CVE-2026-91590 is a medium severity vulnerability in Oracle BI Publisher's Web Service API that allows a low privileged attacker with network access via HTTP to perform unauthorized update, insert, delete, and read operations on some accessible data. Successful exploitation requires human interaction from a user other than the attacker and may impact additional Oracle products beyond BI Publisher. The vulnerability affects Oracle BI Publisher versions 8.2.0.0.0 and 26.01.0.0.0. The CVSS 3.1 base score is 5.4, reflecting confidentiality and integrity impacts without availability impact.
CVE-2026-91588 is a vulnerability in Oracle Business Intelligence Enterprise Edition (BI Search component) versions 8.2.0.0.0 and 12.2.1.4.0. It allows an unauthenticated attacker with network access via HTTP to compromise the product, requiring user interaction from a person other than the attacker. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical or accessible data. The CVSS 3.1 base score is 6.5, indicating a medium severity with integrity impact but no confidentiality or availability impact. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, recommending patching and staying on supported versions.
CVE-2026-91582 is a vulnerability in Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 affecting the BI Search component. It allows an unauthenticated attacker with network access via HTTP to cause a partial denial of service. The vulnerability is rated as low severity with a CVSS 3.1 base score of 3.7, primarily impacting availability. Exploitation is considered difficult.
CVE-2026-91579 is a high-severity vulnerability in Oracle BI Publisher affecting versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. It allows an unauthenticated attacker with network access via HTTP to compromise the product, requiring user interaction from a person other than the attacker. Successful exploitation can lead to full takeover of Oracle BI Publisher. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high impact on confidentiality, integrity, and availability.
CVE-2026-91577 is a vulnerability in Oracle Business Intelligence Enterprise Edition version 12.2.1.4.0 that allows a low privileged attacker with network access via HTTP to compromise the product. Successful exploitation can lead to unauthorized read, update, insert, or delete access to some accessible data. The vulnerability has a CVSS 3.1 base score of 6.4, indicating medium severity with confidentiality and integrity impacts. Oracle has published a Critical Patch Update advisory addressing this and other vulnerabilities.
CVE-2026-91576 is a vulnerability in Oracle Business Intelligence Enterprise Edition version 12.2.1.4.0. It allows a low privileged attacker with network access via HTTP to compromise the product, potentially gaining unauthorized access to critical or all accessible data. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity focused on confidentiality impact. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, which provides patches addressing this and many other vulnerabilities.
CVE-2026-91574 is a vulnerability in Oracle BI Publisher that allows a low privileged attacker with network access via HTTP to gain unauthorized access to critical or all accessible data. The affected versions are 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity with high confidentiality impact but no integrity or availability impact. Oracle has released patches for this and many other vulnerabilities in their October 2026 Critical Patch Update advisory. Users are strongly advised to apply the available patches promptly to mitigate this risk.
CVE-2026-91573 is a vulnerability in Oracle Agile Product Lifecycle Management for Process version 6.2.4. It allows an unauthenticated attacker with network access via HTTP to gain unauthorized access to critical data and perform unauthorized update, insert, or delete operations on some accessible data. The vulnerability has a CVSS 3.1 base score of 8.2, indicating high severity with significant confidentiality and integrity impacts.
CVE-2026-91568 is a vulnerability in the Oracle Database Server RDBMS component affecting versions 23.4.0 through 23.26.3. It allows a low privileged attacker with Create Session privilege and network access via Oracle Net to compromise the database. Successful exploitation can lead to unauthorized access to critical or all accessible data in the RDBMS. The vulnerability has a CVSS 3.1 base score of 7.7, indicating high severity with significant confidentiality impact. Oracle has released patches addressing this vulnerability as part of its October 2026 Critical Patch Update.
CVE-2026-91565 is a vulnerability in Oracle Agile Product Lifecycle Management for Process version 6.2.4. It allows a low privileged attacker with network access via HTTP to potentially gain unauthorized access to critical data, perform unauthorized data modifications, and cause partial denial of service. The vulnerability is rated medium severity with a CVSS 3.1 base score of 6.4.
CVE-2026-91563 is a high-severity vulnerability in the Oracle OLAP component of Oracle Database Server. It affects versions 19.3 through 19.32, 21.3 through 21.23, and 23.4.0 through 23.26.3. The flaw allows a low privileged attacker with the DBMS_AW privilege and network access via Oracle Net to compromise Oracle OLAP, potentially leading to full takeover. The CVSS 3.1 base score is 8.8, indicating high impact on confidentiality, integrity, and availability. Oracle has released patches for this vulnerability as part of the October 2026 Critical Patch Update. Users are strongly advised to apply these patches promptly to mitigate risk.
CVE-2026-91562 is a vulnerability in Oracle PeopleSoft Enterprise FIN Inventory Brazil version 9.1. It allows a low privileged attacker with logon access to the infrastructure to perform unauthorized update, insert, or delete operations on accessible data and potentially cause a partial denial of service. The vulnerability has a CVSS 3.1 base score of 4.4, indicating medium severity with impacts on integrity and availability.
CVE-2026-91559 is a vulnerability in Oracle PeopleSoft Enterprise FIN Manufacturing Brazil version 9.1. It allows a low privileged attacker with logon access to the infrastructure to perform unauthorized update, insert, or delete operations on accessible data and cause a partial denial of service. The vulnerability has a CVSS 3.1 base score of 4.4, indicating medium severity with impacts on integrity and availability.
CVE-2026-91557 is a vulnerability in Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 that allows a low privileged attacker with logon access to the infrastructure to compromise the product. The vulnerability is difficult to exploit but can lead to full takeover of the Oracle Business Intelligence Enterprise Edition instance. It has a CVSS 3.1 base score of 7.0, indicating high severity with impacts on confidentiality, integrity, and availability.
CVE-2026-91555 is a vulnerability in Oracle BI Publisher that allows an unauthenticated attacker with network access via HTTP to perform unauthorized update, insert, or delete operations on accessible data. Successful exploitation requires human interaction from a person other than the attacker and may impact additional Oracle products. The vulnerability affects versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. The CVSS 3.1 base score is 6.1, indicating medium severity with confidentiality and integrity impacts but no availability impact.
CVE-2026-91554 is a vulnerability in Oracle BI Publisher version 12.2.1.4.0 that allows an unauthenticated attacker with network access via HTTP to gain unauthorized read and write access to some data accessible by Oracle BI Publisher. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity impact on confidentiality and integrity. Oracle has published a Critical Patch Update advisory that includes security patches for this and many other vulnerabilities. Customers are strongly advised to apply the available patches promptly.
CVE-2026-91553 is a vulnerability in Oracle's PeopleSoft Enterprise FIN Product Configurator Brazil version 9.1. It allows a low privileged attacker with logon access to the infrastructure to perform unauthorized update, insert, or delete operations on accessible data and cause a partial denial of service. The vulnerability has a CVSS 3.1 base score of 4.4, indicating medium severity with impacts on integrity and availability. No confidentiality impact is noted. The vulnerability requires local access with low complexity and no user interaction.
CVE-2026-91552 is a high-severity vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0. It allows an unauthenticated attacker with network access via HTTP to gain unauthorized access to critical or all accessible data within Oracle WebCenter Sites. The vulnerability has a CVSS 3.1 base score of 7.5, indicating a significant confidentiality impact without requiring privileges or user interaction.
CVE-2026-91550 is a high-severity vulnerability in Oracle Agile Product Lifecycle Management for Process version 6.2.4. It allows a low privileged attacker with network access via HTTP to compromise the product, potentially leading to full takeover. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high impact on confidentiality, integrity, and availability. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, which contains numerous security patches across multiple products.
CVE-2026-91549 is a vulnerability in Oracle Business Intelligence Enterprise Edition (versions 8.2.0.0.0 and 12.2.1.4.0) that allows an unauthenticated attacker with access to the infrastructure where the product runs to compromise it. Exploitation requires human interaction from a third party and can lead to full takeover of the affected system. The vulnerability has a CVSS 3.1 base score of 7.8, indicating high severity with impacts on confidentiality, integrity, and availability.