CVE-2026-91617 is a vulnerability in Oracle Middleware Common Libraries and Tools, specifically in the Remote Diagnostic Agent component. It affects versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The flaw allows a low privileged attacker with logon access to the infrastructure to compromise the middleware component, potentially leading to unauthorized access to critical or all accessible data. The CVSS 3.1 base score is 5.5, indicating a medium severity with a high confidentiality impact but no integrity or availability impact. Oracle has released patches as part of its October 2026 Critical Patch Update, and customers are strongly advised to apply these patches promptly.
CVE-2026-91616 is a low severity vulnerability in Oracle Middleware Common Libraries and Tools, specifically in the Remote Diagnostic Agent component. It affects versions 12.2.1.4.0 and 14.1.1.0.0. The vulnerability allows an unauthenticated attacker with network access via HTTP to gain unauthorized read access to some accessible data. The vulnerability is difficult to exploit and does not impact integrity or availability.
CVE-2026-91615 is a vulnerability in the Java VM component of Oracle Database Server affecting versions 19.3 through 19.32, 21.3 through 21.23, and 23.4.0 through 23.26.3. It allows a low privileged attacker with no privileges and network access via SOCKS5 to compromise the Java VM. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data accessible by the Java VM. The vulnerability has a CVSS 3.1 base score of 6.3, indicating a medium severity with integrity impact. Oracle has released patches addressing this vulnerability as part of their October 2026 Critical Patch Update.
CVE-2026-91614 is a low-severity vulnerability in Oracle Communications Unified Inventory Management versions 7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0, and 8.0.1. It allows a low privileged attacker with logon access to the infrastructure to gain unauthorized read access to some data within the product. The vulnerability does not impact integrity or availability. Oracle has published a Critical Patch Update advisory that includes patches for this and many other vulnerabilities.
CVE-2026-91613 is a vulnerability in Oracle Communications Unified Inventory Management versions 7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0, and 8.0.1. It allows a low privileged attacker with logon access to the infrastructure to gain unauthorized read access to some data within the product. The vulnerability has a low CVSS score of 3.3, indicating limited confidentiality impact without integrity or availability effects. Oracle has published a Critical Patch Update advisory that includes patches for multiple vulnerabilities, including this one. Customers are strongly advised to apply the available patches promptly to mitigate this risk.
CVE-2026-91612 is a vulnerability in Oracle Communications Unified Inventory Management versions 7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0, and 8.0.1. It allows a low privileged attacker with logon access to the infrastructure to gain unauthorized read access to some data within the product. The vulnerability has a low severity with a CVSS 3.1 base score of 3.3, impacting confidentiality but not integrity or availability.
CVE-2026-91610 is a high-severity vulnerability in Oracle REST Data Services versions 24.2.0 through 26.2.2. It allows a low privileged attacker with network access via HTTP to compromise the service, potentially leading to full takeover. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high impact on confidentiality, integrity, and availability. Oracle has released patches for this vulnerability as part of their October 2026 Critical Patch Update.
CVE-2026-91609 is a vulnerability in Oracle REST Data Services (component: Graph QL) affecting versions 24.2.0 through 26.2.1. It allows a low privileged attacker with network access via HTTP to gain unauthorized access to critical or all accessible data. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity with a high confidentiality impact but no integrity or availability impact. Oracle has released a Critical Patch Update addressing this and many other vulnerabilities, and customers are strongly advised to apply the patches promptly.
CVE-2026-91608 is a high-severity vulnerability in Oracle BI Publisher affecting versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. It allows an unauthenticated attacker with network access via HTTP to gain unauthorized access to critical or all accessible data within Oracle BI Publisher. The vulnerability has a CVSS 3.1 base score of 7.5, indicating a significant confidentiality impact without requiring privileges or user interaction.
CVE-2026-91607 is a vulnerability in Oracle Business Intelligence Enterprise Edition (OBIEE) versions 8.2.0.0.0 and 26.01.0.0.0. It allows a low privileged attacker with network access via HTTP to gain unauthorized read access to some data accessible through OBIEE. The vulnerability has a CVSS 3.1 base score of 4.3, indicating a medium severity with confidentiality impact only. There is no indication of integrity or availability impact. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory.
CVE-2026-91604 is a vulnerability in Oracle Agile Product Lifecycle Management for Process version 6.2.4. It allows a low privileged attacker with network access via HTTP to potentially take over the affected product. The vulnerability is rated with a CVSS 3.1 base score of 7.5, indicating high severity with impacts on confidentiality, integrity, and availability. The vulnerability is difficult to exploit due to the required conditions. Oracle has included this vulnerability in its October 2026 Critical Patch Update, which provides security patches for this and many other vulnerabilities.
CVE-2026-91600 is a vulnerability in Oracle Business Intelligence Enterprise Edition version 26.01.0.0.0. It allows a low privileged attacker with network access via HTTP to gain unauthorized read access to some accessible data within the product. The vulnerability has a CVSS 3.1 base score of 4.3, indicating a medium severity with confidentiality impact only. No integrity or availability impacts are reported. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory.
CVE-2026-91598 is a vulnerability in Oracle Business Intelligence Enterprise Edition affecting versions 8.2.0.0.0 and 26.01.0.0.0. It allows a low privileged attacker with network access via HTTP to gain unauthorized read access to some accessible data. The vulnerability has a CVSS 3.1 base score of 4.3, indicating a medium severity with confidentiality impact only. Oracle has released security patches addressing this and many other vulnerabilities in their October 2026 Critical Patch Update advisory.
CVE-2026-91597 is a high-severity vulnerability in Oracle Business Intelligence Enterprise Edition versions 8.2.0.0.0 and 26.01.0.0.0. It allows an unauthenticated attacker with access to the physical communication segment attached to the hardware running the software to compromise the system. Successful exploitation can lead to full takeover of Oracle Business Intelligence Enterprise Edition and may impact additional Oracle products. The vulnerability has a CVSS 3.1 base score of 8.3, indicating high confidentiality, integrity, and availability impacts. Oracle has released patches addressing this and many other vulnerabilities in its October 2026 Critical Patch Update. Users are strongly advised to apply the official patches promptly.
CVE-2026-91590 is a medium severity vulnerability in Oracle BI Publisher's Web Service API that allows a low privileged attacker with network access via HTTP to perform unauthorized update, insert, delete, and read operations on some accessible data. Successful exploitation requires human interaction from a user other than the attacker and may impact additional Oracle products beyond BI Publisher. The vulnerability affects Oracle BI Publisher versions 8.2.0.0.0 and 26.01.0.0.0. The CVSS 3.1 base score is 5.4, reflecting confidentiality and integrity impacts without availability impact.
CVE-2026-91588 is a vulnerability in Oracle Business Intelligence Enterprise Edition (BI Search component) versions 8.2.0.0.0 and 12.2.1.4.0. It allows an unauthenticated attacker with network access via HTTP to compromise the product, requiring user interaction from a person other than the attacker. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical or accessible data. The CVSS 3.1 base score is 6.5, indicating a medium severity with integrity impact but no confidentiality or availability impact. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, recommending patching and staying on supported versions.
CVE-2026-91582 is a vulnerability in Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 affecting the BI Search component. It allows an unauthenticated attacker with network access via HTTP to cause a partial denial of service. The vulnerability is rated as low severity with a CVSS 3.1 base score of 3.7, primarily impacting availability. Exploitation is considered difficult.
CVE-2026-91579 is a high-severity vulnerability in Oracle BI Publisher affecting versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. It allows an unauthenticated attacker with network access via HTTP to compromise the product, requiring user interaction from a person other than the attacker. Successful exploitation can lead to full takeover of Oracle BI Publisher. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high impact on confidentiality, integrity, and availability.
CVE-2026-91577 is a vulnerability in Oracle Business Intelligence Enterprise Edition version 12.2.1.4.0 that allows a low privileged attacker with network access via HTTP to compromise the product. Successful exploitation can lead to unauthorized read, update, insert, or delete access to some accessible data. The vulnerability has a CVSS 3.1 base score of 6.4, indicating medium severity with confidentiality and integrity impacts. Oracle has published a Critical Patch Update advisory addressing this and other vulnerabilities.
CVE-2026-91576 is a vulnerability in Oracle Business Intelligence Enterprise Edition version 12.2.1.4.0. It allows a low privileged attacker with network access via HTTP to compromise the product, potentially gaining unauthorized access to critical or all accessible data. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity focused on confidentiality impact. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, which provides patches addressing this and many other vulnerabilities.