# Vulnerabilities published in 2026


- [CVE-2026-60255](https://insights.sbomify.com/CVE-2026-60255/): Missing authorization in Oracle Coherence (high 8.2)
- [CVE-2026-60254](https://insights.sbomify.com/CVE-2026-60254/): Auth bypass in Oracle Coherence (critical 9.8)
- [CVE-2026-60253](https://insights.sbomify.com/CVE-2026-60253/): Missing authorization in Oracle Coherence (critical 9.8)
- [CVE-2026-60252](https://insights.sbomify.com/CVE-2026-60252/): Denial of service in Oracle Coherence (high 7.5)
- [CVE-2026-60251](https://insights.sbomify.com/CVE-2026-60251/): Auth bypass in Oracle Coherence (critical 9.8)
- [CVE-2026-60250](https://insights.sbomify.com/CVE-2026-60250/): Auth bypass in Oracle Coherence (critical 9.8)
- [CVE-2026-6025](https://insights.sbomify.com/CVE-2026-6025/): Totolink A7100RU CGI cstecgi.cgi setSyslogCfg os command injection (critical 9.3)
- [CVE-2026-60249](https://insights.sbomify.com/CVE-2026-60249/): Missing authorization in Oracle Coherence (critical 9.0)
- [CVE-2026-60248](https://insights.sbomify.com/CVE-2026-60248/): Privilege escalation in Oracle Coherence (critical 9.3)
- [CVE-2026-60247](https://insights.sbomify.com/CVE-2026-60247/): Missing authorization in Oracle Coherence (critical 9.8)
- [CVE-2026-60246](https://insights.sbomify.com/CVE-2026-60246/): Auth bypass in Oracle Coherence (critical 9.8)
- [CVE-2026-60245](https://insights.sbomify.com/CVE-2026-60245/): Missing authorization in Oracle Coherence (high 7.2)
- [CVE-2026-60244](https://insights.sbomify.com/CVE-2026-60244/): Missing authorization in Oracle Coherence (critical 9.8)
- [CVE-2026-60243](https://insights.sbomify.com/CVE-2026-60243/): Denial of service in Oracle Coherence (medium 6.5)
- [CVE-2026-60242](https://insights.sbomify.com/CVE-2026-60242/): Missing authorization in Oracle Coherence (critical 9.8)
- [CVE-2026-60241](https://insights.sbomify.com/CVE-2026-60241/): Missing authorization in Oracle Coherence (critical 9.8)
- [CVE-2026-60240](https://insights.sbomify.com/CVE-2026-60240/): Auth bypass in Oracle Coherence (critical 9.8)
- [CVE-2026-6024](https://insights.sbomify.com/CVE-2026-6024/): Tenda i6 HTTP R7WebsSecurityHandlerfunction path traversal (medium 6.9)
- [CVE-2026-60239](https://insights.sbomify.com/CVE-2026-60239/): Missing authorization in Oracle Coherence (critical 9.6)
- [CVE-2026-60238](https://insights.sbomify.com/CVE-2026-60238/): Missing authorization in Oracle Coherence (medium 5.4)
- [CVE-2026-60237](https://insights.sbomify.com/CVE-2026-60237/): Information disclosure in Oracle Coherence (medium 5.3)
- [CVE-2026-60236](https://insights.sbomify.com/CVE-2026-60236/): Missing authorization in Oracle Coherence (critical 9.8)
- [CVE-2026-60235](https://insights.sbomify.com/CVE-2026-60235/): Missing authorization in Oracle Coherence (high 8.6)
- [CVE-2026-60234](https://insights.sbomify.com/CVE-2026-60234/): Missing authorization in Oracle Coherence (critical 9.8)
- [CVE-2026-60233](https://insights.sbomify.com/CVE-2026-60233/): Denial of service in Oracle Coherence (medium 4.3)
- [CVE-2026-60232](https://insights.sbomify.com/CVE-2026-60232/): Missing authorization in Oracle Coherence (critical 9.8)
- [CVE-2026-60231](https://insights.sbomify.com/CVE-2026-60231/): Missing authorization in Oracle Coherence (medium 5.4)
- [CVE-2026-60230](https://insights.sbomify.com/CVE-2026-60230/): Auth bypass in Oracle Coherence (critical 9.8)
- [CVE-2026-6023](https://insights.sbomify.com/CVE-2026-6023/): Deserialization of Untrusted Data Vulnerability in Telerik UI for ASP.NET AJAX (high 8.1)
- [CVE-2026-60229](https://insights.sbomify.com/CVE-2026-60229/): Auth bypass in Oracle Coherence (critical 9.8)
- [CVE-2026-60228](https://insights.sbomify.com/CVE-2026-60228/): Auth bypass in Oracle Coherence (critical 9.8)
- [CVE-2026-60227](https://insights.sbomify.com/CVE-2026-60227/): Missing authorization in Oracle Coherence (critical 9.8)
- [CVE-2026-60226](https://insights.sbomify.com/CVE-2026-60226/): Missing authorization in Oracle Coherence (critical 9.8)
- [CVE-2026-60225](https://insights.sbomify.com/CVE-2026-60225/): Missing authorization in Oracle Coherence (critical 9.8)
- [CVE-2026-60224](https://insights.sbomify.com/CVE-2026-60224/): Missing authorization in Oracle Coherence (critical 9.8)
- [CVE-2026-60223](https://insights.sbomify.com/CVE-2026-60223/): Denial of service in Oracle Coherence (high 7.5)
- [CVE-2026-60222](https://insights.sbomify.com/CVE-2026-60222/): Missing authorization in Oracle Coherence (high 8.1)
- [CVE-2026-60221](https://insights.sbomify.com/CVE-2026-60221/): Missing authorization in Oracle Coherence (critical 9.8)
- [CVE-2026-60220](https://insights.sbomify.com/CVE-2026-60220/): Missing authorization in Oracle Coherence (critical 9.3)
- [CVE-2026-6022](https://insights.sbomify.com/CVE-2026-6022/): Uncontrolled Resource Consumption Vulnerability in Telerik UI for ASP.NET AJAX (high 7.5)
- [CVE-2026-60219](https://insights.sbomify.com/CVE-2026-60219/): Auth bypass in Oracle Coherence (critical 9.8)
- [CVE-2026-60218](https://insights.sbomify.com/CVE-2026-60218/): Missing authorization in Oracle Coherence (high 8.8)
- [CVE-2026-60217](https://insights.sbomify.com/CVE-2026-60217/): Auth bypass in Oracle Coherence (critical 10.0)
- [CVE-2026-60216](https://insights.sbomify.com/CVE-2026-60216/): Auth bypass in Oracle Coherence (critical 9.8)
- [CVE-2026-60215](https://insights.sbomify.com/CVE-2026-60215/): Auth bypass in Oracle Coherence (critical 9.8)
- [CVE-2026-60214](https://insights.sbomify.com/CVE-2026-60214/): Missing authorization in Oracle Coherence (high 8.7)
- [CVE-2026-60213](https://insights.sbomify.com/CVE-2026-60213/): Denial of service in Oracle Coherence (medium 6.5)
- [CVE-2026-60212](https://insights.sbomify.com/CVE-2026-60212/): Auth bypass in Oracle Coherence (critical 9.8)
- [CVE-2026-60211](https://insights.sbomify.com/CVE-2026-60211/): Missing authorization in Oracle Coherence (high 8.8)
- [CVE-2026-60210](https://insights.sbomify.com/CVE-2026-60210/): Auth bypass in Oracle Coherence (critical 9.8)
- [CVE-2026-60209](https://insights.sbomify.com/CVE-2026-60209/): Auth bypass in Oracle Coherence (critical 9.8)
- [CVE-2026-60208](https://insights.sbomify.com/CVE-2026-60208/): Denial of service in Oracle WebLogic Server (critical 9.1)
- [CVE-2026-60207](https://insights.sbomify.com/CVE-2026-60207/): Auth bypass in Oracle WebLogic Server (high 8.8)
- [CVE-2026-60206](https://insights.sbomify.com/CVE-2026-60206/): Auth bypass in Oracle WebLogic Server (critical 9.9)
- [CVE-2026-60205](https://insights.sbomify.com/CVE-2026-60205/): Auth bypass in Oracle WebLogic Server (critical 9.8)
- [CVE-2026-60204](https://insights.sbomify.com/CVE-2026-60204/): Auth bypass in Oracle WebLogic Server (critical 9.8)
- [CVE-2026-60203](https://insights.sbomify.com/CVE-2026-60203/): Auth bypass in Oracle WebLogic Server (high 8.8)
- [CVE-2026-60202](https://insights.sbomify.com/CVE-2026-60202/): Auth bypass in Oracle WebLogic Server (critical 9.8)
- [CVE-2026-60201](https://insights.sbomify.com/CVE-2026-60201/): Auth bypass in Oracle WebLogic Server (high 8.1)
- [CVE-2026-60200](https://insights.sbomify.com/CVE-2026-60200/): Auth bypass in Oracle WebLogic Server (critical 9.8)
- [CVE-2026-6020](https://insights.sbomify.com/CVE-2026-6020/): ShopLentor <= 3.3.7 - Authenticated (Administrator+) Arbitrary Function Execution via 'callback' Parameter via REST API (high 7.2)
- [CVE-2026-60199](https://insights.sbomify.com/CVE-2026-60199/): Auth bypass in Oracle WebLogic Server (critical 9.8)
- [CVE-2026-60198](https://insights.sbomify.com/CVE-2026-60198/): Auth bypass in Oracle WebLogic Server (critical 9.8)
- [CVE-2026-60197](https://insights.sbomify.com/CVE-2026-60197/): Auth bypass in Oracle Coherence (critical 9.8)
- [CVE-2026-60196](https://insights.sbomify.com/CVE-2026-60196/): Missing authorization in Oracle WebLogic Server (high 8.4)
- [CVE-2026-60195](https://insights.sbomify.com/CVE-2026-60195/): Denial of service in MySQL Cluster (medium 4.9)
- [CVE-2026-60194](https://insights.sbomify.com/CVE-2026-60194/): Denial of service in MySQL Cluster (medium 4.9)
- [CVE-2026-60193](https://insights.sbomify.com/CVE-2026-60193/): Other in MySQL Connectors (high 8.5)
- [CVE-2026-60192](https://insights.sbomify.com/CVE-2026-60192/): Other in MySQL Connectors (high 8.1)
- [CVE-2026-60191](https://insights.sbomify.com/CVE-2026-60191/): Denial of service in MySQL Cluster (medium 4.1)
- [CVE-2026-60190](https://insights.sbomify.com/CVE-2026-60190/): Denial of service in MySQL Cluster (low 2.2)
- [CVE-2026-6019](https://insights.sbomify.com/CVE-2026-6019/): BaseCookie.js_output() does not neutralize embedded characters (low 2.1)
- [CVE-2026-60189](https://insights.sbomify.com/CVE-2026-60189/): Denial of service in MySQL Cluster (medium 4.4)
- [CVE-2026-60188](https://insights.sbomify.com/CVE-2026-60188/): Denial of service in MySQL Cluster (medium 4.4)
- [CVE-2026-60187](https://insights.sbomify.com/CVE-2026-60187/): Denial of service in MySQL Cluster (medium 4.4)
- [CVE-2026-60186](https://insights.sbomify.com/CVE-2026-60186/): Denial of service in MySQL Cluster (medium 4.4)
- [CVE-2026-60185](https://insights.sbomify.com/CVE-2026-60185/): Denial of service in MySQL Cluster (medium 4.4)
- [CVE-2026-60184](https://insights.sbomify.com/CVE-2026-60184/): Denial of service in MySQL Cluster (medium 4.4)
- [CVE-2026-60183](https://insights.sbomify.com/CVE-2026-60183/): Privilege escalation in MySQL Cluster (medium 6.4)
- [CVE-2026-60182](https://insights.sbomify.com/CVE-2026-60182/): Denial of service in MySQL Cluster (medium 4.4)
- [CVE-2026-60181](https://insights.sbomify.com/CVE-2026-60181/): Missing authorization in MySQL Cluster (medium 6.7)
- [CVE-2026-60180](https://insights.sbomify.com/CVE-2026-60180/): Denial of service in MySQL Connectors (high 7.5)
- [CVE-2026-60179](https://insights.sbomify.com/CVE-2026-60179/): Other in MySQL Connectors (high 7.4)
- [CVE-2026-60178](https://insights.sbomify.com/CVE-2026-60178/): Other in MySQL Cluster (medium 6.6)
- [CVE-2026-60177](https://insights.sbomify.com/CVE-2026-60177/): Denial of service in MySQL Cluster (medium 4.4)
- [CVE-2026-60176](https://insights.sbomify.com/CVE-2026-60176/): Information disclosure in Oracle Payments (high 7.1)
- [CVE-2026-60175](https://insights.sbomify.com/CVE-2026-60175/): Privilege escalation in Oracle Database Server (high 8.8)
- [CVE-2026-60174](https://insights.sbomify.com/CVE-2026-60174/): Denial of service in MySQL Cluster (medium 6.5)
- [CVE-2026-60173](https://insights.sbomify.com/CVE-2026-60173/): Missing authorization in Oracle BI Publisher (critical 9.8)
- [CVE-2026-60172](https://insights.sbomify.com/CVE-2026-60172/): Other in Oracle Autonomous Health Framework (medium 6.3)
- [CVE-2026-60171](https://insights.sbomify.com/CVE-2026-60171/): Denial of service in MySQL Cluster (medium 4.9)
- [CVE-2026-60170](https://insights.sbomify.com/CVE-2026-60170/): Missing authorization in Oracle Hospitality Simphony (high 7.5)
- [CVE-2026-6017](https://insights.sbomify.com/CVE-2026-6017/): Missing Authentication for Critical Function in KAON PG5298 (high 7.1)
- [CVE-2026-60169](https://insights.sbomify.com/CVE-2026-60169/): Missing authorization in Oracle Hospitality Simphony (high 8.1)
- [CVE-2026-60168](https://insights.sbomify.com/CVE-2026-60168/): Missing authorization in Oracle Hospitality Simphony (critical 9.1)
- [CVE-2026-60167](https://insights.sbomify.com/CVE-2026-60167/): Information disclosure in Oracle Hospitality Simphony (high 7.5)
- [CVE-2026-60166](https://insights.sbomify.com/CVE-2026-60166/): Security feature bypass in Oracle Java SE (low 3.1)
- [CVE-2026-60165](https://insights.sbomify.com/CVE-2026-60165/): Missing authorization in Oracle Cost Management (medium 6.5)
- [CVE-2026-60164](https://insights.sbomify.com/CVE-2026-60164/): Security feature bypass in Oracle Java SE (low 3.1)
- [CVE-2026-60163](https://insights.sbomify.com/CVE-2026-60163/): Missing authorization in MySQL Cluster (high 8.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/507/