Stored cross-site scripting in the Free Theme Builder for Elementor WordPress plugin before 1.6.7 lets unauthenticated attackers inject malicious script through contact form field values, which are stored unsanitized and later rendered in the admin dashboard's form-submissions view. The payload executes in the browser of any logged-in administrator who reviews submissions, enabling session hijacking or actions in the admin's context. Publicly available exploit code exists (WPScan), but there is no evidence of active exploitation and EPSS probability is low (0.17%).
Physical firmware compromise in Autel MaxiCharger Single EV charging stations (firmware through V1.03.51) lets an attacker with hands-on access exploit exposed NXP i.MX6 hardware recovery pins to boot unsigned, attacker-controlled code into memory. Once in recovery mode the attacker can dump, modify, or replace the device firmware and extract sensitive data such as credentials, keys, or configuration. Publicly available exploit code exists (published by CyberDanube), though there is no public exploit identified as being used in active campaigns and the flaw is not listed in CISA KEV.
Physical compromise of Autel MaxiCharger Single EV charging stations running firmware through V1.03.51 is possible via an unprotected UART interface that lets an attacker halt boot and drop into the U-Boot bootloader. From the bootloader an attacker can rewrite boot configuration or the filesystem to gain full operating-system access on the charger. Publicly available exploit code exists (published by CyberDanube), though there is no public exploit identified as being used in active attacks and the flaw requires physical access.
Server-side request forgery and internal repository exfiltration in Gitea before 1.27.0 lets a low-privileged authenticated user bypass the migration URL allow/block list by supplying a permitted public Git URL that HTTP-redirects the server's git subprocess to an otherwise-blocked internal endpoint. Because Gitea validates only the originally submitted URL while git runs with its default http.followRedirects=initial, the redirected internal Git repository is cloned into an attacker-controlled repository, and pull mirrors keep re-fetching it on schedule. No public exploit identified at time of analysis; a vendor-authored local proof-of-concept confirmed the redirect is followed to 127.0.0.1, and EPSS/KEV data were not supplied.
Memory-exhaustion denial of service in Netty's HTTP/3 codec (Http3FrameCodec) affects all releases prior to 4.2.16.Final, where decodeFrame trusts the wire-supplied payLoadLength and buffers reserved-frame-type payloads without an upper bound. A remote unauthenticated attacker (CVSS 7.5, AV:N/PR:N) can open many QUIC streams and advertise very large payload lengths on reserved HTTP/3 frames to force unbounded heap allocation and crash the server. No public exploit or CISA KEV listing exists at time of analysis; a vendor patch (4.2.16.Final) is available.
Privileged GITHUB_TOKEN exfiltration in the meltano/hub repository allows any unauthenticated attacker who can open a pull request to inject shell commands into the test_dispatcher.yml GitHub Actions workflow and steal a repository-write token. Because the workflow uses the pull_request_target trigger, it executes untrusted PR-controlled data (changed filenames) in the trusted base-repository context with access to secrets. Publicly available exploit code exists (a dedicated PoC repo), though this is not listed in CISA KEV.
Denial of service in the Go golang.org/x/net/dns/dnsmessage package allows remote attackers to crash any application that parses attacker-supplied DNS responses by sending a malformed SVCB or HTTPS resource record. When the declared size of a service-parameter value exceeds the remaining DNS message buffer, the parser panics instead of returning an error, taking down the DNS client, resolver, or proxy embedding this library. EPSS is low (0.15%) and there is no public exploit identified at time of analysis, but a vendor patch is available and the pre-conditions are trivial for any host that resolves DNS through untrusted responders.
SQL injection in the bpost Shipping Platform WordPress plugin (versions before 3.2.3) lets unauthenticated attackers inject SQL via an unsanitized parameter processed during WooCommerce order submission, enabling time-based blind extraction of database contents. Any WooCommerce store using this Belgian-postal shipping integration is exposed at checkout without authentication or user interaction. Publicly available exploit code exists (WPScan) and a vendor patch is available, though there is no public exploit identified as being actively used in the wild (not in CISA KEV).
Cross-tenant data disclosure in Aptabase (open-source privacy-friendly analytics) up to commit 5a89368 lets an authenticated tenant read every other tenant's event data by abusing a ClickHouse SQL injection in the stats API. Filter parameters (EventName, CountryCode, OsName, DeviceModel, AppVersion, SessionId) are interpolated unsanitized into Liquid SQL templates, letting an attacker append a UNION ALL that defeats the app_id tenant-isolation filter on 13 of 15 stats endpoints. Publicly available exploit code exists and the issue was reported by VulnCheck; no active exploitation is confirmed (not in CISA KEV).
OS command injection in Tenable Security Center (formerly Tenable.sc) lets authenticated users abuse the audit file upload handler, which fails to sanitize filenames and lets shell metacharacters reach a system command call. Rated CVSS 4.0 8.7 (High), the flaw is described as reaching full command execution when chained with a related vulnerability, giving an attacker code execution on the appliance. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Denial of service in websocket-driver-ruby (all versions before 0.8.2) allows any unauthenticated remote client to crash a Ruby WebSocket server process by sending an HTTP Upgrade request containing a syntactically invalid Host header value. The root cause is an unhandled URI::InvalidURIError exception raised during Host header parsing in the request.complete() method, which propagates uncaught to the top level and terminates the server process. No public exploit has been identified at time of analysis, but the attack technique is trivially constructible from the CVE description and the published patch diff alone.
Privilege escalation to arbitrary code execution in HPE Aruba Networking AOS-CX switches allows a remote low-privileged, authenticated user to exploit a buffer overflow in the command line interface (CLI) and run arbitrary code as a privileged user on the underlying switch operating system. Because the CVSS vector is AV:N/PR:L, an attacker who already holds any valid low-level CLI account (e.g., an operator-level login over SSH) can escalate to full device control. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; risk is driven by the high CVSS (8.8) and full C/I/A impact.
Account/instance takeover in Oracle Process Manufacturing Systems (Internal Operations component of Oracle E-Business Suite 12.2.3 through 12.2.15) lets a low-privileged attacker with HTTP network access fully compromise the module, achieving high confidentiality, integrity, and availability impact. Oracle rates it CVSS 8.8 and calls it 'easily exploitable'; no public exploit is identified at time of analysis, and it is not listed in CISA KEV. The fix ships in Oracle's July 2026 Critical Patch Update.
Full compromise of Oracle Advanced Collections (Internal Operations component of Oracle E-Business Suite) is achievable by a low-privileged attacker with HTTP network access, per Oracle's July 2026 Critical Patch Update. Rated CVSS 3.1 8.8, successful exploitation yields complete takeover of the module with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and single-privilege prerequisite make it a strong patching priority.
Full takeover of Oracle Transportation Execution (a module of Oracle E-Business Suite, Internal Operations component) is possible for a low-privileged attacker with only network HTTP access to the application. Any authenticated user account can be leveraged to fully compromise confidentiality, integrity, and availability of the module, per the CVSS 3.1 8.8 vector. No public exploit identified at time of analysis; the fix ships in Oracle's July 2026 Critical Patch Update.
Full account takeover of Oracle Labor Distribution (part of Oracle E-Business Suite, Internal Operations component) is possible when a low-privileged attacker sends crafted HTTP requests to affected servers running versions 12.2.3 through 12.2.15. The flaw compromises confidentiality, integrity, and availability of the module and, per Oracle, results in complete takeover of Labor Distribution. No public exploit identified at time of analysis, though the CVSS 8.8 rating and network-reachable, low-complexity nature make it a high-priority patch in the Oracle July 2026 Critical Patch Update.
Account takeover in the Public Sector Payroll module (Internal Operations component) of Oracle E-Business Suite 12.2.3 through 12.2.15 lets a low-privileged attacker with network HTTP access fully compromise the payroll application. Oracle rates it CVSS 3.1 8.8 with high confidentiality, integrity, and availability impact and calls it 'easily exploitable,' meaning a single low-tier authenticated account is enough to seize the module. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the low attack complexity and network reach make it a prompt-patch item from the July 2026 Critical Patch Update.
Account/component takeover in the Oracle Customer Care module of Oracle E-Business Suite (versions 12.2.3 through 12.2.15) allows a low-privileged, authenticated attacker with HTTP network access to fully compromise the Customer Care component. The flaw carries a CVSS 3.1 base score of 8.8 with high confidentiality, integrity, and availability impact, and low attack complexity. It was reported by Oracle's own security team and fixed in the July 2026 Critical Patch Update; no public exploit identified at time of analysis.
Privilege-based takeover of Oracle Project Intelligence (a module of Oracle E-Business Suite 12.2.3-12.2.15) allows a low-privileged attacker with HTTP network access to fully compromise the component, resulting in high confidentiality, integrity, and availability impact. Oracle rates it CVSS 3.1 8.8 and delivered the fix in the July 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV, though EBS components are historically attractive post-authentication targets.
Full compromise of Oracle Payroll (Oracle E-Business Suite, Internal Operations component) is possible when a low-privileged attacker sends crafted HTTP requests to the affected application, per Oracle's July 2026 Critical Patch Update. The flaw affects EBS releases 12.2.3 through 12.2.15 and, given the CVSS 3.1 base score of 8.8 with high confidentiality, integrity, and availability impact, allows takeover of Oracle Payroll. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and 'easily exploitable' vendor characterization warrant prompt patching.
Full takeover of Oracle Payroll (component: Internal Operations) in Oracle E-Business Suite 12.2.3 through 12.2.15 is achievable by a low-privileged, authenticated attacker over HTTP, yielding complete compromise of confidentiality, integrity, and availability (CVSS 8.8). The flaw is described by Oracle as easily exploitable, but there is no public exploit identified at time of analysis and it is not listed in CISA KEV. It was disclosed and fixed in the Oracle Critical Patch Update of July 2026.
Full compromise of Oracle Order Management, a module of Oracle E-Business Suite (EBS), is possible via the Product Diagnostic Tools component, where a low-privileged attacker with HTTP network access can achieve complete takeover of the module. Oracle rates the flaw 8.8 (High) and describes it as 'easily exploitable,' with full confidentiality, integrity, and availability impact across EBS releases 12.2.3 through 12.2.15. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low complexity and low privilege bar make it a strong patch priority.
Full compromise of Oracle Advanced Pricing (Pricing Installation component of Oracle E-Business Suite) is achievable by a low-privileged, network-adjacent attacker over HTTP, per Oracle's July 2026 Critical Patch Update. Affecting EBS releases 12.2.3 through 12.2.15, successful exploitation yields complete takeover of the Advanced Pricing module with high confidentiality, integrity, and availability impact (CVSS 3.1 8.8). There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Account takeover in Oracle Sales Offline, a module of Oracle E-Business Suite (Internal Operations component) versions 12.2.3 through 12.2.15, lets a low-privileged authenticated attacker with HTTP network access fully compromise the product. Oracle rates it CVSS 3.1 8.8 with high confidentiality, integrity, and availability impact, describing it as 'easily exploitable' and resulting in complete takeover. No public exploit identified at time of analysis and it is not listed in CISA KEV, but its inclusion in Oracle's July 2026 Critical Patch Update warrants prompt patching.
Account takeover in Oracle General Ledger (Oracle E-Business Suite 12.2.3 through 12.2.15) lets a low-privileged attacker with network access via SOAP fully compromise the General Ledger module, gaining high impact to confidentiality, integrity, and availability. The Oracle July 2026 Critical Patch Update rates it CVSS 3.1 8.8 and describes it as easily exploitable, resulting in complete takeover of the affected component. No public exploit has been identified at time of analysis and it is not listed in CISA KEV.
Takeover of Oracle Trade Management (component: Claim LOV) within Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a low-privileged attacker with HTTP network access to fully compromise confidentiality, integrity, and availability of the module. The flaw is easily exploitable (AC:L) and requires only a low level of authenticated access (PR:L), carrying a CVSS 3.1 base score of 8.8. No public exploit identified at time of analysis, and it is not currently listed in CISA KEV.
Full compromise of the Oracle E-Business Suite TeleSales module (Internal Operations component) is possible over the network via HTTP by a low-privileged authenticated user. Affecting EBS releases 12.2.3 through 12.2.15, successful exploitation results in complete takeover of TeleSales with high confidentiality, integrity, and availability impact (CVSS 3.1 8.8). This flaw was disclosed in the Oracle July 2026 Critical Patch Update; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise of Oracle Payables (Oracle E-Business Suite, Internal Operations component) allows a low-privileged, network-authenticated attacker to take over the module via HTTP, with high impact to confidentiality, integrity, and availability (CVSS 3.1 8.8). Any user holding a valid low-privilege EBS session can escalate to full control of the Payables application. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and 'easily exploitable' vendor language make it a strong patching priority.
Privilege-based takeover of Oracle Product Hub (Oracle E-Business Suite, Internal Operations component) allows a low-privileged, network-authenticated attacker to fully compromise the product via HTTP. Affected releases span EBS 12.2.3 through 12.2.15, and the CVSS 3.1 vector (8.8) reflects high confidentiality, integrity, and availability impact with low attack complexity. No public exploit identified at time of analysis; disclosed through Oracle's July 2026 Critical Patch Update.
Takeover of Oracle Process Manufacturing (OPM) Product Development is possible in Oracle E-Business Suite 12.2.15 via its Quality Management Specs component, where a low-privileged attacker with HTTP network access can fully compromise the module. Oracle rates this 8.8 (High) with full confidentiality, integrity, and availability impact, and flags it as easily exploitable, meaning a valid but low-privilege application account is the only barrier. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Account takeover in Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 (Staffing component) lets a low-privileged, network-based attacker fully compromise the module over HTTP. Oracle rates the flaw CVSS 8.8 with high confidentiality, integrity, and availability impact and classifies it as "easily exploitable," meaning an authenticated user with minimal privileges can escalate to full control of the affected product. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but Oracle's own "easily exploitable" language signals a low barrier once credentials are held.
Full product takeover in Oracle Agile Product Lifecycle Management for Process 6.2.4 (Product Quality Management component) allows a low-privileged, network-authenticated attacker to compromise confidentiality, integrity, and availability over HTTP. Oracle rates this 8.8 and describes it as 'easily exploitable,' meaning any user holding a valid low-level account can escalate to full application control. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but the low attack complexity and high impact make it a strong patch priority.
Full product takeover in Oracle Agile Product Lifecycle Management for Process 6.2.4 (Product Quality Management component) allows a low-privileged, network-authenticated attacker to compromise the entire application over HTTP. Oracle rates the flaw as easily exploitable with high confidentiality, integrity, and availability impact (CVSS 8.8). No public exploit identified at time of analysis, and it is not on CISA KEV; the only source is Oracle's July 2026 Critical Patch Update.
Account takeover in Oracle Agile PLM 9.3.6 (Security component) lets a low-privileged, remotely authenticated attacker fully compromise the product over HTTP, per Oracle's July 2026 Critical Patch Update. The flaw is rated easily exploitable with high confidentiality, integrity, and availability impact (CVSS 8.8) and results in complete takeover of the Agile PLM instance. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Full application takeover in Oracle Agile PLM 9.3.6 (Product Lifecycle Management) is possible via the User and User Group component, where a low-privileged authenticated user with HTTP network access can escalate to complete compromise of confidentiality, integrity, and availability. Rated CVSS 3.1 8.8 (High) and disclosed in Oracle's Critical Patch Update of July 2026, exploitation requires only valid low-level credentials and low attack complexity, making it attractive for insider or credential-theft abuse. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Takeover of Oracle Commerce Guided Search / Experience Manager 11.4.0 is possible for an authenticated low-privileged attacker reaching the Experience Manager component over HTTP. Rated CVSS 3.1 8.8 with full confidentiality, integrity, and availability impact, this flaw was disclosed in the Oracle Critical Patch Update of July 2026. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Account/system takeover in Oracle Communications Service Catalog and Design (versions 8.0.0.7.0 through 8.3.0.2.0), Solution Designer component, lets a low-privileged attacker with network HTTP access fully compromise the product. Rated CVSS 3.1 8.8 with high confidentiality, integrity, and availability impact, Oracle describes it as 'easily exploitable,' meaning any authenticated user can escalate to complete control. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Account/module takeover in Oracle HRMS (UK) UK Payroll — part of Oracle E-Business Suite 12.2.8 through 12.2.15 — lets a low-privileged, network-based attacker fully compromise the module over HTTP with high confidentiality, integrity, and availability impact (CVSS 3.1 8.8). Oracle classifies it as easily exploitable and rates the outcome as complete takeover of Oracle HRMS (UK). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but as a networked, low-complexity flaw requiring only minimal privileges it warrants prompt patching in the July 2026 Critical Patch Update.
Privilege escalation to full component takeover in Oracle E-Business Suite (Oracle Applications DBA, ADPatch component) versions 12.2.3 through 12.2.15 allows a low-privileged attacker with HTTP network access to fully compromise the Oracle Applications DBA subsystem, yielding high confidentiality, integrity, and availability impact (CVSS 3.1 8.8). Disclosed in Oracle's July 2026 Critical Patch Update, this is easily exploitable per Oracle's own rating. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and low privilege requirement make it a strong patching priority.
Full compromise of Oracle WebCenter Enterprise Capture is possible when a low-privileged, network-authenticated attacker abuses a flaw in the Client Bundle component reachable over HTTP, resulting in complete takeover with high confidentiality, integrity, and availability impact. It affects Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 and was disclosed in Oracle's July 2026 Critical Patch Update. Oracle rates it easily exploitable (CVSS 8.8), with no public exploit identified at time of analysis and no CISA KEV listing.
Full compromise of Oracle WebCenter Enterprise Capture (versions 12.2.1.4.0 and 14.1.2.0.0) is possible when a low-privileged attacker with network access over HTTP targets the Client Bundle component. Per Oracle's July 2026 Critical Patch Update, successful attacks result in complete takeover of the product with high confidentiality, integrity, and availability impact (CVSS 3.1 base score 8.8). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Full compromise of Oracle Advanced Outbound Telephony (a component of Oracle E-Business Suite) is possible when a low-privileged user with HTTP network access exploits an easily-exploitable flaw in the Internal Operations component, per the July 2026 Oracle Critical Patch Update. Successful exploitation yields complete takeover of the module with high confidentiality, integrity, and availability impact across all supported releases 12.2.3 through 12.2.15. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Account takeover in Oracle iReceivables (Oracle E-Business Suite, AR Web Utilities component), versions 12.2.3 through 12.2.15, lets a low-privileged attacker with HTTP network access fully compromise the module. Oracle rates it CVSS 3.1 8.8 with high confidentiality, integrity, and availability impact and describes it as 'easily exploitable,' meaning a valid low-privilege EBS account is the only real barrier. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and authenticated-but-low privilege requirement make it a strong patching priority.
Takeover of the Oracle Installed Base component in Oracle E-Business Suite (Create Item Instance function) is possible by a low-privileged, remote attacker over HTTP against versions 12.2.3 through 12.2.15. Oracle's July 2026 Critical Patch Update rates this at CVSS 8.8 with full confidentiality, integrity, and availability impact, meaning any authenticated EBS user account can fully compromise the Installed Base module. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Takeover of Oracle Enterprise Asset Management (the eAM module of Oracle E-Business Suite, Internal Operations component) is possible by a low-privileged, authenticated network attacker sending crafted HTTP requests. Oracle rates this CVSS 3.1 8.8 with full confidentiality, integrity, and availability impact against supported versions 12.2.3 through 12.2.15, and describes exploitation as easy. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the fix ships in the Oracle Critical Patch Update of July 2026.
Account takeover in Oracle Applications Framework (Search Bean component) affects Oracle E-Business Suite versions 12.2.3 through 12.2.15, allowing a low-privileged, authenticated attacker with HTTP network access to fully compromise the Applications Framework. Rated CVSS 3.1 8.8 with high confidentiality, integrity, and availability impact, the flaw is described by Oracle as easily exploitable and results in complete takeover of the component. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV, though its inclusion in Oracle's July 2026 Critical Patch Update signals vendor-confirmed severity.
Full compromise of Oracle WebCenter Content is possible in versions 12.2.1.4.0 and 14.1.2.0.0 (Web Content Management component of Oracle Fusion Middleware), where a low-privileged, network-adjacent attacker sending crafted HTTP requests can escalate to complete takeover of the product with high confidentiality, integrity, and availability impact. Oracle rates this 8.8 (CVSS 3.1) and describes it as 'easily exploitable,' meaning any authenticated user with minimal privileges can seize the system. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and 'takeover' outcome make it a priority patch.
Privilege-based full compromise of Oracle WebCenter Content (Web Content Management component) in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged, network-authenticated attacker take over the entire product over HTTP. Oracle rates it CVSS 3.1 8.8 with High confidentiality, integrity, and availability impact, and describes it as 'easily exploitable.' There is no public exploit identified at time of analysis and it is not on CISA KEV, but the low attack complexity and 'takeover' outcome make it a high-priority patch in the July 2026 Oracle Critical Patch Update.
Full compromise of Oracle JD Edwards EnterpriseOne Procurement and Subcontract Management (version 9.2) is achievable by a low-privileged attacker with HTTP network access, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 score of 8.8 and Oracle explicitly characterizes it as 'easily exploitable,' with successful attacks resulting in complete takeover of the Procurement component (confidentiality, integrity, and availability all high). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the authenticated-yet-low-barrier profile makes it a strong patch priority for JD Edwards operators.
Privilege-escalating takeover of Oracle PeopleSoft Enterprise CS Student Records (Campus Solutions) 9.2.38, specifically the Australian Features component, allows a low-privileged attacker with only HTTP network access to fully compromise the module. Per Oracle's CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:H, score 8.8), a single valid low-level application account is enough to achieve complete confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was disclosed via the Oracle Critical Patch Update of July 2026.