# Vulnerabilities published in 2026 - [CVE-2026-22027](https://insights.sbomify.com/CVE-2026-22027/): CryptoLib Vulnerable to Heap Buffer Overflow in MariaDB SA Hexstring Conversion (medium 5.7) - [CVE-2026-22026](https://insights.sbomify.com/CVE-2026-22026/): CryptoLib Unbounded Memory Allocation in KMC HTTP Response Handler Allows Resource Exhaustion (high 8.2) - [CVE-2026-22025](https://insights.sbomify.com/CVE-2026-22025/): CryptoLib Memory Leak on HTTP Error Response in KMC Client (medium 6.3) - [CVE-2026-22024](https://insights.sbomify.com/CVE-2026-22024/): CryptoLib Memory Leak in KMC Encrypt Function Leads to Resource Exhaustion (medium 6.3) - [CVE-2026-22023](https://insights.sbomify.com/CVE-2026-22023/): CryptoLib Has Out-of-Bounds Read in KMC AEAD Encrypt Metadata Parsing via Flawed strtok Pattern (high 8.2) - [CVE-2026-22022](https://insights.sbomify.com/CVE-2026-22022/): Apache Solr: Unauthorized bypass of certain "predefined permission" rules in the RuleBasedAuthorizationPlugin (high 8.2) - [CVE-2026-22021](https://insights.sbomify.com/CVE-2026-22021/): Denial of service in Oracle GraalVM Enterprise Edition (medium 5.3) - [CVE-2026-2202](https://insights.sbomify.com/CVE-2026-2202/): Tenda AC8 httpd WifiGuestSet fromSetWifiGusetBasic buffer overflow (high 8.7) - [CVE-2026-22019](https://insights.sbomify.com/CVE-2026-22019/): Missing authorization in PeopleSoft Enterprise HCM Shared Components (medium 5.4) - [CVE-2026-22018](https://insights.sbomify.com/CVE-2026-22018/): Denial of service in Oracle GraalVM Enterprise Edition (low 3.7) - [CVE-2026-22017](https://insights.sbomify.com/CVE-2026-22017/): Denial of service in MySQL Server (medium 6.5) - [CVE-2026-22016](https://insights.sbomify.com/CVE-2026-22016/): XML external entity in Oracle GraalVM Enterprise Edition (high 7.5) - [CVE-2026-22015](https://insights.sbomify.com/CVE-2026-22015/): Information disclosure in MySQL Server (medium 4.3) - [CVE-2026-22014](https://insights.sbomify.com/CVE-2026-22014/): Missing authorization in Oracle User Management (low 3.8) - [CVE-2026-22013](https://insights.sbomify.com/CVE-2026-22013/): Security feature bypass in Oracle GraalVM Enterprise Edition (medium 5.3) - [CVE-2026-22011](https://insights.sbomify.com/CVE-2026-22011/): Missing authorization in Oracle Applications DBA (high 7.6) - [CVE-2026-22010](https://insights.sbomify.com/CVE-2026-22010/): Missing authorization in Oracle Financial Services Analytical Applications Infrastructure (high 7.5) - [CVE-2026-2201](https://insights.sbomify.com/CVE-2026-2201/): ZeroWdd studentmanager LeaveController.java addLeave cross site scripting (medium 4.8) - [CVE-2026-22009](https://insights.sbomify.com/CVE-2026-22009/): Denial of service in MySQL Server (medium 6.5) - [CVE-2026-22008](https://insights.sbomify.com/CVE-2026-22008/): Security feature bypass in Oracle Java SE (low 3.7) - [CVE-2026-22007](https://insights.sbomify.com/CVE-2026-22007/): Information disclosure in Oracle GraalVM Enterprise Edition (low 2.9) - [CVE-2026-22006](https://insights.sbomify.com/CVE-2026-22006/): Information disclosure in PeopleSoft Enterprise HCM Human Resources (medium 5.4) - [CVE-2026-22005](https://insights.sbomify.com/CVE-2026-22005/): Denial of service in MySQL Server (medium 4.9) - [CVE-2026-22004](https://insights.sbomify.com/CVE-2026-22004/): Denial of service in MySQL Server (medium 4.9) - [CVE-2026-22003](https://insights.sbomify.com/CVE-2026-22003/): Denial of service in Oracle GraalVM Enterprise Edition (medium 6.0) - [CVE-2026-22002](https://insights.sbomify.com/CVE-2026-22002/): Denial of service in MySQL Server (medium 4.9) - [CVE-2026-22001](https://insights.sbomify.com/CVE-2026-22001/): Information disclosure in MySQL Server (low 2.7) - [CVE-2026-2200](https://insights.sbomify.com/CVE-2026-2200/): heyewei JFinalCMS API Endpoint save cross site scripting (medium 4.8) - [CVE-2026-21999](https://insights.sbomify.com/CVE-2026-21999/): Information disclosure in Oracle Database Server (medium 5.3) - [CVE-2026-21998](https://insights.sbomify.com/CVE-2026-21998/): Denial of service in MySQL Server (medium 4.9) - [CVE-2026-21997](https://insights.sbomify.com/CVE-2026-21997/): Missing authorization in Oracle Life Sciences Empirica Signal (high 8.5) - [CVE-2026-21996](https://insights.sbomify.com/CVE-2026-21996/): Denial of service in Oracle Linux (low 3.3) - [CVE-2026-21994](https://insights.sbomify.com/CVE-2026-21994/): Missing authorization in Oracle Edge Cloud Infrastructure Designer and Visualisation Toolkit (critical 9.8) - [CVE-2026-21992](https://insights.sbomify.com/CVE-2026-21992/): Auth bypass in Oracle Identity Manager (critical 9.8) - [CVE-2026-21991](https://insights.sbomify.com/CVE-2026-21991/): Path traversal in Oracle Linux (medium 5.5) - [CVE-2026-21990](https://insights.sbomify.com/CVE-2026-21990/): Other in Oracle VM VirtualBox (high 8.2) - [CVE-2026-2199](https://insights.sbomify.com/CVE-2026-2199/): code-projects Online Reviewer System user-delete.php sql injection (medium 6.9) - [CVE-2026-21989](https://insights.sbomify.com/CVE-2026-21989/): Other in Oracle VM VirtualBox (high 8.1) - [CVE-2026-21988](https://insights.sbomify.com/CVE-2026-21988/): Other in Oracle VM VirtualBox (high 8.2) - [CVE-2026-21987](https://insights.sbomify.com/CVE-2026-21987/): Other in Oracle VM VirtualBox (high 8.2) - [CVE-2026-21986](https://insights.sbomify.com/CVE-2026-21986/): Denial of service in Oracle VM VirtualBox (high 7.1) - [CVE-2026-21985](https://insights.sbomify.com/CVE-2026-21985/): Information disclosure in Oracle VM VirtualBox (medium 6.0) - [CVE-2026-21984](https://insights.sbomify.com/CVE-2026-21984/): Other in Oracle VM VirtualBox (high 7.5) - [CVE-2026-21983](https://insights.sbomify.com/CVE-2026-21983/): Privilege escalation in Oracle VM VirtualBox (high 7.5) - [CVE-2026-21982](https://insights.sbomify.com/CVE-2026-21982/): Other in Oracle VM VirtualBox (high 7.5) - [CVE-2026-21981](https://insights.sbomify.com/CVE-2026-21981/): Privilege escalation in Oracle VM VirtualBox (medium 4.6) - [CVE-2026-21980](https://insights.sbomify.com/CVE-2026-21980/): Other in Oracle Life Sciences Central Coding (medium 6.5) - [CVE-2026-2198](https://insights.sbomify.com/CVE-2026-2198/): code-projects Online Reviewer System loaddata.php sql injection (medium 6.9) - [CVE-2026-21979](https://insights.sbomify.com/CVE-2026-21979/): Other in Oracle Planning and Budgeting Cloud Service (medium 4.2) - [CVE-2026-21978](https://insights.sbomify.com/CVE-2026-21978/): Other in Oracle FLEXCUBE Universal Banking (medium 6.5) - [CVE-2026-21977](https://insights.sbomify.com/CVE-2026-21977/): Other in Oracle Zero Data Loss Recovery Appliance Software (low 3.1) - [CVE-2026-21976](https://insights.sbomify.com/CVE-2026-21976/): Other in Oracle Business Intelligence Enterprise Edition (high 7.1) - [CVE-2026-21975](https://insights.sbomify.com/CVE-2026-21975/): Denial of service in Oracle Database Server (medium 4.5) - [CVE-2026-21974](https://insights.sbomify.com/CVE-2026-21974/): Information disclosure in Oracle Life Sciences Central Designer (medium 5.3) - [CVE-2026-21973](https://insights.sbomify.com/CVE-2026-21973/): Other in Oracle FLEXCUBE Investor Servicing (high 8.1) - [CVE-2026-21972](https://insights.sbomify.com/CVE-2026-21972/): Information disclosure in Oracle Configurator (medium 5.3) - [CVE-2026-21971](https://insights.sbomify.com/CVE-2026-21971/): Other in PeopleSoft Enterprise SCM Purchasing (medium 5.4) - [CVE-2026-21970](https://insights.sbomify.com/CVE-2026-21970/): Other in Oracle Life Sciences Central Designer (medium 6.5) - [CVE-2026-2197](https://insights.sbomify.com/CVE-2026-2197/): code-projects Online Reviewer System exam-delete.php sql injection (medium 6.9) - [CVE-2026-21969](https://insights.sbomify.com/CVE-2026-21969/): Other in Oracle Agile Product Lifecycle Management for Process (critical 9.8) - [CVE-2026-21968](https://insights.sbomify.com/CVE-2026-21968/): Denial of service in MySQL Server (medium 6.5) - [CVE-2026-21967](https://insights.sbomify.com/CVE-2026-21967/): Other in Oracle Hospitality OPERA 5 (high 8.6) - [CVE-2026-21966](https://insights.sbomify.com/CVE-2026-21966/): Cross-site scripting in Oracle Hospitality OPERA 5 Property Services (medium 6.1) - [CVE-2026-21965](https://insights.sbomify.com/CVE-2026-21965/): Denial of service in MySQL Server (low 2.7) - [CVE-2026-21964](https://insights.sbomify.com/CVE-2026-21964/): Denial of service in MySQL Server (medium 4.9) - [CVE-2026-21963](https://insights.sbomify.com/CVE-2026-21963/): Privilege escalation in Oracle VM VirtualBox (medium 6.0) - [CVE-2026-21962](https://insights.sbomify.com/CVE-2026-21962/): Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control (critical 10.0, exploited in the wild) - [CVE-2026-21961](https://insights.sbomify.com/CVE-2026-21961/): Missing authorization in PeopleSoft Enterprise HCM Human Resources (medium 6.1) - [CVE-2026-21960](https://insights.sbomify.com/CVE-2026-21960/): Missing authorization in Oracle Applications DBA (medium 6.5) - [CVE-2026-2196](https://insights.sbomify.com/CVE-2026-2196/): code-projects Online Reviewer System exam-update.php sql injection (medium 6.9) - [CVE-2026-21959](https://insights.sbomify.com/CVE-2026-21959/): Missing authorization in Oracle Workflow (medium 4.9) - [CVE-2026-21957](https://insights.sbomify.com/CVE-2026-21957/): Privilege escalation in Oracle VM VirtualBox (high 7.5) - [CVE-2026-21956](https://insights.sbomify.com/CVE-2026-21956/): Denial of service in Oracle VM VirtualBox (high 8.2) - [CVE-2026-21955](https://insights.sbomify.com/CVE-2026-21955/): Denial of service in Oracle VM VirtualBox (high 8.2) - [CVE-2026-21954](https://insights.sbomify.com/CVE-2026-21954/): Missing authorization in Oracle Retail Xstore Point of Service (medium 4.3) - [CVE-2026-21953](https://insights.sbomify.com/CVE-2026-21953/): Missing authorization in Oracle Retail Xstore Point of Service (low 3.3) - [CVE-2026-21952](https://insights.sbomify.com/CVE-2026-21952/): Denial of service in MySQL Server (medium 4.9) - [CVE-2026-21951](https://insights.sbomify.com/CVE-2026-21951/): Cross-site scripting in PeopleSoft Enterprise PeopleTools (medium 6.1) - [CVE-2026-21950](https://insights.sbomify.com/CVE-2026-21950/): Denial of service in MySQL Server (medium 6.5) - [CVE-2026-2195](https://insights.sbomify.com/CVE-2026-2195/): code-projects Online Reviewer System questions-view.php sql injection (medium 6.9) - [CVE-2026-21949](https://insights.sbomify.com/CVE-2026-21949/): Denial of service in MySQL Server (medium 6.5) - [CVE-2026-21948](https://insights.sbomify.com/CVE-2026-21948/): Denial of service in MySQL Server (medium 4.9) - [CVE-2026-21947](https://insights.sbomify.com/CVE-2026-21947/): Cross-site scripting in Oracle Java SE (low 3.1) - [CVE-2026-21946](https://insights.sbomify.com/CVE-2026-21946/): Cross-site scripting in JD Edwards EnterpriseOne Tools (medium 6.1) - [CVE-2026-21945](https://insights.sbomify.com/CVE-2026-21945/): Denial of service in Oracle GraalVM Enterprise Edition (high 7.5) - [CVE-2026-21944](https://insights.sbomify.com/CVE-2026-21944/): Cross-site scripting in Oracle Agile Product Lifecycle Management for Process (medium 6.5) - [CVE-2026-21943](https://insights.sbomify.com/CVE-2026-21943/): Cross-site scripting in Oracle Scripting (medium 6.1) - [CVE-2026-21942](https://insights.sbomify.com/CVE-2026-21942/): Denial of service in Oracle Solaris (medium 5.0) - [CVE-2026-21941](https://insights.sbomify.com/CVE-2026-21941/): Denial of service in MySQL Server (medium 4.9) - [CVE-2026-21940](https://insights.sbomify.com/CVE-2026-21940/): Information disclosure in Oracle Agile PLM (high 7.5) - [CVE-2026-2194](https://insights.sbomify.com/CVE-2026-2194/): D-Link DI-7100G C1 start_proxy_client_email command injection (medium 5.3) - [CVE-2026-21939](https://insights.sbomify.com/CVE-2026-21939/): Other in Oracle Database Server (high 7.0) - [CVE-2026-21938](https://insights.sbomify.com/CVE-2026-21938/): Cross-site scripting in PeopleSoft Enterprise PeopleTools (medium 6.1) - [CVE-2026-21937](https://insights.sbomify.com/CVE-2026-21937/): Denial of service in MySQL Server (medium 4.9) - [CVE-2026-21936](https://insights.sbomify.com/CVE-2026-21936/): Denial of service in MySQL Cluster (medium 4.9) - [CVE-2026-21935](https://insights.sbomify.com/CVE-2026-21935/): Other in Oracle Solaris (medium 5.8) - [CVE-2026-21934](https://insights.sbomify.com/CVE-2026-21934/): Other in PeopleSoft Enterprise PeopleTools (medium 5.4) - [CVE-2026-21933](https://insights.sbomify.com/CVE-2026-21933/): Other in Oracle GraalVM Enterprise Edition (medium 6.1) - [CVE-2026-21932](https://insights.sbomify.com/CVE-2026-21932/): Other in Oracle GraalVM Enterprise Edition (high 7.4) - [CVE-2026-21931](https://insights.sbomify.com/CVE-2026-21931/): Other in Oracle APEX Sample Applications (medium 5.4) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/802/