Threats affecting pkg:maven/com.oracle/OracleHospitalitySimphony

CVE-2026-60591 is a critical vulnerability in Oracle Hospitality Simphony versions 19.8 through 19.10.1. It allows an unauthenticated attacker with network access via HTTP to compromise the system. Exploitation can lead to unauthorized creation, deletion, or modification of critical data and can cause a hang or repeated crashes resulting in a denial of service. The vulnerability has a CVSS 3.1 base score of 9.1, indicating high integrity and availability impacts.

CVE-2026-60169 is a high-severity vulnerability in Oracle Hospitality Simphony versions 19.8 through 19.10. It allows an unauthenticated attacker with network access via HTTP to potentially take over the affected system. The vulnerability is difficult to exploit but can lead to full confidentiality, integrity, and availability compromise. No specific patch or fix version is explicitly stated in the advisory, but Oracle recommends applying Critical Patch Updates promptly.