CVE-2026-91341 is a critical vulnerability in Oracle Outside In Technology version 8.5.8. It allows an unauthenticated attacker with network access via HTTP to compromise the product, potentially leading to unauthorized creation, deletion, or modification of critical data. The vulnerability also enables denial of service by causing the product to hang or crash repeatedly. The CVSS 3.1 base score is 9.1, indicating high severity with significant integrity and availability impacts. Oracle has released a Critical Patch Update advisory that includes patches for multiple vulnerabilities, including this one.
CVE-2026-91340 is a high-severity vulnerability in Oracle Outside In Technology version 8.5.8. It allows a low privileged attacker with network access via HTTP to compromise the product, potentially leading to full takeover. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high impact on confidentiality, integrity, and availability. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, which contains numerous security patches across multiple products.
CVE-2026-91339 is a vulnerability in Oracle E-Business Suite's iSupport component (Service Requests) affecting versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to gain unauthorized access to critical or all accessible iSupport data. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity primarily impacting confidentiality. Oracle has released a Critical Patch Update addressing this and many other vulnerabilities, urging customers to apply patches promptly.
CVE-2026-91338 is a vulnerability in Oracle E-Business Suite's iSupport component affecting versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to perform unauthorized creation, deletion, or modification of critical or accessible data, as well as unauthorized read access to some data. The vulnerability has a CVSS 3.1 base score of 7.1, indicating high severity with confidentiality and integrity impacts. Oracle has released patches for this vulnerability as part of its October 2026 Critical Patch Update.
CVE-2026-91337 is a high-severity vulnerability in Oracle E-Business Suite's iProcurement component affecting versions 12.2.3 through 12.2.15. It allows an unauthenticated attacker with network access via HTTPS to potentially compromise the system. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or full access to all data accessible through iProcurement. The vulnerability has a CVSS 3.1 base score of 7.4, indicating significant confidentiality and integrity impacts but no availability impact.
CVE-2026-91336 is a vulnerability in Oracle Solaris 11.4 that allows a low privileged attacker with logon access to the infrastructure to compromise the system. The vulnerability impacts the Utility component and can lead to unauthorized creation, deletion, or modification of critical or accessible data. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity with integrity impact but no confidentiality or availability impact. The vulnerability also has scope change potential, affecting additional Oracle products beyond Solaris. Oracle has published a Critical Patch Update advisory that includes security patches for multiple products, including Oracle Solaris.
CVE-2026-91335 is a low-severity vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition affecting the AWT component. It allows a low privileged attacker with network access via multiple protocols to gain unauthorized read access to certain accessible data. Exploitation requires human interaction from a user other than the attacker and typically affects Java deployments running untrusted code in sandboxed environments such as Java Web Start applications or applets. Server-side Java deployments running only trusted code are not affected. The vulnerability has a CVSS 3.1 base score of 2.6, indicating limited confidentiality impact without integrity or availability effects.
CVE-2026-91334 is a low-severity vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition affecting the ImageIO component. It allows an unauthenticated attacker with network access via multiple protocols to gain unauthorized read access to certain accessible data. The vulnerability can be exploited through APIs, including via web services or sandboxed Java applications that run untrusted code relying on the Java sandbox. The CVSS 3.1 base score is 3.7, indicating a low impact on confidentiality with no integrity or availability impact.
CVE-2026-91333 is a low-severity vulnerability in Oracle Java SE Security component affecting versions 21.0.12.1, 25.0.4.1, and 27. It allows an unauthenticated attacker with network access via multiple protocols to perform unauthorized update, insert, or delete operations on some data accessible by Oracle Java SE. The vulnerability can be exploited through APIs, including via web services or sandboxed Java Web Start applications and applets that run untrusted code relying on the Java sandbox. The CVSS 3.1 base score is 3.7, indicating low impact primarily on integrity. Oracle has released a Critical Patch Update addressing this and many other vulnerabilities, and strongly recommends applying patches promptly.
Vulnerability in Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).
CVE-2026-91331 is a vulnerability in Oracle PeopleSoft Enterprise CC Common Application Objects version 9.2. It allows a high privileged attacker with network access via HTTP to perform unauthorized update, insert, delete, and read operations on some accessible data within the application. The vulnerability has a CVSS 3.1 base score of 3.8, indicating low severity with limited confidentiality and integrity impact and no availability impact. Oracle has published a Critical Patch Update advisory that includes patches for this and other vulnerabilities.
CVE-2026-91330 is a vulnerability in Oracle JD Edwards EnterpriseOne Tools (Installation Security component) affecting versions 9.2.0.0 through 9.2.26.5. It allows a low privileged attacker with logon access to the infrastructure to cause a partial denial of service (partial DOS) of the JD Edwards EnterpriseOne Tools. The vulnerability has a CVSS 3.1 base score of 3.3, indicating a low severity impact focused on availability.
CVE-2026-91329 is a vulnerability in Oracle JD Edwards EnterpriseOne Tools (Installation Security component) affecting versions 9.2.0.0 through 9.2.26.5. It allows an unauthenticated attacker with logon access to the infrastructure where the tools execute to compromise the product. Successful exploitation requires human interaction from a user other than the attacker. The vulnerability can lead to unauthorized creation, deletion, or modification of critical data, unauthorized read access to some data, and denial of service via application hang or crash. The CVSS 3.1 base score is 6.5, indicating a medium severity level.
CVE-2026-91328 is a vulnerability in Oracle's JD Edwards EnterpriseOne Tools (Deployment SEC component) affecting versions 9.2.0.0 through 9.2.26.5. It allows an unauthenticated attacker with logon access to the infrastructure where the tools execute to compromise the product. Successful exploitation requires human interaction from a person other than the attacker and can lead to full takeover of JD Edwards EnterpriseOne Tools. The vulnerability has a CVSS 3.1 base score of 7.8, indicating high severity with impacts on confidentiality, integrity, and availability.
CVE-2026-91327 is a vulnerability in Oracle JD Edwards EnterpriseOne Tools (Installation Security component) affecting versions 9.2.0.0 through 9.2.26.5. It allows an unauthenticated attacker with access to the physical communication segment attached to the hardware running the software to compromise the JD Edwards EnterpriseOne Tools. Successful exploitation can lead to full takeover of the affected product. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity with impacts on confidentiality, integrity, and availability.
CVE-2026-91326 is a high-severity vulnerability in Oracle JD Edwards EnterpriseOne Tools (versions 9.2.0.0 through 9.2.26.4). It allows an unauthenticated attacker with access to the physical communication segment of the hardware running the software to compromise the JD Edwards EnterpriseOne Tools. Successful exploitation requires human interaction from a person other than the attacker and may impact additional products beyond the initial scope. The vulnerability can lead to full takeover of the JD Edwards EnterpriseOne Tools, affecting confidentiality, integrity, and availability.
CVE-2026-91325 is a vulnerability in Oracle JD Edwards EnterpriseOne Tools (Installation Security component) affecting versions 9.2.0.0 through 9.2.26.5. It allows an unauthenticated attacker with network access via HTTP to gain unauthorized access to critical or all accessible data within JD Edwards EnterpriseOne Tools. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity with a high confidentiality impact but no impact on integrity or availability.
CVE-2026-91324 is a vulnerability in Oracle Solaris 11.4 affecting the Libraries component. It allows an unauthenticated attacker with logon access to the infrastructure where Oracle Solaris runs to cause a denial of service (DoS) by hanging or crashing the system. Exploitation requires human interaction from someone other than the attacker. The vulnerability has a CVSS 3.1 base score of 4.7, indicating a medium severity focused on availability impact.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVE-2026-91322 is a vulnerability in Oracle JDeveloper versions 12.2.1.4.0 and 14.1.2.0.0 that allows a low privileged attacker with logon access to the infrastructure where Oracle JDeveloper runs to gain unauthorized read access to some data accessible by Oracle JDeveloper. The vulnerability has a CVSS 3.1 base score of 3.3, indicating a low severity confidentiality impact without affecting integrity or availability.