# Vulnerabilities published in 2026


- [CVE-2026-4689](https://insights.sbomify.com/CVE-2026-4689/): Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component (critical 10.0)
- [CVE-2026-46889](https://insights.sbomify.com/CVE-2026-46889/): Missing authorization in Siebel Apps - Marketing (critical 9.8)
- [CVE-2026-46888](https://insights.sbomify.com/CVE-2026-46888/): Missing authorization in Siebel CRM Deployment (high 7.8)
- [CVE-2026-46887](https://insights.sbomify.com/CVE-2026-46887/): Missing authorization in Siebel Apps - Marketing (critical 9.8)
- [CVE-2026-46886](https://insights.sbomify.com/CVE-2026-46886/): Missing authorization in Siebel Apps - Marketing (high 8.8)
- [CVE-2026-46885](https://insights.sbomify.com/CVE-2026-46885/): Privilege escalation in Siebel CRM Integration (high 8.8)
- [CVE-2026-46884](https://insights.sbomify.com/CVE-2026-46884/): Missing authorization in Siebel Apps - Marketing (critical 9.8)
- [CVE-2026-46883](https://insights.sbomify.com/CVE-2026-46883/): Missing authorization in JD Edwards EnterpriseOne Tools (critical 9.8)
- [CVE-2026-46882](https://insights.sbomify.com/CVE-2026-46882/): Missing authorization in JD Edwards EnterpriseOne Tools (critical 9.8)
- [CVE-2026-46881](https://insights.sbomify.com/CVE-2026-46881/): Missing authorization in JD Edwards EnterpriseOne Tools (critical 9.8)
- [CVE-2026-46880](https://insights.sbomify.com/CVE-2026-46880/): Missing authorization in JD Edwards EnterpriseOne Tools (critical 9.8)
- [CVE-2026-4688](https://insights.sbomify.com/CVE-2026-4688/): Sandbox escape due to use-after-free in the Disability Access APIs component (critical 9.6)
- [CVE-2026-46879](https://insights.sbomify.com/CVE-2026-46879/): Auth bypass in JD Edwards EnterpriseOne Tools (critical 9.8)
- [CVE-2026-46878](https://insights.sbomify.com/CVE-2026-46878/): Missing authorization in JD Edwards EnterpriseOne Tools (critical 9.8)
- [CVE-2026-46877](https://insights.sbomify.com/CVE-2026-46877/): Privilege escalation in Oracle VM VirtualBox (medium 6.0)
- [CVE-2026-46876](https://insights.sbomify.com/CVE-2026-46876/): Missing authorization in Oracle Application Testing Suite (critical 9.8)
- [CVE-2026-46875](https://insights.sbomify.com/CVE-2026-46875/): Missing authorization in Oracle Enterprise Manager Base Platform (critical 9.1)
- [CVE-2026-46874](https://insights.sbomify.com/CVE-2026-46874/): Information disclosure in Oracle VM VirtualBox (low 3.2)
- [CVE-2026-46873](https://insights.sbomify.com/CVE-2026-46873/): Privilege escalation in Oracle VM VirtualBox (high 7.5)
- [CVE-2026-46872](https://insights.sbomify.com/CVE-2026-46872/): Missing authorization in Oracle Enterprise Manager Base Platform (critical 9.0)
- [CVE-2026-46871](https://insights.sbomify.com/CVE-2026-46871/): Missing authorization in MySQL Shell (medium 6.5)
- [CVE-2026-46870](https://insights.sbomify.com/CVE-2026-46870/): Other in MySQL Shell (high 8.5)
- [CVE-2026-4687](https://insights.sbomify.com/CVE-2026-4687/): Sandbox escape due to incorrect boundary conditions in the Telemetry component (critical 9.6)
- [CVE-2026-46869](https://insights.sbomify.com/CVE-2026-46869/): Cross-site request forgery in MySQL Shell (medium 6.5)
- [CVE-2026-46868](https://insights.sbomify.com/CVE-2026-46868/): Missing authorization in Oracle Enterprise Manager Base Platform (high 7.2)
- [CVE-2026-46867](https://insights.sbomify.com/CVE-2026-46867/): Privilege escalation in Oracle Enterprise Manager Base Platform (high 7.2)
- [CVE-2026-46866](https://insights.sbomify.com/CVE-2026-46866/): Denial of service in Oracle Enterprise Manager Base Platform (high 8.2)
- [CVE-2026-46865](https://insights.sbomify.com/CVE-2026-46865/): Other in Oracle Enterprise Manager Base Platform (high 8.2)
- [CVE-2026-46864](https://insights.sbomify.com/CVE-2026-46864/): Missing authorization in Oracle Enterprise Manager Base Platform (high 8.8)
- [CVE-2026-46863](https://insights.sbomify.com/CVE-2026-46863/): Denial of service in MySQL Cluster (high 7.5)
- [CVE-2026-46862](https://insights.sbomify.com/CVE-2026-46862/): Denial of service in MySQL Router (high 7.5)
- [CVE-2026-46861](https://insights.sbomify.com/CVE-2026-46861/): Missing authorization in MySQL NDB Cluster (critical 9.6)
- [CVE-2026-46860](https://insights.sbomify.com/CVE-2026-46860/): Missing authorization in MySQL Router (critical 9.8)
- [CVE-2026-4686](https://insights.sbomify.com/CVE-2026-4686/): Incorrect boundary conditions in the Graphics: Canvas2D component (high 7.5)
- [CVE-2026-46859](https://insights.sbomify.com/CVE-2026-46859/): Auth bypass in Oracle Agile PLM (critical 9.8)
- [CVE-2026-46858](https://insights.sbomify.com/CVE-2026-46858/): Missing authorization in APM - Application Performance Management (critical 9.1)
- [CVE-2026-46857](https://insights.sbomify.com/CVE-2026-46857/): Missing authorization in Oracle Enterprise Manager Base Platform (critical 9.8)
- [CVE-2026-46856](https://insights.sbomify.com/CVE-2026-46856/): Cross-site scripting in Oracle Enterprise Manager Base Platform (critical 9.6)
- [CVE-2026-46855](https://insights.sbomify.com/CVE-2026-46855/): Missing authorization in Oracle Enterprise Manager Base Platform (critical 9.9)
- [CVE-2026-46854](https://insights.sbomify.com/CVE-2026-46854/): Missing authorization in Oracle Enterprise Manager Base Platform (critical 9.9)
- [CVE-2026-46853](https://insights.sbomify.com/CVE-2026-46853/): Cross-site scripting in Oracle Enterprise Manager Base Platform (critical 9.6)
- [CVE-2026-46852](https://insights.sbomify.com/CVE-2026-46852/): Privilege escalation in Oracle Enterprise Manager Base Platform (critical 9.9)
- [CVE-2026-46851](https://insights.sbomify.com/CVE-2026-46851/): Code injection in PeopleSoft Enterprise CS Campus Community (high 8.1)
- [CVE-2026-46850](https://insights.sbomify.com/CVE-2026-46850/): Code injection in MySQL Shell (critical 9.9)
- [CVE-2026-4685](https://insights.sbomify.com/CVE-2026-4685/): Incorrect boundary conditions in the Graphics: Canvas2D component (high 7.5)
- [CVE-2026-46849](https://insights.sbomify.com/CVE-2026-46849/): Missing authorization in PeopleSoft Enterprise CS Student Financials (high 8.1)
- [CVE-2026-46848](https://insights.sbomify.com/CVE-2026-46848/): Missing authorization in WebLogic Server (high 7.9)
- [CVE-2026-46847](https://insights.sbomify.com/CVE-2026-46847/): Missing authorization in Oracle WebCenter Portal (critical 9.9)
- [CVE-2026-46846](https://insights.sbomify.com/CVE-2026-46846/): Auth bypass in Oracle WebCenter Portal (critical 10.0)
- [CVE-2026-46845](https://insights.sbomify.com/CVE-2026-46845/): Auth bypass in Oracle WebCenter Portal (critical 9.8)
- [CVE-2026-46844](https://insights.sbomify.com/CVE-2026-46844/): Missing authorization in Oracle WebCenter Portal (critical 9.9)
- [CVE-2026-46843](https://insights.sbomify.com/CVE-2026-46843/): Denial of service in Oracle REST Data Services (medium 5.3)
- [CVE-2026-46842](https://insights.sbomify.com/CVE-2026-46842/): Missing authorization in Oracle REST Data Services (medium 5.3)
- [CVE-2026-46841](https://insights.sbomify.com/CVE-2026-46841/): Information disclosure in Oracle REST Data Services (medium 5.3)
- [CVE-2026-46840](https://insights.sbomify.com/CVE-2026-46840/): Auth bypass in Oracle REST Data Services (critical 10.0)
- [CVE-2026-4684](https://insights.sbomify.com/CVE-2026-4684/): Race condition, use-after-free in the Graphics: WebRender component (high 7.5)
- [CVE-2026-46839](https://insights.sbomify.com/CVE-2026-46839/): Missing authorization in Oracle REST Data Services (critical 9.9)
- [CVE-2026-46838](https://insights.sbomify.com/CVE-2026-46838/): Missing authorization in Oracle WebCenter Portal (critical 9.9)
- [CVE-2026-46837](https://insights.sbomify.com/CVE-2026-46837/): Privilege escalation in Oracle Flow Manufacturing (high 8.8)
- [CVE-2026-46835](https://insights.sbomify.com/CVE-2026-46835/): Denial of service in Oracle Database Server (high 7.5)
- [CVE-2026-46834](https://insights.sbomify.com/CVE-2026-46834/): Denial of service in Oracle Database Server (high 7.5)
- [CVE-2026-46833](https://insights.sbomify.com/CVE-2026-46833/): Other in Oracle Database Server (critical 9.0)
- [CVE-2026-46832](https://insights.sbomify.com/CVE-2026-46832/): Missing authorization in Oracle Enterprise Manager Base Platform (critical 9.9)
- [CVE-2026-46830](https://insights.sbomify.com/CVE-2026-46830/): Information disclosure in Oracle REST Data Services (medium 5.3)
- [CVE-2026-4683](https://insights.sbomify.com/CVE-2026-4683/): Smartcat Translator for WPML <= 3.1.77 - Missing Authorization to Unauthenticated Plugin Settings Update (medium 6.5)
- [CVE-2026-46829](https://insights.sbomify.com/CVE-2026-46829/): Denial of service in Oracle REST Data Services (high 7.5)
- [CVE-2026-46828](https://insights.sbomify.com/CVE-2026-46828/): Missing authorization in Oracle Payroll (high 8.1)
- [CVE-2026-46827](https://insights.sbomify.com/CVE-2026-46827/): Auth bypass in Oracle Payroll (high 8.8)
- [CVE-2026-46826](https://insights.sbomify.com/CVE-2026-46826/): Missing authorization in Oracle Payroll (high 8.8)
- [CVE-2026-46825](https://insights.sbomify.com/CVE-2026-46825/): Other in Oracle VM VirtualBox (medium 6.0)
- [CVE-2026-46824](https://insights.sbomify.com/CVE-2026-46824/): Missing authorization in Oracle Universal Work Queue (critical 9.9)
- [CVE-2026-46823](https://insights.sbomify.com/CVE-2026-46823/): Missing authorization in Oracle Public Sector Financials (International) (high 7.7)
- [CVE-2026-46822](https://insights.sbomify.com/CVE-2026-46822/): Missing authorization in Oracle iAssets (critical 9.9)
- [CVE-2026-46821](https://insights.sbomify.com/CVE-2026-46821/): Missing authorization in Oracle Financials Common Modules (high 7.7)
- [CVE-2026-46820](https://insights.sbomify.com/CVE-2026-46820/): Missing authorization in Oracle Financials Common Modules (high 8.5)
- [CVE-2026-4682](https://insights.sbomify.com/CVE-2026-4682/): Certain HP DeskJet All In One (AIO) Devices – Potential Remote Code Execution & Potential Buffer Overflow (high 8.7)
- [CVE-2026-46819](https://insights.sbomify.com/CVE-2026-46819/): Missing authorization in Oracle Internet Procurement Connector (critical 9.1)
- [CVE-2026-46818](https://insights.sbomify.com/CVE-2026-46818/): Missing authorization in Oracle Payments (high 7.4)
- [CVE-2026-46817](https://insights.sbomify.com/CVE-2026-46817/): Oracle E-Business Suite Improper Privilege Management (critical 9.8, exploited in the wild)
- [CVE-2026-46816](https://insights.sbomify.com/CVE-2026-46816/): Information disclosure in Oracle VM VirtualBox (low 3.2)
- [CVE-2026-46815](https://insights.sbomify.com/CVE-2026-46815/): Information disclosure in Oracle VM VirtualBox (low 3.2)
- [CVE-2026-46814](https://insights.sbomify.com/CVE-2026-46814/): Missing authorization in Oracle WebCenter Portal (critical 9.9)
- [CVE-2026-46813](https://insights.sbomify.com/CVE-2026-46813/): Auth bypass in Oracle WebCenter Content (critical 9.8)
- [CVE-2026-46812](https://insights.sbomify.com/CVE-2026-46812/): Other in Oracle Access Manager (medium 6.1)
- [CVE-2026-46810](https://insights.sbomify.com/CVE-2026-46810/): Missing authorization in Identity Manager (medium 6.5)
- [CVE-2026-4681](https://insights.sbomify.com/CVE-2026-4681/): Critical Remote Code Execution vulnerability reported in Windchill (critical 9.3)
- [CVE-2026-46809](https://insights.sbomify.com/CVE-2026-46809/): Missing authorization in Oracle WebCenter Sites (critical 9.1)
- [CVE-2026-46808](https://insights.sbomify.com/CVE-2026-46808/): Missing authorization in Oracle WebCenter Content (high 8.7)
- [CVE-2026-46807](https://insights.sbomify.com/CVE-2026-46807/): Auth bypass in Identity Manager (critical 9.8)
- [CVE-2026-46806](https://insights.sbomify.com/CVE-2026-46806/): Open redirect in Oracle WebCenter Content (high 8.2)
- [CVE-2026-46805](https://insights.sbomify.com/CVE-2026-46805/): Missing authorization in Oracle WebCenter Content (critical 9.3)
- [CVE-2026-46804](https://insights.sbomify.com/CVE-2026-46804/): Privilege escalation in Oracle WebCenter Content (high 8.7)
- [CVE-2026-46803](https://insights.sbomify.com/CVE-2026-46803/): Auth bypass in Oracle WebCenter Portal (critical 10.0)
- [CVE-2026-46802](https://insights.sbomify.com/CVE-2026-46802/): Missing authorization in Oracle WebCenter Portal (critical 9.9)
- [CVE-2026-46801](https://insights.sbomify.com/CVE-2026-46801/): Missing authorization in Oracle WebCenter Sites (critical 9.8)
- [CVE-2026-46800](https://insights.sbomify.com/CVE-2026-46800/): Auth bypass in Oracle WebCenter Sites (critical 10.0)
- [CVE-2026-4680](https://insights.sbomify.com/CVE-2026-4680/): Use after free in Chrome (high 8.8)
- [CVE-2026-46799](https://insights.sbomify.com/CVE-2026-46799/): Auth bypass in Oracle WebCenter Sites (critical 9.8)
- [CVE-2026-46798](https://insights.sbomify.com/CVE-2026-46798/): Auth bypass in Oracle WebCenter Sites (critical 10.0)
- [CVE-2026-46797](https://insights.sbomify.com/CVE-2026-46797/): Missing authorization in Oracle WebCenter Sites (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/608/