CVE-2026-101607 is a medium severity vulnerability affecting MySQL Server and MySQL Cluster, specifically the Server Optimizer component. It impacts multiple MySQL versions including 8.0, 8.4, and 9.7, as well as various Ubuntu-packaged versions of MySQL 5.5. Oracle has included this vulnerability in its October 2026 Critical Patch Update, which contains numerous security patches across many Oracle products. No public exploit or active exploitation has been reported. Oracle strongly recommends applying the available patches promptly to mitigate the risk.
CVE-2026-101599 is a high severity vulnerability affecting specific versions of Oracle VM VirtualBox. It has a CVSS 3.1 score of 7.5, indicating a significant risk. The vulnerability requires local attack vector with high attack complexity, low privileges, and user interaction, but can impact confidentiality, integrity, and availability with a scope change. Multiple versions of VirtualBox 5.0.x are affected. No public exploits or patches are currently documented in the provided data.
CVE-2026-101598 is a high-severity vulnerability affecting specific versions of Oracle VM VirtualBox. It has a CVSS 3.1 base score of 7.8, indicating significant impact on confidentiality, integrity, and availability. The vulnerability requires local access with low complexity and no user interaction. It affects multiple specific versions of VirtualBox, primarily in the 5.0.x series. There is no information about public exploits or vendor patches in the provided data.
A buffer overflow vulnerability exists in the gf_ac4_parser_bs function of the gpac media processing tool. This flaw can cause a denial of service by crashing the application. The vulnerability affects multiple specific versions of gpac. The CVSS score is 5.5, indicating medium severity with local attack vector and no confidentiality or integrity impact.
Thunderbird's chat feature with XMPP accounts had a vulnerability where attribute values were not escaped when serializing outgoing XMPP stanzas. This allowed a remote XMPP user to send crafted requests that caused Thunderbird to inject arbitrary stanzas into the user's connection, which the server would process as if sent by the user. This could enable sending messages or changing contact and subscription settings without user interaction. The issue was fixed in Thunderbird versions 158.0.1 and 153.5.1.
CVE-2026-91664 is a vulnerability in Oracle Essbase version 21.8.3.0.0 that allows an unauthenticated attacker with network access via TCP to cause a denial of service by hanging or crashing the application. The vulnerability impacts availability but does not affect confidentiality or integrity. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, which contains numerous security patches across multiple products. However, no explicit patch version or fix details for this specific vulnerability are provided in the advisory content.
CVE-2026-91614 is a vulnerability in Oracle Communications Unified Inventory Management versions 7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0, and 8.0.1. It allows a low privileged attacker with logon access to the infrastructure to gain unauthorized read access to some data within the product. The vulnerability has a CVSS 3.1 base score of 3.3, indicating a low severity impact focused on confidentiality. There is no indication of impact on integrity or availability. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, which contains multiple patches across products. However, no specific patch link for this vulnerability was provided in the input data.
CVE-2026-91613 is a vulnerability in Oracle Communications Unified Inventory Management versions 7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0, and 8.0.1. It allows a low privileged attacker with logon access to the infrastructure to gain unauthorized read access to some data within the product. The vulnerability has a CVSS 3.1 base score of 3.3, indicating a low severity impact focused on confidentiality. No integrity or availability impacts are reported. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, which contains numerous patches across many products, but no specific patch link for this vulnerability was provided in the input data.
CVE-2026-91612 is a vulnerability in Oracle Communications Unified Inventory Management versions 7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0, and 8.0.1. It allows a low privileged attacker with logon access to the infrastructure to gain unauthorized read access to some data within the product. The vulnerability has a CVSS 3.1 base score of 3.3, indicating a low severity impact focused on confidentiality. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, which contains numerous patches for multiple products. However, no explicit patch link or fixed version is provided in the data.
CVE-2026-91608 is a high-severity vulnerability in Oracle BI Publisher's web server component affecting versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. It allows an unauthenticated attacker with network access via HTTP to gain unauthorized access to critical or all accessible data in Oracle BI Publisher. The vulnerability has a CVSS 3.1 base score of 7.5, indicating a significant confidentiality impact without requiring user interaction or privileges. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, which contains numerous security patches across multiple products. However, the specific patch availability for this vulnerability is not explicitly stated in the advisory content provided.
CVE-2026-91574 is a vulnerability in Oracle BI Publisher that allows a low privileged attacker with network access via HTTP to gain unauthorized access to critical data. The affected versions include 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity with high confidentiality impact but no impact on integrity or availability.
CVE-2026-91517 is a vulnerability in the Oracle Management Pack for Oracle GoldenGate (EM Plugin component) affecting versions 13.4.1.0.1 through 13.5.2.0.6. It allows an unauthenticated attacker with physical access to the communication segment attached to the hardware running the product to compromise it. Successful exploitation requires human interaction by someone other than the attacker and can lead to full takeover of the Oracle Management Pack for Oracle GoldenGate. The vulnerability has a CVSS 3.1 base score of 8.0, indicating high severity with impacts on confidentiality, integrity, and availability.
CVE-2026-91497 is a vulnerability in Oracle PeopleSoft Enterprise PeopleTools (versions 8.61 through 8.63) that allows an unauthenticated attacker with network access via HTTP to perform unauthorized update, insert, or delete operations on accessible data. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity primarily impacting data integrity. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, recommending customers apply patches promptly to mitigate risk.
CVE-2026-91483 is a vulnerability in Oracle Outside In Technology version 8.5.8 that allows an unauthenticated attacker with logon access to the infrastructure to compromise the product. Exploitation requires user interaction from a person other than the attacker. Successful exploitation can lead to full takeover of Oracle Outside In Technology, impacting confidentiality, integrity, and availability. The vulnerability has a CVSS 3.1 base score of 7.8, indicating high severity.
CVE-2026-91475 is a vulnerability in Oracle Outside In Technology version 8.5.8 that allows a low privileged attacker with logon access to compromise the product. Exploitation can lead to unauthorized creation, deletion, or modification of critical or accessible data, unauthorized read access to some data, and partial denial of service. The vulnerability has a CVSS 3.1 base score of 6.6, indicating a medium severity level.
CVE-2026-91458 is a vulnerability in Oracle Outside In Technology version 8.5.8 that allows an unauthenticated attacker with logon access to the infrastructure to potentially take over the Oracle Outside In Technology component. Exploitation requires user interaction from a person other than the attacker. The vulnerability has a CVSS 3.1 base score of 7.8, indicating high severity with impacts on confidentiality, integrity, and availability.
CVE-2026-91457 is a vulnerability in Oracle Outside In Technology version 8.5.8 that allows an unauthenticated attacker with logon access to the infrastructure to compromise the product. Exploitation requires user interaction by someone other than the attacker. Successful exploitation can lead to full takeover of Oracle Outside In Technology, impacting confidentiality, integrity, and availability. The vulnerability has a CVSS 3.1 base score of 7.8, indicating high severity.
CVE-2026-91448 is a vulnerability in the Oracle Siebel CRM Deployment product affecting versions 17.0 through 26.9. It allows an unauthenticated attacker with network access via HTTP to gain unauthorized access to critical data within Siebel CRM Deployment. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity with a significant confidentiality impact but no impact on integrity or availability.
CVE-2026-91406 is a vulnerability in Oracle Outside In Technology version 8.5.8 that allows an unauthenticated attacker with network access via HTTP to potentially take over the product. Exploitation is difficult and requires user interaction from someone other than the attacker. The vulnerability impacts confidentiality, integrity, and availability with a CVSS 3.1 base score of 7.5. Oracle has published a Critical Patch Update advisory but does not explicitly confirm a patch for this specific version in the provided data.
CVE-2026-91405 is a vulnerability in Oracle Outside In Technology version 8.5.8, specifically in the Outside In PDF Export SDK component. It allows an unauthenticated attacker with network access via HTTP to potentially compromise the product. Exploitation is difficult and requires user interaction from someone other than the attacker. Successful exploitation can lead to full takeover of the Oracle Outside In Technology component. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity with impacts on confidentiality, integrity, and availability.