Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Agile Product Lifecycle Management for Process accessible data as well as unauthorized access to critical data or complete access to all Oracle Agile Product Lifecycle Management for Process accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
CVE-2026-91623 is a vulnerability in Oracle Agile Product Lifecycle Management for Process version 6.2.4. It allows an unauthenticated attacker with network access via HTTP to potentially create, delete, or modify critical data or gain unauthorized access to all accessible data within the product. The vulnerability is rated with a CVSS 3.1 base score of 7.4, indicating high severity with impacts on confidentiality and integrity. The vulnerability is difficult to exploit due to high attack complexity and requires no user interaction. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory.
CVE-2026-91622 is a critical vulnerability in Oracle Agile Product Lifecycle Management for Process version 6.2.4. It allows an unauthenticated attacker with network access via HTTP to compromise the product by exploiting a flaw that requires user interaction. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data, as well as complete unauthorized access to all data accessible by the product. The vulnerability has a CVSS 3.1 base score of 9.3, indicating high confidentiality and integrity impact. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory but has not explicitly listed a patch for this specific version in the provided advisory content.
CVE-2026-91614 is a vulnerability in Oracle Communications Unified Inventory Management versions 7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0, and 8.0.1. It allows a low privileged attacker with logon access to the infrastructure to gain unauthorized read access to some data within the product. The vulnerability has a CVSS 3.1 base score of 3.3, indicating a low severity impact focused on confidentiality. There is no indication of impact on integrity or availability. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, which contains multiple patches across products. However, no specific patch link for this vulnerability was provided in the input data.
CVE-2026-91613 is a vulnerability in Oracle Communications Unified Inventory Management versions 7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0, and 8.0.1. It allows a low privileged attacker with logon access to the infrastructure to gain unauthorized read access to some data within the product. The vulnerability has a CVSS 3.1 base score of 3.3, indicating a low severity impact focused on confidentiality. No integrity or availability impacts are reported. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, which contains numerous patches across many products, but no specific patch link for this vulnerability was provided in the input data.
CVE-2026-91612 is a vulnerability in Oracle Communications Unified Inventory Management versions 7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0, and 8.0.1. It allows a low privileged attacker with logon access to the infrastructure to gain unauthorized read access to some data within the product. The vulnerability has a CVSS 3.1 base score of 3.3, indicating a low severity impact focused on confidentiality. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, which contains numerous patches for multiple products. However, no explicit patch link or fixed version is provided in the data.
CVE-2026-91604 is a vulnerability in Oracle Agile Product Lifecycle Management for Process version 6.2.4. It allows a low privileged attacker with network access via HTTP to potentially take over the affected product. The vulnerability is rated with a CVSS 3.1 base score of 7.5, indicating high severity with impacts on confidentiality, integrity, and availability. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, which contains numerous security patches across many products.
CVE-2026-91573 is a high-severity vulnerability in Oracle Agile Product Lifecycle Management for Process version 6.2.4. It allows an unauthenticated attacker with network access via HTTP to gain unauthorized access to critical data and perform unauthorized updates, inserts, or deletes on accessible data. The vulnerability has a CVSS 3.1 base score of 8.2, indicating significant confidentiality and integrity impacts.
CVE-2026-91565 is a vulnerability in Oracle Agile Product Lifecycle Management for Process version 6.2.4. It allows a low privileged attacker with network access via HTTP to potentially gain unauthorized access to critical data, modify some data, and cause a partial denial of service. The vulnerability is rated with a CVSS 3.1 base score of 6.4, indicating a medium severity level.
CVE-2026-91550 is a high-severity vulnerability in Oracle Agile Product Lifecycle Management for Process version 6.2.4. It allows a low privileged attacker with network access via HTTP to fully compromise the product, impacting confidentiality, integrity, and availability. The vulnerability has a CVSS 3.1 base score of 8.8. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, which contains numerous security patches across multiple products.
CVE-2026-91521 is a high-severity vulnerability in Oracle Agile Product Lifecycle Management for Process version 6.2.4. It allows a low privileged attacker with network access via HTTP to potentially take over the affected product. The vulnerability impacts confidentiality, integrity, and availability with a CVSS 3.1 base score of 8.8. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, which contains numerous security patches across multiple products.
CVE-2026-91520 is a high-severity vulnerability in Oracle Agile Product Lifecycle Management for Process version 6.2.4. It allows a low privileged attacker with network access via HTTP to fully compromise the affected product, impacting confidentiality, integrity, and availability. The vulnerability is easily exploitable and can lead to complete takeover of the system.
CVE-2026-91517 is a vulnerability in the Oracle Management Pack for Oracle GoldenGate (EM Plugin component) affecting versions 13.4.1.0.1 through 13.5.2.0.6. It allows an unauthenticated attacker with physical access to the communication segment attached to the hardware running the product to compromise it. Successful exploitation requires human interaction by someone other than the attacker and can lead to full takeover of the Oracle Management Pack for Oracle GoldenGate. The vulnerability has a CVSS 3.1 base score of 8.0, indicating high severity with impacts on confidentiality, integrity, and availability.
CVE-2026-91515 is a vulnerability in Oracle Agile Product Lifecycle Management for Process version 6.2.4. It allows a low privileged attacker with network access via HTTP to potentially take over the affected product. The vulnerability is difficult to exploit but has high impact on confidentiality, integrity, and availability. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory.
CVE-2026-91512 is a vulnerability in Oracle Agile Product Lifecycle Management for Process version 6.2.4. It allows a high privileged attacker with network access via HTTP to compromise the product, potentially resulting in complete takeover. The vulnerability has a CVSS 3.1 base score of 7.2, indicating high severity with impacts on confidentiality, integrity, and availability. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, recommending customers apply patches promptly.
CVE-2026-91485 is a vulnerability in Oracle PeopleSoft Enterprise FIN Cash Management version 9.2. It requires a high privileged attacker with logon access and human interaction from another user to exploit. Successful exploitation can lead to unauthorized read, insert, update, or delete access to some accessible data and partial denial of service. The vulnerability has a low CVSS score of 3.8, indicating limited impact on confidentiality, integrity, and availability.
CVE-2026-91441 is a vulnerability in Oracle Siebel CRM's Customer Order Management component affecting versions 17.0 through 26.9. It allows a low privileged attacker with network access via HTTP to perform unauthorized read, insert, update, or delete operations on accessible data and cause partial denial of service. Exploitation requires user interaction by a person other than the attacker. The vulnerability impacts confidentiality, integrity, and availability with a CVSS 3.1 base score of 6.5.
CVE-2026-91399 is a vulnerability in Oracle's Primavera P6 Enterprise Project Portfolio Management Web Access component. It affects multiple supported versions from 21.12.0.0 through 25.12.8. A low privileged attacker with network access via HTTP can exploit this flaw to gain unauthorized ability to update, insert, or delete certain accessible data within the application. The CVSS 3.1 base score is 4.3, indicating a medium severity primarily impacting data integrity without affecting confidentiality or availability.
Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web Access). Supported versions that are affected are 21.12.0.0-21.12.21.9, 22.12.0.0-22.12.21.4, 23.12.0-23.12.20, 24.12.0-24.12.16 and 25.12.0-25.12.8. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera P6 Enterprise Project Portfolio Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Primavera P6 Enterprise Project Portfolio Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Primavera P6 Enterprise Project Portfolio Management accessible data as well as unauthorized update, insert or delete access to some of Primavera P6 Enterprise Project Portfolio Management accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N).
CVE-2026-91358 is a high-severity vulnerability in Oracle Business Process Management Suite versions 12.2.1.4.0 and 14.1.2.0.0. It allows an unauthenticated attacker with network access via HTTP to gain unauthorized access to critical data and perform unauthorized data modifications. The vulnerability impacts confidentiality and integrity but not availability. Oracle has published a Critical Patch Update advisory addressing this and many other vulnerabilities.