CVE-2026-91628 is a vulnerability in Oracle Communications Billing and Revenue Management (BRM) versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, and 15.2.0.0.0. It allows a low privileged attacker with logon access to the infrastructure to compromise the BRM system, potentially gaining unauthorized access to critical or all accessible data. The vulnerability has a CVSS 3.1 base score of 5.5, indicating a medium severity with high confidentiality impact but no integrity or availability impact. Oracle has released patches for this and many other vulnerabilities in its October 2026 Critical Patch Update advisory.
CVE-2026-91627 is a high-severity vulnerability in Oracle Communications Billing and Revenue Management (versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, and 15.2.0.0.0). It allows a low privileged attacker with logon access to the infrastructure to fully compromise the product, potentially leading to complete takeover. The vulnerability impacts confidentiality, integrity, and availability with a CVSS 3.1 base score of 7.8. Oracle has published a Critical Patch Update advisory addressing this and many other vulnerabilities, recommending timely patching. No known exploits in the wild have been reported yet.
CVE-2026-91625 is a high-severity vulnerability in Oracle Agile Product Lifecycle Management for Process version 6.2.4. It allows an unauthenticated attacker with network access via HTTP to gain unauthorized access to critical data and perform unauthorized update, insert, or delete operations on some accessible data. The vulnerability has a CVSS 3.1 base score of 8.2, indicating significant confidentiality and integrity impacts. Oracle has acknowledged this vulnerability in its October 2026 Critical Patch Update advisory and recommends applying security patches promptly.
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Agile Product Lifecycle Management for Process accessible data as well as unauthorized access to critical data or complete access to all Oracle Agile Product Lifecycle Management for Process accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
CVE-2026-91623 is a vulnerability in Oracle Agile Product Lifecycle Management for Process version 6.2.4. It allows an unauthenticated attacker with network access via HTTP to potentially compromise the product. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data, resulting in high confidentiality and integrity impacts. The vulnerability is rated with a CVSS 3.1 base score of 7.4, indicating high severity. Oracle has included this vulnerability in its October 2026 Critical Patch Update, which provides patches for affected products.
CVE-2026-91622 is a critical vulnerability in Oracle Agile Product Lifecycle Management for Process version 6.2.4. It allows an unauthenticated attacker with network access via HTTP to compromise the product. Successful exploitation requires human interaction from a user other than the attacker and can lead to unauthorized creation, deletion, or modification of critical data, as well as unauthorized access to all accessible data. The vulnerability has a CVSS 3.1 base score of 9.3, indicating high confidentiality and integrity impacts. Oracle has released patches addressing this vulnerability as part of their October 2026 Critical Patch Update.
CVE-2026-91617 is a vulnerability in Oracle Middleware Common Libraries and Tools, specifically in the Remote Diagnostic Agent component. It affects versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The flaw allows a low privileged attacker with logon access to the infrastructure to compromise the middleware component, potentially leading to unauthorized access to critical or all accessible data. The CVSS 3.1 base score is 5.5, indicating a medium severity with a high confidentiality impact but no integrity or availability impact. Oracle has released patches as part of its October 2026 Critical Patch Update, and customers are strongly advised to apply these patches promptly.
CVE-2026-91616 is a low severity vulnerability in Oracle Middleware Common Libraries and Tools, specifically in the Remote Diagnostic Agent component. It affects versions 12.2.1.4.0 and 14.1.1.0.0. The vulnerability allows an unauthenticated attacker with network access via HTTP to gain unauthorized read access to some accessible data. The vulnerability is difficult to exploit and does not impact integrity or availability.
CVE-2026-91615 is a vulnerability in the Java VM component of Oracle Database Server affecting versions 19.3 through 19.32, 21.3 through 21.23, and 23.4.0 through 23.26.3. It allows a low privileged attacker with no privileges and network access via SOCKS5 to compromise the Java VM. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data accessible by the Java VM. The vulnerability has a CVSS 3.1 base score of 6.3, indicating a medium severity with integrity impact. Oracle has released patches addressing this vulnerability as part of their October 2026 Critical Patch Update.
CVE-2026-91614 is a low-severity vulnerability in Oracle Communications Unified Inventory Management versions 7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0, and 8.0.1. It allows a low privileged attacker with logon access to the infrastructure to gain unauthorized read access to some data within the product. The vulnerability does not impact integrity or availability. Oracle has published a Critical Patch Update advisory that includes patches for this and many other vulnerabilities.
CVE-2026-91613 is a vulnerability in Oracle Communications Unified Inventory Management versions 7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0, and 8.0.1. It allows a low privileged attacker with logon access to the infrastructure to gain unauthorized read access to some data within the product. The vulnerability has a low CVSS score of 3.3, indicating limited confidentiality impact without integrity or availability effects. Oracle has published a Critical Patch Update advisory that includes patches for multiple vulnerabilities, including this one. Customers are strongly advised to apply the available patches promptly to mitigate this risk.
CVE-2026-91612 is a vulnerability in Oracle Communications Unified Inventory Management versions 7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0, and 8.0.1. It allows a low privileged attacker with logon access to the infrastructure to gain unauthorized read access to some data within the product. The vulnerability has a low severity with a CVSS 3.1 base score of 3.3, impacting confidentiality but not integrity or availability.
CVE-2026-91610 is a high-severity vulnerability in Oracle REST Data Services versions 24.2.0 through 26.2.2. It allows a low privileged attacker with network access via HTTP to compromise the service, potentially leading to full takeover. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high impact on confidentiality, integrity, and availability. Oracle has released patches for this vulnerability as part of their October 2026 Critical Patch Update.
CVE-2026-91609 is a vulnerability in Oracle REST Data Services (component: Graph QL) affecting versions 24.2.0 through 26.2.1. It allows a low privileged attacker with network access via HTTP to gain unauthorized access to critical or all accessible data. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity with a high confidentiality impact but no integrity or availability impact. Oracle has released a Critical Patch Update addressing this and many other vulnerabilities, and customers are strongly advised to apply the patches promptly.
CVE-2026-91608 is a high-severity vulnerability in Oracle BI Publisher affecting versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. It allows an unauthenticated attacker with network access via HTTP to gain unauthorized access to critical or all accessible data within Oracle BI Publisher. The vulnerability has a CVSS 3.1 base score of 7.5, indicating a significant confidentiality impact without requiring privileges or user interaction.
CVE-2026-91607 is a vulnerability in Oracle Business Intelligence Enterprise Edition (OBIEE) versions 8.2.0.0.0 and 26.01.0.0.0. It allows a low privileged attacker with network access via HTTP to gain unauthorized read access to some data accessible through OBIEE. The vulnerability has a CVSS 3.1 base score of 4.3, indicating a medium severity with confidentiality impact only. There is no indication of integrity or availability impact. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory.
CVE-2026-91604 is a vulnerability in Oracle Agile Product Lifecycle Management for Process version 6.2.4. It allows a low privileged attacker with network access via HTTP to potentially take over the affected product. The vulnerability is rated with a CVSS 3.1 base score of 7.5, indicating high severity with impacts on confidentiality, integrity, and availability. The vulnerability is difficult to exploit due to the required conditions. Oracle has included this vulnerability in its October 2026 Critical Patch Update, which provides security patches for this and many other vulnerabilities.
CVE-2026-91600 is a vulnerability in Oracle Business Intelligence Enterprise Edition version 26.01.0.0.0. It allows a low privileged attacker with network access via HTTP to gain unauthorized read access to some accessible data within the product. The vulnerability has a CVSS 3.1 base score of 4.3, indicating a medium severity with confidentiality impact only. No integrity or availability impacts are reported. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory.
CVE-2026-91598 is a vulnerability in Oracle Business Intelligence Enterprise Edition affecting versions 8.2.0.0.0 and 26.01.0.0.0. It allows a low privileged attacker with network access via HTTP to gain unauthorized read access to some accessible data. The vulnerability has a CVSS 3.1 base score of 4.3, indicating a medium severity with confidentiality impact only. Oracle has released security patches addressing this and many other vulnerabilities in their October 2026 Critical Patch Update advisory.
CVE-2026-91597 is a high-severity vulnerability in Oracle Business Intelligence Enterprise Edition versions 8.2.0.0.0 and 26.01.0.0.0. It allows an unauthenticated attacker with access to the physical communication segment attached to the hardware running the software to compromise the system. Successful exploitation can lead to full takeover of Oracle Business Intelligence Enterprise Edition and may impact additional Oracle products. The vulnerability has a CVSS 3.1 base score of 8.3, indicating high confidentiality, integrity, and availability impacts. Oracle has released patches addressing this and many other vulnerabilities in its October 2026 Critical Patch Update. Users are strongly advised to apply the official patches promptly.