# Vulnerabilities published in 2026


- [CVE-2026-47074](https://insights.sbomify.com/CVE-2026-47074/): ex_aws_sns SigningCertURL not validated in verify_message/1 (high 8.7)
- [CVE-2026-47073](https://insights.sbomify.com/CVE-2026-47073/): Unbounded memory consumption in WebSocket client in hackney (high 8.7)
- [CVE-2026-47072](https://insights.sbomify.com/CVE-2026-47072/): CRLF injection in WebSocket upgrade request in hackney (medium 6.9)
- [CVE-2026-47071](https://insights.sbomify.com/CVE-2026-47071/): SOCKS5 TLS upgrade ignores caller timeout in hackney (high 8.2)
- [CVE-2026-47070](https://insights.sbomify.com/CVE-2026-47070/): HTTP/3 redirect handler leaks Authorization and Cookie headers to cross-origin redirect target in hackney (medium 6.0)
- [CVE-2026-4707](https://insights.sbomify.com/CVE-2026-4707/): Incorrect boundary conditions in the Graphics: Canvas2D component (high 7.5)
- [CVE-2026-47069](https://insights.sbomify.com/CVE-2026-47069/): CRLF injection in cookie domain/path options in hackney (low 2.1)
- [CVE-2026-47068](https://insights.sbomify.com/CVE-2026-47068/): Cross-session PubSub topic injection via URL parameter in phoenix_storybook (low 2.3)
- [CVE-2026-47067](https://insights.sbomify.com/CVE-2026-47067/): Atom table exhaustion via unrecognized URL schemes in hackney (high 8.7)
- [CVE-2026-47066](https://insights.sbomify.com/CVE-2026-47066/): Infinite loop in Alt-Svc header parser in hackney (high 8.7)
- [CVE-2026-47065](https://insights.sbomify.com/CVE-2026-47065/): Apache MINA: Critical Deserialization Allow-list Bypass via resolveProxyClass - ZDRES-232 (critical 9.8)
- [CVE-2026-47064](https://insights.sbomify.com/CVE-2026-47064/): Denial of service in MySQL Cluster (medium 6.5)
- [CVE-2026-47063](https://insights.sbomify.com/CVE-2026-47063/): Other in Oracle GraalVM Enterprise Edition (high 7.5)
- [CVE-2026-47062](https://insights.sbomify.com/CVE-2026-47062/): Denial of service in Oracle VM VirtualBox (medium 5.5)
- [CVE-2026-47061](https://insights.sbomify.com/CVE-2026-47061/): Missing authorization in Oracle Database Server (medium 5.6)
- [CVE-2026-47060](https://insights.sbomify.com/CVE-2026-47060/): Other in Oracle Database Server (medium 6.5)
- [CVE-2026-4706](https://insights.sbomify.com/CVE-2026-4706/): Incorrect boundary conditions in the Graphics: Canvas2D component (high 7.5)
- [CVE-2026-47059](https://insights.sbomify.com/CVE-2026-47059/): Denial of service in Oracle GraalVM Enterprise Edition (low 3.7)
- [CVE-2026-47058](https://insights.sbomify.com/CVE-2026-47058/): Deserialization in Oracle Java SE (high 7.4)
- [CVE-2026-47057](https://insights.sbomify.com/CVE-2026-47057/): Denial of service in Oracle Java SE (high 7.5)
- [CVE-2026-47056](https://insights.sbomify.com/CVE-2026-47056/): Missing authorization in Oracle Data Integrator (critical 10.0)
- [CVE-2026-47055](https://insights.sbomify.com/CVE-2026-47055/): Other in Oracle VM VirtualBox (low 3.2)
- [CVE-2026-47054](https://insights.sbomify.com/CVE-2026-47054/): Privilege escalation in Oracle VM VirtualBox (high 7.8)
- [CVE-2026-47053](https://insights.sbomify.com/CVE-2026-47053/): Missing authorization in Oracle VM VirtualBox (medium 5.6)
- [CVE-2026-47052](https://insights.sbomify.com/CVE-2026-47052/): Denial of service in MySQL Cluster (medium 4.9)
- [CVE-2026-47051](https://insights.sbomify.com/CVE-2026-47051/): Open redirect in PeopleSoft Enterprise PeopleTools (medium 5.4)
- [CVE-2026-47050](https://insights.sbomify.com/CVE-2026-47050/): Other in Oracle VM VirtualBox (high 7.4)
- [CVE-2026-4705](https://insights.sbomify.com/CVE-2026-4705/): Undefined behavior in the WebRTC: Signaling component (critical 9.8)
- [CVE-2026-47049](https://insights.sbomify.com/CVE-2026-47049/): Missing authorization in PeopleSoft Enterprise PeopleTools (medium 4.9)
- [CVE-2026-47048](https://insights.sbomify.com/CVE-2026-47048/): Open redirect in PeopleSoft Enterprise PeopleTools (medium 5.4)
- [CVE-2026-47047](https://insights.sbomify.com/CVE-2026-47047/): Privilege escalation in Oracle VM VirtualBox (high 7.8)
- [CVE-2026-47046](https://insights.sbomify.com/CVE-2026-47046/): Denial of service in Oracle Database Server (high 8.2)
- [CVE-2026-47045](https://insights.sbomify.com/CVE-2026-47045/): Open redirect in Oracle Database Server (medium 6.8)
- [CVE-2026-47044](https://insights.sbomify.com/CVE-2026-47044/): Denial of service in Oracle VM VirtualBox (medium 5.5)
- [CVE-2026-47043](https://insights.sbomify.com/CVE-2026-47043/): Information disclosure in Oracle VM VirtualBox (low 3.2)
- [CVE-2026-47041](https://insights.sbomify.com/CVE-2026-47041/): Denial of service in Oracle VM VirtualBox (medium 6.0)
- [CVE-2026-47040](https://insights.sbomify.com/CVE-2026-47040/): Missing authorization in Oracle Net Services (critical 9.1)
- [CVE-2026-4704](https://insights.sbomify.com/CVE-2026-4704/): Denial-of-service in the WebRTC: Signaling component (high 7.5)
- [CVE-2026-47039](https://insights.sbomify.com/CVE-2026-47039/): Missing authorization in Oracle Database Server (medium 6.5)
- [CVE-2026-47038](https://insights.sbomify.com/CVE-2026-47038/): Missing authorization in Oracle Database Server (low 2.7)
- [CVE-2026-47037](https://insights.sbomify.com/CVE-2026-47037/): Auth bypass in Oracle Access Manager (high 8.8)
- [CVE-2026-47036](https://insights.sbomify.com/CVE-2026-47036/): Missing authorization in Siebel CRM Development (critical 9.8)
- [CVE-2026-47035](https://insights.sbomify.com/CVE-2026-47035/): Security feature bypass in Oracle Java SE (low 3.1)
- [CVE-2026-47034](https://insights.sbomify.com/CVE-2026-47034/): Security feature bypass in Oracle Java SE (low 3.1)
- [CVE-2026-47033](https://insights.sbomify.com/CVE-2026-47033/): Missing authorization in Oracle Contracts Integration (high 8.5)
- [CVE-2026-47032](https://insights.sbomify.com/CVE-2026-47032/): Other in Siebel CRM End User (low 2.6)
- [CVE-2026-47031](https://insights.sbomify.com/CVE-2026-47031/): Missing authorization in Oracle Bills of Material (high 8.8)
- [CVE-2026-47030](https://insights.sbomify.com/CVE-2026-47030/): Other in Oracle Java SE (low 3.1)
- [CVE-2026-4703](https://insights.sbomify.com/CVE-2026-4703/): WS Form LITE <= 1.10.80 - Unauthenticated PHP Object Injection via Form Submission (critical 9.8)
- [CVE-2026-47028](https://insights.sbomify.com/CVE-2026-47028/): Missing authorization in Oracle Document Management and Collaboration (high 8.1)
- [CVE-2026-47027](https://insights.sbomify.com/CVE-2026-47027/): Denial of service in Oracle Java SE (medium 5.3)
- [CVE-2026-47026](https://insights.sbomify.com/CVE-2026-47026/): Open redirect in PeopleSoft Enterprise PeopleTools (high 7.4)
- [CVE-2026-47025](https://insights.sbomify.com/CVE-2026-47025/): Information disclosure in Oracle Solaris (high 8.8)
- [CVE-2026-47024](https://insights.sbomify.com/CVE-2026-47024/): Missing authorization in PeopleSoft Enterprise PeopleTools (medium 5.4)
- [CVE-2026-47023](https://insights.sbomify.com/CVE-2026-47023/): Denial of service in MySQL Cluster (medium 4.9)
- [CVE-2026-47022](https://insights.sbomify.com/CVE-2026-47022/): Denial of service in GoldenGate Stream Analytics (low 3.3)
- [CVE-2026-47021](https://insights.sbomify.com/CVE-2026-47021/): Denial of service in Oracle GraalVM Enterprise Edition (medium 5.3)
- [CVE-2026-4702](https://insights.sbomify.com/CVE-2026-4702/): JIT miscompilation in the JavaScript Engine component (critical 9.8)
- [CVE-2026-47019](https://insights.sbomify.com/CVE-2026-47019/): Missing authorization in Oracle Product Hub (high 8.1)
- [CVE-2026-47018](https://insights.sbomify.com/CVE-2026-47018/): Denial of service in Siebel CRM Cloud Applications (high 7.5)
- [CVE-2026-47017](https://insights.sbomify.com/CVE-2026-47017/): Missing authorization in PeopleSoft Enterprise PeopleTools (high 8.7)
- [CVE-2026-47016](https://insights.sbomify.com/CVE-2026-47016/): Information disclosure in Siebel CRM Integration (low 1.9)
- [CVE-2026-47015](https://insights.sbomify.com/CVE-2026-47015/): Open redirect in PeopleSoft Enterprise PeopleTools (high 7.1)
- [CVE-2026-47014](https://insights.sbomify.com/CVE-2026-47014/): Missing authorization in Oracle Product Workbench (high 8.1)
- [CVE-2026-47013](https://insights.sbomify.com/CVE-2026-47013/): Denial of service in Oracle Java SE (medium 5.3)
- [CVE-2026-47012](https://insights.sbomify.com/CVE-2026-47012/): Denial of service in MySQL Cluster (medium 4.4)
- [CVE-2026-47011](https://insights.sbomify.com/CVE-2026-47011/): Information disclosure in Siebel CRM Deployment (low 2.6)
- [CVE-2026-47010](https://insights.sbomify.com/CVE-2026-47010/): Other in Oracle GraalVM Enterprise Edition (low 3.7)
- [CVE-2026-4701](https://insights.sbomify.com/CVE-2026-4701/): Use-after-free in the JavaScript Engine component (critical 9.8)
- [CVE-2026-47009](https://insights.sbomify.com/CVE-2026-47009/): Information disclosure in Oracle Agile PLM (medium 6.5)
- [CVE-2026-47008](https://insights.sbomify.com/CVE-2026-47008/): Denial of service in MySQL Cluster (medium 4.9)
- [CVE-2026-47007](https://insights.sbomify.com/CVE-2026-47007/): Missing authorization in Oracle Communications Pricing Design Center (high 7.3)
- [CVE-2026-47006](https://insights.sbomify.com/CVE-2026-47006/): Missing authorization in Oracle Enterprise Manager Base Platform (high 7.2)
- [CVE-2026-47005](https://insights.sbomify.com/CVE-2026-47005/): Missing authorization in Oracle Enterprise Manager Base Platform (high 7.2)
- [CVE-2026-47004](https://insights.sbomify.com/CVE-2026-47004/): Missing authorization in Oracle Enterprise Manager Base Platform (high 8.8)
- [CVE-2026-47003](https://insights.sbomify.com/CVE-2026-47003/): Missing authorization in Oracle Enterprise Manager Base Platform (medium 5.9)
- [CVE-2026-47002](https://insights.sbomify.com/CVE-2026-47002/): Open redirect in Oracle Enterprise Manager Base Platform (medium 6.1)
- [CVE-2026-47001](https://insights.sbomify.com/CVE-2026-47001/): Missing authorization in Oracle Enterprise Manager Base Platform (medium 5.4)
- [CVE-2026-47000](https://insights.sbomify.com/CVE-2026-47000/): Cross-site request forgery in Oracle Enterprise Manager Base Platform (low 3.5)
- [CVE-2026-4700](https://insights.sbomify.com/CVE-2026-4700/): Mitigation bypass in the Networking: HTTP component (critical 9.8)
- [CVE-2026-46999](https://insights.sbomify.com/CVE-2026-46999/): Missing authorization in Oracle Enterprise Manager Base Platform (high 7.0)
- [CVE-2026-46998](https://insights.sbomify.com/CVE-2026-46998/): Open redirect in Oracle Enterprise Manager Base Platform (high 8.8)
- [CVE-2026-46997](https://insights.sbomify.com/CVE-2026-46997/): Missing authorization in Oracle Enterprise Manager Base Platform (medium 6.5)
- [CVE-2026-46996](https://insights.sbomify.com/CVE-2026-46996/): Missing authorization in Oracle Enterprise Manager Base Platform (high 7.1)
- [CVE-2026-46995](https://insights.sbomify.com/CVE-2026-46995/): Privilege escalation in Oracle Enterprise Manager Base Platform (high 8.8)
- [CVE-2026-46994](https://insights.sbomify.com/CVE-2026-46994/): Missing authorization in Oracle Enterprise Manager Base Platform (critical 9.8)
- [CVE-2026-46993](https://insights.sbomify.com/CVE-2026-46993/): Missing authorization in Oracle Enterprise Manager Base Platform (high 8.2)
- [CVE-2026-46992](https://insights.sbomify.com/CVE-2026-46992/): Missing authorization in Oracle Enterprise Manager Base Platform (high 8.8)
- [CVE-2026-46991](https://insights.sbomify.com/CVE-2026-46991/): Missing authorization in Oracle Enterprise Manager Base Platform (medium 4.4)
- [CVE-2026-46990](https://insights.sbomify.com/CVE-2026-46990/): Missing authorization in Oracle Enterprise Manager Base Platform (high 7.3)
- [CVE-2026-4699](https://insights.sbomify.com/CVE-2026-4699/): Incorrect boundary conditions in the Layout: Text and Fonts component (high 7.5)
- [CVE-2026-46989](https://insights.sbomify.com/CVE-2026-46989/): Missing authorization in Oracle Enterprise Manager Base Platform (critical 9.1)
- [CVE-2026-46988](https://insights.sbomify.com/CVE-2026-46988/): Missing authorization in Oracle Enterprise Manager Base Platform (high 7.2)
- [CVE-2026-46987](https://insights.sbomify.com/CVE-2026-46987/): Missing authorization in Oracle Enterprise Manager Base Platform (high 7.7)
- [CVE-2026-46986](https://insights.sbomify.com/CVE-2026-46986/): Missing authorization in Oracle Enterprise Manager Base Platform (medium 5.3)
- [CVE-2026-46985](https://insights.sbomify.com/CVE-2026-46985/): Missing authorization in Oracle Enterprise Manager Base Platform (medium 5.3)
- [CVE-2026-46984](https://insights.sbomify.com/CVE-2026-46984/): Missing authorization in Oracle Enterprise Manager Base Platform (medium 5.3)
- [CVE-2026-46983](https://insights.sbomify.com/CVE-2026-46983/): Missing authorization in Oracle Retail Integration Bus (critical 9.8)
- [CVE-2026-46982](https://insights.sbomify.com/CVE-2026-46982/): Missing authorization in Oracle Retail Integration Bus (critical 9.8)
- [CVE-2026-46981](https://insights.sbomify.com/CVE-2026-46981/): Missing authorization in Oracle Utilities Network Management System (high 7.2)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/606/