Missing authorization in Oracle WebCenter Sites (critical 9.1)
- [CVE-2026-61007](https://insights.sbomify.com/CVE-2026-61007/): Missing authorization in Oracle WebCenter Sites (high 7.5)
- [CVE-2026-61006](https://insights.sbomify.com/CVE-2026-61006/): Privilege escalation in Oracle Process Manufacturing Logistics (high 7.2)
- [CVE-2026-61005](https://insights.sbomify.com/CVE-2026-61005/): Missing authorization in Oracle Process Manufacturing Logistics (high 8.1)
- [CVE-2026-61004](https://insights.sbomify.com/CVE-2026-61004/): Missing authorization in Oracle Landed Cost Management (high 8.1)
- [CVE-2026-61003](https://insights.sbomify.com/CVE-2026-61003/): Missing authorization in Oracle Managed File Transfer (critical 9.9)
- [CVE-2026-61002](https://insights.sbomify.com/CVE-2026-61002/): Missing authorization in Oracle SOA Suite (high 8.8)
- [CVE-2026-61001](https://insights.sbomify.com/CVE-2026-61001/): Missing authorization in Oracle Web Services Manager (critical 9.6)
- [CVE-2026-61000](https://insights.sbomify.com/CVE-2026-61000/): Missing authorization in Oracle Process Manufacturing Systems (high 8.1)
- [CVE-2026-6100](https://insights.sbomify.com/CVE-2026-6100/): Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure (critical 9.1)
- [CVE-2026-60999](https://insights.sbomify.com/CVE-2026-60999/): Missing authorization in Oracle Data Integrator (critical 9.8)
- [CVE-2026-60998](https://insights.sbomify.com/CVE-2026-60998/): Missing authorization in Oracle Identity Manager Connector (high 8.0)
- [CVE-2026-60997](https://insights.sbomify.com/CVE-2026-60997/): Missing authorization in Oracle Universal Work Queue (high 8.1)
- [CVE-2026-60996](https://insights.sbomify.com/CVE-2026-60996/): Missing authorization in Oracle Identity Manager Connector (high 8.7)
- [CVE-2026-60995](https://insights.sbomify.com/CVE-2026-60995/): Missing authorization in Oracle Identity Manager Connector (critical 9.9)
- [CVE-2026-60994](https://insights.sbomify.com/CVE-2026-60994/): Missing authorization in Oracle Identity Manager Connector (high 7.2)
- [CVE-2026-60993](https://insights.sbomify.com/CVE-2026-60993/): Missing authorization in Oracle Identity Manager Connector (high 7.5)
- [CVE-2026-60992](https://insights.sbomify.com/CVE-2026-60992/): Missing authorization in Oracle Identity Manager Connector (high 8.1)
- [CVE-2026-60991](https://insights.sbomify.com/CVE-2026-60991/): Missing authorization in Oracle Identity Manager Connector (high 7.8)
- [CVE-2026-60990](https://insights.sbomify.com/CVE-2026-60990/): Missing authorization in Oracle Identity Manager Connector (critical 9.9)
- [CVE-2026-60989](https://insights.sbomify.com/CVE-2026-60989/): Auth bypass in Oracle Advanced Collections (high 8.8)
- [CVE-2026-60988](https://insights.sbomify.com/CVE-2026-60988/): Missing authorization in Oracle Project Portfolio Analysis (high 7.5)
- [CVE-2026-60987](https://insights.sbomify.com/CVE-2026-60987/): Missing authorization in Oracle Project Portfolio Analysis (high 7.1)
- [CVE-2026-60986](https://insights.sbomify.com/CVE-2026-60986/): Missing authorization in Oracle Project Portfolio Analysis (high 8.1)
- [CVE-2026-60985](https://insights.sbomify.com/CVE-2026-60985/): Missing authorization in Oracle Project Portfolio Analysis (high 7.1)
- [CVE-2026-60984](https://insights.sbomify.com/CVE-2026-60984/): Missing authorization in Oracle Project Portfolio Analysis (high 7.1)
- [CVE-2026-60983](https://insights.sbomify.com/CVE-2026-60983/): Missing authorization in Oracle WebCenter Content (high 7.7)
- [CVE-2026-60982](https://insights.sbomify.com/CVE-2026-60982/): Missing authorization in Oracle US Federal Human Resources (high 8.1)
- [CVE-2026-60981](https://insights.sbomify.com/CVE-2026-60981/): Missing authorization in Oracle WebCenter Content (high 8.7)
- [CVE-2026-60980](https://insights.sbomify.com/CVE-2026-60980/): Missing authorization in Oracle WebCenter Content (high 8.7)
- [CVE-2026-60979](https://insights.sbomify.com/CVE-2026-60979/): Auth bypass in Oracle Scripting (high 8.1)
- [CVE-2026-60978](https://insights.sbomify.com/CVE-2026-60978/): Missing authorization in Oracle Scripting (medium 6.5)
- [CVE-2026-60977](https://insights.sbomify.com/CVE-2026-60977/): Missing authorization in Oracle WebLogic Server (critical 9.8)
- [CVE-2026-60976](https://insights.sbomify.com/CVE-2026-60976/): Missing authorization in Oracle Scripting (high 8.8)
- [CVE-2026-60975](https://insights.sbomify.com/CVE-2026-60975/): Missing authorization in PeopleSoft Enterprise PeopleTools (high 7.5)
- [CVE-2026-60974](https://insights.sbomify.com/CVE-2026-60974/): Missing authorization in Oracle E-Business Tax (high 8.1)
- [CVE-2026-60973](https://insights.sbomify.com/CVE-2026-60973/): Privilege escalation in Oracle E-Business Tax (high 7.8)
- [CVE-2026-60972](https://insights.sbomify.com/CVE-2026-60972/): Missing authorization in Oracle E-Business Tax (high 8.1)
- [CVE-2026-60971](https://insights.sbomify.com/CVE-2026-60971/): Missing authorization in Oracle WebCenter Enterprise Capture (critical 9.8)
- [CVE-2026-60970](https://insights.sbomify.com/CVE-2026-60970/): Missing authorization in Oracle WebCenter Enterprise Capture (critical 9.8)
- [CVE-2026-60969](https://insights.sbomify.com/CVE-2026-60969/): Missing authorization in Oracle Unified Directory (high 7.7)
- [CVE-2026-60968](https://insights.sbomify.com/CVE-2026-60968/): Information disclosure in PeopleSoft Enterprise PeopleTools (medium 6.0)
- [CVE-2026-60967](https://insights.sbomify.com/CVE-2026-60967/): Auth bypass in PeopleSoft Enterprise PeopleTools (high 8.8)
- [CVE-2026-60966](https://insights.sbomify.com/CVE-2026-60966/): Missing authorization in Oracle Public Sector Human Resources (high 8.1)
- [CVE-2026-60965](https://insights.sbomify.com/CVE-2026-60965/): Missing authorization in Oracle HRMS (France) (high 8.1)
- [CVE-2026-60964](https://insights.sbomify.com/CVE-2026-60964/): Information disclosure in PeopleSoft Enterprise PeopleTools (low 1.9)
- [CVE-2026-60963](https://insights.sbomify.com/CVE-2026-60963/): Missing authorization in Oracle Treasury (high 8.1)
- [CVE-2026-60962](https://insights.sbomify.com/CVE-2026-60962/): Cross-site request forgery in Oracle Flow Manufacturing (medium 5.4)
- [CVE-2026-60961](https://insights.sbomify.com/CVE-2026-60961/): Missing authorization in Oracle WebCenter Content (high 8.0)
- [CVE-2026-60960](https://insights.sbomify.com/CVE-2026-60960/): Missing authorization in Oracle SDP Number Portability (high 8.8)
- [CVE-2026-60959](https://insights.sbomify.com/CVE-2026-60959/): Missing authorization in Oracle SDP Number Portability (high 8.1)
- [CVE-2026-60958](https://insights.sbomify.com/CVE-2026-60958/): Missing authorization in Oracle WebCenter Enterprise Capture (critical 9.8)
- [CVE-2026-60957](https://insights.sbomify.com/CVE-2026-60957/): Cross-site request forgery in Oracle Transportation Execution (medium 5.4)
- [CVE-2026-60956](https://insights.sbomify.com/CVE-2026-60956/): Missing authorization in JD Edwards EnterpriseOne US Payroll (high 7.5)
- [CVE-2026-60955](https://insights.sbomify.com/CVE-2026-60955/): Missing authorization in Oracle WebCenter Content (high 8.2)
- [CVE-2026-60954](https://insights.sbomify.com/CVE-2026-60954/): Missing authorization in Oracle WebCenter Content (high 8.7)
- [CVE-2026-60953](https://insights.sbomify.com/CVE-2026-60953/): Missing authorization in Oracle Telecommunications Billing Integrator (high 8.1)
- [CVE-2026-60952](https://insights.sbomify.com/CVE-2026-60952/): Auth bypass in Oracle Transportation Execution (high 8.8)
- [CVE-2026-60951](https://insights.sbomify.com/CVE-2026-60951/): Missing authorization in Oracle Time and Labor (high 8.1)
- [CVE-2026-60950](https://insights.sbomify.com/CVE-2026-60950/): Information disclosure in Oracle HRMS (Ireland) (low 2.2)
- [CVE-2026-6095](https://insights.sbomify.com/CVE-2026-6095/): Orejime - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-032 (medium 6.1)
- [CVE-2026-60949](https://insights.sbomify.com/CVE-2026-60949/): Missing authorization in Oracle WebCenter Content (high 7.1)
- [CVE-2026-60948](https://insights.sbomify.com/CVE-2026-60948/): Missing authorization in Oracle Learning Management (high 8.1)
- [CVE-2026-60947](https://insights.sbomify.com/CVE-2026-60947/): Missing authorization in Oracle WebCenter Enterprise Capture (critical 9.8)
- [CVE-2026-60946](https://insights.sbomify.com/CVE-2026-60946/): Missing authorization in Oracle WebCenter Enterprise Capture (critical 9.8)
- [CVE-2026-60945](https://insights.sbomify.com/CVE-2026-60945/): Open redirect in Oracle Learning Management (high 7.3)
- [CVE-2026-60944](https://insights.sbomify.com/CVE-2026-60944/): Missing authorization in Oracle WebCenter Content (high 8.2)
- [CVE-2026-60943](https://insights.sbomify.com/CVE-2026-60943/): Privilege escalation in Oracle Service Fulfillment Manager (high 7.5)
- [CVE-2026-60942](https://insights.sbomify.com/CVE-2026-60942/): Missing authorization in Oracle Service Fulfillment Manager (high 8.1)
- [CVE-2026-60941](https://insights.sbomify.com/CVE-2026-60941/): Privilege escalation in Oracle Service Fulfillment Manager (high 8.7)
- [CVE-2026-60940](https://insights.sbomify.com/CVE-2026-60940/): Missing authorization in Oracle Service Contracts (medium 5.7)
- [CVE-2026-6094](https://insights.sbomify.com/CVE-2026-6094/): Heap buffer overread in wc_PKCS7_DecodeEnvelopedData parsing crafted PKCS7 EnvelopedData (medium 6.3)
- [CVE-2026-60939](https://insights.sbomify.com/CVE-2026-60939/): Information disclosure in Oracle Project Contracts (low 3.1)
- [CVE-2026-60938](https://insights.sbomify.com/CVE-2026-60938/): Privilege escalation in Oracle Labor Distribution (medium 4.1)
- [CVE-2026-60937](https://insights.sbomify.com/CVE-2026-60937/): Missing authorization in Oracle Labor Distribution (low 3.1)
- [CVE-2026-60936](https://insights.sbomify.com/CVE-2026-60936/): Denial of service in Oracle Labor Distribution (low 3.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/499/