CVE-2026-83394 is a vulnerability in Oracle Demand Planning versions 12.1 and 12.2 that allows a low privileged attacker with network access via HTTP to compromise the product. Exploitation requires user interaction from a person other than the attacker. Successful exploitation can lead to unauthorized access to critical data or full access to all data accessible by Oracle Demand Planning. The vulnerability has a CVSS 3.1 base score of 6.8, indicating a medium severity with significant confidentiality impact but no integrity or availability impact. Oracle has released patches addressing this vulnerability as part of its October 2026 Critical Patch Update. Users are strongly advised to apply these patches promptly to mitigate the risk.
CVE-2026-83393 is a vulnerability in Oracle Product Hub within Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to compromise Oracle Product Hub. The vulnerability is difficult to exploit but can lead to a full takeover of Oracle Product Hub and may impact additional Oracle products. The CVSS 3.1 base score is 8.5, indicating high severity with confidentiality, integrity, and availability impacts. Oracle has released patches addressing this vulnerability in their October 2026 Critical Patch Update.
CVE-2026-83392 is a vulnerability in Oracle Applications Manager component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to gain unauthorized read access to some data accessible by Oracle Applications Manager. The vulnerability is difficult to exploit and has a low CVSS 3.1 base score of 3.1, indicating limited confidentiality impact without integrity or availability effects. Oracle has released patches for affected versions as part of its October 2026 Critical Patch Update.
CVE-2026-83391 is a vulnerability in Oracle HRMS (US) component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to perform unauthorized update, insert, delete, and read operations on accessible data. Successful exploitation requires human interaction from a user other than the attacker and may impact additional Oracle products. The vulnerability has a CVSS 3.1 base score of 5.4, indicating medium severity with confidentiality and integrity impacts but no availability impact.
CVE-2026-83390 is a vulnerability in Oracle Applications Manager within Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to gain unauthorized read access to some Oracle Applications Manager data and to cause a partial denial of service. The vulnerability is rated medium severity with a CVSS 3.1 base score of 4.2, reflecting limited confidentiality and availability impacts.
CVE-2026-83389 is a vulnerability in Oracle HRMS (UK) component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to perform unauthorized update, insert, delete, and read operations on accessible data. Successful exploitation requires human interaction from a person other than the attacker. The vulnerability has a CVSS 3.1 base score of 5.4, indicating medium severity, with impacts on confidentiality and integrity but no impact on availability. Oracle has released patches addressing this vulnerability as part of their October 2026 Critical Patch Update.
CVE-2026-83388 is a vulnerability in Oracle Applications Manager within Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a high privileged attacker with network access via HTTP to gain unauthorized read access to some data accessible by Oracle Applications Manager. The vulnerability is rated as low severity with a CVSS 3.1 base score of 2.2, reflecting limited confidentiality impact and no impact on integrity or availability.
CVE-2026-83387 is a vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition affecting the JDBC component. It allows an unauthenticated attacker with network access via multiple protocols to potentially gain unauthorized access to critical or all accessible data. The vulnerability is difficult to exploit and impacts confidentiality without affecting integrity or availability. It can be exploited through APIs, including web services supplying data to these APIs, and affects sandboxed Java Web Start applications or applets running untrusted code relying on the Java sandbox. The CVSS 3.1 base score is 5.9, indicating a medium severity. Oracle has released patches as part of their October 2026 Critical Patch Update, strongly recommending timely application of these patches.
CVE-2026-83386 is a vulnerability in Oracle HRMS (US) component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to gain unauthorized access to critical or all accessible data in Oracle HRMS (US). The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity with high confidentiality impact but no integrity or availability impact. Oracle has released security patches addressing this and many other vulnerabilities in its October 2026 Critical Patch Update advisory.
CVE-2026-83385 is a vulnerability in Oracle HRMS (US) component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to gain unauthorized access to critical or all accessible data within Oracle HRMS (US). The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity with high confidentiality impact but no impact on integrity or availability.
CVE-2026-83384 is a vulnerability in Oracle HRMS (US) component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to gain unauthorized access to critical or all accessible data within Oracle HRMS (US). The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity with high confidentiality impact but no integrity or availability impact. Oracle has released security patches addressing this and many other vulnerabilities in their October 2026 Critical Patch Update advisory.
CVE-2026-83383 is a vulnerability in Oracle HRMS (US) within the Oracle E-Business Suite Internal Operations component. It affects versions 12.2.3 through 12.2.15. The flaw allows a low privileged attacker with network access via HTTP to gain unauthorized access to critical or all accessible data within Oracle HRMS (US). The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity with high confidentiality impact but no integrity or availability impact. Oracle has released a Critical Patch Update addressing this and many other vulnerabilities, and customers are strongly advised to apply patches promptly.
CVE-2026-83382 is a vulnerability in Oracle Report Manager versions 12.2.3 through 12.2.15 that allows a low privileged attacker with network access via HTTPS to gain unauthorized read access to some data accessible by Oracle Report Manager. The vulnerability has a CVSS 3.1 base score of 4.3, indicating a medium severity primarily impacting confidentiality. No integrity or availability impacts are reported. Oracle has published a Critical Patch Update advisory that includes security patches addressing this and other vulnerabilities.
CVE-2026-83381 is a medium severity vulnerability in Oracle Java SE affecting specific versions including 8u503, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, and 27, as well as certain Oracle GraalVM versions. It allows an unauthenticated attacker with network access via multiple protocols to gain unauthorized read and write access to some data accessible by Oracle Java SE. The vulnerability is difficult to exploit and impacts confidentiality and integrity but not availability. It can be exploited through APIs, such as web services, or sandboxed Java Web Start applications or applets that run untrusted code relying on the Java sandbox for security.
CVE-2026-83380 is a medium severity vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition affecting the JAAS component. It allows an unauthenticated attacker with network access via multiple protocols to gain unauthorized read access to some accessible data. The vulnerability can be exploited through APIs, including via web services or sandboxed Java applications that run untrusted code. The CVSS 3.1 base score is 5.3, indicating a confidentiality impact without integrity or availability effects. Oracle has released patches for this vulnerability as part of their October 2026 Critical Patch Update.
CVE-2026-83379 is a high-severity vulnerability in the Oracle Weblogic Server Proxy Plug-in affecting versions 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0. It allows an unauthenticated attacker with network access via HTTP to compromise the plug-in, potentially leading to unauthorized creation, deletion, or modification of critical data. The vulnerability has a CVSS 3.1 base score of 8.7, indicating significant confidentiality and integrity impacts. Attacks exploiting this vulnerability may also affect additional Oracle products due to scope change. Oracle has released patches as part of its October 2026 Critical Patch Update, and customers are strongly advised to apply these patches promptly.
CVE-2026-83378 is a vulnerability in the Oracle Java SE Compiler component affecting versions 21.0.12.1, 25.0.4.1, and 27. It allows an unauthenticated attacker with network access via multiple protocols to gain unauthorized read and write access to some Oracle Java SE accessible data. Exploitation requires supplying data to specific APIs without using untrusted Java Web Start applications or applets. The vulnerability has a CVSS 3.1 base score of 4.8, indicating medium severity with confidentiality and integrity impacts but no availability impact. Oracle has published a Critical Patch Update advisory addressing this and many other vulnerabilities and strongly recommends applying patches promptly.
CVE-2026-83377 is a vulnerability in Oracle HRMS (US) component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to perform unauthorized update, insert, delete, and read operations on accessible data. Exploitation requires user interaction from a person other than the attacker. The vulnerability has a CVSS 3.1 base score of 5.4, indicating medium severity with confidentiality and integrity impacts. The vulnerability may also affect additional products beyond Oracle HRMS (US).
CVE-2026-83376 is a vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition affecting the JSSE component. It allows an unauthenticated attacker with network access via TLS to potentially perform unauthorized update, insert, or delete operations on accessible data. The vulnerability is difficult to exploit and impacts data integrity without affecting confidentiality or availability. It applies to specific versions of Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition. The CVSS 3.1 base score is 3.7, indicating a low severity. Oracle has released a Critical Patch Update addressing this and many other vulnerabilities, and customers are strongly advised to apply patches promptly.
CVE-2026-83375 is a vulnerability in Oracle PeopleSoft Enterprise HCM Human Resources version 9.2. It allows a high privileged attacker with network access via HTTP to compromise the system. Exploitation requires human interaction from a person other than the attacker. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data, unauthorized read access to some data, and the ability to cause denial of service by crashing the application. The CVSS 3.1 base score is 6.0, indicating a medium severity level.