CVE-2026-91574 is a vulnerability in Oracle BI Publisher that allows a low privileged attacker with network access via HTTP to gain unauthorized access to critical or all accessible data. The affected versions are 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity with high confidentiality impact but no integrity or availability impact. Oracle has released patches for this and many other vulnerabilities in their October 2026 Critical Patch Update advisory. Users are strongly advised to apply the available patches promptly to mitigate this risk.
CVE-2026-91573 is a vulnerability in Oracle Agile Product Lifecycle Management for Process version 6.2.4. It allows an unauthenticated attacker with network access via HTTP to gain unauthorized access to critical data and perform unauthorized update, insert, or delete operations on some accessible data. The vulnerability has a CVSS 3.1 base score of 8.2, indicating high severity with significant confidentiality and integrity impacts.
CVE-2026-91568 is a vulnerability in the Oracle Database Server RDBMS component affecting versions 23.4.0 through 23.26.3. It allows a low privileged attacker with Create Session privilege and network access via Oracle Net to compromise the database. Successful exploitation can lead to unauthorized access to critical or all accessible data in the RDBMS. The vulnerability has a CVSS 3.1 base score of 7.7, indicating high severity with significant confidentiality impact. Oracle has released patches addressing this vulnerability as part of its October 2026 Critical Patch Update.
CVE-2026-91565 is a vulnerability in Oracle Agile Product Lifecycle Management for Process version 6.2.4. It allows a low privileged attacker with network access via HTTP to potentially gain unauthorized access to critical data, perform unauthorized data modifications, and cause partial denial of service. The vulnerability is rated medium severity with a CVSS 3.1 base score of 6.4.
CVE-2026-91563 is a high-severity vulnerability in the Oracle OLAP component of Oracle Database Server. It affects versions 19.3 through 19.32, 21.3 through 21.23, and 23.4.0 through 23.26.3. The flaw allows a low privileged attacker with the DBMS_AW privilege and network access via Oracle Net to compromise Oracle OLAP, potentially leading to full takeover. The CVSS 3.1 base score is 8.8, indicating high impact on confidentiality, integrity, and availability. Oracle has released patches for this vulnerability as part of the October 2026 Critical Patch Update. Users are strongly advised to apply these patches promptly to mitigate risk.
CVE-2026-91562 is a vulnerability in Oracle PeopleSoft Enterprise FIN Inventory Brazil version 9.1. It allows a low privileged attacker with logon access to the infrastructure to perform unauthorized update, insert, or delete operations on accessible data and potentially cause a partial denial of service. The vulnerability has a CVSS 3.1 base score of 4.4, indicating medium severity with impacts on integrity and availability.
CVE-2026-91559 is a vulnerability in Oracle PeopleSoft Enterprise FIN Manufacturing Brazil version 9.1. It allows a low privileged attacker with logon access to the infrastructure to perform unauthorized update, insert, or delete operations on accessible data and cause a partial denial of service. The vulnerability has a CVSS 3.1 base score of 4.4, indicating medium severity with impacts on integrity and availability.
CVE-2026-91557 is a vulnerability in Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 that allows a low privileged attacker with logon access to the infrastructure to compromise the product. The vulnerability is difficult to exploit but can lead to full takeover of the Oracle Business Intelligence Enterprise Edition instance. It has a CVSS 3.1 base score of 7.0, indicating high severity with impacts on confidentiality, integrity, and availability.
CVE-2026-91555 is a vulnerability in Oracle BI Publisher that allows an unauthenticated attacker with network access via HTTP to perform unauthorized update, insert, or delete operations on accessible data. Successful exploitation requires human interaction from a person other than the attacker and may impact additional Oracle products. The vulnerability affects versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. The CVSS 3.1 base score is 6.1, indicating medium severity with confidentiality and integrity impacts but no availability impact.
CVE-2026-91554 is a vulnerability in Oracle BI Publisher version 12.2.1.4.0 that allows an unauthenticated attacker with network access via HTTP to gain unauthorized read and write access to some data accessible by Oracle BI Publisher. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity impact on confidentiality and integrity. Oracle has published a Critical Patch Update advisory that includes security patches for this and many other vulnerabilities. Customers are strongly advised to apply the available patches promptly.
CVE-2026-91553 is a vulnerability in Oracle's PeopleSoft Enterprise FIN Product Configurator Brazil version 9.1. It allows a low privileged attacker with logon access to the infrastructure to perform unauthorized update, insert, or delete operations on accessible data and cause a partial denial of service. The vulnerability has a CVSS 3.1 base score of 4.4, indicating medium severity with impacts on integrity and availability. No confidentiality impact is noted. The vulnerability requires local access with low complexity and no user interaction.
CVE-2026-91552 is a high-severity vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0. It allows an unauthenticated attacker with network access via HTTP to gain unauthorized access to critical or all accessible data within Oracle WebCenter Sites. The vulnerability has a CVSS 3.1 base score of 7.5, indicating a significant confidentiality impact without requiring privileges or user interaction.
CVE-2026-91550 is a high-severity vulnerability in Oracle Agile Product Lifecycle Management for Process version 6.2.4. It allows a low privileged attacker with network access via HTTP to compromise the product, potentially leading to full takeover. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high impact on confidentiality, integrity, and availability. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, which contains numerous security patches across multiple products.
CVE-2026-91549 is a vulnerability in Oracle Business Intelligence Enterprise Edition (versions 8.2.0.0.0 and 12.2.1.4.0) that allows an unauthenticated attacker with access to the infrastructure where the product runs to compromise it. Exploitation requires human interaction from a third party and can lead to full takeover of the affected system. The vulnerability has a CVSS 3.1 base score of 7.8, indicating high severity with impacts on confidentiality, integrity, and availability.
CVE-2026-91547 is a vulnerability in Oracle GoldenGate's Vendor Access Module affecting multiple versions. It allows a low privileged attacker with access to the infrastructure where Oracle GoldenGate runs to compromise the product. Successful exploitation can lead to unauthorized access to critical or all data accessible by Oracle GoldenGate. The CVSS 3.1 base score is 5.5, indicating a medium severity with high confidentiality impact but no integrity or availability impact.
CVE-2026-91546 is a high-severity vulnerability in Oracle Business Intelligence Enterprise Edition 12.2.1.4.0. It allows an unauthenticated attacker with network access via HTTP to potentially take over the affected system. The vulnerability is difficult to exploit but can lead to full confidentiality, integrity, and availability compromise. Oracle has released security patches addressing this and many other vulnerabilities in its October 2026 Critical Patch Update advisory.
CVE-2026-91545 is a high-severity vulnerability in Oracle Business Intelligence Enterprise Edition affecting versions 8.2.0.0.0 and 12.2.1.4.0. It allows an unauthenticated attacker with access to the infrastructure where the product runs to compromise the system, requiring human interaction from someone other than the attacker. Successful exploitation can lead to complete takeover of the Oracle Business Intelligence Enterprise Edition environment. The vulnerability has a CVSS 3.1 base score of 7.8, reflecting high impact on confidentiality, integrity, and availability.
CVE-2026-91542 is a high-severity vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0. It allows an unauthenticated attacker with network access via HTTP to gain unauthorized access to critical or all accessible data within Oracle WebCenter Sites. The vulnerability has a CVSS 3.1 base score of 7.5, indicating a significant confidentiality impact without requiring user interaction or privileges.
Vulnerability in the PeopleSoft Enterprise FIN Common Objects Brazil product of Oracle PeopleSoft (component: Common Objects). The supported version that is affected is 9.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Common Objects Brazil. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise FIN Common Objects Brazil accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise FIN Common Objects Brazil. CVSS 3.1 Base Score 6.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L).
CVE-2026-91539 is a vulnerability in Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 that allows a low privileged attacker with logon access to the infrastructure to compromise the product. Successful exploitation can lead to complete takeover of Oracle Business Intelligence Enterprise Edition. The vulnerability has a CVSS 3.1 base score of 7.8, indicating high severity with impacts on confidentiality, integrity, and availability.