PHP object injection in MetaSlider Responsive Slider plugin (WordPress) through version 3.106.0 allows authenticated administrators with high privileges to execute arbitrary code by deserializing untrusted data. The vulnerability requires authenticated high-privilege access (PR:H), limiting exploitation to compromised admin accounts or malicious insiders. EPSS data not available; no confirmed active exploitation or public POC identified at time of analysis.
Second-order SQL injection in mailcow: dockerized versions prior to 2026-03b allows authenticated API users with high privileges to execute arbitrary SQL commands through the quarantine notification system. Attackers inject malicious SQL via the quarantine_category field in /api/v1/add/mailbox endpoint, which executes when quarantine_notify.py runs its scheduled job, enabling data exfiltration of admin credentials and sensitive information through UNION-based queries rendered in notification emails. No public exploit code or active exploitation confirmed at time of analysis, with vendor patch available in version 2026-03b.
Full server takeover in Oracle WebLogic Server 12.2.1.4.0 and 14.1.1.0.0 (Core component) allows a high-privileged, authenticated attacker with HTTP network access to fully compromise the affected instance, resulting in total loss of confidentiality, integrity, and availability. CVSS 3.1 base score is 7.2 (PR:H), and while the intelligence tags reference 'Authentication Bypass,' the CVSS vector requires high privileges, indicating a conflict worth vendor verification. There is no public exploit identified at time of analysis, EPSS is very low (0.04%, 12th percentile), and CISA SSVC reports no known exploitation.
Improper authorization in GitHub Enterprise Server (GHES) lets an authenticated attacker abuse scoped user-to-server (ghu_) tokens to reach private repositories outside their intended GitHub App installation scope, including write access. The root cause is an authorization fallback that treated a revoked or deleted installation as a global installation context; chained with token-revocation timing and SSH push attribution, an attacker can obtain and reuse a victim-scoped token. It affects all GHES releases prior to 3.21 and was reported through the GitHub Bug Bounty program, with no public exploit identified at time of analysis.
Authorization bypass in OpenClaw's chat.send gateway allows authenticated operator clients to spoof ACP (Access Control Provider) identity labels and inject reserved provenance metadata by manipulating WebSocket handshake client metadata. Attackers with low-privilege operator credentials can bypass intended privilege boundaries to impersonate the ACP bridge, achieving high integrity impact through unauthorized modification of chat message provenance. EPSS probability is low (0.05%, 15th percentile) and CISA SSVC indicates no active exploitation, non-automatable attacks, and partial technical impact. Vendor patch available as of version 2026.3.28.
Broken access control in Horilla HRMS 1.5.0 helpdesk module allows any authenticated employee to view support ticket attachments belonging to other users by manipulating attachment IDs in URLs. This exposes confidential HR documents, employee grievances, and internal communications across organizational boundaries. The vulnerability requires only basic authentication (CVSS PR:L) with no technical complexity (AC:L), making it trivially exploitable by malicious insiders. EPSS data not available, not currently listed in CISA KEV, but the authentication bypass tag indicates a fundamental access control failure in a system designed to handle sensitive employee data.
Authenticated mailbox users can delete arbitrary conversation attachments in FreeScout versions prior to 1.8.215 by replaying encrypted attachment IDs through the draft-saving API. The vulnerability exploits insufficient authorization checks in the reply/draft workflows, allowing peers with legitimate conversation access to extract encrypted attachment IDs via load_attachments, then submit those IDs through save_draft to trigger deletion of attachments they should not control. With CVSS 7.1 (AV:N/AC:L/PR:L) and EPSS data unavailable, risk depends heavily on whether attackers have mailbox credentials and access to shared conversations. GitHub commit 5f182818e confirms the fix validates attachment ownership before deletion.
Privilege escalation in FreeScout self-hosted help desk allows authenticated users with limited mailbox signature permissions to modify global chat settings beyond their authorization. The vulnerability (CVE-2026-41191) affects versions prior to 1.8.215 through insufficient input validation in the mailbox update endpoint, enabling low-privileged users to manipulate administrative configuration parameters via crafted POST requests. CVSS score of 7.1 reflects high integrity impact with low complexity network-based attack requiring only low-level authentication. No active exploitation confirmed in CISA KEV, and EPSS data not available at time of analysis, but the fix is available in version 1.8.215 with a corresponding GitHub commit.
Authorization bypass in FreeScout's draft save functionality allows authenticated users with low privileges to create draft messages in conversations they should not access when APP_SHOW_ONLY_ASSIGNED_CONVERSATIONS is enabled. While the conversation view correctly enforces access controls, the save_draft AJAX endpoint fails to validate user permissions, enabling unauthorized information disclosure and message manipulation (CVSS 7.1, High integrity impact). No active exploitation confirmed (not in CISA KEV), but publicly available commit reveals exact vulnerability location. EPSS data not provided, limiting probability assessment.
Authorization bypass in FreeScout allows low-privileged authenticated users to edit customer threads in conversations they cannot access. The ThreadPolicy::edit() method validates mailbox access but fails to enforce assigned-only conversation restrictions from ConversationPolicy, enabling unauthorized modification of customer communications with high integrity impact. Vendor patch released in version 1.8.215 with fix commit confirmed in GitHub advisory GHSA-4h5p-7f5c-q7gj. No public exploit identified at time of analysis, CVSS 7.1 (High) with low attack complexity indicates straightforward exploitation once authenticated.
Low-privileged agents in FreeScout can escalate mailbox access by exploiting insufficient customer visibility enforcement in phone conversation creation. Attackers with agent credentials for Mailbox A can reference and modify customer records from Mailbox B, adding alias emails to hidden customer profiles and bypassing mailbox isolation boundaries. This constitutes an authentication bypass enabling cross-mailbox data manipulation. Fixed in version 1.8.214. EPSS data not provided; no CISA KEV listing at time of analysis. GitHub security advisory and upstream commit confirm the vulnerability and patch.
Insecure direct object reference in Horilla HRMS 1.5.0 employee document viewer allows authenticated users to access other employees' sensitive HR files by manipulating document IDs in API requests. Successful exploitation exposes identity documents, employment contracts, certificates, and other confidential employee records. No public exploit code identified at time of analysis, with EPSS data unavailable for this 2026 CVE.
Cross-site request forgery in WWBN AVideo (versions 29.0 and prior) lets an attacker abuse a logged-in admin's session against three state-changing JSON endpoints (categoryAddNew, categoryDelete, and pluginRunUpdateScript) that enforce only a role check and omit the CSRF token validation their sibling endpoints use. By luring an authenticated administrator to a malicious page, an attacker can create, overwrite, or delete video categories and trigger execution of any installed plugin's updateScript() method. Publicly available exploit code exists per the SSVC assessment, though EPSS is very low (0.02%, 5th percentile) and it is not on the CISA KEV list.
Cross-origin data exposure in WWBN AVideo 29.0 and earlier lets a malicious website read authenticated /api/* responses because an incomplete CORS fix still reflects arbitrary Origin headers with Access-Control-Allow-Credentials: true. Any logged-in user who visits an attacker-controlled page can have their session-authenticated API responses - containing email, admin status, user ID, and other PII - read cross-origin. Publicly available exploit code exists (SSVC: poc) and the issue is confirmed via GitHub Security Advisory GHSA-ff5q-cc22-fgp4, though EPSS is very low (0.01%) and it is not in CISA KEV.
Path traversal in Apktool 3.0.0-3.0.1 enables malicious APK files to write arbitrary files during decoding operations, potentially achieving remote code execution by overwriting shell configuration files or startup scripts. This security regression, introduced December 12, 2025 when sanitization controls were removed from resource decoder logic, allows attackers to embed directory traversal sequences in APK metadata that escape output directories and target critical system files like ~/.ssh/config or Windows Startup folders. CVSS 7.1 with local attack vector and required user interaction. No active exploitation (CISA KEV) or public POC identified at time of analysis, but exploit development is straightforward given the detailed technical disclosure in GitHub advisory GHSA-m8mh-x359-vm8m.
Cross-site scripting in mailcow dockerized versions prior to 2026-03b enables remote attackers to execute malicious JavaScript in victim browsers through a chained Login CSRF and Self-XSS attack. Exploitation requires low-privileged attacker credentials and victim interaction, but can result in unauthorized access to victim email accounts and session hijacking (CVSS 7.0, AV:N/AC:H/PR:L/UI:P). The vulnerability stems from insufficient HTML escaping of X-Real-IP header values in the login history dashboard, combined with server trust of client-supplied IP headers. No active exploitation or public POC identified at time of analysis, but technical details disclosed via GitHub Security Advisory make weaponization feasible.
Custom authentication header leakage in follow-redirects before 1.16.0 exposes API keys and session tokens whenever an HTTP request follows a cross-domain redirect. The header-stripping regex at index.js:469-476 only covers `authorization`, `proxy-authorization`, and `cookie`, leaving headers such as `X-API-Key`, `X-Auth-Token`, and `Token` forwarded verbatim to the redirect destination. Because follow-redirects is the redirect-handling dependency for axios (105K+ GitHub stars), this flaw has broad reach across the Node.js ecosystem; no public exploit code has been identified at time of analysis, though a fully detailed GHSA advisory with a working attack scenario is publicly available.
RansomLook versions prior to 1.9.0 disclose non-public location information through an improper list-filtering logic error in the API layer. The vulnerability stems from removing elements from a list during iteration in website/web/api/genericapi.py, causing entries marked as private to persist in API responses. Unauthenticated remote attackers can retrieve sensitive location data that should remain hidden, with CVSS 6.9 indicating low confidentiality impact across the network.
Fail-open request handling in free5GC UDR's POST /nudr-dr/v2/policy-data/subs-to-notify endpoint allows Policy Data notification subscriptions to be created with invalid, empty, or partially processed input after HTTP body read or deserialization failures. The handler fails to return after sending error responses (HTTP 500 for body read failure, HTTP 400 for deserialization failure), causing execution to continue and invoke the subscription processor with an uninitialized or malformed PolicyDataSubscription object. This is a logic flaw rather than memory corruption or remote code execution, but it violates fail-secure design principles for a write-capable API and may result in inconsistent subscription state or unintended database entries depending on downstream validation behavior.
OpenClaw before version 2026.3.31 allows unauthenticated remote attackers to trigger resource-intensive audio transcription processing via Telegram without proper authorization, enabling denial-of-service through billing or infrastructure exhaustion. The vulnerability stems from insufficient allowlist enforcement that permits unauthorized group senders to initiate preflight transcription operations before authentication is validated, and no public exploit code has been identified at the time of analysis.
OpenClaw before version 2026.3.31 fails to properly invalidate attacker-discovered endpoints during trust decline operations in remote onboarding workflows, allowing attackers to route gateway credentials to malicious endpoints by preserving their URLs through the trust decline process into manual operator acceptance prompts. The vulnerability requires user interaction (UI:A) but affects gateway credential confidentiality (VC:H), posing a significant risk to organizations using OpenClaw's remote onboarding feature with CVSS 6.9 (medium-high severity).
Incomplete PEM parsing in Oxia's TLS subsystem silently drops all but the first certificate from CA bundle files, breaking mutual TLS chain validation in all Oxia deployments prior to 0.16.2 that use the `trustedCaFile` option with a multi-certificate bundle. Legitimate clients presenting certificates signed by an intermediate CA are rejected with `x509: certificate signed by unknown authority`, creating operator pressure to disable client certificate verification entirely - degrading the mTLS security posture rather than enabling direct exploitation. No active exploitation is confirmed (not in CISA KEV), and EPSS is 0.02% (6th percentile), but the indirect risk of operators weakening authentication to restore connectivity is the primary concern.
OpenClaw 2026.3.22 through 2026.3.30 contain a signature verification bypass in the Nostr direct message (DM) ingress handler that processes pairing challenges before validating event signatures. Remote unauthenticated attackers can send forged DMs to create bogus pending pairing entries, exhaust shared pairing capacity, and trigger unbounded relay and logging work on the Nostr channel, causing denial of service. No public exploit code or active exploitation has been confirmed; a vendor patch is available in version 2026.3.31 and later.
Privilege escalation in KDE Kleopatra before 26.08.0 on Windows allows any local user to assume the operating system privileges of a currently-running Kleopatra process by exploiting a control-flow defect in the KUniqueService single-instance enforcement mechanism. The CVSS 6.9 rating reflects high confidentiality and integrity impact - access to private cryptographic keys and certificates is plausible - but is substantially offset by the local-only attack vector and high complexity (AC:H). No public exploit code has been identified and SSVC confirms exploitation is currently none, with an EPSS of 0.01% placing this in the bottom 2% of CVEs by exploitation likelihood; a vendor patch at 26.08.0 is available via the April 2026 KDE security advisory.
Improper access control in Oracle Financial Services Analytical Applications Infrastructure (OFSAAI) Platform component allows a low-privileged remote attacker to bypass authorization controls and gain unauthorized read and write access to all financial data managed by the platform. Versions 8.0.7.9, 8.0.8.7, and 8.1.2.5 are confirmed affected. No public exploit code has been identified at time of analysis, and EPSS at 0.03% (9th percentile) signals very low observed exploitation probability, though the SSVC technical impact is rated 'total' given the full confidentiality and integrity exposure.
Indefinite OIDC session persistence in the Data Sharing Framework (DSF) FHIR and BPE servers prior to 2.1.0 allows any person with physical access to an authenticated browser session to access DSF resources under the original user's permissions, even after the OIDC access token has expired. The root cause is the absence of a maximum inactivity timeout in the Jetty-based session handler for OIDC browser sessions. No public exploit code exists and no active exploitation has been identified; EPSS stands at 0.02% (4th percentile), consistent with the physical access requirement.
Oracle Financial Services Analytical Applications Infrastructure (OFSAAI) versions 8.0.7.9, 8.0.8.7, and 8.1.2.5 contain an improper access control flaw (CWE-284) in the User Interface component that permits a locally authenticated low-privileged attacker - contingent on inducing a second user to interact - to bypass access controls and obtain complete read access to all OFSAAI-accessible financial data, perform limited data modification, and trigger a full denial-of-service by crashing or hanging the platform. Disclosed in Oracle's April 2026 Critical Patch Update, this vulnerability carries no public exploit code and no active exploitation per CISA KEV, SSVC, or EPSS (0.01%, 2nd percentile), situating it as a medium-priority insider threat relevant to financial institutions running these specific versions.
October CMS versions prior to 3.7.14 and 4.1.10 allow backend developers with Developer permissions to bypass Twig sandbox restrictions and execute unauthorized database write operations (insert, update, delete) via the query builder when cms.safe_mode is enabled. This privilege escalation vulnerability enables data manipulation on any database table despite sandbox security policies intended to restrict template functionality.
Improper access control in the Fluid Core component of Oracle PeopleSoft Enterprise PeopleTools 8.61-8.62 allows a high-privileged network attacker to perform unauthorized data reads, writes, and partial denial-of-service with scope change affecting adjacent PeopleSoft products. Despite a network-accessible attack vector and no user interaction required, exploitation is gated by the requirement for high-privilege credentials, and SSVC signals (exploitation: none, automatable: no) confirm no active exploitation at time of analysis. Oracle disclosed this through its April 2026 Critical Patch Update; no public exploit code has been identified.
Path traversal fix bypass in WWBN AVideo 29.0 and below allows authenticated uploaders to read arbitrary files from the server and exfiltrate them through a public GIF media URL. The partial fix in commit 2375eb5e0 validated only the URL path component via PHP's `parse_url()`, but the downstream `try_get_contents_from_local()` function in `objects/functionsFile.php` parses the full URL string - including query parameters - using `explode('/videos/', $url)`, enabling traversal payloads embedded in the query string to bypass the check entirely. A detailed proof-of-concept is publicly available in the GHSA-f4f9-627c-jh33 advisory; no CISA KEV listing exists, and EPSS at 0.20% reflects low automated exploitation probability consistent with the required authentication barrier.
Information disclosure in Firefox's IndexedDB storage component allows remote unauthenticated attackers to leak sensitive data through a network-accessible vulnerability with no user interaction required. Affected versions include Firefox prior to 150 and Firefox ESR prior to 140.10. The vulnerability has a CVSS score of 6.5 reflecting moderate severity with confidentiality impact and limited availability risk.
Incorrect boundary conditions in Firefox's DOM Device Interfaces component allow remote attackers to cause limited data corruption and browser instability without authentication or user interaction, per CVSS vector AV:N/AC:L/PR:N/UI:N. Vendor-released patches are confirmed in Firefox 150 and Firefox ESR 140.10, with downstream Red Hat and SUSE advisories also issued. No public exploit has been identified at time of analysis, and EPSS at 0.04% (13th percentile) alongside SSVC exploitation status of 'none' indicate low real-world exploitation likelihood despite the moderate CVSS score.
Authentication bypass in frp (fast reverse proxy) versions 0.43.0 through 0.68.0 allows network-accessible attackers to reach backends protected by httpUser/httpPassword access controls without valid credentials, when the routeByHTTPUser routing feature is in use. The flaw stems from a credential-source mismatch in pkg/util/vhost/http.go: route selection reads the username from the Proxy-Authorization header, while the access control check validates against the separate Authorization header, enabling an attacker who knows the routeByHTTPUser username to bypass authentication entirely. A proof-of-concept has been confirmed by the reporter against official release binaries; no active exploitation is recorded in CISA KEV.
User-controlled HTTP headers in Fortra GoAnywhere MFT prior to version 7.10.0 enable remote unauthenticated attackers to trigger arbitrary DNS lookups and execute DNS rebinding attacks, leading to information disclosure and potential service degradation. The vulnerability exploits improper handling of attacker-supplied header values in network requests, allowing reconnaissance of internal infrastructure and circumvention of network segmentation controls.
Unbounded memory allocation in Tekton Pipelines' HTTP resolver allows any authenticated tenant to crash the shared resolver pod for an entire Kubernetes cluster. The `FetchHttpResource` function reads HTTP response bodies without a byte-level size cap, so a low-privileged user who can create TaskRuns or PipelineRuns can direct the resolver at an attacker-controlled server delivering multi-gigabyte responses, exhausting the pod's 4 GiB memory limit and triggering an OOM-kill. Because all resolver types - Git, Hub, Bundle, Cluster, and HTTP - share the same `tekton-pipelines-resolvers` pod, repeated exploitation causes a sustained crash loop that denies CI/CD pipeline resolution to every tenant on the cluster. A PoC is included in the GHSA advisory and SSVC confirms exploit code exists; however, no CISA KEV listing indicates no confirmed widespread exploitation at time of analysis.
Denial-of-service in Oracle MySQL Server's JSON component allows authenticated low-privileged network users to hang or repeatedly crash the database server across all three supported release branches (8.0.0-8.0.45, 8.4.0-8.4.8, 9.0.0-9.6.0). The flaw is classified as CWE-400 (Uncontrolled Resource Consumption), meaning specially crafted JSON-related queries exhaust server resources without adequate bounds checking. No public exploit code or active exploitation has been identified; EPSS of 0.04% at the 12th percentile and SSVC 'Exploitation: none' together confirm this is not under active threat at time of analysis.
Denial of service in Oracle MySQL Server's Optimizer component allows a low-privileged authenticated attacker with network access to crash or hang the database server across three major version branches (8.0.0-8.0.45, 8.4.0-8.4.8, 9.0.0-9.6.0). The attack is network-reachable over multiple protocols but requires valid database credentials, limiting the exposed surface to authenticated users. No public exploit code exists and EPSS probability sits at 0.04% (12th percentile), making this a meaningful patch-cycle priority rather than an emergency response item, though availability impact for business-critical databases warrants timely remediation.
Uncontrolled resource consumption in the Group Replication Plugin of Oracle MySQL Server (versions 8.0.0-8.0.45, 8.4.0-8.4.8, and 9.0.0-9.6.0) allows a low-privileged network attacker to hang or repeatedly crash the database server, resulting in complete denial of service. Oracle patched this issue in the April 2026 Critical Patch Update; no active exploitation has been confirmed (absent from CISA KEV), and EPSS of 0.04% (12th percentile) reflects very low current exploitation probability. Downstream distribution advisories from Red Hat and SUSE indicate broad ecosystem acknowledgement of the issue.
MySQL Server's Optimizer component in versions 9.0.0 through 9.6.0 is susceptible to uncontrolled resource consumption triggered by a low-privileged authenticated attacker over the network, resulting in a complete denial of service via hang or repeated crash. The attack surface spans multiple protocols and requires no user interaction beyond valid database credentials. No public exploit code has been identified and exploitation probability is minimal (EPSS 0.04%, SSVC exploitation: none), but the low complexity and broad version range make it relevant for any organization running MySQL 9.x in multi-tenant or externally reachable deployments.
Uncontrolled resource consumption in Oracle MySQL Server's Group Replication Plugin allows a low-privileged authenticated network attacker to cause a complete denial of service - server hang or repeatable crash - across three major release lines (8.0.x, 8.4.x, and 9.x). The vulnerability carries a CVSS 3.1 score of 6.5 with network attack vector and low attack complexity, though real-world exploitation pressure is minimal: EPSS sits at 0.04% (12th percentile), SSVC marks exploitation status as none and the attack as non-automatable, and no public exploit code has been identified at time of analysis. Oracle has released a patch via the April 2026 Critical Patch Update.
Uncontrolled resource consumption in the MySQL Server Group Replication Plugin enables low-privileged, network-accessible attackers to cause a complete denial of service - forcing MySQL Server into a hang or repeatedly reproducible crash across versions 8.0.0-8.0.45, 8.4.0-8.4.8, and 9.0.0-9.6.0. Oracle has released a patch via its April 2026 Critical Patch Update, and no active exploitation has been identified at time of analysis. EPSS stands at 0.04% (12th percentile) and SSVC classifies exploitation as 'none' and the attack as non-automatable, indicating low real-world exploitation probability despite a medium CVSS score.
MySQL Server's Optimizer component allows a low-privileged, network-connected attacker to repeatedly crash or hang the database server across three active release trains. Affected versions span 8.0.0 through 8.0.45, 8.4.0 through 8.4.8, and 9.0.0 through 9.6.0, representing a wide swath of currently deployed MySQL installations. Oracle confirmed a patch in the April 2026 Critical Patch Update; no public exploit code exists and EPSS remains at 0.04% with SSVC exploitation status of none, though the breadth of affected versions and low attack complexity make patching a meaningful operational priority for any network-accessible deployment.
MySQL Server's Optimizer component allows any low-privileged authenticated user with network access to trigger a complete denial of service via an uncontrolled resource consumption flaw. Affected across three active release lines - 8.0.x through 8.0.45, 8.4.x through 8.4.8, and 9.0.x through 9.6.0 - this vulnerability is broadly deployed given MySQL's ubiquity, but real-world exploitation risk is low: EPSS sits at 0.04% (12th percentile), SSVC marks exploitation as 'none' and the attack as non-automatable, and no public exploit code exists at time of analysis. Oracle released a patch in the April 2026 Critical Patch Update.
Mitigation bypass in Mozilla Firefox's File Handling component allows remote network-reachable attackers to circumvent a security protection mechanism (CWE-693), resulting in partial confidentiality and integrity compromise. All Firefox stable versions prior to 150 and Firefox ESR versions prior to 140.10 are affected across platforms, with downstream impact confirmed for Red Hat Enterprise Linux and SUSE Linux packaging. No active exploitation has been confirmed - CISA KEV listing is absent, EPSS sits at 0.04% (12th percentile), and SSVC classifies exploitation status as none - making this a medium-priority patching item rather than an emergency response trigger.
Jupyter nbconvert 6.5 through 7.17.0 allows unauthenticated remote attackers to read arbitrary files from the conversion host when HTMLExporter.embed_images is enabled, by embedding malicious image references with path traversal sequences in a crafted notebook. A malicious actor can exfiltrate sensitive files as base64-encoded data URIs in the output HTML, achieving confidentiality breach with no integrity or availability impact. Vendor-released patch: version 7.17.1.
SQL injection in Frappe HR (HRMS) exposes sensitive human resources data to authenticated remote attackers via a specially crafted request to an undisclosed endpoint. Affected installations running versions prior to 15.54.0 (v15 branch) or 14.38.1 (v14 branch) are vulnerable to unauthorized data extraction through unsanitized query parameters. No public exploit code has been identified and CISA KEV does not list this CVE; EPSS at 0.03% (10th percentile) and SSVC exploitation status of 'none' collectively indicate low current threat actor interest, though the C:H CVSS impact reflects meaningful data exposure risk for organizations handling employee records.
Unauthorized data exposure in Oracle Financial Services Analytical Applications Infrastructure (OFSAAI) versions 8.0.7.9, 8.0.8.7, and 8.1.2.5 allows a low-privileged, network-authenticated attacker to read critical or complete data accessible within the platform via HTTP. The Platform component contains a CWE-200 information disclosure flaw that, per Oracle's April 2026 CPU, is classified as 'easily exploitable' under authenticated low-privilege conditions. No public exploit code has been identified and CISA has not listed this in KEV; EPSS at 0.03% (9th percentile) and SSVC exploitation status of 'none' indicate no observed active exploitation at time of analysis.
Unauthorized full data disclosure in PeopleSoft Enterprise FIN Project Costing 9.2 allows a low-privileged authenticated attacker to read all data accessible to the Projects component via a network-reachable HTTP endpoint. The root cause is improper access control (CWE-284), tagged by Oracle as an authentication bypass - most likely an authorization boundary failure that permits privilege escalation within the application rather than a bypass of the initial login gate, consistent with a PR:L CVSS vector. No public exploit code has been identified and EPSS is 0.03% (9th percentile), indicating negligible automated exploitation activity at this time.
Unauthorized data disclosure in Oracle PeopleSoft Enterprise FIN Maintenance Management 9.2 allows an authenticated low-privileged attacker with HTTP network access to read all data accessible within the Work Order Management component, including potentially sensitive financial maintenance records. The flaw is rooted in improper access control (CWE-284) and is tagged as an authentication bypass, suggesting a low-privileged session can circumvent authorization checks to access data scoped to higher-privilege roles. No active exploitation is confirmed (absent from CISA KEV), and EPSS of 0.03% at the 9th percentile indicates very low real-world exploitation probability; remediation is addressed in Oracle's April 2026 Critical Patch Update.
Unauthorized financial contract data disclosure in Oracle PeopleSoft Enterprise FIN Contracts 9.2 allows low-privileged authenticated users to access all contract records via HTTP without integrity or availability impact. The CWE-200 classification and 'Authentication Bypass' tag together suggest the flaw is an intra-session authorization control bypass - not a login bypass - permitting users to read contract data beyond their assigned permissions. No public exploit exists and EPSS sits at 0.03% (9th percentile), consistent with SSVC's 'Exploitation: none' assessment, though the high confidentiality impact to sensitive financial data warrants prompt patching for affected enterprises.