Unauthorized read access to sensitive financial data is possible in Oracle PeopleSoft Enterprise FIN Maintenance Management 9.2 through an improper access control flaw (CWE-284) in the Work Order Management component. An authenticated low-privileged attacker with network access over HTTP can exploit this to gain complete access to all data within the PeopleSoft FIN Maintenance Management system. No public exploit exists and SSVC classifies exploitation as 'none,' with EPSS at 0.03% (9th percentile), indicating negligible opportunistic exploitation risk despite Oracle's own classification of the vulnerability as 'easily exploitable.'
PeopleSoft Enterprise SCM Purchasing 9.2 exposes critical procurement data to low-privileged authenticated attackers over HTTP, enabling complete unauthorized read access to all data within the Purchasing module. The flaw is rooted in improper access control (CWE-284), allowing a low-privileged PeopleSoft account holder to bypass post-authentication authorization restrictions and retrieve sensitive purchasing records they should not have access to. No public exploit code exists and EPSS sits at a very low 0.03%, but Oracle's April 2026 Critical Patch Update addresses the vulnerability and should be applied to any internet-facing or multi-tenant PeopleSoft deployment.
Arbitrary file write in Jupyter nbconvert 6.5 through 7.17.0 allows unauthenticated attackers to write files to arbitrary filesystem locations outside the intended output directory by crafting malicious cell attachment filenames in notebooks. The ExtractAttachmentsPreprocessor fails to sanitize attachment filenames, enabling path traversal that provides full control over destination paths and file extensions. Requires user interaction (opening a malicious notebook) and is patched in version 7.17.1.
Improper authorization in Oracle WebLogic Server's Web Services component allows unauthenticated remote attackers to perform unauthorized creation, deletion, or modification of critical data - but only when a victim user interacts with attacker-controlled content. Affecting four actively supported versions (12.2.1.4.0 through 15.1.1.0.0), this flaw carries a CVSS 6.5 Medium rating reflecting the mandatory human-interaction prerequisite that prevents fully automated exploitation. No public exploit code exists and CISA has not listed this in the Known Exploited Vulnerabilities catalog; SSVC assessment confirms exploitation status as none at time of analysis.
Unauthorized employee data disclosure in Frappe HRMS allows any authenticated user holding only a default role to retrieve private employee fields via an insufficiently access-controlled API endpoint in the Roster shift assignment module. Affected versions span the v15 branch prior to 15.58.1 and the v16 branch prior to 16.4.1. No public exploit or active exploitation has been identified; EPSS stands at 0.03% (8th percentile), and CISA SSVC rates exploitation as none with partial technical impact.
Tekton Pipelines 0.43.0 through 1.11.0 allows authenticated attackers to bypass trusted resource verification policies via unanchored regular expression patterns that match substrings rather than exact resource sources, enabling policy manipulation and unauthorized verification mode changes. The vulnerability stems from Go's regexp.MatchString function matching patterns anywhere within a string rather than requiring full anchoring, permitting attackers to craft source URIs containing trusted patterns as substrings to trigger unintended policy matches and potentially apply weaker verification keys or modes.
Unauthenticated network exploitation of the Oracle Life Sciences InForm App Server (versions 7.0.1.0 and 7.0.1.1) allows remote attackers to read a subset of clinical trial application data and perform unauthorized insert, update, or delete operations via HTTP - with no credentials or user interaction required. Rooted in CWE-284 (Improper Access Control) and tagged as an Authentication Bypass, the App Server fails to enforce access controls on certain endpoints, confirmed by Oracle in the April 2026 Critical Patch Update. No public exploit code or active exploitation has been identified; EPSS sits at 0.03% (8th percentile), though SSVC flags the attack as automatable.
PeopleSoft Enterprise HCM Human Resources 9.2 exposes critical HR data to unauthorized access and modification through a missing authentication control (CWE-306) in the Job Profile Manager component. High-privileged authenticated attackers with network HTTP access can read or modify all data accessible within the HCM module, including sensitive employee records and job profile configurations. No active exploitation is confirmed (CISA KEV absent, EPSS 0.03%), but the SSVC technical impact is rated 'total', indicating full data compromise potential upon successful exploitation.
PeopleSoft Enterprise HCM Absence Management version 9.2 exposes a missing-authentication function (CWE-306) in its Absence Management component, accessible over HTTP by network-reachable, high-privileged attackers. Successful exploitation grants unauthorized read and write access to critical HR absence data - including creation, deletion, or modification of all data accessible within the component. No active exploitation has been confirmed (not in CISA KEV), EPSS is 0.03% (8th percentile), and no public proof-of-concept code has been identified, positioning this as a targeted risk rather than an opportunistic threat.
Insecure Direct Object Reference in AVideo's live restream list endpoint exposes any victim user's RTMP stream keys and OAuth tokens - including access_token and refresh_token for YouTube Live, Facebook Live, and Twitch - to any peer with a streaming-permission account on the same instance. The flaw exists in versions 29.0 and prior, where the authorization guard in list.json.php is trivially bypassed by supplying an explicit users_id GET parameter, routing directly to an attacker-controlled database query. Publicly available exploit code exists per SSVC; EPSS is 0.03% (8th percentile), indicating limited opportunistic exploitation at this time, and the vulnerability is not listed in CISA KEV.
Unauthorized file access in Frappe HRMS allows any authenticated user to retrieve files attached to documents they are not permitted to view by calling the attachment API endpoint without proper authorization enforcement. Affected versions span both the v15 branch (prior to 15.58.2) and v16 branch (prior to 16.4.2); patched releases are available from the vendor. No public exploit exists and EPSS is 0.03% (8th percentile), though the confidentiality impact is significant given that HR systems routinely store payroll records, employment contracts, and personal employee data.
SQL injection in the CMS für Motorrad Werkstätten WordPress plugin (versions up to 1.0.0) allows authenticated attackers with subscriber-level privileges to extract sensitive database information via an unsanitized 'arttype' parameter. The vulnerability requires valid WordPress user credentials but no special configuration, making it exploitable against any WordPress installation running the affected plugin. No public exploit code or active exploitation has been identified at the time of analysis.
blueprintUE prior to version 4.2.0 fails to invalidate active user sessions when passwords are changed or reset, allowing attackers with compromised sessions to maintain indefinite account access even after the legitimate user detects the breach and changes their password. The attacker retains full account privileges until the session naturally expires (default 24 hours) or is manually cleared, creating a critical window where password changes provide no security benefit.
Textpattern CMS 4.9.0 allows authenticated low-privilege users to modify articles owned by higher-privilege users by manipulating the article ID parameter in the duplicate-and-save workflow, bypassing authorization checks in the article management system. The vulnerability affects only authenticated users with existing CMS access and requires no user interaction or special network access. No public exploit code or active exploitation has been identified, though the EPSS score of 0.02% suggests minimal real-world attack probability despite the moderate CVSS 6.5 score.
A cross-site request forgery (CSRF) mitigation bypass in the DOM postMessage component of Firefox allows authenticated attackers to trigger denial of service against affected systems. The vulnerability bypasses existing CSRF protections through improper validation of postMessage origin checks, affecting Firefox versions prior to 150. No public exploit code has been identified, and exploitation requires authenticated network access without user interaction.
Local denial-of-service in the Oracle Solaris 11.4 Kernel component allows a low-privileged authenticated attacker to hang or crash the operating system with scope change implications for co-hosted workloads. The vulnerability stems from uncontrolled resource consumption (CWE-400) in the kernel and is addressed in Oracle's April 2026 Critical Patch Update. No public exploit or active exploitation has been identified; EPSS at 0.01% (2nd percentile) and SSVC exploitation rating of none confirm negligible exploitation activity at time of analysis.
Improper access control (CWE-284) in the C Oracle SSL API component of Oracle Security Service 12.1.3.0.0 and 12.2.1.4.0 - part of Oracle Fusion Middleware - allows a low-privileged network attacker to compromise the service via HTTPS, resulting in unauthorized read access to all critical data and unauthorized creation, modification, or deletion of critical data. The attack is constrained by high complexity and mandatory human interaction from a third party, making automated or mass exploitation infeasible; EPSS exploitation probability is extremely low at 0.03% and CISA SSVC classifies exploitation as none. No public exploit has been identified at time of analysis.
Inverted time comparison logic in the Data Sharing Framework (DSF) OIDC cache layer creates two compounding defects in all versions prior to 2.1.0: the JWKS and Metadata Document caches never serve cached values, forcing a live HTTP fetch to the OIDC provider on every authenticated request, while the FHIR client token cache never expires entries, allowing revoked or expired OIDC tokens to be accepted indefinitely. Both conditions require OIDC bearer-token authentication or back-channel logout to be enabled on the DSF FHIR Server or BPE Server. No public exploit exists and SSVC confirms exploitation status as none, but the expired-token acceptance path represents a meaningful authentication integrity gap in deployments relying on token revocation.
Improper access control in the IDM Authentication component of Oracle Life Sciences InForm 7.0.1.0 and 7.0.1.1 exposes the platform to unauthenticated network-based attacks over HTTP that require victim user interaction to succeed. Successful exploitation yields unauthorized partial read, write/delete, and denial-of-service impact against InForm clinical trial data. No public exploit code exists and no active exploitation has been identified; EPSS at 0.03% (9th percentile) and SSVC exploitation status of 'none' confirm minimal real-world threat at this time.
Honor E App discloses sensitive information to unauthorized users via network-accessible endpoints, requiring user interaction but affecting service confidentiality across all product versions. The vulnerability carries a moderate CVSS score of 6.3 (AV:N/AC:L/PR:N/UI:R) indicating remote exploitation without authentication, though successful attack requires user interaction. Patch availability and exploitation status remain unconfirmed from available sources.
DOM spoofing in Firefox allows remote attackers to deceive users about webpage origin and integrity through rendering manipulation, requiring user interaction. Affects Firefox 149 and earlier, Firefox ESR 115.34 and earlier, and Firefox ESR 140.9 and earlier. Fixed in Firefox 150, Firefox ESR 115.35, and Firefox ESR 140.10. EPSS score of 0.02% indicates low exploitation probability despite CVSS 6.3 rating, suggesting practical exploitation constraints despite network accessibility.
Invalid pointer handling in Firefox's JavaScript-WebAssembly component allows remote attackers to disclose information or cause limited memory corruption via a malicious webpage, requiring user interaction. The vulnerability affects Firefox versions prior to 150 and Firefox ESR prior to 140.10, with an EPSS score of 0.02% indicating minimal real-world exploitation probability despite moderate CVSS severity. Vendor-released patches are available in Firefox 150 and Firefox ESR 140.10.
Cassandra export module in Glances prior to version 4.5.4 allows local privilege-escalated users to redirect monitoring data to attacker-controlled databases by injecting CQL statements through unvalidated configuration parameters. An authenticated local attacker with write access to the Glances configuration file can modify keyspace, table, and replication_factor settings to execute arbitrary CQL, enabling data exfiltration or denial of service against the monitoring infrastructure. This vulnerability requires elevated local access but carries high confidentiality and integrity impact.
Command injection in the Comfast CF-N1-S router version 2.6.0.1 allows an authenticated remote attacker to execute arbitrary OS commands by manipulating the `destination` parameter of the `/cgi-bin/mbox-config?method=SET§ion=ping_config` CGI endpoint. A public exploit has been released on GitHub. No vendor patch exists - the vendor was contacted prior to disclosure and did not respond. Despite the public POC, EPSS sits at 0.84% and SSVC classifies exploitation as none with partial technical impact, suggesting limited real-world uptake at time of analysis.
Denial of service in Next AI Draw.io prior to version 0.4.15 allows local attackers to crash the embedded HTTP sidecar by sending oversized request bodies to three POST endpoints (/api/state, /api/restore, /api/history-svg) without size limits, exhausting Node.js V8 heap memory and forcing an out-of-memory shutdown. CVSS 6.2 reflects local attack vector and high availability impact; no public exploit code confirmed at time of analysis.
Reflected cross-site scripting (XSS) in the Website LLMs.txt WordPress plugin versions up to 8.2.6 allows unauthenticated attackers to inject arbitrary JavaScript via the 'tab' parameter due to improper use of filter_input() without sanitization and insufficient output escaping. Exploitation requires social engineering an administrator to click a malicious link, but once successful grants the attacker ability to execute scripts in the admin's browser session with access to sensitive WordPress functions and data.
Reflected XSS in mailcow-dockerized's login page (all versions prior to 2026-03b) allows a remote unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by delivering a crafted URL. The flaw stems from two compounding issues: the raw `REQUEST_URI` server variable is rendered inside a JavaScript string literal in `base.twig` using HTML-only escaping instead of JS-context escaping, and the `query_string()` helper propagates all `$_GET` parameters into language-switching links, preserving injected payloads across page navigation. A publicly available Nuclei detection template confirms the attack surface is known; however, SSVC lists exploitation as 'none' and EPSS at 0.05% indicates no observed widespread abuse at time of analysis.
Server-side request forgery in Bagisto's Downloadable Link Handler component (versions up to 2.3.15) allows authenticated remote attackers to perform arbitrary HTTP requests on behalf of the server, potentially enabling access to internal resources, metadata services, or information disclosure. The vulnerability has publicly available exploit code and affects the copy function with low-to-moderate CVSS score (5.3) but concrete real-world impact if internal services are exposed. Vendor acknowledges the issue and states fixes are coming in upcoming releases.
Reflected XSS in Astro's SSR pipeline allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in victims' browsers by bypassing the incomplete `</script>` tag sanitization in the `defineScriptVars` function. All Astro versions prior to 6.1.6 running in SSR mode are affected when user-controlled input reaches a `define:vars` script block - a documented and common usage pattern. A detailed public proof-of-concept is available via GHSA-j687-52p2-xcff; EPSS is low (0.03%, 8th percentile) consistent with the required victim interaction, and no CISA KEV listing indicates no confirmed mass exploitation at time of analysis.
Stored cross-site scripting (XSS) in FreeScout prior to version 1.8.213 allows remote attackers to inject arbitrary HTML attributes into email message bodies by embedding unescaped double-quote characters in URLs. When the linkify() function converts plain-text URLs to anchor tags without proper escaping, attackers can break out of the href attribute and inject malicious JavaScript or event handlers. This requires user interaction (UI:R) to view a crafted email, but once viewed, the injected script executes in the context of the victim's session with potential for account compromise or data theft.
Cross-site scripting or improper access control in the Human Workflow component of Oracle Business Process Management Suite (versions 12.2.1.4.0 and 14.1.2.0.0) allows unauthenticated remote attackers to read a subset of BPM data and perform unauthorized data modifications via HTTP, provided a legitimate user interacts with attacker-controlled content. The attack carries a scope change, meaning successful exploitation can impact components beyond the BPM Suite itself within the Oracle Fusion Middleware stack. No public exploit code has been identified and CISA has not listed this in KEV; EPSS places exploitation probability at 0.03% (8th percentile), consistent with low near-term exploitation risk.
Improper access control in Oracle Identity Manager's Identity Console component (versions 12.2.1.4.0 and 14.1.2.0.0) allows unauthenticated remote attackers to partially compromise confidentiality and integrity via HTTP when a victim user interacts with attacker-controlled content. The scope change designation confirms that a successful attack can cascade beyond OIM itself to additional Oracle Fusion Middleware components integrated within the same environment. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS score of 0.03% (8th percentile) reflects very low real-world exploitation probability.
Cross-site scripting or improper access control in Oracle Configurator's User Interface component allows unauthenticated remote attackers to compromise data confidentiality and integrity across Oracle E-Business Suite. Affected versions span the full supported range of 12.2.3 through 12.2.15, requiring an authenticated victim to interact with attacker-controlled content to trigger the flaw. The scope change (S:C) signals that exploitation can pivot beyond Oracle Configurator itself into adjacent E-Business Suite products; no public exploit code has been identified and SSVC confirms exploitation status as none at time of analysis.
Improper access control (CWE-284) in the Portal component of Oracle PeopleSoft Enterprise PeopleTools 8.61-8.62 permits unauthenticated remote attackers to perform unauthorized data reads and writes against PeopleTools and connected downstream products, contingent on luring an authenticated user into triggering the vulnerable endpoint via HTTP. The CVSS vector pattern (AV:N/PR:N/UI:R/S:C) combined with the Authentication Bypass tag strongly suggests a client-side injection vector such as reflected XSS or CSRF that operates within the victim's session context. No public exploit code has been identified and CISA has not added this to the KEV catalog; EPSS of 0.03% (8th percentile) and SSVC Exploitation:none corroborate the absence of observed active exploitation at time of analysis.
Excessive memory allocation in the golang.org/x/image/font/sfnt SFNT font parser allows denial of service when processing a malicious font file. All versions of the package prior to 0.39.0 are affected, as confirmed by the Go vulnerability database (GO-2026-4962) and EUVD-2026-24245. An attacker who can supply a crafted font file to any Go application using this library can cause the application to exhaust available memory and crash. No public exploit has been identified and SSVC confirms no active exploitation at time of analysis.
Missing authorization on the `/api/v1/delete/fwdhost` endpoint in mailcow-dockerized allows any low-privileged authenticated user to delete Forwarding Hosts, disrupting outbound mail routing and overall service availability. All versions prior to 2026-03b are affected; the flaw is rooted in inconsistent access control - add/edit operations are gated to administrators but the delete pathway is not. EPSS is low (0.04%) and the vulnerability is not in CISA KEV, though SSVC data indicates POC code exists, lowering the exploitation barrier for users with valid credentials.
Cross-site scripting (XSS) in WebSystems WebTOTUM 2026 Calendar component allows authenticated remote attackers to inject malicious scripts via an unknown function, requiring user interaction for exploitation. Publicly available exploit code exists, and vendor has released a patched version following responsible disclosure.
Stored cross-site scripting (XSS) in Bagisto up to version 2.3.15 allows authenticated attackers to inject malicious scripts via the Custom Scripts Handler component, which are then executed in the browsers of other users with user-interaction. The vulnerability has publicly available exploit code and affects the integrity of user sessions. Vendor has acknowledged the issue and committed to fixes in upcoming releases but no patched version has been released at time of analysis.
Integrity and availability compromise in Oracle Java SE's Hotspot component affects versions 8u481 and 8u481-b50, as well as GraalVM Enterprise Edition 21.3.17, but exclusively in client-side sandboxed deployments running untrusted code via Java Web Start or applets. A low-privileged local attacker who can also induce human interaction from a third-party victim may trigger uncontrolled resource consumption (CWE-400) in Hotspot, resulting in unauthorized modification or deletion of critical data accessible to the JVM, or a complete denial of service via hang or repeatable crash. No public exploit code exists and no active exploitation has been confirmed; EPSS at 0.01% (2nd percentile) and SSVC Exploitation=none corroborate negligible current threat activity.
Confidentiality breach in Oracle VM VirtualBox 7.2.6 Core allows a high-privileged local attacker to gain complete read access to all data accessible by the VirtualBox process, with scope change indicating potential data leakage beyond the primary VM boundary into adjacent virtualized environments. The CVSS vector (AV:L/AC:L/PR:H/UI:N/S:C) confirms local-only exploitation requiring administrative-level host access, substantially limiting the realistic attacker pool. No active exploitation is confirmed - EPSS sits at 0.01% (2nd percentile), SSVC rates exploitation as none, and the vulnerability is absent from CISA KEV.
FreeScout versions prior to 1.8.214 allow authenticated agents in shared mailboxes to recall another agent's reply within a 15-second undo window due to insufficient authorization checks on the undo-send endpoint. The vulnerability requires agent-level authentication and shared mailbox access but enables one user to suppress a colleague's outbound communication, affecting message integrity and audit trails in multi-agent help desk environments.
Oracle Identity Manager Connector 12.2.1.4.0 exposes a missing authentication control (CWE-306) in its Core component, reachable over HTTPS by unauthenticated network attackers. Successful exploitation yields unauthorized read access to critical data or complete access to all data accessible by the connector - a significant confidentiality breach in an identity governance system. No public exploit code has been identified at time of analysis, and EPSS at 0.03% (9th percentile) alongside SSVC's 'none' exploitation rating indicate low real-world exploitation pressure despite the network-accessible vector.
Unauthenticated network access to Oracle Identity Manager Connector 12.2.1.4.0 enables complete confidentiality compromise of all data accessible by the connector via an authentication bypass in its Core component. The flaw (CWE-306, Missing Authentication for Critical Function) is reachable over HTTP without credentials but carries high attack complexity, constraining exploitation to actors capable of meeting undisclosed preconditions. No active exploitation has been identified - EPSS sits at the 9th percentile (0.03%) and CISA SSVC rates it as non-automatable with partial technical impact - suggesting limited near-term risk despite the identity management context.
Improper access control in Oracle Identity Manager Connector 12.2.1.4.0 exposes the Microsoft Active Directory component to network-based exploitation via LDAP, enabling low-privileged authenticated attackers to perform unauthorized creation, deletion, or modification of critical data and read a subset of accessible data. The vulnerability carries a CVSS 3.1 score of 5.9 (Medium), tempered by high attack complexity (AC:H) and a near-zero EPSS of 0.03% (8th percentile). No public exploit code exists and no active exploitation has been reported; this is a real but difficult-to-trigger integrity-focused flaw in Oracle's enterprise identity management stack.
OpenClaw before version 2026.4.2 transmits stored gateway credentials over unencrypted WebSocket (ws://) connections when accepting non-loopback endpoints, allowing adjacent network attackers with user interaction to forge discovery results or craft malicious setup codes that redirect clients to attacker-controlled endpoints and exfiltrate plaintext credentials. No public exploit code has been identified, but the vulnerability requires proximity to the target network and user interaction to trigger the credential disclosure.
HTML injection in FreeScout prior to version 1.8.213 allows unauthenticated attackers to inject arbitrary HTML into outgoing support emails by crafting a malicious From display name. The unsanitized name is stored in the database and rendered unescaped via the {%customer.fullName%} template variable in reply emails, enabling attackers to embed phishing links, tracking pixels, and spoofed content in emails sent from the organization's legitimate address. No public exploit code identified at time of analysis.
Confidentiality breach in Oracle MySQL Shell's Core Client component across three major version branches (8.0.x, 8.4.x, and 9.0.x) permits a high-privileged, network-connected attacker to gain unauthorized access to critical or complete MySQL Shell-accessible data, with a CVSS scope change (S:C) indicating potential impact on adjacent systems. No public exploit code has been identified at time of analysis, and an EPSS score of 0.03% at the 8th percentile reflects near-zero observed exploitation probability. SSVC classifies exploitation status as none and technical impact as only partial, underscoring that despite the scope-change flag and high confidentiality impact, real-world urgency is low given the steep access prerequisites.
Fortra GoAnywhere MFT prior to version 7.10.0 and GoAnywhere Agents prior to version 2.2.0 use a static initialization vector (IV) for encryption, allowing authenticated administrative users to brute-force decryption of encrypted data. The vulnerability requires high-privilege access and computational effort but results in complete confidentiality loss of encrypted values. No public exploit code or active exploitation has been confirmed at time of analysis.
Stored cross-site scripting in Twenty CRM versions prior to 1.20.6 allows authenticated attackers to inject malicious JavaScript URIs into file block attachments via the BlockNote editor, executing arbitrary code in the browsers of users who click the malicious link. The vulnerability bypasses protocol validation in the FileBlock component and lacks server-side sanitization of block content; exploitation requires user interaction (clicking the attachment) but persistence is stored on the server, affecting all subsequent users who view the compromised document.
FreeScout versions prior to 1.8.213 expose complete customer PII through an authentication bypass in the `load_customer_info` action of POST /conversation/ajax, allowing any authenticated user to retrieve sensitive profile data for arbitrary customers by providing only a valid email address. The vulnerability affects the authorization layer rather than authentication, enabling lateral access to customer records across mailboxes without proper access control verification.