CVE-2026-91230: the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer)
- Severity
- 9.3 (CRITICAL)
- Vendor
- ORACLE
- Patch status
- Unknown
- Published
- 2026-10-20T22:20:23.660
Why it matters
This matters because the affected product may be exploitable without valid credentials. Internet-facing deployments should be reviewed first.
Recommended admin actions
- Prioritize validation immediately due to critical CVSS severity.
- Treat internet-facing systems as higher priority.
Technical summary
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite. While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle SOA Suite accessible data as well as unauthorized update, insert or delete access to some of Oracle SOA Suite accessible data. CVSS 3.1 Base Score 9.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N).
View the official NVD record for CVE-2026-91230
CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.
VULNERABILITY PULSE
514 RECORDS
SECURE FEED ACTIVE
| AFFECTED PRODUCT | ACTION | ||
|---|---|---|---|
| CVE-2026-105944 |
Apache Pulsar Manager is a web console for administering Apache Pulsar clusters. It
Reporter: SECURITY
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-111813 |
Apache Traffic Server: from 8.0.1 PATCH
Reporter: SECURITY
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-110264 |
An issue PATCH
Reporter: CVE
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-102785 |
YOOtheme Pro extension for Joomla
Reporter: SECURITY
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-76299 |
Splunk Enterprise
Reporter: PSIRT
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-76302 |
Splunk Enterprise
Reporter: PSIRT
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-76531 |
Splunk SOAR
Reporter: PSIRT
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-76466 |
Cisco TelePresence Video Communication Server (VCS) Expressway
Reporter: PSIRT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-76473 |
Cisco Emergency Responder
Reporter: PSIRT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-76474 |
Cisco Emergency Responder
Reporter: PSIRT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-111183 |
GStreamer
Reporter: ZDI-DISCLOSURES
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-96639 |
Pillow PATCH
Reporter: SECURITY-ADVISORIES
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-112241 |
SureCart PATCH
Reporter: AUDIT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-112832 |
Rootblox PATCH
Reporter: AUDIT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-113788 |
Lagoon is an application delivery platform for Kubernetes PATCH
Reporter: SECURITY-ADVISORIES
|
9.4
CRITICAL
|
VIEW RECORD |
| CVE-2026-111811 |
Apache Traffic Server's experimental tsmemcache plugin PATCH
Reporter: SECURITY
|
9.4
CRITICAL
|
VIEW RECORD |
| CVE-2026-112408 |
the default bucket() function in Amazon SageMaker Python SDK V3 PATCH
Reporter: FF89BA41-3AA1-4D27-914A-91399E9639E5
|
9.4
CRITICAL
|
VIEW RECORD |
| CVE-2026-76475 |
Cisco Emergency Responder
Reporter: PSIRT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-114382 |
EX200
Reporter: CNA
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-114383 |
EX200
Reporter: CNA
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-114575 |
A950RG
Reporter: CNA
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-114220 |
NT OneAPP developed by NewType Infortech
Reporter: TWCERT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-112327 |
Amelia PATCH
Reporter: AUDIT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2021-48014 |
FineReport 9.0
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2021-48016 |
DedeCMS
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-105869 |
fixed PATCH
Reporter: SECURITY
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-114493 |
LocalAI
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-111816 |
Apache Traffic Server: from 8.0.0 PATCH
Reporter: SECURITY
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-114509 |
Laravel is a web application framework PATCH
Reporter: SECURITY-ADVISORIES
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-115324 |
mem0 0.1.117 PATCH
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-111497 |
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli
Reporter: CVE-COORDINATION
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-89035 |
MikroTik RouterOS
Reporter: DISCLOSURE
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2025-31699 |
Apache Traffic Server: from 8.0.0 PATCH
Reporter: SECURITY
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-114139 |
sentry-javascript PATCH
Reporter: SECURITY-ADVISORIES
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-91403 |
the specified Component, e.g
Reporter: SECALERT_US
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-96355 |
Webform
Reporter: MLHESS
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-114219 |
NT OneAPP developed by NewType Infortech
Reporter: TWCERT
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-20043 |
Cisco Cyber Vision
Reporter: PSIRT
|
9
CRITICAL
|
VIEW RECORD |
| CVE-2026-114661 |
OpenRemote 1.2.0 PATCH
Reporter: DISCLOSURE
|
9
CRITICAL
|
VIEW RECORD |
| CVE-2026-76476 |
Cisco Emergency Responder
Reporter: PSIRT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-76477 |
Cisco Emergency Responder
Reporter: PSIRT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-76478 |
Cisco Emergency Responder
Reporter: PSIRT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-92206 |
CrewAI
Reporter: ZDI-DISCLOSURES
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-92207 |
MindsDB
Reporter: ZDI-DISCLOSURES
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-92208 |
NoMachine
Reporter: ZDI-DISCLOSURES
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-111804 |
Apache Traffic Server's experimental wasm plugin PATCH
Reporter: SECURITY
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-114135 |
Product identification pending PATCH
Reporter: SECURITY-ADVISORIES
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-114140 |
Product identification pending PATCH
Reporter: SECURITY-ADVISORIES
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-114142 |
toml-node is a TOML parser for Node.js and the browser PATCH
Reporter: SECURITY-ADVISORIES
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-103090 |
internal/controlplane/server.go) in Google OSS Agent Mesh (SAM) PATCH
Reporter: CVE-COORDINATION
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-76291 |
Splunk Enterprise
Reporter: PSIRT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-76298 |
Splunk Enterprise
Reporter: PSIRT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-76530 |
Splunk SOAR
Reporter: PSIRT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-114177 |
Cross-Site Request Forgery (CSRF) vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons
Reporter: AUDIT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-112242 |
Incorrect Privilege Assignment vulnerability in Cozmoslabs Profile Builder profile-builder
Reporter: AUDIT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2019-25778 |
SeaCMS
Reporter: DISCLOSURE
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2022-51021 |
NotificationX PATCH
Reporter: DISCLOSURE
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2022-51022 |
YiShaAdmin 2.2 PATCH
Reporter: DISCLOSURE
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2022-51023 |
PHPOK 4.5.000 PATCH
Reporter: DISCLOSURE
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2024-58393 |
Readymade Unilevel Ecommerce MLM
Reporter: DISCLOSURE
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2025-71434 |
Weaver E-cology 8.0, 9.0, and 10.0 PATCH
Reporter: DISCLOSURE
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-114126 |
story files. If the Storybook Vitest addon is installed with an old PATCH
Reporter: SECURITY-ADVISORIES
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-105937 |
Apache Pulsar PATCH
Reporter: SECURITY
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-110803 |
VAADIN PATCH
Reporter: SECURITY
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-111810 |
APACHE PATCH
Reporter: SECURITY
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-114141 |
toml-node is a TOML parser for Node.js and the browser PATCH
Reporter: SECURITY-ADVISORIES
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-114143 |
toml-node is a TOML parser for Node.js and the browser PATCH
Reporter: SECURITY-ADVISORIES
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-114658 |
Grav Login plugin from 3.6.0 PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-105270 |
esaml
Reporter: 6B3AD84C-E1A6-4BF7-A703-F496B71E49DB
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-93471 |
esaml
Reporter: 6B3AD84C-E1A6-4BF7-A703-F496B71E49DB
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2017-20287 |
Javo Spot PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2018-25438 |
Intermesh Group-Office 3.3.0 PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2018-25439 |
MetInfo CMS 6.0.0 PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2019-25779 |
WooThemes Diarise
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2021-48013 |
Weaver E-cology 8.0
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2021-48015 |
JeeWMS
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2021-48017 |
OrbiTeam BSCW Server 5.x PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2022-51024 |
Kavita 0.5.2 PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2024-58396 |
CPAS Audit Management System
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-115325 |
Netmaker
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-115328 |
JSON-SCADA PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-115330 |
Lotus
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-115331 |
Lotus
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-115332 |
Lotus
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-113582 |
UNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity references in Apache Abdera
Reporter: SECURITY
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-76490 |
Cisco TelePresence Video Communication Server (VCS) Expressway
Reporter: PSIRT
|
8.6
HIGH
|
VIEW RECORD |
| CVE-2026-114125 |
storybook PATCH
Reporter: SECURITY-ADVISORIES
|
8.6
HIGH
|
VIEW RECORD |
| CVE-2026-113870 |
MONGODB
Reporter: CNA
|
8.6
HIGH
|
VIEW RECORD |
| CVE-2026-114268 |
BE3L Pro
Reporter: CNA
|
8.6
HIGH
|
VIEW RECORD |
| CVE-2026-29001 |
TastyIgniter
Reporter: DISCLOSURE
|
8.6
HIGH
|
VIEW RECORD |
| CVE-2026-114662 |
Obot PATCH
Reporter: DISCLOSURE
|
8.6
HIGH
|
VIEW RECORD |
| CVE-2026-114663 |
Vyper 0.4.0b1
Reporter: DISCLOSURE
|
8.6
HIGH
|
VIEW RECORD |
| CVE-2026-114716 |
Roundcube Webmail PATCH
Reporter: CVE
|
8.5
HIGH
|
VIEW RECORD |
| CVE-2026-112822 |
an SQL Command ('SQL Injection') vulnerability in AmentoTech Workreap Core workreap core PATCH
Reporter: AUDIT
|
8.5
HIGH
|
VIEW RECORD |
| CVE-2026-107588 |
Vaadin Charts renders charts with the Highcharts library and pins an exact PATCH
Reporter: SECURITY
|
8.4
HIGH
|
VIEW RECORD |
| CVE-2026-16477 |
CleanShot X PATCH
Reporter: CVD
|
8.4
HIGH
|
VIEW RECORD |
| CVE-2026-114727 |
Roundcube Webmail PATCH
Reporter: CVE
|
8.3
HIGH
|
VIEW RECORD |
| CVE-2026-112381 |
APACHE PATCH
Reporter: SECURITY
|
8.2
HIGH
|
VIEW RECORD |
| CVE-2026-96640 |
Product identification pending PATCH
Reporter: SECURITY-ADVISORIES
|
8.2
HIGH
|
VIEW RECORD |
| CVE-2026-15723 |
GitLab PATCH
Reporter: CVE
|
8.2
HIGH
|
VIEW RECORD |
About the Vulnerability Pulse CVE Feed
The Vulnerability Pulse feed tracks live CVE advisories sourced from the National Vulnerability Database and vendor security disclosures. It is designed for SOC analysts, IT administrators, and security teams who need a fast, filterable view of current vulnerabilities without digging through raw NVD data.
How to Use the CVE Advisory Tracker
Use the severity filters to narrow results to Critical or High priority vulnerabilities. Filter by vendor to focus on software and hardware relevant to your environment. Export to CSV for reporting, ticketing, or patch prioritization workflows.
What Is a CVE Advisory?
A CVE (Common Vulnerabilities and Exposures) advisory is a public disclosure of a security vulnerability assigned a unique identifier by MITRE. Advisories include severity scores (CVSS), affected versions, and remediation guidance. Monitoring CVE advisories is a core function of vulnerability management programs and SOC operations.
CVE Analysis & Writeups
For in-depth analysis of specific vulnerabilities, visit the IT Knowledge Bases blog for CVE breakdowns, exploitation analysis, and remediation guidance written for security practitioners.