# Vulnerabilities published in 2026


- [CVE-2026-34315](https://insights.sbomify.com/CVE-2026-34315/): Open redirect in Oracle WebLogic Server (medium 6.5)
- [CVE-2026-34314](https://insights.sbomify.com/CVE-2026-34314/): Missing authorization in Oracle Financial Services Analytical Applications Infrastructure (medium 6.8)
- [CVE-2026-34313](https://insights.sbomify.com/CVE-2026-34313/): Information disclosure in Oracle Financial Services Analytical Applications Infrastructure (medium 6.5)
- [CVE-2026-34312](https://insights.sbomify.com/CVE-2026-34312/): Missing authorization in Oracle Database Server (low 2.4)
- [CVE-2026-34311](https://insights.sbomify.com/CVE-2026-34311/): Other in Oracle Hospitality OPERA 5 Property Services (critical 9.8)
- [CVE-2026-34310](https://insights.sbomify.com/CVE-2026-34310/): Missing authorization in Oracle Financial Services Analytical Applications Infrastructure (high 7.5)
- [CVE-2026-3431](https://insights.sbomify.com/CVE-2026-3431/): Sim Studio AI - MongoDB SSRF and Arbitrary Document Deletion (critical 9.8)
- [CVE-2026-34309](https://insights.sbomify.com/CVE-2026-34309/): Missing authorization in PeopleSoft Enterprise PeopleTools (high 8.1)
- [CVE-2026-34308](https://insights.sbomify.com/CVE-2026-34308/): Denial of service in MySQL Server (medium 6.5)
- [CVE-2026-34307](https://insights.sbomify.com/CVE-2026-34307/): Missing authorization in PeopleSoft Enterprise PeopleTools (medium 5.4)
- [CVE-2026-34306](https://insights.sbomify.com/CVE-2026-34306/): Missing authorization in PeopleSoft Enterprise FIN Project Costing (medium 6.5)
- [CVE-2026-34305](https://insights.sbomify.com/CVE-2026-34305/): Information disclosure in Oracle WebLogic Server (high 7.5)
- [CVE-2026-34304](https://insights.sbomify.com/CVE-2026-34304/): Denial of service in MySQL Server (medium 4.9)
- [CVE-2026-34303](https://insights.sbomify.com/CVE-2026-34303/): Denial of service in MySQL Server (medium 6.5)
- [CVE-2026-34302](https://insights.sbomify.com/CVE-2026-34302/): Missing authorization in Oracle Workflow (medium 5.5)
- [CVE-2026-34301](https://insights.sbomify.com/CVE-2026-34301/): Missing authorization in PeopleSoft Enterprise FIN Maintenance Management (medium 6.5)
- [CVE-2026-34300](https://insights.sbomify.com/CVE-2026-34300/): Information disclosure in PeopleSoft Enterprise FIN Contracts (medium 6.5)
- [CVE-2026-3430](https://insights.sbomify.com/CVE-2026-3430/): Creative Mail 1.6.5 - 1.6.9 - Unauthenticated SQLi (high 8.6)
- [CVE-2026-34299](https://insights.sbomify.com/CVE-2026-34299/): Missing authorization in PeopleSoft Enterprise FIN Maintenance Management (medium 6.5)
- [CVE-2026-34298](https://insights.sbomify.com/CVE-2026-34298/): Missing authorization in Oracle Applications Framework (medium 4.7)
- [CVE-2026-34297](https://insights.sbomify.com/CVE-2026-34297/): Information disclosure in Oracle HCM Common Architecture (high 7.5)
- [CVE-2026-34296](https://insights.sbomify.com/CVE-2026-34296/): Information disclosure in Oracle Agile Product Lifecycle Management for Process (medium 4.3)
- [CVE-2026-34295](https://insights.sbomify.com/CVE-2026-34295/): Missing authorization in PeopleSoft Enterprise SCM Purchasing (medium 6.5)
- [CVE-2026-34294](https://insights.sbomify.com/CVE-2026-34294/): Missing authorization in Oracle Identity Manager Connector (medium 5.9)
- [CVE-2026-34293](https://insights.sbomify.com/CVE-2026-34293/): Denial of service in MySQL Server (medium 4.9)
- [CVE-2026-34292](https://insights.sbomify.com/CVE-2026-34292/): Missing authorization in Oracle WebLogic Server (high 7.2)
- [CVE-2026-34291](https://insights.sbomify.com/CVE-2026-34291/): Missing authorization in Oracle HTTP Server (high 8.7)
- [CVE-2026-34290](https://insights.sbomify.com/CVE-2026-34290/): Denial of service in Oracle Identity Manager Connector (high 7.5)
- [CVE-2026-3429](https://insights.sbomify.com/CVE-2026-3429/): Keycloak: Improper Access Control Leading to MFA Deletion and Account Takeover in Keycloak Account REST API (medium 4.2)
- [CVE-2026-34289](https://insights.sbomify.com/CVE-2026-34289/): Missing authorization in Oracle Identity Manager Connector (medium 5.9)
- [CVE-2026-34288](https://insights.sbomify.com/CVE-2026-34288/): Missing authorization in Oracle Identity Manager Connector (medium 5.9)
- [CVE-2026-34287](https://insights.sbomify.com/CVE-2026-34287/): Missing authorization in Oracle Identity Manager Connector (critical 9.1)
- [CVE-2026-34286](https://insights.sbomify.com/CVE-2026-34286/): Missing authorization in Oracle Identity Manager Connector (critical 9.1)
- [CVE-2026-34285](https://insights.sbomify.com/CVE-2026-34285/): Missing authorization in Oracle Identity Manager Connector (critical 9.1)
- [CVE-2026-34284](https://insights.sbomify.com/CVE-2026-34284/): Open redirect in Oracle Business Process Management Suite (medium 6.1)
- [CVE-2026-34283](https://insights.sbomify.com/CVE-2026-34283/): Open redirect in Oracle Identity Manager (medium 6.1)
- [CVE-2026-34282](https://insights.sbomify.com/CVE-2026-34282/): Denial of service in Oracle GraalVM Enterprise Edition (high 7.5)
- [CVE-2026-34281](https://insights.sbomify.com/CVE-2026-34281/): Denial of service in Oracle Solaris (medium 6.5)
- [CVE-2026-34280](https://insights.sbomify.com/CVE-2026-34280/): Missing authorization in PeopleSoft Enterprise HCM Human Resources (medium 6.5)
- [CVE-2026-3428](https://insights.sbomify.com/CVE-2026-3428/): Race condition in Member Center(华硕大厅) (medium 5.4)
- [CVE-2026-34279](https://insights.sbomify.com/CVE-2026-34279/): Missing authorization in Oracle Enterprise Manager Base Platform (critical 9.1)
- [CVE-2026-34278](https://insights.sbomify.com/CVE-2026-34278/): Denial of service in MySQL Server (medium 4.9)
- [CVE-2026-34277](https://insights.sbomify.com/CVE-2026-34277/): Other in PeopleSoft Enterprise PeopleTools (medium 6.6)
- [CVE-2026-34276](https://insights.sbomify.com/CVE-2026-34276/): Denial of service in MySQL Server (medium 6.5)
- [CVE-2026-34275](https://insights.sbomify.com/CVE-2026-34275/): Missing authorization in Oracle Advanced Inbound Telephony (critical 9.8)
- [CVE-2026-34274](https://insights.sbomify.com/CVE-2026-34274/): Missing authorization in Oracle Configurator (medium 6.1)
- [CVE-2026-34273](https://insights.sbomify.com/CVE-2026-34273/): Information disclosure in Oracle GoldenGate (medium 5.3)
- [CVE-2026-34272](https://insights.sbomify.com/CVE-2026-34272/): Denial of service in MySQL Server (medium 6.5)
- [CVE-2026-34271](https://insights.sbomify.com/CVE-2026-34271/): Denial of service in MySQL Server (medium 6.5)
- [CVE-2026-34270](https://insights.sbomify.com/CVE-2026-34270/): Denial of service in MySQL Server (medium 6.5)
- [CVE-2026-3427](https://insights.sbomify.com/CVE-2026-3427/): Yoast SEO <= 27.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'jsonText' Block Attribute (medium 6.4)
- [CVE-2026-34269](https://insights.sbomify.com/CVE-2026-34269/): Missing authorization in PeopleSoft Enterprise PeopleTools (medium 6.1)
- [CVE-2026-34268](https://insights.sbomify.com/CVE-2026-34268/): Information disclosure in Oracle GraalVM Enterprise Edition (low 2.9)
- [CVE-2026-34267](https://insights.sbomify.com/CVE-2026-34267/): Denial of service in MySQL Server (medium 4.9)
- [CVE-2026-34266](https://insights.sbomify.com/CVE-2026-34266/): Missing authorization in PeopleSoft Enterprise HCM Absence Management (medium 6.5)
- [CVE-2026-34265](https://insights.sbomify.com/CVE-2026-34265/): Memory Corruption vulnerability in Application Server ABAP for SAP NetWeaver and ABAP Platform (critical 9.8)
- [CVE-2026-34264](https://insights.sbomify.com/CVE-2026-34264/): Information Disclosure vulnerability in SAP Human Capital Management for SAP S/4HANA (medium 6.5)
- [CVE-2026-34263](https://insights.sbomify.com/CVE-2026-34263/): Missing authentication check in SAP Commerce cloud configuration (critical 9.6)
- [CVE-2026-34262](https://insights.sbomify.com/CVE-2026-34262/): Information Disclosure Vulnerability in SAP HANA Cockpit and HANA Database Explorer (medium 5.0)
- [CVE-2026-34261](https://insights.sbomify.com/CVE-2026-34261/): Missing Authorization check in SAP Business Analytics and SAP Content Management (medium 6.5)
- [CVE-2026-34260](https://insights.sbomify.com/CVE-2026-34260/): SQL injection vulnerability in SAP S/4HANA (SAP Enterprise Search for ABAP) (critical 9.6)
- [CVE-2026-3426](https://insights.sbomify.com/CVE-2026-3426/): Missing authorization in RTMKit (medium 4.3)
- [CVE-2026-34259](https://insights.sbomify.com/CVE-2026-34259/): OS Command Injection Vulnerability in SAP Forecasting & Replenishment (high 8.2)
- [CVE-2026-34258](https://insights.sbomify.com/CVE-2026-34258/): Content Spoofing vulnerability in SAPUI5 (Search UI) (medium 4.7)
- [CVE-2026-34257](https://insights.sbomify.com/CVE-2026-34257/): Open Redirect vulnerability in SAP NetWeaver Application Server ABAP (medium 6.1)
- [CVE-2026-34256](https://insights.sbomify.com/CVE-2026-34256/): Missing Authorization check in SAP ERP and SAP S/4 HANA (Private Cloud and On-Premise) (high 7.1)
- [CVE-2026-34253](https://insights.sbomify.com/CVE-2026-34253/): A buffer underflow vulnerability has been identified in the ogg123 utility from the vorbis-tools 1.4.3 package in function remotethread in remote.c. (high 8.2)
- [CVE-2026-3425](https://insights.sbomify.com/CVE-2026-3425/): RTMKit Addons for Elementor <= 2.0.2 - Authenticated (Author+) Local File Inclusion via 'path' (high 8.8)
- [CVE-2026-34248](https://insights.sbomify.com/CVE-2026-34248/): Zammad has an information disclosure in ticket detail view of customers in shared organizations (low 2.1)
- [CVE-2026-34247](https://insights.sbomify.com/CVE-2026-34247/): AVideo: IDOR in uploadPoster.php Allows Any Authenticated User to Overwrite Scheduled Live Stream Posters and Trigger False Socket Notifications (medium 5.4)
- [CVE-2026-34246](https://insights.sbomify.com/CVE-2026-34246/): CtrlPanel: Stored XSS in Admin Role Management via Unescaped DataTable HTML Output (medium 4.8)
- [CVE-2026-34245](https://insights.sbomify.com/CVE-2026-34245/): AVideo's Missing Authorization in Playlist Schedule Creation Allows Cross-User Broadcast Hijacking (medium 6.3)
- [CVE-2026-34244](https://insights.sbomify.com/CVE-2026-34244/): Weblate: SSRF via Project-Level Machinery Configuration (medium 5.0)
- [CVE-2026-34243](https://insights.sbomify.com/CVE-2026-34243/): wenxian: Command Injection in GitHub Actions Workflow via `issue_comment.body` (critical 9.8)
- [CVE-2026-34242](https://insights.sbomify.com/CVE-2026-34242/): Weblate: Arbitrary File Read via Symlink (high 7.7)
- [CVE-2026-34241](https://insights.sbomify.com/CVE-2026-34241/): CtrlPanel: Stored XSS in Ticket Reply Notifications Allows Session Hijacking (high 8.7)
- [CVE-2026-34240](https://insights.sbomify.com/CVE-2026-34240/): jose vulnerable to untrusted JWK header key acceptance during signature verification (high 7.5)
- [CVE-2026-3424](https://insights.sbomify.com/CVE-2026-3424/): kk Star Ratings <= 5.4.10.3 - Unauthenticated Arbitrary Shortcode Execution via 'payload' Parameter (medium 5.3)
- [CVE-2026-34239](https://insights.sbomify.com/CVE-2026-34239/): Chamilo Authenticated Remote Code Execution (high 7.5)
- [CVE-2026-34238](https://insights.sbomify.com/CVE-2026-34238/): ImageMagick: Integer overflow in despeckle operation causes heap buffer overflow on 32-bit builds (medium 5.1)
- [CVE-2026-34237](https://insights.sbomify.com/CVE-2026-34237/): MCP Java SDK has a Hardcoded Wildcard CORS (Access-Control-Allow-Origin: *) (medium 6.1)
- [CVE-2026-34236](https://insights.sbomify.com/CVE-2026-34236/): Auth0 PHP SDK Insufficient Entropy in Cookie Encryption (high 8.2)
- [CVE-2026-34235](https://insights.sbomify.com/CVE-2026-34235/): PJSIP: Heap OOB read in VPX unpacketizer (medium 6.9)
- [CVE-2026-34234](https://insights.sbomify.com/CVE-2026-34234/): CtrlPanel: Unauthenticated RCE using installer script (critical 10.0)
- [CVE-2026-34233](https://insights.sbomify.com/CVE-2026-34233/): CtrlPanel has Missing Authentication Checks in Datatable Admin Endpoints (medium 6.5)
- [CVE-2026-34232](https://insights.sbomify.com/CVE-2026-34232/): Firebird: DoS via `op_response` packet from client (high 7.5)
- [CVE-2026-34231](https://insights.sbomify.com/CVE-2026-34231/): Slippers: Cross-Site Scripting (XSS) in `attrs` Template Tag (medium 6.1)
- [CVE-2026-34230](https://insights.sbomify.com/CVE-2026-34230/): Rack: Quadratic complexity in Rack::Utils.select_best_encoding via wildcard Accept-Encoding header (medium 5.3)
- [CVE-2026-3423](https://insights.sbomify.com/CVE-2026-3423/): Envira Gallery <= 1.12.4 - Authenticated (Author+) Stored Cross-Site Scripting via Gallery Description (medium 6.4)
- [CVE-2026-34229](https://insights.sbomify.com/CVE-2026-34229/): Emlog: Stored XSS in Comment Module via URI Scheme Validation Bypass (medium 6.1)
- [CVE-2026-34228](https://insights.sbomify.com/CVE-2026-34228/): Emlog: CSRF in Backend Upgrade Interface Leading to Arbitrary Remote SQL Execution and Arbitrary File Write (high 8.7)
- [CVE-2026-34227](https://insights.sbomify.com/CVE-2026-34227/): Sliver One-Click Remote Access: Insecure CORS & Unauthenticated MCP Interface (medium 5.9)
- [CVE-2026-34226](https://insights.sbomify.com/CVE-2026-34226/): Happy DOM's fetch credentials include uses page-origin cookies instead of target-origin cookies (high 7.5)
- [CVE-2026-34225](https://insights.sbomify.com/CVE-2026-34225/): Open WebUI has Blind Server Side Request Forgery in its Image Edit Functionality (medium 4.3)
- [CVE-2026-34224](https://insights.sbomify.com/CVE-2026-34224/): Parse Server: MFA single-use token bypass via concurrent authData login requests (low 2.1)
- [CVE-2026-34223](https://insights.sbomify.com/CVE-2026-34223/): Code injection in Desigo CC ClickOnce Client V6 (high 8.6)
- [CVE-2026-34222](https://insights.sbomify.com/CVE-2026-34222/): Open WebUI has Broken Access Control in Tool Valves (high 7.7)
- [CVE-2026-34221](https://insights.sbomify.com/CVE-2026-34221/): MikroORM has Prototype Pollution in Utils.merge (high 8.3)
- [CVE-2026-34220](https://insights.sbomify.com/CVE-2026-34220/): MikroORM is vulnerable to SQL Injection via specially crafted object (critical 9.3)
- [CVE-2026-3422](https://insights.sbomify.com/CVE-2026-3422/): e-Excellence｜U-Office Force - Insecure Deserialization (critical 9.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/701/