Threats affecting pkg:maven/com.oracle/oracle-rest-data-services

CVE-2026-91610 is a high-severity vulnerability in Oracle REST Data Services versions 24.2.0 through 26.2.2. It allows a low privileged attacker with network access via HTTP to fully compromise the service, impacting confidentiality, integrity, and availability. Oracle has released patches addressing this and many other vulnerabilities in their October 2026 Critical Patch Update.

CVE-2026-91609 is a vulnerability in Oracle REST Data Services (Graph QL component) affecting versions 24.2.0 through 26.2.1. It allows a low privileged attacker with network access via HTTP to gain unauthorized access to critical data. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity with high confidentiality impact but no integrity or availability impact. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, which contains numerous security patches across products.

CVE-2026-101494 is a high-severity vulnerability in Oracle REST Data Services (Core component) affecting versions 24.2.0 through 26.2.2. It allows a low privileged attacker with network access via HTTP to compromise the service, potentially gaining unauthorized access to critical or all accessible data. The vulnerability has a CVSS 3.1 base score of 7.7, indicating significant confidentiality impact without affecting integrity or availability. Oracle has included this vulnerability in its October 2026 Critical Patch Update, which provides security patches for affected products.

CVE-2026-101493 is a vulnerability in Oracle REST Data Services Core component affecting versions 24.2.0 through 26.2.1. It allows a low privileged attacker with network access via HTTP to perform unauthorized read and write operations on accessible data. The vulnerability has a CVSS 3.1 base score of 5.4, indicating medium severity with impacts on confidentiality and integrity but no impact on availability. Oracle has published a Critical Patch Update advisory addressing this and other vulnerabilities, recommending timely application of patches.

CVE-2026-101385 is a vulnerability in Oracle REST Data Services Core component affecting versions 24.2.0 through 26.1.0. It allows a high privileged attacker with network access via HTTP to modify critical data without authorization. The vulnerability impacts data integrity but not confidentiality or availability. The CVSS 3.1 base score is 4.9, indicating a medium severity level. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, which contains patches for multiple products including Oracle REST Data Services.

CVE-2026-101382 is a vulnerability in Oracle REST Data Services versions 24.2.0 through 26.1.0. It allows a low privileged attacker with network access via HTTP to perform unauthorized read and write operations on accessible data. The vulnerability is rated medium severity with a CVSS 3.1 base score of 4.2, reflecting limited confidentiality and integrity impacts. Exploitation is considered difficult due to the required attack conditions.

CVE-2026-101381 is a vulnerability in Oracle REST Data Services versions 24.2.0 through 26.1.0. It allows a low privileged attacker with network access via HTTP to perform unauthorized read and write operations on accessible data. The vulnerability has a CVSS 3.1 base score of 5.4, indicating a medium severity impact on confidentiality and integrity.

CVE-2026-101380 is a vulnerability in Oracle REST Data Services versions 24.2.0 through 26.1.0 that allows a low privileged attacker with network access via HTTP to perform unauthorized read and write operations on accessible data. Exploitation requires user interaction from a person other than the attacker. The vulnerability impacts confidentiality and integrity but not availability, with a CVSS 3.1 base score of 5.4 (medium severity).

CVE-2026-101379 is a vulnerability in Oracle REST Data Services versions 24.2.0 through 26.1.0 that allows an unauthenticated attacker with network access via HTTP to gain unauthorized read access to certain accessible data. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity with confidentiality impact only. Oracle has published a Critical Patch Update advisory that includes patches for this and many other vulnerabilities.

CVE-2026-101378 is a vulnerability in Oracle REST Data Services versions 24.2.0 through 26.1.0. It allows a low privileged attacker with network access via HTTP to perform unauthorized update, insert, or delete operations on accessible data. The vulnerability has a CVSS 3.1 base score of 4.3, indicating a medium severity primarily impacting data integrity.

CVE-2026-101377 is a vulnerability in Oracle REST Data Services affecting versions 24.2.0 through 26.1.0. It allows a high privileged attacker with network access via HTTP to cause a partial denial of service. The vulnerability has a low CVSS score of 2.7, indicating limited impact on availability without confidentiality or integrity compromise. Oracle has included this vulnerability in their October 2026 Critical Patch Update advisory.

CVE-2026-101376 is a vulnerability in Oracle REST Data Services affecting versions 24.2.0 through 26.1.0. It allows a high privileged attacker with network access via HTTP to perform unauthorized read, update, insert, or delete operations on accessible data, and potentially cause a partial denial of service. The vulnerability has a CVSS 3.1 base score of 4.7, indicating medium severity.

CVE-2026-101375 is a vulnerability in Oracle REST Data Services affecting versions 24.2.0 through 26.1.0. It allows a low privileged attacker with network access via HTTP to perform unauthorized read and write operations on accessible data and cause a partial denial of service. The vulnerability has a CVSS 3.1 base score of 6.3, indicating medium severity with impacts on confidentiality, integrity, and availability.

CVE-2026-101374 is a vulnerability in Oracle REST Data Services versions 24.2.0 through 26.1.0. It allows an unauthenticated attacker with network access via HTTP to potentially compromise the service. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical or accessible data. The vulnerability is rated with a CVSS 3.1 base score of 5.9, indicating a medium severity with integrity impact. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory.

CVE-2026-101373 is a vulnerability in Oracle REST Data Services versions 24.2.0 through 26.1.0. It allows a high privileged attacker with network access via HTTP to perform unauthorized update, insert, or delete operations on accessible data. Exploitation requires user interaction from someone other than the attacker. The CVSS 3.1 base score is 2.4, indicating a low severity impact focused on integrity.

CVE-2026-101372 is a vulnerability in Oracle REST Data Services Core component affecting versions 24.2.0 through 26.1.0. It allows an unauthenticated attacker with network access via HTTP to gain unauthorized read access to a subset of accessible data. The vulnerability is rated as low severity with a CVSS 3.1 base score of 3.7, indicating limited confidentiality impact and no impact on integrity or availability.

CVE-2026-101371 is a vulnerability in Oracle REST Data Services (Core component) affecting versions 24.2.0 through 26.1.0. It allows a high privileged attacker with network access via HTTP to perform unauthorized read and write operations on some accessible data. Exploitation is difficult and requires human interaction from a person other than the attacker. The vulnerability has a low CVSS 3.1 base score of 3.1, indicating limited confidentiality and integrity impact without availability impact.

CVE-2026-101370 is a vulnerability in Oracle REST Data Services Core component affecting versions 24.2.0 through 26.1.0. It allows an unauthenticated attacker with network access via HTTP to potentially gain unauthorized read access to some accessible data. Exploitation is difficult and requires human interaction from a person other than the attacker. The vulnerability has a low severity score of 3.1 and impacts confidentiality only.

CVE-2026-101369 is a vulnerability in Oracle REST Data Services versions 24.2.0 through 26.1.0. It allows an unauthenticated attacker with network access via HTTP to perform unauthorized update, insert, or delete operations on some accessible data, as well as unauthorized read access to a subset of data. Successful exploitation requires human interaction from a person other than the attacker and may impact additional Oracle products beyond REST Data Services. The vulnerability has a CVSS 3.1 base score of 6.1, indicating medium severity.

CVE-2026-101368 is a vulnerability in Oracle REST Data Services versions 24.2.0 through 26.1.0. It allows an unauthenticated attacker with network access via HTTP to perform unauthorized read and write operations on accessible data. Successful exploitation requires human interaction from a user other than the attacker. The vulnerability has a CVSS 3.1 base score of 5.4, indicating medium severity.