CVE-2026-91261 is a vulnerability in Oracle WebCenter Content version 14.1.2.0.0 that allows a low privileged attacker with network access via HTTP to gain unauthorized read access to some accessible data. The vulnerability is difficult to exploit and has a low severity with a CVSS 3.1 base score of 3.1, impacting confidentiality only. No known exploits are reported in the wild. Oracle has released a Critical Patch Update advisory recommending timely patching of affected products.
CVE-2026-91260 is a vulnerability in Oracle E-Business Suite's iProcurement component (E-Content Manager Catalog) affecting versions 12.2.3 through 12.2.15. It allows a high privileged attacker with network access via HTTP to compromise iProcurement, potentially leading to full takeover. The vulnerability has a CVSS 3.1 base score of 7.2, indicating high severity with impacts on confidentiality, integrity, and availability.
CVE-2026-91259 is a high-severity vulnerability in Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0. It allows a low privileged attacker with network access via HTTP to compromise the system, potentially leading to complete takeover. The vulnerability affects the OIM Legacy UI component and has a CVSS 3.1 base score of 8.8, indicating high impact on confidentiality, integrity, and availability. Oracle has released patches for this vulnerability as part of its October 2026 Critical Patch Update. Customers are strongly advised to apply these patches promptly to mitigate risk.
CVE-2026-91257 is a vulnerability in Oracle E-Business Suite's iSupport component (Service Requests) affecting versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to gain unauthorized access to critical or all accessible iSupport data. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity with high confidentiality impact but no integrity or availability impact. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory.
CVE-2026-91256 is a vulnerability in Oracle Solaris 11.4 that allows a low privileged attacker with network access via HTTP to cause a denial of service by hanging or crashing the system and to gain unauthorized read access to some data. The vulnerability has a CVSS 3.1 base score of 7.1, indicating high severity with impacts on confidentiality and availability. Oracle has released patches addressing this and many other vulnerabilities in their October 2026 Critical Patch Update advisory.
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Solaris. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Solaris. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Solaris. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Solaris. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
CVE-2026-91253 is a vulnerability in the Oracle Solaris kernel affecting version 11.4. It allows a low privileged attacker with logon access to the infrastructure running Oracle Solaris to compromise the system. Successful exploitation can lead to full takeover of the Oracle Solaris environment. The vulnerability has a CVSS 3.1 base score of 7.8, indicating high severity with impacts on confidentiality, integrity, and availability.
CVE-2026-91252 is a vulnerability in Oracle Solaris 11.4 that allows an unauthenticated attacker with network access via HTTP to cause a denial of service (system hang or crash) and gain unauthorized read access to some data. The vulnerability has a high severity with a CVSS 3.1 base score of 8.2, impacting confidentiality and availability. Oracle has published a Critical Patch Update advisory that includes patches addressing this and many other vulnerabilities. Users are strongly advised to apply the available patches promptly.
CVE-2026-91251 is a critical vulnerability in Oracle SOA Suite versions 12.2.1.4.0 and 14.1.2.0.0. It allows a low privileged attacker with network access via HTTP to fully compromise the Oracle SOA Suite, potentially impacting additional Oracle products. The vulnerability has a CVSS 3.1 base score of 9.9, indicating high confidentiality, integrity, and availability impacts. Oracle has published a Critical Patch Update advisory addressing this and many other vulnerabilities.
CVE-2026-91250 is a critical vulnerability in Oracle SOA Suite versions 12.2.1.4.0 and 14.1.2.0.0 that allows a low privileged attacker with network access via multiple protocols to compromise the product. Successful exploitation can lead to full takeover of Oracle SOA Suite and may impact additional Oracle products. The vulnerability has a CVSS 3.1 base score of 9.9, indicating severe confidentiality, integrity, and availability impacts. Oracle has released patches as part of their October 2026 Critical Patch Update.
CVE-2026-91249 is a vulnerability in Oracle Solaris 11.4 affecting the Libraries component. It allows a low privileged attacker with logon access to the infrastructure running Oracle Solaris to gain unauthorized read access to some accessible data. The vulnerability has a low severity with a CVSS 3.1 base score of 3.3, impacting confidentiality only. Oracle has released security patches as part of its October 2026 Critical Patch Update. Users are strongly advised to apply these patches promptly to mitigate the risk.
CVE-2026-91248 is a vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0. It allows an unauthenticated attacker with network access via HTTP to gain unauthorized read access to some data accessible through the portal. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity with confidentiality impact only. Oracle has published a Critical Patch Update advisory that includes patches addressing this and many other vulnerabilities.
CVE-2026-91247 is a vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0. It allows an unauthenticated attacker with network access via HTTP to compromise the portal. Exploitation is difficult and requires human interaction from a person other than the attacker. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical or accessible data and can cause a partial denial of service. The vulnerability has a CVSS 3.1 base score of 5.9, indicating a medium severity level.
CVE-2026-91246 is a vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 that allows an unauthenticated attacker with network access via HTTP to compromise the portal. Exploitation requires human interaction from a user other than the attacker. Successful exploitation can lead to unauthorized update, insert, or delete access to some accessible data, as well as unauthorized read access to a subset of data. The vulnerability has a CVSS 3.1 base score of 6.1, indicating medium severity. The vulnerability also has a scope change, potentially impacting additional Oracle products. Oracle has published a Critical Patch Update advisory that includes patches for this and other vulnerabilities.
CVE-2026-91245 is a vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 that allows an unauthenticated attacker with network access via HTTP to potentially gain unauthorized access to critical or all accessible data. Exploitation requires human interaction from a user other than the attacker. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity focused on confidentiality impact.
CVE-2026-91244 is a vulnerability in Oracle Solaris 11.4 that allows a low privileged attacker with logon access to cause a hang or frequent crashes, resulting in a denial of service (DoS). The vulnerability is difficult to exploit and does not impact confidentiality or integrity, only availability. The CVSS 3.1 base score is 4.7, indicating medium severity.
CVE-2026-91243 is a critical vulnerability in Oracle Business Process Management Suite versions 12.2.1.4.0 and 14.1.2.0.0. It allows a low privileged attacker with network access via HTTP to compromise the product, potentially impacting additional Oracle products. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data accessible by the suite. The vulnerability has a CVSS 3.1 base score of 9.6, indicating high confidentiality and integrity impacts without availability impact.
CVE-2026-91242 is a high-severity vulnerability in Oracle Solaris 11.4 affecting the Plugins component. It allows a high privileged attacker with local logon to compromise the system, requiring user interaction from another person. The vulnerability can lead to unauthorized creation, deletion, or modification of critical data, impacting confidentiality and integrity. The vulnerability has a CVSS 3.1 base score of 7.4. Oracle has addressed this vulnerability in its October 2026 Critical Patch Update.
CVE-2026-91241 is a critical vulnerability in Oracle Business Intelligence Enterprise Edition affecting versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. It allows a high privileged attacker with network access via HTTP to compromise the product, potentially leading to complete takeover. The vulnerability impacts confidentiality, integrity, and availability, with a CVSS 3.1 base score of 9.1. Oracle has released patches as part of its October 2026 Critical Patch Update.