CVE-2026-91487 is a vulnerability in the Oracle Java SE Compiler component affecting specific Oracle Java SE and GraalVM versions. It allows an unauthenticated attacker with network access to supply data to certain APIs, potentially leading to unauthorized read and write access to some accessible data. Exploitation is difficult and requires network access without user interaction. The vulnerability has a CVSS 3.1 base score of 4.8, indicating medium severity with limited confidentiality and integrity impact but no availability impact. Oracle has published this vulnerability as part of its October 2026 Critical Patch Update.
CVE-2026-91484 is a high-severity vulnerability in Oracle Java SE 8u503 and 8u503-perf affecting the Java plugin component. It allows a low privileged attacker with logon access to the infrastructure where Oracle Java SE runs to compromise the Java SE environment. The vulnerability impacts confidentiality and integrity, potentially enabling unauthorized creation, deletion, or modification of critical data accessible by Oracle Java SE. This flaw primarily affects Java deployments running untrusted code in sandboxed environments, such as Java Web Start applications or applets, and does not apply to server deployments running only trusted code.
CVE-2026-91464 is a vulnerability in Oracle Java SE and Oracle GraalVM products affecting specific versions. It allows an unauthenticated attacker with network access to potentially gain unauthorized access to critical data. Exploitation requires user interaction from someone other than the attacker and is considered difficult. The vulnerability primarily affects Java deployments running untrusted code in sandboxed environments, such as Java Web Start applications or applets, and does not impact server deployments running only trusted code. The CVSS 3.1 base score is 5.3, indicating medium severity with confidentiality impact only.
CVE-2026-91463 is a vulnerability in Oracle Java SE and Oracle GraalVM products affecting specific versions. It allows an unauthenticated attacker with network access to potentially gain unauthorized access to critical data. Exploitation requires user interaction from someone other than the attacker and is considered difficult. The vulnerability primarily affects Java deployments running untrusted code in sandboxed environments such as Java Web Start applications or applets. Server-side Java deployments running only trusted code are not affected. The CVSS 3.1 base score is 5.3, indicating medium severity with confidentiality impact only.
CVE-2026-91462 is a vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition affecting specific versions. It allows an unauthenticated attacker with network access to potentially compromise these products by supplying data to certain APIs without requiring untrusted Java Web Start applications or applets. The vulnerability impacts data integrity, enabling unauthorized creation, deletion, or modification of critical or accessible data. The CVSS 3.1 base score is 5.9, indicating medium severity. No public exploits or known active exploitation are reported. Oracle has published an advisory but no explicit patch links are provided in the input data.
CVE-2026-91461 is a low-severity vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition affecting specific versions. It allows an unauthenticated attacker with network access via TLS to cause unauthorized insert, update, or delete operations on accessible data. The vulnerability requires supplying data to certain APIs without using untrusted Java Web Start applications or applets. The CVSS 3.1 base score is 3.7, indicating a low impact primarily on data integrity.
CVE-2026-91453 is a medium-severity vulnerability in Oracle Java SE and Oracle GraalVM products affecting specific versions. It allows an unauthenticated attacker with network access to exploit multiple protocols in the Lightweight HTTP Server component. Successful exploitation can lead to unauthorized modification (update, insert, or delete) of accessible data. The vulnerability does not impact confidentiality or availability and does not require user interaction. Exploitation requires supplying data to APIs without using untrusted Java Web Start applications or applets. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory.
CVE-2026-91451 is a medium severity vulnerability in Oracle Java SE Networking component affecting specific versions of Oracle Java SE and Oracle GraalVM. It allows an unauthenticated attacker with network access to exploit multiple protocols to gain unauthorized ability to update, insert, or delete some accessible data. The vulnerability does not impact confidentiality or availability but affects integrity. Exploitation requires supplying data to certain APIs without using untrusted Java Web Start applications or applets. Oracle has published a Critical Patch Update advisory addressing this and many other vulnerabilities.
CVE-2026-91418 is a medium severity vulnerability in Oracle Java SE, JavaFX, GraalVM for JDK, and GraalVM Enterprise Edition affecting the ImageIO component. It allows an unauthenticated attacker with network access via multiple protocols to cause a partial denial of service. The vulnerability can be exploited through APIs, including web services supplying data to these APIs, and affects sandboxed Java Web Start applications or applets running untrusted code. The CVSS 3.1 base score is 5.3, indicating an availability impact without confidentiality or integrity loss.
CVE-2026-91417 is a vulnerability in Oracle Java SE and Oracle GraalVM Enterprise Edition affecting specific versions. It allows an unauthenticated attacker with network access to cause a partial denial of service by supplying data to certain APIs in the CORBA component. The vulnerability does not require user interaction or privileges and impacts availability only. The CVSS 3.1 base score is 5.3, indicating medium severity. Oracle has released a Critical Patch Update addressing this and many other vulnerabilities, and customers are strongly advised to apply patches promptly.
CVE-2026-91415 is a vulnerability in Oracle Java SE and Oracle GraalVM products affecting multiple specified versions. It allows an unauthenticated attacker with network access to cause denial of service (application hang or crash) and gain unauthorized read and write access to certain accessible data. The vulnerability involves the 2D component and can be exploited via multiple protocols, including through APIs such as web services. The CVSS 3.1 base score is 7.0, indicating high severity with impacts on confidentiality, integrity, and availability.
CVE-2026-91411 is a vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition affecting specific versions. It allows an unauthenticated attacker with network access to cause denial of service (hang or crash) and unauthorized modification (update, insert, delete) of some accessible data. The vulnerability is difficult to exploit and involves APIs in the JGSS component, including scenarios where sandboxed Java Web Start applications or applets load untrusted code. The CVSS 3.1 base score is 6.5, indicating a medium severity with integrity and availability impacts.
CVE-2026-91409 is a low-severity vulnerability in Oracle Java SE version 27 affecting the Networking component. It allows an unauthenticated attacker with network access via multiple protocols to cause a partial denial of service (DoS). The vulnerability is difficult to exploit and does not impact confidentiality or integrity. It can be triggered through APIs, such as those used by web services or sandboxed Java Web Start applications and applets that run untrusted code relying on the Java sandbox for security.
CVE-2026-91402 is a low-severity vulnerability affecting Oracle Java SE, Oracle JavaFX, and Oracle GraalVM Enterprise Edition. It allows an unauthenticated attacker with network access to potentially gain unauthorized read access to certain data. Exploitation is difficult and requires user interaction by someone other than the attacker. The vulnerability primarily affects client-side Java deployments running sandboxed Java Web Start applications or applets that load untrusted code. Server-side Java deployments running only trusted code are not impacted.
CVE-2026-91398 is a vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition networking components. It allows an unauthenticated attacker with network access via SOCKS5 to potentially compromise the affected products. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data. The vulnerability affects specific versions of Oracle Java SE and GraalVM products. The CVSS 3.1 base score is 6.8, indicating a medium severity with integrity impact. The vulnerability is difficult to exploit and requires high attack complexity without privileges or user interaction.
CVE-2026-91397 is a low-severity vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition affecting the Serviceability component. It allows an unauthenticated attacker with logon access to the infrastructure to potentially perform unauthorized update, insert, or delete operations on accessible data and cause a partial denial of service. Exploitation requires human interaction from a user other than the attacker and high attack complexity. The vulnerability can be exploited via APIs, including through web services supplying data to these APIs, and also affects sandboxed Java Web Start applications or applets running untrusted code. The CVSS 3.1 base score is 3.6, indicating low severity with integrity and availability impacts. Oracle has published a Critical Patch Update advisory addressing this and many other vulnerabilities, recommending customers apply patches promptly.
CVE-2026-91396 is a vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition affecting specific versions. It allows an unauthenticated attacker with network access via multiple protocols to compromise the products by unauthorized update, insert, or delete operations on accessible data and can cause a partial denial of service. The vulnerability can be exploited through APIs, including web services supplying data to these APIs, and affects Java deployments running untrusted code relying on the Java sandbox. The CVSS 3.1 base score is 6.5, indicating a medium severity with impacts on integrity and availability.
CVE-2026-91395 is a vulnerability in Oracle Java SE and Oracle GraalVM products that allows an unauthenticated attacker with network access to exploit multiple protocols to compromise the affected software. The flaw permits unauthorized update, insert, or delete operations on accessible data and can cause a partial denial of service. It affects specific versions of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. The vulnerability can be exploited via APIs, including through web services supplying data to these APIs, and also affects sandboxed Java Web Start applications or applets running untrusted code. The CVSS 3.1 base score is 6.5, indicating a medium severity with impacts on integrity and availability.
Vulnerability in the Oracle Java SE, Oracle JavaFX, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX). Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and 27; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle JavaFX, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle JavaFX, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N).
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 8u503 and 8u503-perf; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).