Denial-of-service in MySQL Server's InnoDB storage engine allows a high-privileged, network-authenticated attacker to hang or repeatedly crash the database server across all major release trains (8.0.x, 8.4.x, and 9.x). The vulnerability is reachable over multiple network protocols without user interaction, making it exploitable by any account holding high database privileges (e.g., DBA or SUPER). No public exploit code has been identified and CISA has not added this to the Known Exploited Vulnerabilities catalog, consistent with an EPSS score of just 0.04%.
InnoDB component in MySQL Server versions 8.0.0-8.0.45, 8.4.0-8.4.8, and 9.0.0-9.6.0 exposes a denial-of-service condition reachable over the network by a highly privileged attacker, causing the database server to hang or crash repeatably. Disclosed as part of Oracle's April 2026 Critical Patch Update (CVSS 3.1: 4.9), the vulnerability has an EPSS of 0.04% (11th percentile), SSVC exploitation status of 'none', and no public exploit identified at time of analysis. Oracle has released a patch; risk is largely limited to scenarios involving compromised administrative credentials or malicious insiders.
Denial-of-service in Oracle MySQL Server's GIS (Geographic Information System) component allows a high-privileged, network-authenticated attacker to cause the database server to hang or repeatedly crash. Versions 9.0.0 through 9.6.0 are confirmed affected. No public exploit has been identified and EPSS probability stands at 0.04% (11th percentile), consistent with SSVC's exploitation rating of 'none' - real-world risk is confined primarily to insider threat or compromised DBA account scenarios.
Denial-of-service in Oracle MySQL Server's Partition component (versions 9.0.0-9.6.0) allows a high-privileged, network-connected attacker to cause a complete server hang or repeatable crash, resulting in full availability loss. Exploitation is constrained to authenticated users holding high database privileges (CVSS PR:H), sharply limiting the realistic attack surface. No public exploit code exists, EPSS is 0.04% (11th percentile), and SSVC confirms no known exploitation - placing this firmly in the low real-world priority tier despite its network-accessible vector.
Denial-of-service in MySQL Server's InnoDB component allows high-privileged authenticated attackers with network access to crash or hang the database server via multiple protocols. Affected versions span three major release lines - 8.0.0 through 8.0.45, 8.4.0 through 8.4.8, and 9.0.0 through 9.6.0 - covering a broad footprint of Oracle MySQL deployments including downstream Red Hat and SUSE packages. Proof-of-concept exploit code exists per SSVC classification, though EPSS stands at 0.04% (11th percentile) with no CISA KEV listing, indicating low observed exploitation probability consistent with the high-privilege prerequisite.
MySQL Server versions 8.0.0 through 8.0.45 expose a denial-of-service condition in the DML processing component, enabling a highly privileged, network-authenticated attacker to crash or hang the database server. Oracle patched this in the April 2026 Critical Patch Update; no active exploitation has been observed (EPSS 0.04%, 11th percentile; SSVC exploitation: none). The mandatory high-privilege authentication requirement significantly constrains the realistic attacker pool to insiders or post-compromise scenarios.
MySQL Server's Optimizer component, across all 8.0.x releases from 8.0.0 through 8.0.45, is susceptible to uncontrolled resource consumption (CWE-400) that allows a high-privileged, network-authenticated attacker to cause a complete denial of service via server hang or repeatable crash. Oracle disclosed this in the April 2026 Critical Patch Update and has released a fix; no active exploitation has been identified (EPSS 0.04%, CISA SSVC exploitation: none). The combination of a required PR:H attack and availability-only impact considerably reduces real-world urgency compared to the network-vector framing alone.
Uncontrolled resource consumption in the Optimizer component of MySQL Server 8.0.0 through 8.0.45 enables a high-privileged, network-connected attacker to cause a complete denial of service via a hang or repeatable crash. The impact is availability-only - no confidentiality or integrity risk exists - and the CVSS vector (PR:H) confirms exploitation is gated behind high-level database credentials. Oracle addressed this in the April 2026 Critical Patch Update; no active exploitation is confirmed (absent from CISA KEV), and the EPSS score of 0.04% (11th percentile) reflects minimal observed exploitation probability.
MySQL Server's Optimizer component crashes or hangs when high-privileged authenticated attackers submit crafted SQL queries over the network, affecting all active release branches (8.0.0-8.0.45, 8.4.0-8.4.8, 9.0.0-9.6.0). The uncontrolled resource consumption (CWE-400) results in complete availability loss for the database service, though confidentiality and integrity are unaffected. No public exploit has been identified at time of analysis and EPSS at 0.04% (11th percentile) places this among the lowest-exploitation-probability CVEs, consistent with the SSVC determination of no active exploitation.
Denial of service in MySQL Server's InnoDB component allows a high-privileged, network-connected attacker to cause the server to hang or crash repeatedly, achieving complete availability disruption. All three active release branches are affected: 8.0.0 through 8.0.45, 8.4.0 through 8.4.8, and 9.0.0 through 9.6.0. No public exploit has been identified at time of analysis, EPSS sits at 0.04% (11th percentile), and CISA SSVC confirms no active exploitation - placing this firmly in a patch-and-monitor posture rather than emergency response.
Uncontrolled resource consumption in the MySQL Server Optimizer component allows a high-privileged, network-accessible attacker to cause a complete denial of service across all three actively maintained release trains (8.0.0-8.0.45, 8.4.0-8.4.8, 9.0.0-9.6.0). The Oracle April 2026 CPU addresses this flaw; no public exploit code is identified and EPSS stands at 0.04% (11th percentile), reflecting low real-world exploitation probability. The scope extends to MySQL Server packages distributed by Red Hat and SUSE, broadening the patching surface for enterprise Linux environments.
Denial-of-service in MySQL Server's Optimizer component allows high-privileged, network-authenticated attackers to cause a complete crash or hang across three active release trains (8.0.x, 8.4.x, 9.x). The broad version coverage and multi-protocol attack surface are notable, but the PR:H requirement limits the attacker pool to actors who already hold elevated MySQL credentials. No public exploit has been identified and EPSS at 0.04% (11th percentile) confirms low observed exploitation probability; Oracle has released a patch via the April 2026 Critical Patch Update.
October CMS versions prior to 3.7.14 and 4.1.10 allow authenticated backend users with Editor permissions to read arbitrary server files by crafting malicious CSS preprocessor files (.less, .sass, .scss) that exploit the compiler's import functionality. The vulnerability persists even when cms.safe_mode is enabled, enabling high-confidence information disclosure of sensitive configuration files, credentials, and application source code without requiring administrative privileges.
OpenClaw before version 2026.3.31 contains a server-side request forgery (SSRF) vulnerability in the marketplace plugin download functionality, where unguarded fetch() calls allow authenticated users with user interaction to make arbitrary network requests on behalf of the affected system. Remote attackers can access internal resources or interact with external services, potentially disclosing sensitive data or compromising internal infrastructure; no public exploit code or active exploitation has been identified at time of analysis.
OpenClaw before version 2026.3.31 allows authenticated users to exploit server-side request forgery (SSRF) through unvalidated HTTP redirects in the marketplace plugin download functionality, enabling access to internal resources and potential information disclosure. The marketplace.ts module fails to validate redirect destinations during archive downloads, permitting remote attackers with valid credentials and user interaction to redirect requests to arbitrary internal or external servers. Real-world exploitation is limited by authentication and interaction requirements, keeping the baseline CVSS at 4.8 (medium), though impact depends on network exposure of internal services.
Authentication bypass in mitmproxy 12.2.1 and below allows remote attackers to bypass LDAP-based proxy authentication through unsanitized username injection. The vulnerability affects only instances explicitly configured with the proxyauth option using LDAP authentication, which is disabled by default. Attackers can exploit this over the network without authentication or user interaction to gain unauthorized access to proxied connections.
Improper authorization in the User Interface component of Oracle Financial Services Analytical Applications Infrastructure (OFSAAI) exposes critical financial data to low-privileged network attackers. Affected versions 8.0.7.9, 8.0.8.7, and 8.1.2.5 allow an authenticated attacker to bypass authorization controls via HTTP, contingent on human interaction from a victim user, resulting in complete confidentiality compromise of all data accessible within the platform. No public exploit exists and EPSS sits at 0.03%, indicating negligible opportunistic exploitation pressure at time of analysis.
Time-of-check Time-of-use (TOCTOU) race condition in Spring Security's JdbcOneTimeTokenService allows unauthenticated remote attackers to bypass one-time token validation and gain unauthorized access. Affected versions include 6.4.0-6.4.15, 6.5.0-6.5.9, and 7.0.0-7.0.4. The vulnerability requires explicit configuration of One-Time Token login and involves high attack complexity, limiting real-world exploitation despite network accessibility.
Environment variable leakage in nesquena/hermes-webui exposes provider API keys and other profile-scoped secrets across profile boundaries when users switch active profiles. The `_reload_dotenv` function in `api/profiles.py` loaded each new profile's `.env` additively into `os.environ` without first purging variables set by the previously active profile, meaning credentials such as `OPENAI_API_KEY` persisted beyond their intended security scope. No active exploitation has been observed (SSVC: Exploitation=none, EPSS 0.01% / 2nd percentile), but the flaw is a clear, reproducible confidentiality break confirmed by vendor source code diff and a VulnCheck advisory.
Oracle Applications Framework's Personalization component in E-Business Suite versions 12.2.9 through 12.2.15 allows an authenticated, high-privileged attacker to exceed intended authorization boundaries via HTTP, resulting in unauthorized data read, write, and partial denial of service against the framework. Root cause is CWE-284 (Improper Access Control), confirmed by Oracle's April 2026 Critical Patch Update. No public exploit code exists and EPSS sits at 0.03% (10th percentile), aligning with SSVC's 'Exploitation: none' assessment - this is a low-urgency, medium-severity finding gated entirely by the requirement for pre-existing high-privilege access.
OpenBao 2.5.2 and earlier fails to properly quote PostgreSQL schema names during role revocation in the PostgreSQL database secrets engine, allowing authenticated high-privilege administrators to execute arbitrary SQL injection as the database management user. The vulnerability affects the credentials management workflow when revoking database roles, potentially compromising database integrity. A vendor-released patch (version 2.5.3) is available.
Stored cross-site scripting in Website LLMs.txt plugin for WordPress versions up to 8.2.6 allows authenticated administrators to inject arbitrary JavaScript into plugin settings that executes when any user visits affected pages. The vulnerability requires high privilege level (PR:H) and occurs only in multi-site installations or where unfiltered_html capability is disabled. No public exploit code or active exploitation has been identified.
Responsive Blocks - Page Builder for Blocks & Patterns plugin for WordPress versions up to 2.2.1 allows authenticated contributors and higher to modify global site-wide plugin configuration, including custom CSS settings, block availability, layout defaults (content width, padding, gap), and auto-recovery behavior due to missing authorization checks. This capability escalation bypasses intended role-based access control, enabling lower-privileged users to degrade site functionality and inject CSS-based attacks. No public exploit code or active exploitation confirmed at time of analysis; CVSS 4.3 (low) reflects the authentication requirement and integrity-only impact, but real-world risk depends on contributor population and site governance.
Improper session timeout handling in Fortra GoAnywhere MFT prior to version 7.10.0 allows unauthenticated remote attackers to bypass SAML authentication and redirect users to the regular login page, potentially enabling credential harvesting or session hijacking attacks. The vulnerability requires user interaction (clicking a malicious link or visiting a crafted URL) but affects all web users configured with SAML single sign-on, creating an information disclosure risk through unexpected authentication flow exposure.
Information disclosure in Oracle Agile Product Lifecycle Management for Process 6.2.4 allows low-privileged authenticated network attackers to read a subset of application data via HTTP through the Product Quality Management component. The vulnerability carries a CVSS 3.1 score of 4.3 and is classified as CWE-200, reflecting improper exposure of sensitive information. No public exploit code exists and no active exploitation has been identified; EPSS stands at 0.03% (8th percentile), consistent with SSVC's 'exploitation: none' signal.
Information disclosure in Oracle MySQL Server's Information Schema component exposes a subset of server data to authenticated low-privileged network attackers across three major release branches (8.0.0-8.0.45, 8.4.0-8.4.8, and 9.0.0-9.6.0). The flaw is exploitable via multiple protocols with low attack complexity but requires a valid database account, limiting opportunistic mass exploitation. No public exploit exists and this vulnerability is absent from the CISA KEV catalog; an EPSS score of 0.03% at the 8th percentile reflects negligible observed exploitation pressure.
FreeScout prior to version 1.8.215 leaks confidential help desk conversations to authenticated users through global search and AJAX filter endpoints, bypassing per-conversation access controls that should restrict visibility to assigned agents. An authenticated user with any level of helpdesk access can enumerate and view conversations they should not have permission to access via non-folder query builders, revealing sensitive customer and internal communication that the application explicitly restricts in folder views.
FreeScout prior to version 1.8.214 permits authenticated users to modify hidden customer profiles through email-based object reuse in the customer creation endpoint. By supplying an email address already associated with a hidden customer via POST /customers/ajax?action=create, an attacker can bypass unique-email validation and populate that customer's empty profile fields with arbitrary data, enabling account takeover or data manipulation without administrative privileges.
NVIDIA KAI Scheduler contains an improper authorization vulnerability allowing authenticated attackers to reference pods across Kubernetes namespaces they do not own, enabling data tampering. The vulnerability requires valid credentials and network access to the scheduler but does not permit confidentiality breaches or denial of service. CVSS 4.3 (low) reflects authenticated access requirement and integrity impact only; no active exploitation or public POC identified.
Denial-of-service in OpenBSD slaacd and rad daemons allows local network attackers to trigger infinite loops by sending crafted ICMPv6 Neighbor Discovery packets with zero-length options, causing affected daemons to hang due to missing validation of the nd_opt_len field before arithmetic operations. OpenBSD versions through 7.8 are affected. No evidence of active exploitation has been identified.
Server-Side Request Forgery (SSRF) in FreeScout versions before 1.8.213 allows authenticated administrators to probe internal networks and fingerprint services via unvalidated IMAP and SMTP connection test functionality. Three AJAX actions in MailboxesController pass attacker-controlled server hostnames and ports directly to fsockopen() and protocol clients without IP validation, hostname restrictions, or internal-range blocklists, enabling port scanning and service banner disclosure through IMAP debug logs and AJAX responses. The vulnerability requires admin authentication but affects confidentiality of internal infrastructure.
Improper access control in Oracle User Management (E-Business Suite component: Workflow and Business Events) exposes versions 12.2.7 through 12.2.15 to unauthorized data access and manipulation by highly privileged, authenticated network attackers over HTTP. Successful exploitation yields limited confidentiality and integrity impact - read access to a subset of data and the ability to insert, update, or delete some records - with no availability impact. No active exploitation is confirmed (absent from CISA KEV), EPSS stands at 0.03% (7th percentile), and SSVC rates exploitation status as none, making this a low operational priority despite the network-reachable attack vector.
Partial denial-of-service exposure in the Libraries component of Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition allows unauthenticated remote attackers to degrade service availability across a wide range of versions from Java 8u481 through 26. The flaw (CWE-770) can be triggered via APIs exposed by web services consuming attacker-controlled input, or through client-side Java Web Start and applet environments loading untrusted code. No active exploitation has been observed (not in CISA KEV), no public proof-of-concept has been identified, and both EPSS (0.04%, 12th percentile) and SSVC (Exploitation: none, Automatable: no) classify this as low operational urgency.
BACnet Stack prior to version 1.4.3 exhibits undefined behavior in the decode_signed32() function when processing signed-integer property values containing bytes with the high bit set, causing denial of service through integer overflow. Network-remote attackers can trigger this vulnerability by sending specially crafted BACnet packets with high-bit-set byte sequences, resulting in application instability or crash on embedded systems running vulnerable versions. The vulnerability is confirmed fixed in version 1.4.3.
Oracle Java SE 25.0.1 exposes an integrity-bypass in its Libraries component that allows a remote unauthenticated attacker, via multiple protocols, to perform unauthorized data writes against accessible Java SE data. The attack is constrained to client-side deployments - specifically sandboxed Java Web Start applications and sandboxed Java applets loading untrusted internet code - and carries a vendor-assigned CVSS 3.7 (Low). No active exploitation is confirmed (SSVC: none, EPSS: 0.03%), and a vendor patch is available via the April 2026 Oracle Critical Patch Update.
HTTP request smuggling in HCL BigFix Service Management allows remote unauthenticated attackers to exploit HTTP parsing inconsistencies between front-end and back-end servers, potentially leading to limited information disclosure through cache poisoning or request hijacking attacks. The vulnerability has a CVSS score of 3.7 with low confidentiality impact but no direct availability or integrity impact.
October CMS versions prior to 3.7.16 and 4.1.16 fail to enforce fine-grained sub-permission checks for asset and blueprint file operations in the CMS and Tailor editor extensions, allowing backend users with editor access but explicitly withheld editor.cms_assets or editor.tailor_blueprints permissions to perform unauthorized file operations (create, delete, rename, move, upload) on theme assets and blueprint files. Additionally, an operator precedence error discloses the theme blueprint directory tree under the same conditions. This affects an uncommon permission configuration where high-privileged users have granular restrictions selectively applied.
Honor PcManager contains a privilege bypass vulnerability allowing local attackers without privileges to impact service availability through a type-confusion mechanism. The vulnerability requires high attack complexity and local access, resulting in a CVSS 3.2 (low severity) score with confidentiality and integrity impact ruled out. No active exploitation or public exploit code has been identified at the time of analysis.
Improper access control in Oracle VM VirtualBox 7.2.6's Core component allows a high-privileged local attacker with logon access to the host infrastructure to perform unauthorized writes, inserts, or deletions against VirtualBox-accessible data. Notably, Oracle's advisory confirms a scope change - successful exploitation may affect additional products beyond VirtualBox itself, such as guest VM environments sharing the same host. No active exploitation is confirmed (SSVC: none; EPSS: 0.01%, 2nd percentile), and no public exploit or POC has been identified at time of analysis.
Disk exhaustion via decompression bomb in OpenBao's OCI plugin downloader allows network attackers to exhaust victim disk resources by serving a crafted container image. The vulnerability exists in ExtractPluginFromImage() which writes decompressed tar streams without size bounds, and validates SHA256 integrity only after the full file is written to disk. An attacker controlling or compromising the OCI registry can replace legitimate plugin images with malicious compressed payloads that decompress to arbitrarily large files, causing denial of service. OpenBao versions prior to 2.5.3 are affected; the CVSS score of 3.1 reflects low impact (availability only) but the attack requires the victim to manually trigger plugin extraction with a compromised registry configured.
Reflected cross-site scripting (XSS) in October CMS backend DataTable widget allows unauthenticated remote attackers to inject arbitrary JavaScript via a query parameter, requiring user interaction to execute malicious code. The vulnerability affects versions prior to 3.7.16 and 4.1.16, with a low severity CVSS score of 3.1 reflecting the requirement for high attack complexity and user clicking a malicious link.
Unauthorized read access to a subset of JVM-accessible data is achievable in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition via a flaw in the Security component, exploitable by a local unauthenticated attacker with infrastructure logon access. The attack carries high complexity (AC:H), limiting opportunistic exploitation, and is confirmed by Oracle's April 2026 Critical Patch Update with patches available. All exploitation signals are minimal: EPSS is 0.01% at the 2nd percentile, SSVC registers exploitation as none and not automatable, and neither KEV listing nor public exploit code has been identified.
Information disclosure in Oracle Java SE (8u481 through 26) and Oracle GraalVM (for JDK 17.0.18/21.0.10; Enterprise Edition 21.3.17) exposes a subset of data accessible to the Java process via the Security component. Exploitation requires local infrastructure logon and high attack complexity (AC:H), limiting the realistic threat surface significantly. No public exploit has been identified, EPSS is at the 2nd percentile (0.01%), and CISA SSVC classifies exploitation status as none - making this a low-priority finding despite the breadth of affected product versions.
Information disclosure in Oracle MySQL Server's Information Schema component allows high-privileged remote attackers to read an unauthorized subset of MySQL Server data across three major version lines. Affected are versions 8.0.0-8.0.45, 8.4.0-8.4.8, and 9.0.0-9.6.0. No public exploit code exists, EPSS exploitation probability sits at 0.03% (7th percentile), and CISA has not added this to KEV - all signals converge on this being a low-priority, low-severity finding appropriate for routine patch cycle treatment.
Unauthorized read access in Oracle Database Server's RDBMS component (versions 19.3-19.30) is achievable by a highly privileged attacker holding the Row Access Method privilege, via multiple network protocols, when a third party performs required human interaction. Impact is limited to a partial confidentiality disclosure of RDBMS-accessible data with no integrity or availability effects. No public exploit exists and EPSS at 0.03% (7th percentile) reflects near-zero exploitation likelihood; SSVC confirms exploitation status as none and the attack is not automatable.
Partial denial-of-service in Oracle VM VirtualBox 7.2.6 Core component allows a locally authenticated, high-privileged attacker to degrade availability of the hypervisor. Exploitation is limited to the local system and requires pre-existing administrative-level access, with no confidentiality or integrity impact. No public exploit code has been identified and CISA has not listed this in the Known Exploited Vulnerabilities catalog; EPSS at 0.01% (2nd percentile) reflects near-zero exploitation probability.
OpenBao versions prior to 2.5.3 allow high-privileged administrators in one tenant to revoke or renew authentication tokens belonging to users in other tenants if the token accessor is disclosed, bypassing the multi-tenant isolation guarantee. The vulnerability requires high privilege level and user interaction but undermines the core security boundary of OpenBao's namespace-based multi-tenancy model. No active exploitation has been reported.
OpenBao's Certificate authentication method with disable_binding=true allows token renewal using any sibling certificate signed by the same CA, rather than requiring the original certificate, enabling attackers with knowledge of a token or accessor to extend dynamic lease lifetimes beyond intended scope. The vulnerability affects OpenBao versions prior to 2.5.3 and requires high privileges and user interaction, resulting in a CVSS 2.0 score with low confidentiality and integrity impact. No public exploit code or active exploitation has been identified.
OpenClaw before version 2026.3.31 fails to sanitize environment variables in its host exec policy, allowing authenticated local attackers to override proxy, TLS, Docker, and Git TLS security controls. An attacker with local access and limited privileges can bypass intended security restrictions by injecting malicious environment variables, potentially disabling certificate verification or redirecting traffic through unauthorized proxies. No public exploit code has been identified, and the vulnerability requires process interaction (AT:P) to trigger.