# Vulnerabilities published in 2026 - [CVE-2026-60439](https://insights.sbomify.com/CVE-2026-60439/): Deserialization in Oracle Platform Security for Java (high 8.8) - [CVE-2026-60438](https://insights.sbomify.com/CVE-2026-60438/): Missing authorization in Oracle HTTP Server (critical 9.1) - [CVE-2026-60437](https://insights.sbomify.com/CVE-2026-60437/): Missing authorization in Oracle Unified Directory (high 8.7) - [CVE-2026-60436](https://insights.sbomify.com/CVE-2026-60436/): Denial of service in Oracle Unified Directory (high 7.5) - [CVE-2026-60435](https://insights.sbomify.com/CVE-2026-60435/): Auth bypass in Oracle WebCenter Content (critical 9.8) - [CVE-2026-60434](https://insights.sbomify.com/CVE-2026-60434/): Auth bypass in Oracle Transportation Management (medium 4.3) - [CVE-2026-60433](https://insights.sbomify.com/CVE-2026-60433/): Missing authorization in Oracle Transportation Management (medium 6.5) - [CVE-2026-60432](https://insights.sbomify.com/CVE-2026-60432/): Auth bypass in Oracle Solaris (critical 9.8) - [CVE-2026-60431](https://insights.sbomify.com/CVE-2026-60431/): Information disclosure in Oracle HTTP Server (high 8.6) - [CVE-2026-60430](https://insights.sbomify.com/CVE-2026-60430/): Missing authorization in Oracle Unified Directory (high 8.8) - [CVE-2026-6043](https://insights.sbomify.com/CVE-2026-6043/): Insecure Default Configuration in P4 Server (high 8.8) - [CVE-2026-60429](https://insights.sbomify.com/CVE-2026-60429/): Missing authorization in Oracle Unified Directory (critical 9.9) - [CVE-2026-60428](https://insights.sbomify.com/CVE-2026-60428/): Missing authorization in Oracle Unified Directory (high 8.2) - [CVE-2026-60427](https://insights.sbomify.com/CVE-2026-60427/): Missing authorization in Oracle Unified Directory (high 8.7) - [CVE-2026-60426](https://insights.sbomify.com/CVE-2026-60426/): Missing authorization in Oracle Unified Directory (high 8.5) - [CVE-2026-60425](https://insights.sbomify.com/CVE-2026-60425/): Denial of service in Oracle Unified Directory (high 7.5) - [CVE-2026-60424](https://insights.sbomify.com/CVE-2026-60424/): Auth bypass in Oracle Unified Directory (critical 9.0) - [CVE-2026-60423](https://insights.sbomify.com/CVE-2026-60423/): Auth bypass in Oracle Unified Directory (high 8.8) - [CVE-2026-60422](https://insights.sbomify.com/CVE-2026-60422/): Missing authorization in Oracle Unified Directory (critical 9.9) - [CVE-2026-60421](https://insights.sbomify.com/CVE-2026-60421/): Missing authorization in Oracle Unified Directory (high 8.2) - [CVE-2026-60420](https://insights.sbomify.com/CVE-2026-60420/): Missing authorization in Oracle Unified Directory (high 8.5) - [CVE-2026-6042](https://insights.sbomify.com/CVE-2026-6042/): musl libc GB18030 4-byte Decoder iconv.c iconv algorithmic complexity (medium 4.8) - [CVE-2026-60419](https://insights.sbomify.com/CVE-2026-60419/): Privilege escalation in Oracle Unified Directory (high 8.8) - [CVE-2026-60418](https://insights.sbomify.com/CVE-2026-60418/): Privilege escalation in Oracle Unified Directory (high 7.2) - [CVE-2026-60417](https://insights.sbomify.com/CVE-2026-60417/): Auth bypass in Oracle Unified Directory (high 8.1) - [CVE-2026-60416](https://insights.sbomify.com/CVE-2026-60416/): Auth bypass in Oracle Access Manager (high 8.1) - [CVE-2026-60415](https://insights.sbomify.com/CVE-2026-60415/): Information disclosure in Oracle WebLogic Server (high 8.1) - [CVE-2026-60414](https://insights.sbomify.com/CVE-2026-60414/): Information disclosure in Oracle Outside In Technology (high 7.8) - [CVE-2026-60413](https://insights.sbomify.com/CVE-2026-60413/): Information disclosure in Oracle Outside In Technology (high 7.8) - [CVE-2026-60412](https://insights.sbomify.com/CVE-2026-60412/): Deserialization in Oracle Outside In Technology (high 7.8) - [CVE-2026-60411](https://insights.sbomify.com/CVE-2026-60411/): Denial of service in TimesTen In-Memory Database (medium 6.5) - [CVE-2026-60410](https://insights.sbomify.com/CVE-2026-60410/): Denial of service in TimesTen In-Memory Database (medium 4.3) - [CVE-2026-6041](https://insights.sbomify.com/CVE-2026-6041/): Buzz Comments <= 0.9.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Custom Buzz Avatar' Setting (medium 4.4) - [CVE-2026-60409](https://insights.sbomify.com/CVE-2026-60409/): Missing authorization in TimesTen In-Memory Database (medium 5.7) - [CVE-2026-60408](https://insights.sbomify.com/CVE-2026-60408/): Information disclosure in TimesTen In-Memory Database (medium 4.3) - [CVE-2026-60407](https://insights.sbomify.com/CVE-2026-60407/): Missing authorization in TimesTen In-Memory Database (medium 5.6) - [CVE-2026-60406](https://insights.sbomify.com/CVE-2026-60406/): Privilege escalation in TimesTen In-Memory Database (medium 6.7) - [CVE-2026-60405](https://insights.sbomify.com/CVE-2026-60405/): Information disclosure in TimesTen In-Memory Database (low 3.8) - [CVE-2026-60404](https://insights.sbomify.com/CVE-2026-60404/): Denial of service in TimesTen In-Memory Database (medium 6.5) - [CVE-2026-60403](https://insights.sbomify.com/CVE-2026-60403/): Denial of service in TimesTen In-Memory Database (medium 6.5) - [CVE-2026-60402](https://insights.sbomify.com/CVE-2026-60402/): Missing authorization in TimesTen In-Memory Database (critical 9.9) - [CVE-2026-60401](https://insights.sbomify.com/CVE-2026-60401/): Missing authorization in TimesTen In-Memory Database (medium 6.5) - [CVE-2026-60400](https://insights.sbomify.com/CVE-2026-60400/): Missing authorization in Oracle GoldenGate (high 8.8) - [CVE-2026-6040](https://insights.sbomify.com/CVE-2026-6040/): Heap use-after-free in ODF number-format blank-width parsing (medium 5.4) - [CVE-2026-60399](https://insights.sbomify.com/CVE-2026-60399/): Denial of service in Oracle GoldenGate (medium 6.5) - [CVE-2026-60398](https://insights.sbomify.com/CVE-2026-60398/): Missing authorization in Oracle GoldenGate (high 8.8) - [CVE-2026-60397](https://insights.sbomify.com/CVE-2026-60397/): Denial of service in Oracle GoldenGate (medium 4.3) - [CVE-2026-60396](https://insights.sbomify.com/CVE-2026-60396/): Missing authorization in Oracle GoldenGate (high 7.2) - [CVE-2026-60395](https://insights.sbomify.com/CVE-2026-60395/): Information disclosure in Oracle GoldenGate (medium 4.3) - [CVE-2026-60394](https://insights.sbomify.com/CVE-2026-60394/): Information disclosure in Oracle GoldenGate (medium 5.3) - [CVE-2026-60393](https://insights.sbomify.com/CVE-2026-60393/): Information disclosure in Oracle Hyperion Infrastructure Technology (high 7.5) - [CVE-2026-60392](https://insights.sbomify.com/CVE-2026-60392/): Deserialization in Oracle Outside In Technology (high 7.8) - [CVE-2026-60391](https://insights.sbomify.com/CVE-2026-60391/): Missing authorization in Oracle Hyperion Financial Reporting (high 7.5) - [CVE-2026-6039](https://insights.sbomify.com/CVE-2026-6039/): Heap buffer overflow in DXF polyline import (medium 5.4) - [CVE-2026-60389](https://insights.sbomify.com/CVE-2026-60389/): Missing authorization in Service Delivery Platform (critical 10.0) - [CVE-2026-60388](https://insights.sbomify.com/CVE-2026-60388/): Missing authorization in Service Delivery Platform (critical 9.8) - [CVE-2026-60387](https://insights.sbomify.com/CVE-2026-60387/): Auth bypass in Service Delivery Platform (critical 9.8) - [CVE-2026-60386](https://insights.sbomify.com/CVE-2026-60386/): Missing authorization in Service Delivery Platform (critical 9.8) - [CVE-2026-60385](https://insights.sbomify.com/CVE-2026-60385/): Auth bypass in Service Delivery Platform (critical 9.8) - [CVE-2026-60384](https://insights.sbomify.com/CVE-2026-60384/): Missing authorization in Service Delivery Platform (critical 9.8) - [CVE-2026-60383](https://insights.sbomify.com/CVE-2026-60383/): Missing authorization in Service Delivery Platform (high 8.4) - [CVE-2026-60382](https://insights.sbomify.com/CVE-2026-60382/): Denial of service in Service Delivery Platform (high 7.5) - [CVE-2026-60381](https://insights.sbomify.com/CVE-2026-60381/): Missing authorization in Service Delivery Platform (critical 9.9) - [CVE-2026-60380](https://insights.sbomify.com/CVE-2026-60380/): Auth bypass in Service Delivery Platform (critical 9.8) - [CVE-2026-6038](https://insights.sbomify.com/CVE-2026-6038/): code-projects Vehicle Showroom Management System RegisterCustomerFunction.php sql injection (medium 6.9) - [CVE-2026-60379](https://insights.sbomify.com/CVE-2026-60379/): Missing authorization in Service Delivery Platform (critical 10.0) - [CVE-2026-60378](https://insights.sbomify.com/CVE-2026-60378/): Auth bypass in Service Delivery Platform (critical 9.8) - [CVE-2026-60377](https://insights.sbomify.com/CVE-2026-60377/): Missing authorization in Service Delivery Platform (critical 9.9) - [CVE-2026-60376](https://insights.sbomify.com/CVE-2026-60376/): Missing authorization in Service Delivery Platform (critical 9.8) - [CVE-2026-60375](https://insights.sbomify.com/CVE-2026-60375/): Missing authorization in Service Delivery Platform (critical 9.8) - [CVE-2026-60374](https://insights.sbomify.com/CVE-2026-60374/): Auth bypass in Service Delivery Platform (critical 9.8) - [CVE-2026-60373](https://insights.sbomify.com/CVE-2026-60373/): Deserialization in Oracle Platform Security for Java (high 8.8) - [CVE-2026-60372](https://insights.sbomify.com/CVE-2026-60372/): Deserialization in Oracle Platform Security for Java (critical 9.8) - [CVE-2026-60371](https://insights.sbomify.com/CVE-2026-60371/): Privilege escalation in Oracle Platform Security for Java (high 8.0) - [CVE-2026-60370](https://insights.sbomify.com/CVE-2026-60370/): Other in Oracle Platform Security for Java (high 7.5) - [CVE-2026-6037](https://insights.sbomify.com/CVE-2026-6037/): code-projects Vehicle Showroom Management System AddVehicleFunction.php sql injection (medium 6.9) - [CVE-2026-60369](https://insights.sbomify.com/CVE-2026-60369/): Deserialization in Oracle Platform Security for Java (critical 9.9) - [CVE-2026-60368](https://insights.sbomify.com/CVE-2026-60368/): Other in Oracle Platform Security for Java (high 8.8) - [CVE-2026-60367](https://insights.sbomify.com/CVE-2026-60367/): Auth bypass in Oracle Platform Security for Java (critical 9.8) - [CVE-2026-60366](https://insights.sbomify.com/CVE-2026-60366/): Deserialization in Oracle Platform Security for Java (critical 10.0) - [CVE-2026-60365](https://insights.sbomify.com/CVE-2026-60365/): Missing authorization in Oracle HTTP Server (critical 10.0) - [CVE-2026-60364](https://insights.sbomify.com/CVE-2026-60364/): Missing authorization in Oracle HTTP Server (critical 9.8) - [CVE-2026-60363](https://insights.sbomify.com/CVE-2026-60363/): Missing authorization in Oracle HTTP Server (critical 9.8) - [CVE-2026-60362](https://insights.sbomify.com/CVE-2026-60362/): Auth bypass in Oracle Unified Directory (critical 9.8) - [CVE-2026-60361](https://insights.sbomify.com/CVE-2026-60361/): Missing authorization in Oracle Unified Directory (critical 9.9) - [CVE-2026-60360](https://insights.sbomify.com/CVE-2026-60360/): Auth bypass in Oracle Unified Directory (critical 10.0) - [CVE-2026-6036](https://insights.sbomify.com/CVE-2026-6036/): code-projects Vehicle Showroom Management System VehicleDetailsFunction.php sql injection (medium 6.9) - [CVE-2026-60359](https://insights.sbomify.com/CVE-2026-60359/): Missing authorization in Oracle Unified Directory (high 8.6) - [CVE-2026-60358](https://insights.sbomify.com/CVE-2026-60358/): Missing authorization in Oracle Access Manager (critical 10.0) - [CVE-2026-60357](https://insights.sbomify.com/CVE-2026-60357/): Auth bypass in Siebel CRM Integration (low 3.7) - [CVE-2026-60356](https://insights.sbomify.com/CVE-2026-60356/): Auth bypass in Oracle Access Manager (high 8.6) - [CVE-2026-60355](https://insights.sbomify.com/CVE-2026-60355/): Auth bypass in Oracle Access Manager (critical 9.8) - [CVE-2026-60354](https://insights.sbomify.com/CVE-2026-60354/): Information disclosure in Oracle JDeveloper (low 3.7) - [CVE-2026-60353](https://insights.sbomify.com/CVE-2026-60353/): Missing authorization in Oracle JDeveloper (low 3.1) - [CVE-2026-60352](https://insights.sbomify.com/CVE-2026-60352/): Information disclosure in Oracle JDeveloper (low 3.7) - [CVE-2026-60351](https://insights.sbomify.com/CVE-2026-60351/): Missing authorization in Oracle JDeveloper (medium 4.8) - [CVE-2026-60350](https://insights.sbomify.com/CVE-2026-60350/): Information disclosure in Oracle JDeveloper (medium 6.5) - [CVE-2026-6035](https://insights.sbomify.com/CVE-2026-6035/): code-projects Vehicle Showroom Management System ServiceAndSalesReport.php cross site scripting (medium 5.3) - [CVE-2026-60349](https://insights.sbomify.com/CVE-2026-60349/): Information disclosure in Oracle JDeveloper (medium 5.9) - [CVE-2026-60348](https://insights.sbomify.com/CVE-2026-60348/): Missing authorization in Oracle JDeveloper (medium 5.9) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/505/