CVE-2026-91321 is a vulnerability in Oracle E-Business Suite's iProcurement component (Requisition Management) affecting versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to potentially take over the iProcurement application. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity with impacts on confidentiality, integrity, and availability. Oracle has addressed this vulnerability in its October 2026 Critical Patch Update.
CVE-2026-91320 is a vulnerability in Oracle JDeveloper versions 12.2.1.4.0 and 14.1.2.0.0 that allows a high privileged attacker with local access to the infrastructure to compromise Oracle JDeveloper. Exploitation can lead to unauthorized creation, deletion, or modification of critical or accessible data, and can cause a hang or repeated crash resulting in denial of service. The vulnerability is rated medium severity with a CVSS 3.1 base score of 5.7.
CVE-2026-91319 is a vulnerability in Oracle JDeveloper versions 12.2.1.4.0 and 14.1.2.0.0 that allows an unauthenticated attacker with network access via HTTP to potentially compromise the application. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data accessible by Oracle JDeveloper. The vulnerability is rated with a CVSS 3.1 base score of 5.9, indicating a medium severity level with a high impact on integrity but no impact on confidentiality or availability.
CVE-2026-91318 is a vulnerability in Oracle JDeveloper versions 12.2.1.4.0 and 14.1.2.0.0 that allows an unauthenticated attacker with network access via HTTP to compromise the product. Exploitation requires user interaction from someone other than the attacker. Successful exploitation can lead to unauthorized access to critical or all accessible data within Oracle JDeveloper. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level.
CVE-2026-91317 is a vulnerability in Oracle JDeveloper's ADF Databinding component affecting versions 12.2.1.4.0 and 14.1.2.0.0. It allows a low privileged attacker with network access via SOAP to potentially gain unauthorized access to critical data or all data accessible by Oracle JDeveloper and cause a partial denial of service. The vulnerability is rated medium severity with a CVSS 3.1 base score of 5.9.
CVE-2026-91316 is a vulnerability in Oracle E-Business Suite's iProcurement component (E-Content Manager Catalog) affecting versions 12.2.3 through 12.2.15. It allows a high privileged attacker with network access via HTTPS to compromise iProcurement, potentially resulting in full takeover. The vulnerability has a CVSS 3.1 base score of 7.2, indicating high severity with impacts on confidentiality, integrity, and availability. Oracle has released a Critical Patch Update in October 2026 addressing this and many other vulnerabilities.
CVE-2026-91315 is a vulnerability in Oracle JD Edwards EnterpriseOne Tools (Installation Security component) affecting versions 9.2.0.0 through 9.2.26.5. It allows an unauthenticated attacker with logon access to the infrastructure where the tools execute to compromise the product. Successful exploitation requires human interaction from a person other than the attacker and can lead to full takeover of JD Edwards EnterpriseOne Tools. The vulnerability has a CVSS 3.1 base score of 7.8, indicating high severity with impacts on confidentiality, integrity, and availability.
CVE-2026-91314 is a vulnerability in Oracle JD Edwards EnterpriseOne Tools (Installation Security component) affecting versions 9.2.0.0 through 9.2.26.5. It allows an unauthenticated attacker with access to the infrastructure where the tools run to compromise the product. Exploitation requires human interaction from a user other than the attacker and can lead to full takeover of JD Edwards EnterpriseOne Tools. The vulnerability has a CVSS 3.1 base score of 7.8, indicating high severity with impacts on confidentiality, integrity, and availability. Oracle has released security patches addressing this and many other vulnerabilities in its October 2026 Critical Patch Update.
CVE-2026-91313 is a vulnerability in Oracle JD Edwards EnterpriseOne Tools (Installation Security component) affecting versions 9.2.0.0 through 9.2.26.4. It allows an unauthenticated attacker with network access via HTTP to potentially take over the affected software. The vulnerability is rated high severity with a CVSS 3.1 base score of 8.1, impacting confidentiality, integrity, and availability. Exploitation is considered difficult due to the required conditions. Oracle has released patches addressing this vulnerability as part of its October 2026 Critical Patch Update.
CVE-2026-91312 is a vulnerability in Oracle JD Edwards EnterpriseOne Tools (Installation Security component) affecting versions 9.2.0.0 through 9.2.26.5. It allows a low privileged attacker with logon access to the infrastructure where the tools execute to compromise the product. Successful exploitation can lead to unauthorized access to critical data or complete access to all accessible JD Edwards EnterpriseOne Tools data. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity with significant confidentiality impact. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, which provides patches for affected versions.
CVE-2026-91311 is a vulnerability in Oracle JD Edwards EnterpriseOne Tools (Installation Security component) affecting versions 9.2.0.0 through 9.2.26.5. It allows a low privileged attacker with logon access to the infrastructure to compromise the JD Edwards EnterpriseOne Tools product, potentially leading to full takeover. The vulnerability has a CVSS 3.1 base score of 7.8, indicating high severity with impacts on confidentiality, integrity, and availability. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, which provides patches for affected versions.
CVE-2026-91310 is a high-severity vulnerability in Oracle JD Edwards EnterpriseOne Tools (component: Installation SEC) affecting versions 9.2.0.0 through 9.2.26.5. It allows a low privileged attacker with network access via JDENET to compromise the product, potentially resulting in full takeover. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high impact on confidentiality, integrity, and availability. Oracle has released patches addressing this vulnerability as part of its October 2026 Critical Patch Update.
CVE-2026-91309 is a vulnerability in Oracle JD Edwards EnterpriseOne Tools (Interoperability SEC component) affecting versions 9.2.0.0 through 9.2.26.5. It allows an unauthenticated attacker with network access via HTTPS to gain unauthorized access to critical data or complete access to all accessible data within JD Edwards EnterpriseOne Tools. The vulnerability is rated medium severity with a CVSS 3.1 base score of 5.9, primarily impacting confidentiality. Oracle has released security patches addressing this and many other vulnerabilities in their October 2026 Critical Patch Update.
CVE-2026-91308 is a vulnerability in Oracle JD Edwards EnterpriseOne Tools (Installation Security component) affecting versions 9.2.0.0 through 9.2.26.5. It allows an unauthenticated attacker with network access via Oracle Net to gain unauthorized access to critical data or full access to all data accessible through JD Edwards EnterpriseOne Tools. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity with a high confidentiality impact but no impact on integrity or availability.
CVE-2026-91307 is a vulnerability in Oracle JD Edwards EnterpriseOne Tools (Installation Security component) affecting versions 9.2.0.0 through 9.2.26.5. It allows an unauthenticated attacker with network access via Oracle Net to gain unauthorized access to critical or all accessible data within JD Edwards EnterpriseOne Tools. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity due to confidentiality impact. Oracle has released patches for this vulnerability as part of its October 2026 Critical Patch Update.
CVE-2026-91306 is a vulnerability in Oracle JD Edwards EnterpriseOne Tools (Installation Security component) affecting versions 9.2.0.0 through 9.2.26.5. It allows a low privileged attacker with logon access to the infrastructure to compromise the JD Edwards EnterpriseOne Tools, potentially leading to full takeover. The vulnerability has a CVSS 3.1 base score of 7.8, indicating high severity with impacts on confidentiality, integrity, and availability. Oracle has addressed this vulnerability in its October 2026 Critical Patch Update, which includes patches for JD Edwards EnterpriseOne Tools among many other products.
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
CVE-2026-91304 is a high-severity vulnerability in Oracle JD Edwards EnterpriseOne Tools (Installation Security component) affecting versions 9.2.0.0 through 9.2.26.5. It allows an unauthenticated attacker with access to the infrastructure where the software runs to compromise the product, requiring human interaction from a third party. Successful exploitation can lead to full takeover of JD Edwards EnterpriseOne Tools. The vulnerability has a CVSS 3.1 base score of 7.8, indicating high impact on confidentiality, integrity, and availability.
CVE-2026-91303 is a high-severity vulnerability in Oracle JD Edwards EnterpriseOne Tools (Installation Security component) affecting versions 9.2.0.0 through 9.2.26.5. It allows an unauthenticated attacker with network access via HTTP to potentially take over the JD Edwards EnterpriseOne Tools product. Successful exploitation requires user interaction from someone other than the attacker. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high impact on confidentiality, integrity, and availability.
CVE-2026-91302 is a vulnerability in Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5. It allows an unauthenticated attacker with logon access to the infrastructure where the tools execute to cause a partial denial of service. Exploitation requires human interaction from a user other than the attacker. The vulnerability impacts availability but does not affect confidentiality or integrity. The CVSS 3.1 base score is 3.3, indicating low severity.