Threat database

CVE-2026-87372 is a vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 that allows a low privileged attacker with logon access to the infrastructure to compromise the product. Successful exploitation can lead to unauthorized access to critical or all accessible data within Oracle WebCenter Content. The vulnerability has a CVSS 3.1 base score of 6.5, indicating medium severity, with a confidentiality impact but no impact on integrity or availability. The vulnerability may also affect additional Oracle products due to scope change. Oracle has released patches for this and many other vulnerabilities in its October 2026 Critical Patch Update advisory.

CVE-2026-87371 is a vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0. It allows an unauthenticated attacker with physical access to the communication segment attached to the hardware running the software to compromise the system. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or full access to all data accessible by Oracle WebCenter Content. The vulnerability has a CVSS 3.1 base score of 6.8, indicating a medium severity level.

CVE-2026-87370 is a vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0. It allows a low privileged attacker with network access via HTTP to potentially compromise the product. Exploitation requires human interaction from a user other than the attacker. Successful exploitation can lead to unauthorized access to critical data and unauthorized modification of some data within Oracle WebCenter Content. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level.

Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Service Bus. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Service Bus. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

CVE-2026-87367 is a vulnerability in the JAXP component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. It allows an unauthenticated attacker with network access via multiple protocols to perform unauthorized update, insert, or delete operations on accessible data. The vulnerability is difficult to exploit and affects specific versions of Oracle Java SE and GraalVM products. The CVSS 3.1 base score is 3.7, indicating a low severity impact primarily on data integrity. The vulnerability can be exploited through APIs, including web services and sandboxed Java applications that run untrusted code. Oracle has published a Critical Patch Update advisory that includes patches for this and other vulnerabilities.

CVE-2026-87366 is a vulnerability in Oracle Applications Framework versions 12.2.3 through 12.2.15. It allows a high privileged attacker with network access via HTTP to compromise the framework, potentially leading to unauthorized access to critical data. The vulnerability has a CVSS 3.1 base score of 4.9, indicating a medium severity focused on confidentiality impact. Oracle has released patches for this vulnerability as part of its October 2026 Critical Patch Update.

CVE-2026-87365 is a vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0. It allows a low privileged attacker with network access via HTTP to cause a denial of service by hanging or crashing the application. The vulnerability impacts availability but does not affect confidentiality or integrity. The CVSS 3.1 base score is 6.5, indicating a medium severity level. Oracle has released patches for this and many other vulnerabilities in its October 2026 Critical Patch Update.

CVE-2026-87364 is a high-severity vulnerability in Oracle Service Bus versions 12.2.1.4.0 and 14.1.2.0.0. It allows a low privileged attacker with network access via HTTP to compromise the Oracle Service Bus, potentially resulting in full takeover. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high impact on confidentiality, integrity, and availability. Oracle has addressed this vulnerability in its October 2026 Critical Patch Update, which includes numerous security patches across Oracle products.

CVE-2026-87363 is a vulnerability in Oracle Payroll, part of Oracle E-Business Suite, affecting versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to potentially compromise Oracle Payroll. The vulnerability is difficult to exploit but can lead to full takeover of the Oracle Payroll component. The CVSS 3.1 base score is 7.5, indicating high severity with impacts on confidentiality, integrity, and availability. Oracle has published a Critical Patch Update advisory that includes patches for this and many other vulnerabilities.

CVE-2026-87362 is a vulnerability in Oracle Agile PLM version 9.3.6 that allows a low privileged attacker with network access via HTTP to gain unauthorized access to critical or all accessible data within Oracle Agile PLM. The vulnerability affects the component handling folders, files, and attachments. It has a CVSS 3.1 base score of 6.5, indicating a medium severity with high confidentiality impact but no integrity or availability impact. Oracle has published a Critical Patch Update advisory that includes patches for this and many other vulnerabilities.

CVE-2026-87361 is a vulnerability in Oracle WebCenter Content 12.2.1.4.0 that allows a low privileged attacker with network access via HTTP to perform unauthorized update, insert, or delete operations on accessible data. The vulnerability has a CVSS 3.1 base score of 4.3, indicating a medium severity with integrity impact only. No confidentiality or availability impacts are reported. Oracle has published a Critical Patch Update advisory that includes patches for this and many other vulnerabilities.

CVE-2026-87360 is a vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 that allows an unauthenticated attacker with network access via HTTP to potentially gain unauthorized access to critical data. Exploitation is difficult and requires human interaction from a person other than the attacker. The vulnerability impacts confidentiality but does not affect integrity or availability. The CVSS 3.1 base score is 5.3, indicating medium severity.

CVE-2026-87359 is a high-severity vulnerability in Oracle Service Bus versions 12.2.1.4.0 and 14.1.2.0.0. It allows a low privileged attacker with network access via HTTP to compromise the Oracle Service Bus, potentially leading to full takeover. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high impact on confidentiality, integrity, and availability. Oracle has addressed this vulnerability in its October 2026 Critical Patch Update. Users are strongly advised to apply the provided patches promptly to mitigate risk.

CVE-2026-87358 is a vulnerability in Oracle General Ledger component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to potentially compromise the system. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data, unauthorized read access to some data, and the ability to cause a denial of service by hanging or crashing the application. The vulnerability is rated with a CVSS 3.1 base score of 7.1, indicating high severity.

CVE-2026-87357 is a vulnerability in Oracle E-Business Suite's Order Capture component affecting versions 12.2.3 through 12.2.15. It allows a high privileged attacker with network access via HTTP to compromise the Order Capture system. The vulnerability has a CVSS 3.1 base score of 7.2, indicating high severity with impacts on confidentiality, integrity, and availability. Successful exploitation can lead to complete takeover of the Order Capture component.

CVE-2026-87356 is a high-severity vulnerability in Oracle Applications Platform Engineering versions 12.2.3 through 12.2.15. It allows a low privileged attacker with logon access to the infrastructure where the platform executes to compromise and potentially take over the Applications Platform Engineering component. The vulnerability impacts confidentiality, integrity, and availability with a CVSS 3.1 base score of 7.8. Oracle has included this fix in their October 2026 Critical Patch Update.

CVE-2026-87355 is a vulnerability in Oracle PeopleSoft Enterprise PeopleTools (Panel Processor component) affecting versions 8.61 through 8.63. It allows a low-privileged attacker with network access via HTTP to perform unauthorized update, insert, delete, and read operations on some accessible data. Exploitation is difficult and requires human interaction from someone other than the attacker. The vulnerability has a CVSS 3.1 base score of 4.4, indicating medium severity with limited confidentiality and integrity impact and no availability impact. Oracle has released patches as part of its October 2026 Critical Patch Update. Users are strongly advised to apply these patches promptly.

CVE-2026-87354 is a vulnerability in the Oracle TimesTen In-Memory Database Kubernetes Operator component affecting versions 22.1 through 22.1.40.0 and 26.1 through 26.1.1.2.0. It allows a low privileged attacker with network access via HTTPS to gain unauthorized read access to some data within the database. The vulnerability has a CVSS 3.1 base score of 4.3, indicating a medium severity with confidentiality impact only. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, which contains multiple security patches across Oracle products.

CVE-2026-87353 is a vulnerability in Oracle PeopleSoft Enterprise PeopleTools (component: Porting) affecting versions 8.61 through 8.63. It allows an unauthenticated attacker with logon access to the infrastructure where PeopleTools runs to potentially compromise the product. Exploitation requires human interaction from a user other than the attacker. Successful exploitation can lead to unauthorized read, update, insert, or delete access to some accessible data and may cause a partial denial of service. The CVSS 3.1 base score is 4.5, indicating medium severity.

CVE-2026-87352 is a vulnerability in Oracle PeopleSoft Enterprise PeopleTools (LDAP component) versions 8.61 through 8.63. It allows a low privileged attacker with logon access to the infrastructure to perform unauthorized read and write operations on some PeopleSoft accessible data. The vulnerability has a CVSS 3.1 base score of 4.4, indicating medium severity with impacts on confidentiality and integrity but no impact on availability.