Path traversal in Vim's zip.vim plugin prior to version 9.1.1551 allows local attackers to overwrite arbitrary files when a user opens a specially crafted zip archive, potentially enabling arbitrary command execution if sensitive files or privileged locations are targeted. The vulnerability requires direct user interaction (opening a malicious zip file in Vim) and has low real-world impact due to high attack complexity and local attack vector, though publicly available exploit code exists. EPSS exploitation probability is minimal at 0.03% (7th percentile), reflecting the friction imposed by user interaction requirements.
Unauthenticated information disclosure in Oracle Siebel CRM's End User User Interface component allows remote attackers to read a subset of CRM data over HTTP without credentials. Versions 25.0 through 25.5 are confirmed affected. Oracle has released a fix in the July 2025 Critical Patch Update; no public exploit or active exploitation has been identified at time of analysis.