CVE-2026-91537 is a vulnerability in Oracle Solaris 11.4 affecting the Utility component. It allows a low privileged attacker with logon access to the infrastructure running Oracle Solaris to compromise the system, potentially resulting in full takeover. The vulnerability has a CVSS 3.1 base score of 7.8, indicating high severity with impacts on confidentiality, integrity, and availability.
CVE-2026-91536 is a vulnerability in Oracle SOA Suite versions 12.2.1.4.0 and 14.1.2.0.0 that allows a low privileged attacker with network access via HTTPS to perform unauthorized update, insert, delete, and read operations on accessible data. It also enables the attacker to cause a partial denial of service. The vulnerability is rated with a CVSS 3.1 base score of 5.0, indicating medium severity.
CVE-2026-91535 is a high-severity vulnerability in Oracle Business Intelligence Enterprise Edition (BI Search component) affecting versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. It allows a low privileged attacker with network access via HTTP to compromise the product, potentially resulting in full takeover. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high impact on confidentiality, integrity, and availability. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, which contains security patches for multiple products including Oracle BI Enterprise Edition. Customers are strongly advised to apply the available patches promptly to mitigate this risk.
CVE-2026-91534 is a high-severity vulnerability in Oracle Business Intelligence Enterprise Edition (OBIEE) versions 8.2.0.0.0, 12.2.1.4.0, and 26.1.0.0.0. It allows an unauthenticated attacker with network access via HTTP to cause denial of service by hanging or crashing the application and to gain unauthorized read and write access to some accessible data. The vulnerability impacts confidentiality, integrity, and availability with a CVSS 3.1 base score of 8.6. Oracle has released a Critical Patch Update addressing this and many other vulnerabilities. Users are strongly advised to apply the official patches promptly.
CVE-2026-91532 is a high-severity vulnerability in Oracle Applications Manager, part of Oracle E-Business Suite. It affects versions 12.2.3 through 12.2.15. The flaw allows a low privileged attacker with network access via HTTP to compromise Oracle Applications Manager, potentially leading to full takeover of the application. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high impact on confidentiality, integrity, and availability. Oracle has released patches as part of its October 2026 Critical Patch Update. Customers are strongly advised to apply these patches promptly to mitigate the risk.
CVE-2026-91530 is a vulnerability in the Admin Client Executable component of Oracle GoldenGate versions 23.4 through 23.26.2.0.0. It allows a high privileged attacker with network access via HTTP to potentially gain unauthorized access to critical or all accessible data within Oracle GoldenGate. The vulnerability is rated with a CVSS 3.1 base score of 4.4, indicating a medium severity focused on confidentiality impact. The vulnerability is difficult to exploit and does not affect integrity or availability.
CVE-2026-91528 is a vulnerability in Oracle BI Publisher version 12.2.1.4.0 that allows a low privileged attacker with network access via HTTPS to gain unauthorized read access to some data accessible by Oracle BI Publisher. The vulnerability has a CVSS 3.1 base score of 4.3, indicating a medium severity with confidentiality impact only. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, which contains numerous security patches across Oracle products.
CVE-2026-91527 is a vulnerability in Oracle ZFS Storage Appliance Kit version 8.8 that allows a low privileged attacker with network access via HTTP to compromise the system. The vulnerability has a high CVSS score of 8.8, indicating severe impacts on confidentiality, integrity, and availability. Successful exploitation can lead to complete takeover of the affected appliance. Oracle has published a Critical Patch Update advisory addressing this and many other vulnerabilities, recommending customers apply patches promptly.
CVE-2026-91526 is a vulnerability in Oracle BI Publisher that allows an unauthenticated attacker with network access via HTTP to potentially compromise the product. Exploitation is difficult and requires human interaction from a person other than the attacker. Successful exploitation can lead to unauthorized update, insert, or delete access to some Oracle BI Publisher accessible data, as well as unauthorized read access to a subset of that data. The vulnerability affects versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. The CVSS 3.1 base score is 4.7, indicating a medium severity with confidentiality and integrity impacts but no availability impact. Oracle has released a Critical Patch Update that includes fixes for this and many other vulnerabilities.
CVE-2026-91524 is a vulnerability in Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 that allows a low privileged attacker with network access via HTTP to cause a partial denial of service. The vulnerability has a CVSS 3.1 base score of 4.3, indicating a medium severity impact focused on availability. Oracle has released security patches addressing this and many other vulnerabilities in their October 2026 Critical Patch Update advisory.
CVE-2026-91523 is a medium severity vulnerability in Oracle Business Intelligence Enterprise Edition that allows a low privileged attacker with network access via HTTP to perform unauthorized read and write operations on accessible data. Exploitation requires user interaction from a person other than the attacker. The vulnerability affects versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. The impact includes unauthorized update, insert, or delete access to some data and unauthorized read access to a subset of data. Oracle has released patches for this and many other vulnerabilities in its October 2026 Critical Patch Update advisory.
CVE-2026-91521 is a high-severity vulnerability in Oracle Agile Product Lifecycle Management for Process version 6.2.4. It allows a low privileged attacker with network access via HTTP to compromise the product, potentially leading to full takeover. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high impact on confidentiality, integrity, and availability.
CVE-2026-91520 is a high-severity vulnerability in Oracle Agile Product Lifecycle Management for Process version 6.2.4. It allows a low privileged attacker with network access via HTTP to compromise the product, potentially leading to full takeover. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high impact on confidentiality, integrity, and availability. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, which contains numerous security patches across multiple products. Customers are strongly advised to apply the relevant patches promptly to mitigate this risk.
CVE-2026-91519 is a vulnerability in Oracle PeopleSoft Enterprise PeopleTools Report Distribution component affecting versions 8.61 through 8.63. It allows a low privileged attacker with network access via HTTP to gain unauthorized access to critical or all accessible data within PeopleSoft Enterprise PeopleTools. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity with high confidentiality impact but no integrity or availability impact. Oracle has released security patches addressing this vulnerability as part of their October 2026 Critical Patch Update.
CVE-2026-91518 is a medium severity vulnerability in Oracle BI Publisher that allows a low privileged attacker with network access via HTTP to gain unauthorized read and write access to some accessible data. The vulnerability affects versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0 of Oracle BI Publisher. Successful exploitation can lead to unauthorized update, insert, or delete operations on accessible data, as well as unauthorized reading of a subset of data. The CVSS 3.1 base score is 5.4, indicating a moderate impact on confidentiality and integrity without affecting availability. Oracle has released a Critical Patch Update that includes patches for this vulnerability, and customers are strongly advised to apply these patches promptly.
CVE-2026-91517 is a high-severity vulnerability in Oracle Management Pack for Oracle GoldenGate versions 13.4.1.0.1 through 13.5.2.0.6. It allows an unauthenticated attacker with access to the physical communication segment of the hardware running the software to compromise the product. Successful exploitation requires human interaction from a third party. The vulnerability can lead to full takeover of the Oracle Management Pack for Oracle GoldenGate.
CVE-2026-91515 is a vulnerability in Oracle Agile Product Lifecycle Management for Process version 6.2.4. It allows a low privileged attacker with network access via HTTP to potentially take over the affected product. The vulnerability is rated with a CVSS 3.1 base score of 7.5, indicating high severity with impacts on confidentiality, integrity, and availability.
CVE-2026-91514 is a vulnerability in Oracle BI Publisher affecting versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. It allows a low privileged attacker with network access via HTTP to gain unauthorized access to critical data or all data accessible by Oracle BI Publisher. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity impact focused on confidentiality. Oracle has released security patches addressing this and many other vulnerabilities in their October 2026 Critical Patch Update advisory.
CVE-2026-91512 is a high-severity vulnerability in Oracle Agile Product Lifecycle Management for Process version 6.2.4. It allows a high privileged attacker with network access via HTTP to compromise the product, potentially leading to full takeover. The vulnerability impacts confidentiality, integrity, and availability with a CVSS 3.1 base score of 7.2. Oracle has acknowledged this issue in their October 2026 Critical Patch Update advisory.
CVE-2026-91511 is a vulnerability in Oracle Purchasing component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to compromise Oracle Purchasing. Successful exploitation can lead to unauthorized access to critical data and unauthorized update, insert, or delete operations on Oracle Purchasing accessible data. The vulnerability has a CVSS 3.1 base score of 7.1, indicating high severity with confidentiality and integrity impacts. Oracle has released security patches addressing this vulnerability as part of its October 2026 Critical Patch Update.