Threat database

CVE-2026-101539 is a vulnerability in Oracle Payroll within Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to gain unauthorized access to critical or all accessible data in Oracle Payroll. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity with high confidentiality impact but no impact on integrity or availability. Oracle has released a Critical Patch Update addressing this and many other vulnerabilities, and customers are strongly advised to apply the patches promptly.

CVE-2026-101538 is a vulnerability in Oracle Order Management within Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to gain unauthorized access to critical or all accessible data in Oracle Order Management. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity with a high confidentiality impact but no integrity or availability impact. Oracle has released security patches addressing this and many other vulnerabilities in their October 2026 Critical Patch Update advisory.

CVE-2026-101537 is a critical vulnerability in Oracle Solaris 11.4 affecting the Utility component. It allows an unauthenticated attacker with network access via TCP to fully compromise the system, resulting in complete takeover. The vulnerability has a CVSS 3.1 base score of 9.8, indicating high impact on confidentiality, integrity, and availability. Oracle has released patches addressing this and many other vulnerabilities in its October 2026 Critical Patch Update. Users are strongly advised to apply the available security patches promptly to mitigate this risk.

CVE-2026-101536 is a vulnerability in Oracle Cost Management, part of the Oracle E-Business Suite. It affects versions 12.2.3 through 12.2.15. The flaw allows a low privileged attacker with network access via HTTP to potentially take over Oracle Cost Management. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity with impacts on confidentiality, integrity, and availability.

CVE-2026-101535 is a vulnerability in Oracle Sales Foundation, part of Oracle E-Business Suite, affecting versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to potentially compromise the product. The vulnerability is difficult to exploit but can lead to full takeover of Oracle Sales Foundation. It has a CVSS 3.1 base score of 7.5, indicating high severity with impacts on confidentiality, integrity, and availability. Oracle has released patches for this vulnerability as part of its October 2026 Critical Patch Update.

CVE-2026-101534 is a high-severity vulnerability in Oracle EDI Gateway versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to compromise the Oracle EDI Gateway. Successful exploitation can lead to unauthorized access to critical data and unauthorized modification (update, insert, delete) of some accessible data. The vulnerability may also impact additional Oracle products beyond EDI Gateway. Oracle has published a Critical Patch Update advisory addressing this and other vulnerabilities.

CVE-2026-101533 is a vulnerability in Oracle EDI Gateway versions 12.2.3 through 12.2.15 that allows a high privileged attacker with network access via HTTP to compromise the system. The vulnerability is difficult to exploit but can lead to full takeover of Oracle EDI Gateway. It has a CVSS 3.1 base score of 6.6, indicating medium severity with impacts on confidentiality, integrity, and availability.

CVE-2026-101532 is a high-severity vulnerability in Oracle EDI Gateway versions 12.2.3 through 12.2.15. It allows a high privileged attacker with network access via HTTP to compromise the Oracle EDI Gateway, potentially leading to full takeover of the system. The vulnerability has a CVSS 3.1 base score of 7.2, indicating significant impacts on confidentiality, integrity, and availability. Oracle has released patches addressing this and many other vulnerabilities in their October 2026 Critical Patch Update advisory.

CVE-2026-101531 is a high-severity vulnerability in Oracle Business Intelligence Enterprise Edition (versions 8.2.0.0.0 and 26.01.0.0.0). It allows an unauthenticated attacker with network access via HTTP to gain unauthorized access to critical or all accessible data within the product. The vulnerability has a CVSS 3.1 base score of 7.5, indicating a significant confidentiality impact without requiring privileges or user interaction.

CVE-2026-101529 is a critical vulnerability in Oracle Enterprise Manager for Oracle Database, specifically in the Data Guard Management component. It allows a low privileged attacker with network access via HTTP to compromise the product, potentially leading to full takeover. The vulnerability affects versions 13.5 and 24.1. The CVSS 3.1 base score is 9.9, indicating severe confidentiality, integrity, and availability impacts. Attacks exploiting this flaw may also impact additional Oracle products due to scope change. Oracle has released patches addressing this vulnerability in their October 2026 Critical Patch Update.

CVE-2026-101528 is a critical vulnerability in Oracle Enterprise Manager for Oracle Database, specifically in the Data Guard Management component. It affects versions 13.5 and 24.1. The flaw allows a low privileged attacker with network access via HTTP to compromise the product, potentially leading to full takeover. The vulnerability has a CVSS 3.1 base score of 9.9, indicating severe confidentiality, integrity, and availability impacts. Attacks exploiting this vulnerability may also affect additional Oracle products due to scope change. Oracle has released patches for this and many other vulnerabilities in its October 2026 Critical Patch Update advisory.

CVE-2026-101527 is a high-severity vulnerability in Oracle Enterprise Manager Base Platform versions 13.5 and 24.1. It allows a low privileged attacker with logon access to the infrastructure where the platform runs to compromise the platform, potentially resulting in full takeover. The vulnerability has a CVSS 3.1 base score of 7.8, indicating high impact on confidentiality, integrity, and availability. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, which contains multiple security patches across various products. Users are strongly advised to apply the relevant patches promptly to mitigate this risk.

CVE-2026-101526 is a high-severity vulnerability in Oracle Enterprise Manager for Siebel, specifically in the Configuration Management component. It affects versions 13.5 and 24.1. The flaw allows a low privileged attacker with network access via HTTP to compromise the product, potentially leading to full takeover. The CVSS 3.1 base score is 8.8, indicating high impact on confidentiality, integrity, and availability. Oracle has released patches addressing this vulnerability as part of its October 2026 Critical Patch Update.

CVE-2026-101525 is a high-severity vulnerability in Oracle Enterprise Manager for Siebel versions 13.5 and 24.1. It allows a low privileged attacker with network access via HTTP to compromise the product, potentially resulting in full takeover. The vulnerability affects confidentiality, integrity, and availability with a CVSS 3.1 base score of 8.8. Oracle has released security patches addressing this and many other vulnerabilities in their October 2026 Critical Patch Update advisory.

CVE-2026-101524 is a vulnerability in Oracle Enterprise Manager Base Platform versions 13.5 and 24.1. It allows an unauthenticated attacker with network access via HTTP to perform unauthorized update, insert, or delete operations on some accessible data, read a subset of data, and cause a partial denial of service. The vulnerability is rated medium severity with a CVSS 3.1 base score of 5.6.

CVE-2026-101522 is a vulnerability in Oracle TimesTen In-Memory Database versions 22.1 through 22.1.1.43.0. It allows a low privileged attacker with logon access to the infrastructure hosting the database to compromise it, potentially gaining unauthorized access to critical or all accessible data. The vulnerability has a CVSS 3.1 base score of 5.5, indicating a medium severity primarily due to confidentiality impact. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, which provides patches for affected products.

Vulnerability in Oracle APEX (component: General). Supported versions that are affected are 24.1.0-24.1.21, 24.2.0-24.2.20 and 26.1.0-26.1.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle APEX. Successful attacks of this vulnerability can result in takeover of Oracle APEX. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Vulnerability in the Oracle Global Lifecycle Management NextGen OUI Framework product of Oracle Fusion Middleware (component: NextGen Installer). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 14.1.2.1.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Global Lifecycle Management NextGen OUI Framework. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Global Lifecycle Management NextGen OUI Framework. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

CVE-2026-101519 is a high-severity vulnerability in Oracle EDI Gateway versions 12.2.3 through 12.2.15. It allows a high privileged attacker with network access via HTTP to compromise the Oracle EDI Gateway, potentially resulting in full takeover of the system. The vulnerability has a CVSS 3.1 base score of 7.2, indicating significant confidentiality, integrity, and availability impacts. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, recommending prompt patching to mitigate the risk.

CVE-2026-101518 is a high-severity vulnerability in Oracle Enterprise Manager Base Platform versions 13.5 and 24.1. It allows a low privileged attacker with network access via HTTP to compromise the platform, potentially leading to full takeover. The vulnerability affects confidentiality, integrity, and availability, with a CVSS 3.1 base score of 8.8. Oracle has released patches addressing this and many other vulnerabilities in their October 2026 Critical Patch Update. Customers are strongly advised to apply these patches promptly to mitigate the risk.