Threat database

CVE-2026-91574 is a vulnerability in Oracle BI Publisher that allows a low privileged attacker with network access via HTTP to gain unauthorized access to critical or all accessible data. The affected versions are 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity with high confidentiality impact but no integrity or availability impact. Oracle has released patches for this and many other vulnerabilities in their October 2026 Critical Patch Update advisory. Users are strongly advised to apply the available patches promptly to mitigate this risk.

CVE-2026-91528 is a vulnerability in Oracle BI Publisher version 12.2.1.4.0 that allows a low privileged attacker with network access via HTTPS to gain unauthorized read access to some data accessible by Oracle BI Publisher. The vulnerability has a CVSS 3.1 base score of 4.3, indicating a medium severity with confidentiality impact only. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, which contains numerous security patches across Oracle products.

Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle BI Publisher. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle BI Publisher, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle BI Publisher accessible data as well as unauthorized read access to a subset of Oracle BI Publisher accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).