CVE-2026-101603 is a high-severity vulnerability in Oracle Communications Unified Inventory Management affecting versions 7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0, and 8.0.1. It allows a low privileged attacker with network access via HTTP to potentially take over the product. The vulnerability impacts confidentiality, integrity, and availability, with a CVSS 3.1 base score of 7.5. Oracle has published a Critical Patch Update advisory that includes patches addressing this and many other vulnerabilities.
CVE-2026-101602 is a high-severity vulnerability in Oracle Agile Product Lifecycle Management for Process version 6.2.4. It allows a low privileged attacker with network access via HTTP to potentially take over the affected product. Exploitation requires user interaction from someone other than the attacker. The vulnerability impacts confidentiality, integrity, and availability with a CVSS 3.1 base score of 8.0. Oracle has released patches addressing this and many other vulnerabilities in their October 2026 Critical Patch Update.
CVE-2026-101601 is a vulnerability in Oracle GoldenGate's Vendor Access Module affecting versions 21.3 through 21.23. It allows a low privileged attacker with logon access to the infrastructure where Oracle GoldenGate runs to compromise the software. Successful exploitation can lead to unauthorized access to critical or all data accessible by Oracle GoldenGate. The vulnerability has a CVSS 3.1 base score of 5.5, indicating a medium severity focused on confidentiality impact.
CVE-2026-101600 is a vulnerability in Oracle TimesTen In-Memory Database versions 26.1 through 26.1.1.3.0. It allows a low privileged attacker with logon access to the infrastructure hosting the database to potentially perform unauthorized read and write operations on some accessible data. The vulnerability is difficult to exploit and has a low CVSS score of 3.6, indicating limited confidentiality and integrity impacts without availability impact.
CVE-2026-101599 is a high-severity vulnerability in Oracle VM VirtualBox version 7.2.20. It allows a low privileged attacker with logon access to the host infrastructure to potentially take over Oracle VM VirtualBox. Exploitation is difficult and requires human interaction from a person other than the attacker. The vulnerability has a scope change, meaning it may impact additional products beyond VirtualBox. The CVSS 3.1 base score is 7.5, indicating significant confidentiality, integrity, and availability impacts.
CVE-2026-101598 is a vulnerability in Oracle VM VirtualBox version 7.2.20 that allows a low privileged attacker with logon access to the host infrastructure to compromise the VirtualBox software. Successful exploitation can lead to full takeover of Oracle VM VirtualBox. The vulnerability has a CVSS 3.1 base score of 7.8, indicating high severity with impacts on confidentiality, integrity, and availability. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, which contains numerous security patches across multiple products.
CVE-2026-101597 is a vulnerability in Oracle ZFS Storage Appliance Kit version 8.8 that allows an unauthenticated attacker with network access via HTTP to gain unauthorized read access to some data accessible by the appliance. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity impact focused on confidentiality. Oracle has published a Critical Patch Update advisory that includes patches for multiple vulnerabilities, including this one.
CVE-2026-101596 is a high-severity vulnerability in Oracle Agile Product Lifecycle Management for Process version 6.2.4. It allows a low-privileged attacker with network access via HTTP to fully compromise the affected product, resulting in complete takeover. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high impact on confidentiality, integrity, and availability. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, which provides patches addressing this and many other vulnerabilities.
CVE-2026-101595 is a vulnerability in Oracle Agile Product Lifecycle Management for Process version 6.2.4. It allows a low privileged attacker with network access via HTTP to perform unauthorized read and write operations on accessible data. Successful exploitation requires user interaction from someone other than the attacker and may impact additional Oracle products beyond the initial scope. The vulnerability has a CVSS 3.1 base score of 5.4, indicating medium severity with confidentiality and integrity impacts.
CVE-2026-101594 is a high-severity vulnerability in Oracle Agile Product Lifecycle Management for Process version 6.2.4. It allows a low privileged attacker with network access via HTTP to compromise the product, potentially leading to full takeover. The vulnerability impacts confidentiality, integrity, and availability with a CVSS 3.1 base score of 8.8. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, indicating that patches addressing this and other vulnerabilities are available.
CVE-2026-101593 is a high-severity vulnerability in Oracle Agile Product Lifecycle Management for Process version 6.2.4. It allows a low privileged attacker with network access via HTTP to compromise the product, potentially leading to unauthorized creation, deletion, or modification of critical data. The vulnerability also permits unauthorized access to all accessible data and can cause a partial denial of service. The CVSS 3.1 base score is 8.3, reflecting high confidentiality and integrity impacts and a low availability impact. Oracle has published a Critical Patch Update advisory addressing this and many other vulnerabilities.
CVE-2026-101592 is a medium severity vulnerability in Oracle Agile Product Lifecycle Management for Process version 6.2.4. It allows a low privileged attacker with network access via HTTP to perform unauthorized read and write operations on accessible data. Successful exploitation requires user interaction from someone other than the attacker and may impact additional Oracle products beyond the initial scope. The vulnerability has a CVSS 3.1 base score of 5.4, reflecting limited confidentiality and integrity impacts without availability impact.
CVE-2026-101591 is a vulnerability in Oracle Agile Product Lifecycle Management for Process version 6.2.4. It allows a low privileged attacker with network access via HTTP to gain unauthorized read access to some accessible data within the product. The vulnerability has a CVSS 3.1 base score of 4.3, indicating a medium severity with confidentiality impact only. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory.
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-microprofile-security). Supported versions that are affected are 4.0.0-4.5.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Helidon accessible data as well as unauthorized access to critical data or complete access to all Helidon accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
CVE-2026-101589 is a vulnerability in Oracle Utilities Network Management System that allows an unauthenticated attacker with network access via HTTPS to gain unauthorized read access to some accessible data. The affected versions include 2.6.0.1.0 through 2.6.0.1.12, 2.6.0.2.0 through 2.6.0.2.10, and 25.12.0.0.0 through 25.12.0.0.2. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity impact focused on confidentiality. Oracle has released a Critical Patch Update that includes patches for this and many other vulnerabilities, and customers are strongly advised to apply these patches promptly.
CVE-2026-101588 is a medium severity vulnerability in Oracle Helidon WebSocket component affecting versions 4.0.0 through 4.5.5 and 27.0.0. It allows an unauthenticated attacker with network access via HTTP to gain unauthorized read access to some Helidon accessible data. The vulnerability has a CVSS 3.1 base score of 5.3, indicating limited confidentiality impact without integrity or availability effects. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, which provides patches for affected versions.
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webclient-http1). Supported versions that are affected are 4.0.0-4.5.5 and 27.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Helidon. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
CVE-2026-101586 is a medium severity vulnerability in Oracle Helidon versions 4.0.0 through 4.5.5 and version 27.0.0. It allows an unauthenticated attacker with network access via HTTP to gain unauthorized read access to some Helidon accessible data. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a confidentiality impact without integrity or availability effects. Oracle has released security patches addressing this issue as part of its October 2026 Critical Patch Update.
CVE-2026-101585 is a high-severity vulnerability in Oracle Helidon versions 3.0.0 through 3.2.21. It allows an unauthenticated attacker with network access via HTTP to compromise Helidon, potentially impacting additional products. Successful exploitation can lead to unauthorized update, insert, or delete operations on some Helidon-accessible data, as well as unauthorized read access to a subset of that data. The vulnerability has a CVSS 3.1 base score of 7.2, reflecting its impact on confidentiality and integrity with no impact on availability.
CVE-2026-101584 is a vulnerability in Oracle Helidon versions 4.0.0 through 4.5.5 and 27.0.0 affecting the helidon-webclient-websocket component. It allows an unauthenticated attacker with network access via HTTP to gain unauthorized read access to some Helidon data and cause a partial denial of service. The vulnerability has a CVSS 3.1 base score of 6.5, indicating medium severity with impacts on confidentiality and availability. Oracle has released patches for this vulnerability as part of its October 2026 Critical Patch Update.