Unauthorized read access to student records data in Oracle PeopleSoft Enterprise CS Student Records 9.2 (Research Tracking component) can be triggered by a low-privileged authenticated attacker over HTTP, provided a victim user interacts with attacker-controlled content. The flaw is rooted in improper access control (CWE-284), enabling horizontal or vertical privilege escalation within the application to expose the full scope of student records data. No public exploit exists and EPSS is extremely low at 0.03% (9th percentile), though the confidentiality impact is rated High by Oracle given the breadth of data potentially accessible.
Denial-of-service in Zyxel WRE6505 v2 firmware via improper encoding in the CGI program allows an adjacent WLAN attacker to crash the web management interface by crafting a malformed SSID and convincing an authenticated administrator to visit the 'AP Select' page. CVSS 4.5 (moderate) with attack vector limited to adjacent networks (Wi-Fi range). No public exploit code identified; Zyxel has marked this as unsupported (end-of-life product).
Oracle Workflow (E-Business Suite component, versions 12.2.3-12.2.15) exposes its Workflow Loader component to unauthorized data manipulation and partial denial of service by highly privileged network attackers over HTTP. The CVSS S:C (scope changed) designation confirms that a successful attack can cascade beyond Oracle Workflow itself to affect other products within the E-Business Suite application tier, amplifying the business impact beyond what the base score of 5.5 initially suggests. No public exploit has been identified and EPSS sits at 0.04% (11th percentile), indicating negligible exploitation probability at time of analysis; SSVC likewise assesses exploitation status as none.
VolumeMount path restriction bypass in Tekton Pipelines prior to v1.11.1 permits authenticated users holding Task or TaskRun creation permissions to mount volumes over internal /tekton/ paths using dot-dot traversal sequences, violating Tekton's internal execution isolation boundary. The flaw exists in both the v1 and v1beta1 API validation layers (pkg/apis/pipeline/v1/container_validation.go and pkg/apis/pipeline/v1beta1/task_validation.go), where strings.HasPrefix is applied to the raw, un-normalized mount path instead of the filepath.Clean-resolved form. No public exploit code has been identified and SSVC assessment confirms no active exploitation; however, in shared or multi-tenant Kubernetes CI/CD environments the integrity risk is meaningful - an attacker can inject falsified task results trusted by downstream pipelines, alter step scripts before execution, or disrupt entrypoint coordination state.
SSH key brute-force attack against GoAnywhere MFT SFTP service allows remote unauthenticated attackers to compromise Web User accounts configured with SSH key authentication in versions prior to 7.10.0. The SFTP service fails to enforce login attempt limits when SSH key authentication is used, enabling attackers to programmatically guess private keys. EPSS and KEV data not provided; vendor Fortra disclosed this vulnerability directly (FI-2026-004).
Mitigation bypass in Firefox's DOM Security component allows authenticated remote attackers with user interaction to circumvent security controls and gain limited read/write access to sensitive data across security boundaries. Firefox 150 and later versions contain the fix; versions prior to 150 are vulnerable. SSVC assessment indicates no current public exploitation, though the vulnerability requires user interaction and authentication to trigger.
Stored XSS in WWBN AVideo 29.0 and below allows authenticated attackers to inject arbitrary JavaScript via markdown comment links using `javascript:` URI schemes that bypass the platform's custom `ParsedownSafeWithLinks` sanitization. The incomplete fix for CVE-2026-27568 patched raw HTML `<a>` tag processing through `inlineMarkup()` but left Parsedown's `inlineLink()` and `inlineUrlTag()` methods unguarded, while simultaneously disabling Parsedown's built-in `safeMode` filtering - creating a clear bypass path. No public exploitation has been confirmed (not in CISA KEV), though SSVC designates a proof-of-concept as existing; EPSS is very low at 0.03% (9th percentile), indicating no widespread active exploitation at time of analysis.
Stored XSS in WWBN AVideo 29.0 and below allows authenticated uploaders to inject persistent JavaScript payloads via a malformed video duration field that bypasses input validation due to a missing regex end anchor. The crafted payload is stored in the database and rendered unescaped across trending, playlist, and gallery thumbnail pages, enabling session hijacking or credential theft against any visiting user including administrators. A proof-of-concept is documented in the GitHub Security Advisory; however, EPSS probability is very low (0.03%, 8th percentile) and no CISA KEV listing confirms active exploitation.
Stored cross-site scripting in Docmost's comment system allows authenticated users to plant javascript: URI hyperlinks that execute arbitrary JavaScript when victims click them. All Docmost instances prior to version 0.80.0 are affected (CPE: cpe:2.3:a:docmost:docmost:*). No active exploitation has been confirmed - SSVC exploitation status is 'none' and the vulnerability is absent from CISA KEV - and EPSS at 0.03% (8th percentile) indicates minimal real-world exploitation probability. Vendor-released patch is available in version 0.80.0.
Improper access control in the Dynamic Monitoring Service (DMS) component of Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0 enables low-privileged authenticated attackers to perform unauthorized read and write operations on accessible Fusion Middleware data over HTTP. The scope change in the CVSS vector (S:C) indicates successful exploitation can extend impact to additional co-deployed Oracle middleware components beyond DMS itself. No public exploit has been identified, EPSS stands at a low 0.03%, and SSVC records exploitation as none - positioning this as a normal-cycle patch priority rather than an emergency response.
Improper access control in the Workflow component of Oracle PeopleSoft Enterprise PeopleTools 8.61-8.62 allows a low-privileged, network-authenticated attacker to compromise confidentiality and integrity of accessible data when a victim user interacts with attacker-controlled content. The scope change (S:C) in the CVSS vector indicates successful exploitation can impact resources beyond the vulnerable component, consistent with client-side attack patterns such as stored or reflected XSS enabling cross-context data access. No public exploit code has been identified and EPSS sits at 0.03% (8th percentile), indicating negligible observed exploitation pressure at time of analysis.
Improper access control in the Person Search component of Oracle PeopleSoft Enterprise HCM Shared Components 9.2 enables an authenticated low-privileged attacker to compromise confidentiality and integrity of HCM data, with scope change indicating the impact extends to additional PeopleSoft products beyond the vulnerable component. Exploitation requires human interaction from a victim other than the attacker, consistent with a client-side injection pattern. No public exploit or KEV listing is present, and EPSS at 0.03% (8th percentile) with SSVC exploitation status of 'none' confirms low real-world exploitation activity at time of analysis.
Cross-site scripting or equivalent client-side injection in Oracle PeopleSoft Enterprise HCM Human Resources 9.2 - specifically the Employee Snapshot component - enables a low-privileged authenticated attacker to compromise confidentiality and integrity of HR data and trigger a scope change affecting additional products, provided a victim user interacts with attacker-controlled content over HTTP. The CVSS 3.1 score is 5.4 Medium (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), reflecting the scope change that elevates impact beyond the directly vulnerable system. No public exploit code exists and EPSS is 0.03% (8th percentile), indicating very low likelihood of opportunistic exploitation at time of analysis.
Cross-site request forgery in WWBN AVideo 29.0 and prior allows an unauthenticated attacker to trigger mass comment deletion on behalf of any authenticated victim (moderator, video owner, or comment author) who visits a malicious page. The attack is critically amplified by AVideo's deliberate platform setting of `session.cookie_samesite=None`, which strips the browser's native CSRF defense and guarantees the victim's session cookie travels with every cross-origin request. Publicly available exploit code exists per SSVC data; the vulnerability is not listed in CISA KEV at time of analysis.
Cross-site request forgery in WWBN AVideo 29.0 and prior allows unauthenticated attackers to force logged-in victims into performing state-changing actions - posting attacker-authored comments under the victim's identity, manipulating comment likes/dislikes, and deleting category assets when the victim holds management rights. Exploitation requires only that the victim loads an attacker-controlled HTML page, making the attack trivially deliverable via email, forum post, or any embedded image. No public exploit confirmed beyond SSVC poc status; no officially released patched version has been confirmed despite a fix commit existing upstream.
Cross-site request forgery (CSRF) in FreeScout prior to version 1.8.215 allows unauthenticated remote attackers to disconnect OAuth integrations from a mailbox by tricking a logged-in admin into visiting a malicious web page, resulting in loss of email synchronization and potential service disruption. The vulnerability stems from the OAuth disconnect endpoint using GET HTTP method without CSRF token validation, enabling attackers to craft simple links or embed requests in third-party sites to trigger account modifications.
Private repository name disclosure in GitHub Enterprise Server allows any authenticated user to enumerate the names of private repositories by their numeric ID via a missing authorization check in the mobile upload policy API endpoint. Validation error responses included full repository names even when the requesting user lacked access to those repositories. No public exploit has been identified, EPSS is 0.05% (15th percentile), SSVC rates exploitation as none, and this was responsibly disclosed through the GitHub Bug Bounty program - indicators that real-world risk is low but the confidentiality impact is meaningful in environments with sensitive project naming conventions.
Unauthenticated open email relay in Responsive Blocks - Page Builder for Blocks & Patterns WordPress plugin (versions up to 2.2.0) allows remote attackers to send arbitrary emails through the affected site's mail server via a public REST API endpoint lacking authorization checks and email recipient validation. The vulnerability enables attackers to abuse WordPress sites for spam distribution and phishing campaigns without authentication.
Authorization bypass in GitHub Enterprise Server allows a repository admin to hijack secret scanning push protection delegated bypass reviewer lists on repositories they do not administer. The server authorizes requests against the repository specified in the URL path but applies the configuration change to the repository identified by the attacker-controlled owner_id parameter in the request body - a classic IDOR pattern (CWE-639). Impact is constrained: an attacker can only assign existing trusted users within the instance as bypass reviewers, not introduce arbitrary external accounts. No public exploit exists and EPSS is 0.05% (14th percentile); patched releases are available for all supported GHES branches.
Mozilla Firefox JavaScript Engine contains an improper input validation flaw that permits remote, unauthenticated information disclosure to attackers without user interaction. The vulnerability (CWE-20: Improper Input Validation) affects all versions prior to Firefox 150 and allows attackers to access sensitive data via a network-based attack with low complexity. A vendor-released patch is available in Firefox 150.
Uncontrolled resource consumption in Oracle Java SE's JSSE (Java Secure Socket Extension) component allows unauthenticated remote attackers to cause partial denial of service against HTTPS-enabled Java services and GraalVM deployments. Affected versions span all major Java SE release trains from 8u481 through 26, as well as GraalVM for JDK and GraalVM Enterprise Edition. Oracle confirmed the vulnerability in the April 2026 Critical Patch Update; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Signed integer overflow in OpenEXR 3.4.0-3.4.9 HTJ2K decompression allows remote attackers to cause denial of service via crafted EXR files with excessive FLOAT channels. The `ht_undo_impl()` function accumulates a bytes-per-line value in a 32-bit signed integer without overflow protection; on memory-permissive systems, the wrapped negative value enables heap out-of-bounds writes. OpenEXR 3.4.10 contains the fix. This is a distinct overflow from CVE-2026-34545 in the same function and mirrors the pattern of CVE-2026-34588.
Uncontrolled resource consumption in Sanluan PublicCMS versions 6.202506.a through 6.202506.d enables low-privileged remote attackers to trigger denial-of-service conditions by manipulating the ZipSecureFile.setMinflateRatio function within the document-to-HTML conversion utility DocToHtmlUtils.java. The flaw (CWE-400) causes the server to exhaust resources when processing attacker-controlled input through the affected code path. No public exploit exists, EPSS sits at 0.03% (10th percentile), SSVC confirms no known exploitation and non-automatable attack profile - real-world priority is low for most deployments, though the vendor's non-response to disclosure leaves patch status unresolved.
Confidentiality compromise in Firefox NSS Libraries allows remote unauthenticated attackers to leak sensitive information over the network without user interaction. The vulnerability affects Firefox 150 and earlier, Firefox ESR 115.34 and earlier, and Firefox ESR 140.9 and earlier, and has been patched in Firefox 150, Firefox ESR 115.35, and Firefox ESR 140.10. No public exploit code or active exploitation has been identified at the time of analysis.
Denial of service via null pointer dereference in Firefox's Audio/Video Playback component allows remote attackers to crash the browser without user interaction. The vulnerability affects Firefox versions prior to 150 and requires only a network connection to trigger, resulting in availability loss but not code execution or data compromise. No active exploitation has been confirmed at time of analysis.
Unauthorized full data disclosure in Oracle Java SE's JGSS component allows unauthenticated remote attackers to read all data accessible by the Java runtime, but only against sandboxed client deployments running untrusted code such as Java Web Start applications or applets. Affected releases span Oracle Java SE 8u481 through 26, GraalVM for JDK 17.0.18 and 21.0.10, and GraalVM Enterprise Edition 21.3.17. No active exploitation is confirmed - EPSS sits at 0.03% (9th percentile) and CISA has not listed this in KEV - but the confidentiality impact is rated high when exploitation conditions are met.
Unauthorized disclosure of sensitive XML data from Oracle Database Server's XML Database component is possible via network-accessible HTTPS endpoints in versions 23.4.0 through 23.26.1. An unauthenticated remote attacker exploiting this CWE-200 information exposure flaw - tagged as involving authentication bypass - can obtain complete access to all XML Database accessible data, but success requires high attack complexity and human interaction from a victim user. No active exploitation is confirmed (EPSS 0.03%, 9th percentile; CISA KEV absent; SSVC exploitation: none), placing this firmly in the patch-on-schedule category despite the high confidentiality impact stated in the CVSS.
Unauthenticated information disclosure in WWBN AVideo versions 29.0 and prior exposes the full output of `git log -1` via a publicly accessible `git.json.php` endpoint, leaking the exact deployed commit hash, developer names and email addresses, and commit messages to any network client without credentials. The commit hash enables an attacker to fingerprint the precise deployed version and cross-reference it against AVideo's 22 published GHSAs to enumerate which vulnerabilities remain unpatched on a given instance - making this a high-value reconnaissance primitive even at a moderate CVSS score. A public proof-of-concept exists; no patched version has been released as of time of publication.
Information disclosure via the Form Autofill component in Mozilla Firefox exposes private user data to unauthorized parties through a network-accessible vector requiring no privileges. All Firefox versions prior to 150 and Firefox ESR versions prior to 140.10 are affected. With an EPSS of 0.03% and SSVC exploitation status of none, real-world exploitation appears limited at this time, though the low-friction CVSS vector and widespread browser deployment make patching advisable.
Path traversal in nesquena hermes-webui allows any authenticated user to redirect a session workspace to an arbitrary existing directory on the host filesystem by supplying attacker-controlled paths to four POST endpoints. Once the workspace is redirected, the attacker leverages the application's own file read and write APIs to access or modify files well outside the intended workspace sandbox, bounded only by the OS-level permissions of the hermes-webui process. No public exploit is identified at time of analysis and this is not listed in CISA KEV; vendor-patched release v0.50.34 is available.
CAPTCHA bypass in WWBN AVideo 29.0 and prior enables unauthenticated attackers to defeat bot protection on user registration, password recovery, and contact form endpoints in at most 33 HTTP requests per session. Two cooperating flaws are responsible: the getCaptcha.php endpoint accepts the word-length parameter directly from the query string without bounds checking, allowing an attacker to force a 1-character CAPTCHA, and failed validation attempts do not invalidate the stored session token, enabling exhaustive brute-forcing of the 33-symbol alphabet. No CISA KEV listing exists, though SSVC rates the attack as automatable with POC-level exploitation, and the effective attack complexity is trivially low regardless of the AC:L CVSS rating.
Unauthenticated information disclosure in Oracle GoldenGate versions 23.4 through 23.10 exposes a subset of accessible data to remote attackers via HTTP, requiring no credentials or user interaction. The Libraries component contains a CWE-200 flaw that allows network-based attackers to read protected data, though impact is limited to partial confidentiality - integrity and availability are unaffected. No active exploitation has been identified (not in CISA KEV), and EPSS places exploitation probability at 0.03%, consistent with the SSVC exploitation status of none despite the automatable flag.
Integer overflow in Firefox's Audio/Video Playback component allows remote unauthenticated attackers to cause integrity violations through specially crafted multimedia content. The vulnerability stems from incorrect boundary condition handling in numeric calculations, potentially enabling attackers to modify playback state or corrupt audio/video streams without user interaction. Firefox 150 and later contain the fix.
Incorrect boundary conditions in Firefox's WebRTC component allow remote attackers to read limited memory contents without authentication. Firefox versions prior to 150 are affected by this low-confidentiality vulnerability, which CVSS rates at 5.3 due to network exploitability without user interaction, though CISA's SSVC framework indicates no current exploitation activity and limited technical impact.
Denial of service in Firefox DNS networking component allows unauthenticated remote attackers to cause partial availability impact through crafted network requests. The vulnerability, classified as a cross-site request forgery (CSRF) issue within DNS handling, affects Firefox versions prior to 150 and has been patched by Mozilla.
OpenClaw before version 2026.4.2 fails to enforce write-scope authorization on the POST /sessions/:sessionKey/kill endpoint, allowing authenticated users with read-only credentials to terminate arbitrary subagent sessions. The vulnerability requires valid API credentials with read scope but does NOT require write permissions, enabling privilege escalation within identity-bearing authentication modes. No public exploit code has been identified, and this is not listed as actively exploited by CISA; however, the low CVSS score of 5.3 reflects the requirement for prior authentication rather than the ease of exploitation once credentials are obtained.
Erlang OTP SSH daemon (ssh_sftpd) stores unresolved user-supplied paths in file handles, allowing authenticated SFTP users to modify file attributes (permissions, ownership, timestamps) outside the configured chroot directory via SSH_FXP_FSETSTAT requests. When the SSH daemon runs as root, this enables privilege escalation through setting setuid bits or changing ownership of system files. The vulnerability affects OTP versions 17.0 through 28.4.3 (and earlier point releases in 27.x and 26.x series); patched versions are available per vendor advisory.
Cleartext credential storage in PublicCMS 6.202506.a through 6.202506.d exposes user-supplied passwords to any party with read access to the application's log files. The failed login handler (`log_login` in `LoginAdminController.java`) persists the raw `errorPassword` argument to disk without obfuscation, meaning that mistyped or probed passwords accumulate in plaintext logs indefinitely. No public exploit code exists and CISA has not listed this in KEV; EPSS sits at 0.01% (2nd percentile), confirming negligible observed exploitation activity at time of analysis.
HCL BigFix Service Management Discovery accepts unencrypted HTTP traffic on port 80, allowing network-adjacent attackers to passively intercept and read sensitive data in transit without authentication or user interaction. The vulnerability exposes confidential information including credentials and system details to packet sniffing attacks on any network where the service is accessible.
XiangShan open-source RISC-V processor commit edb1dfaf7d290ae99724594507dc46c2c2125384 and earlier versions fail to properly gate the Control and Status Register (CSR) write-enable path for Physical Memory Attribute (PMA) configuration, allowing local attackers with code execution privileges to write to PMA CSRs that should raise illegal-instruction exceptions per the RISC-V specification. Successful exploitation enables attackers to alter memory attribute enforcement, potentially leading to privilege escalation, information disclosure, or denial of service depending on platform security boundaries. No public exploit code or active exploitation has been confirmed at time of analysis.
Improper access control in Oracle Hyperion Infrastructure Technology's Lifecycle Management component allows a network-reachable, high-privileged authenticated attacker to perform unauthorized creation, deletion, or modification of critical Hyperion data, while also gaining read access to a subset of accessible data. Affected is the single supported version 11.2.24.0.000, patched in Oracle's April 2026 Critical Patch Update. No public exploit or active exploitation has been identified; EPSS stands at 0.03% (7th percentile) and CISA's SSVC framework rates exploitation as none, placing this firmly in a low-urgency remediation tier despite the High integrity impact component.
Reflected cross-site scripting in Navigate CMS allows remote attackers to inject and execute arbitrary JavaScript in victims' browsers via unsanitized query parameters in the /blog endpoint. The vulnerability affects Navigate CMS versions 0 through 2.9.5 and requires user interaction (clicking a malicious link). CVSS 5.1 reflects the limited scope (only session/cookie theft) and mandatory user interaction, though exploitation is straightforward for phishing campaigns.
HTML injection vulnerability in PHP Point of Sale v19.4 allows unauthenticated remote attackers to render arbitrary HTML in victims' browsers via the '/reports/generate/specific_customer' endpoint, affecting the 'start_date_formatted' and 'end_date_formatted' parameters. User interaction is required (victim must visit a crafted link), limiting impact to stored/reflected XSS scenarios. No public exploit code or active exploitation has been confirmed at the time of analysis.
Reflected cross-site scripting (XSS) in Semantic MediaWiki 5.0.2 allows unauthenticated remote attackers to inject malicious JavaScript via the '/index.php/Speciaal:GefacetteerdZoeken' endpoint parameter. A victim visiting an attacker-crafted URL executes arbitrary JavaScript in their browser, enabling session cookie theft or unauthorized actions on behalf of the user. User interaction (clicking the link) is required. No public exploit code or active exploitation has been identified at time of analysis.
Local denial-of-service in MySQL Shell's Core Client component allows a low-privileged OS user, with required interaction from a legitimate victim user, to repeatedly crash or hang the MySQL Shell process across three active release branches. Affected deployments span 8.0.x through 8.0.45, 8.4.x through 8.4.8, and 9.0.x through 9.6.0, as confirmed by Oracle's April 2026 CPU. EPSS sits at the 2nd percentile with no public exploit code and no CISA KEV listing, placing this squarely in the routine-patching tier rather than emergency response.
Denial-of-service in Oracle MySQL Shell's Core Client component allows a low-privileged local attacker, with required human interaction from another user, to cause a hang or repeatable crash of MySQL Shell across versions 8.0.0-8.0.45, 8.4.0-8.4.8, and 9.0.0-9.6.0. No public exploit has been identified, EPSS sits at 0.01% (2nd percentile), and SSVC assesses exploitation as 'none' with non-automatable attack conditions - all signals converging on minimal real-world risk. Impact is strictly limited to availability; there is no confidentiality or integrity exposure.
Oracle VM VirtualBox 7.2.6 contains an improper access control flaw in its Core component that enables a highly privileged local attacker to partially compromise confidentiality, integrity, and availability - with a scope change indicating potential bleed beyond the VirtualBox process boundary to adjacent products or guest VMs on the same host. Exploitation requires local logon with high privileges and high attack complexity, making opportunistic exploitation unlikely; EPSS at the 2nd percentile and SSVC exploitation status of 'none' corroborate low real-world risk. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog.
Denial-of-service in MySQL Server's Optimizer component allows a high-privileged network attacker to hang or repeatedly crash the database engine across three major release branches (8.0.x through 8.0.45, 8.4.x through 8.4.8, and 9.0.x through 9.6.0). Exploitation requires a high-privilege database account (DBA-level), but once authenticated, the attack is low-complexity and requires no user interaction - Oracle's advisory describes it as 'easily exploitable' in that context. No public exploit code or active exploitation has been identified; EPSS of 0.04% (11th percentile) and SSVC exploitation rating of 'none' together indicate this poses negligible real-world exploitation risk at time of analysis.
Denial-of-service exposure in Oracle MySQL Server's DML (Data Manipulation Language) component allows a high-privileged, network-authenticated attacker to cause a complete, repeatable crash or hang of the database server. Affected across three active release trains - 8.0.0 through 8.0.45, 8.4.0 through 8.4.8, and 9.0.0 through 9.6.0 - the vulnerability is exploitable over multiple network protocols without user interaction. No public exploit exists and the vulnerability is not listed in CISA KEV; EPSS at 0.04% (11th percentile) confirms very low exploitation activity at time of analysis.
Denial-of-service in MySQL Server's InnoDB component allows a high-privileged authenticated attacker with network access to cause a hang or frequently repeatable crash of the database server across versions 8.0.0-8.0.45, 8.4.0-8.4.8, and 9.0.0-9.6.0. Impact is confined to availability - no data exfiltration or integrity compromise is possible through this vector. No public exploit has been identified at time of analysis, and EPSS probability of 0.04% (11th percentile) is consistent with SSVC's confirmed zero observed exploitation, placing this firmly in the lower-priority patch tier for most organizations.