Path traversal in Progress ShareFile Storage Zones Controller before 5.12.5 and 6.0.2 lets an authenticated administrative user break out of intended directory boundaries to read arbitrary files, write files to arbitrary locations, and probe for file existence on the underlying server. Rated CVSS 8.7 with a scope change (S:C), the flaw converts application-level admin privileges into host filesystem read/write, but exploitation requires high privileges (PR:H) and there is no public exploit identified at time of analysis. Affected organizations are those self-hosting the on-premises Storage Zones Controller component that fronts ShareFile storage zones.
SQL injection in DHIS2 SQL View data endpoints lets an authenticated user with SQL View execution access supply crafted filter values that are interpolated directly into the generated SQL, allowing them to read data outside the intended SQL View result set. It affects release lines 2.37, 2.38 and 2.39 prior to the 2026-06-09 End-of-Support security updates and carries a vendor CVSS 4.0 score of 8.7 (High). There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the fix reworks filter handling to use parameterized placeholders instead of string interpolation.
Cross-context data compromise in Oracle PeopleSoft Enterprise CC Common Application Objects 9.2 (Common Application Objects component) allows a low-privileged, network-based attacker to gain unauthorized read and write access to critical data after tricking a legitimate user into interacting with malicious content. The scope-changing nature (S:C) combined with the Authentication Bypass tag and required user interaction is consistent with a stored cross-site scripting or session-riding style flaw whose impact spills over into additional PeopleSoft products. No public exploit identified at time of analysis and the flaw is not on CISA KEV.
Cross-context data compromise in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 (Content Server component) lets a low-privileged, authenticated attacker abuse HTTP-facing functionality to read and modify all Content-Server-accessible data, with a scope change that can significantly impact adjacent Oracle products. Exploitation requires tricking a legitimate user into interacting with attacker-controlled content, and Oracle rates it CVSS 3.1 8.7 (confidentiality and integrity high, no availability impact). Disclosed in Oracle's July 2026 Critical Patch Update with no public exploit identified at time of analysis and not listed in CISA KEV.
Scope-changing confidentiality and integrity compromise in Oracle WebCenter Content: Imaging (Core component) affects Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0, letting a low-privileged, network-based attacker who lures an authenticated user into an action read, create, delete, or modify all Imaging-accessible data. Oracle rates it CVSS 3.1 8.7 with a scope change, meaning successful attacks can significantly impact products beyond Imaging itself. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the fix ships in the Oracle July 2026 Critical Patch Update.
Scope-changing data compromise in Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged, network-based attacker read, create, delete, or modify all data accessible to the application. Exploitation is rated easy but requires tricking a separate user into an interaction (UI:R), and the flaw crosses a trust boundary to significantly impact additional products (scope change). No public exploit has been identified at time of analysis and it is not on CISA KEV; EPSS was not provided.
Unauthorized data compromise in Oracle PeopleSoft Enterprise FIN Cash Management 9.2 allows a remote, unauthenticated attacker to read, create, delete, or modify all data accessible to the Cash Management component over HTTP. The flaw carries a scope change, meaning a successful attack can significantly impact products beyond Cash Management itself. No public exploit identified at time of analysis; the CVSS 3.1 base score is 8.7 driven by high confidentiality and integrity impact, though the vector rates exploitation as difficult (AC:H).
Cross-scope data compromise in Oracle WebCenter Content (Content Server component), versions 12.2.1.4.0 and 14.1.2.0.0, lets a remote unauthenticated attacker over HTTP read, create, delete, or modify all data accessible to the Content Server, with a scope change that can significantly impact other integrated Oracle Fusion Middleware products. Oracle rates it CVSS 3.1 8.7 (high complexity) with confidentiality and integrity impact but no availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the vendor tags suggest an authentication-bypass class issue.
Data tampering and denial-of-service in Oracle Unified Directory (OUD Core component) let a high-privileged, network-adjacent attacker abuse the LDAP interface to modify or destroy directory data and force a complete crash or hang of the service. Affected supported versions are 12.2.1.4.0 and 14.1.2.1.0, addressed in the Oracle July 2026 Critical Patch Update. The flaw carries a scope change, meaning a successful attack can significantly impact products beyond OUD itself. No public exploit has been identified at time of analysis.
Broken authorization in the Grav api plugin (grav-plugin-api) before 1.0.8 lets any authenticated panel user holding the baseline admin.login permission forge persistent API keys bound to arbitrary accounts, resulting in impersonation and privilege escalation up to account takeover. The plugin intercepts the apiKeyGenerate/apiKeyRevoke admin tasks ahead of the account-management ACL, so a low-privilege operator can mint a key that inherits a higher-privileged account's API permissions. Reported by VulnCheck with a fix in 1.0.8; no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Unauthorized data compromise in Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 lets a remote unauthenticated attacker read, create, delete, or modify all data accessible to the product over HTTP, with a scope change that can significantly impact adjacent products. Oracle rates this CVSS 8.7 with high confidentiality and integrity impact but high attack complexity, and the vendor tags it as an authentication bypass. No public exploit identified at time of analysis and it is not on CISA KEV.
Scope-changing compromise of Oracle Unified Directory (OUD Core) 12.2.1.4.0 and 14.1.2.1.0 lets a remote, unauthenticated attacker abuse the LDAP interface to read and alter all directory-accessible data, tagged by Oracle as an authentication bypass. Because OUD brokers identity and access for downstream Fusion Middleware systems, successful attacks carry a CVSS 3.1 scope change (S:C) and can significantly impact other products beyond the directory itself. No public exploit identified at time of analysis; exploitation is rated high-complexity (AC:H), so this is a serious but non-trivial-to-weaponize flaw addressed in Oracle's July 2026 Critical Patch Update.
Unauthorized data compromise in Oracle WebCenter Content: Imaging (Core component) versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged, network-adjacent attacker to read, create, delete, or modify all Imaging-accessible data by tricking an authenticated user into interacting with a malicious request. Rated CVSS 3.1 8.7 (High) with a scope change that lets exploitation impact additional connected Oracle Fusion Middleware products beyond Imaging itself. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; authentication is required (PR:L) plus victim interaction (UI:R), which meaningfully limits mass exploitation.
Data compromise in Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 (Process Scheduler component) lets a low-privileged, network-reachable attacker read and modify critical data after luring a legitimate user into an interaction, with a scope change that can spill impact onto additional connected products. Oracle rates it CVSS 3.1 8.7 (C:H/I:H, no availability impact). No public exploit is identified at time of analysis and it is not in CISA KEV, but ease of exploitation and the cross-boundary scope change make it a notable item in the July 2026 Oracle Critical Patch Update.
Adjacent-network compromise of Oracle Coherence (Oracle Fusion Middleware Core component) allows a low-privileged attacker on the same physical communication segment to read and modify all Coherence-accessible data, with a scope change that can significantly impact other products on the host. Supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 are affected, carrying a CVSS 3.1 base score of 8.7 (High) with high confidentiality and integrity impact but no availability impact. No public exploit identified at time of analysis; the flaw is tagged as an authentication bypass and is fixed in the Oracle July 2026 Critical Patch Update.
Stored cross-site scripting in FOG Project's inventory reporting pipeline allows an unauthenticated network attacker to inject persistent JavaScript into the admin interface by submitting a crafted `sysproduct` field to the client-facing `/service/inventory.php` endpoint using any known registered host MAC address. The payload is persisted to the database and executes in an administrator's browser when they open Reports > Inventory, enabling session hijacking, credential theft, or admin-level actions including host manipulation and imaging pipeline control. No public exploit has been identified at time of analysis and EPSS is low (0.22%, 12th percentile), but the stored nature of the payload and its execution in a privileged admin context make this a meaningful risk for any internet-exposed or internally accessible FOG deployment.
Stored XSS in FOG Project's unauthenticated inventory endpoint allows network-accessible attackers to inject persistent malicious scripts that execute in any administrator's browser session. Affecting fogproject versions prior to 1.5.10.1832 (stable) and 1.6.0-beta.2313 (beta), the flaw chains an unsanitized write path at /service/inventory.php with unencoded HTML rendering on the Host Management Inventory page, producing a scope-changing XSS condition with high confidentiality and integrity impact on the admin session. No public exploit has been identified at time of analysis, but the unauthenticated write vector combined with high-privilege execution context makes this a high-priority patch despite a low EPSS score of 0.20%.
Payment and calculation total tampering in the Ninja Forms WordPress plugin (versions 3.14.8 and prior) allows unauthenticated attackers to submit crafted values that match no configured option in ListSelect or ListRadio fields, causing the get_calc_value() method to fail open and return attacker-supplied numbers. This lets an attacker rewrite form calculation results and payment amounts - including setting order totals to zero - bypassing admin-defined pricing logic. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis, and this is not listed in CISA KEV.
Unauthenticated authentication-bypass in Oracle Access Manager (Oracle Fusion Middleware, Authentication Engine) versions 12.2.1.4.0 and 14.1.2.1.0 lets a remote attacker reach protected data over HTTP without credentials. Because the scope changes, a successful attack can pivot beyond OAM itself and compromise other products that rely on it for single sign-on, exposing critical data across the integrated environment. No public exploit identified at time of analysis; Oracle addressed the flaw in its July 2026 Critical Patch Update.
Unauthorized data disclosure in Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 lets a remote, unauthenticated attacker reach and read all data accessible to the application over HTTP, with a scope change that can significantly impact other connected products. The flaw is tagged as an authentication bypass and carries a CVSS 3.1 score of 8.6 driven entirely by confidentiality impact. No public exploit is identified at time of analysis, and it is fixed in the Oracle Critical Patch Update of July 2026.
Unauthorized data access in Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 allows a remote, unauthenticated attacker to reach all data accessible to the product over HTTP. The flaw carries a scope change, meaning a successful attack can significantly impact additional connected products beyond WebCenter Sites itself. Oracle rates it CVSS 3.1 8.6 (confidentiality-only); no public exploit identified at time of analysis and it is not listed in CISA KEV, though Oracle tags it as an Authentication Bypass.
Unauthorized data disclosure in Oracle Identity Manager Connector (Oracle Fusion Middleware, PeopleSoft Applications component) versions 12.2.1.4.0 and 14.1.2.1.0 allows a remote unauthenticated attacker to reach critical data over HTTP, with a scope change (S:C) meaning the impact extends to additional connected products beyond the connector itself. The vendor rates it CVSS 8.6 with confidentiality-only impact and low attack complexity, and tags indicate an authentication-bypass class weakness. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, so risk is currently based on the vendor's own severity assessment via the July 2026 Critical Patch Update.
Unauthorized data access in Oracle Unified Directory (OUD Core) 12.2.1.4.0 and 14.1.2.1.0 lets a remote unauthenticated attacker reach critical directory data over HTTP, with a scope change that can spill impact into other products relying on the directory. Oracle rates it CVSS 3.1 8.6 with high confidentiality impact and no integrity or availability effect, and tags it as an authentication bypass. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated authentication-bypass in Oracle Access Manager (Fusion Middleware Authentication Engine, versions 12.2.1.4.0 and 14.1.2.1.0) lets a remote attacker over HTTP compromise the identity/SSO tier and read all data it can access. Because of a CVSS scope change, successful attacks can significantly impact other products that rely on OAM for authentication, magnifying the blast radius. There is no public exploit identified at time of analysis and this CVE is not listed in CISA KEV; risk is driven by the low-complexity, no-authentication network vector (CVSS 3.1 base 8.6).
Unauthorized data disclosure in Oracle WebLogic Server (WLS Web Services component) lets an unauthenticated remote attacker read all data accessible to the server over HTTP, with a scope change that can significantly impact additional products beyond WebLogic itself. Affected supported versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, addressed in Oracle's July 2026 Critical Patch Update. Rated CVSS 3.1 8.6 (confidentiality-only) and tagged as an authentication bypass; no public exploit identified at time of analysis.
Denial-of-service with data tampering in Oracle Coherence 15.1.1.0.0 (Fusion Middleware Core) lets an unauthenticated network attacker hang or repeatedly crash the in-memory data grid over TCP, while also gaining limited unauthorized read and write access to a subset of grid-managed data. Rated CVSS 3.1 8.6 by Oracle and described as 'easily exploitable,' the flaw requires no authentication or user interaction. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Unauthorized data access in Oracle Access Manager (Fusion Middleware, Authentication Engine) 12.2.1.4.0 and 14.1.2.1.0 allows a remote, unauthenticated attacker to compromise confidentiality over HTTP, with a scope change that can significantly impact other Oracle products relying on it for single sign-on. Tagged as an Authentication Bypass, the flaw carries a CVSS 3.1 score of 8.6 and is addressed in the Oracle Critical Patch Update of July 2026. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthorized data disclosure in Oracle HTTP Server 12.2.1.4.0 and 14.1.2.0.0 (Oracle Fusion Middleware, mod_proxy component) lets an unauthenticated remote attacker over HTTP read critical data and, because of a scope change, reach data belonging to other back-end products the proxy fronts. The confidentiality-only impact combined with S:C strongly indicates a proxy-side request-forwarding/SSRF-class weakness that exposes internal resources rather than a code-execution flaw. Addressed in the Oracle Critical Patch Update of July 2026; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Denial-of-service and limited data tampering in Oracle Business Intelligence Enterprise Edition (BI Platform Security component, versions 8.2.0.0.0 and 26.01.0.0.0) lets an unauthenticated remote attacker over HTTP hang or repeatedly crash the server (complete DOS) and perform limited unauthorized read, insert, update, or delete of accessible data. Oracle rates it CVSS 3.1 8.6 and describes it as easily exploitable with no authentication or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
SQL injection and security-boundary bypass in Google's MCP Toolbox for Databases (googleapis/mcp-toolbox) lets a low-privileged MCP client abuse the prebuilt BigQuery forecasting tool (bigquery-forecast) to read arbitrary BigQuery tables. The tool interpolates client-supplied column parameters (data_col, timestamp_col, id_cols) unescaped into a generated AI.FORECAST SELECT statement, and the operator-configured allowedDatasets guard only validates the history_data parameter - not the final assembled query - so an attacker breaks out of a string literal to reach datasets that should be off-limits. There is no public exploit identified at time of analysis; risk derives from the injection primitive plus the confidentiality impact of cross-dataset reads.
Full compromise of Oracle Product Hub (Internal Operations component) in Oracle E-Business Suite 12.2.3 through 12.2.15 allows an authenticated, low-privileged attacker with HTTP network access to take over the product and, because of a scope change, significantly impact additional connected products. The flaw was disclosed in Oracle's July 2026 Critical Patch Update with a CVSS 3.1 score of 8.5, though the vector rates it as difficult to exploit (AC:H). No public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege-escalation-to-takeover in Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 (OIM Legacy UI component) allows a low-privileged, authenticated attacker with HTTP network access to fully compromise the product, with a scope change that can significantly impact additional connected products. Rated CVSS 3.1 8.5 (High) with full confidentiality, integrity, and availability impact, though the AC:H metric marks it as difficult to exploit. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; it was disclosed in Oracle's July 2026 Critical Patch Update.
Full takeover of Oracle Coherence (Fusion Middleware Core) is possible by a low-privileged network attacker over TCP in supported versions 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, with a scope change that can significantly impact additional co-located products beyond Coherence itself. Rated CVSS 3.1 8.5 with high confidentiality, integrity and availability impact, though the high attack complexity means exploitation is not trivial. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege escalation and full component takeover affects Oracle Contracts Integration within Oracle E-Business Suite (Internal Operations component), versions 12.2.3 through 12.2.15, where a low-privileged, network-authenticated attacker can compromise the component and, due to a scope change (S:C), significantly impact additional connected products. Rated CVSS 3.1 8.5 (High) with full confidentiality, integrity, and availability loss, though the attack is flagged as difficult to exploit (AC:H). No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Privilege-abusing information disclosure and data tampering in Oracle WebCenter Content: Imaging (Core component) lets a low-privileged, network-based attacker read all Imaging-accessible data and modify some of it over HTTP. The flaw carries a scope change (CVSS 8.5), meaning a successful attack can reach beyond the Imaging module into other Fusion Middleware components, and Oracle tags it as an authentication-bypass-class issue. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle rates it 'easily exploitable' and shipped a fix in the July 2026 Critical Patch Update.
Sensitive data disclosure and partial data tampering in Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 allow a low-privileged, network-based attacker over HTTP to gain complete read access to all data the product can reach and to modify some of that data. Oracle rates the flaw CVSS 3.1 8.5 with a scope change, meaning exploitation can significantly impact adjacent products beyond WebCenter Content itself. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so treat this as a high-severity but not confirmed-exploited issue.
Privilege escalation and cross-product data compromise in Oracle Unified Directory 12.2.1.4.0 and 14.1.2.1.0 (OUD Core) lets a low-privileged network attacker abuse the LDAP interface to gain complete read access to all directory-accessible data and partial write access. Vendor-tagged as an authentication bypass with a scope change, meaning successful attacks can significantly impact other products that rely on this directory. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but the CVSS 3.1 base score of 8.5 with 'easily exploitable' vendor language marks it as a high-priority patch.
Full takeover of Oracle MySQL Connector/Net (versions 9.7.0 and 9.7.1) is possible by a low-privileged network attacker who wins a high-complexity attack, with a scope change that lets the compromise significantly impact products beyond the connector itself. Oracle rates this CVSS 3.1 8.5 with high confidentiality, integrity, and availability impact, and it is addressed in the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Elevation-of-scope compromise in Oracle Unified Directory (Fusion Middleware, OUD Core component) versions 12.2.1.4.0 and 14.1.2.1.0 lets an authenticated low-privileged attacker with LDAP network access read all OUD-accessible data and modify some of it, with a scope change that can significantly impact additional connected products. Oracle rates it CVSS 3.1 8.5, and the source intelligence tags it as an authentication-bypass-class issue. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the low attack complexity and scope change make it a meaningful patch priority for Oracle-integrated identity infrastructure.
Unauthorized critical-data access in Oracle E-Business Suite's Process Manufacturing Regulatory Management module (component: Internal Operations) allows a low-privileged, network-authenticated attacker to compromise the module over HTTP, with a scope change that may significantly impact additional Oracle products. Oracle rates it CVSS 3.1 8.5, reflecting high confidentiality impact plus limited integrity impact across a changed scope. There is no public exploit identified and it is not in CISA KEV, but Oracle self-reported it and shipped a fix in the July 2026 Critical Patch Update.
Data compromise and cross-product impact in Oracle E-Business Suite (Oracle Common Application Components, versions 12.2.3 through 12.2.15) allows a low-privileged, network-authenticated attacker to read, create, delete, or modify critical application data and cause a partial denial of service. Because the flaw carries a scope change (S:C), a successful attack can significantly affect additional Oracle products beyond the vulnerable component. Oracle rates it CVSS 3.1 8.4 but flags it as difficult to exploit (AC:H); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full server takeover in Oracle WebLogic Server 12.2.1.4.0 and 14.1.2.0.0 (Core component) allows a high-privileged attacker positioned on the adjacent physical communication segment to compromise the server and, due to a scope change, significantly impact additional connected products. Successful exploitation yields complete loss of confidentiality, integrity, and availability. No public exploit is identified at time of analysis and the issue is not listed in CISA KEV; Oracle addressed it in the July 2026 Critical Patch Update.
Full takeover of Oracle MySQL Server and MySQL Cluster is possible through the Server: Group Replication Plugin, where a local attacker holding only a logon to the host running the database can compromise the instance without any database credentials. The flaw affects MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, plus MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1, and carries a CVSS 3.1 base score of 8.4 with high confidentiality, integrity and availability impact. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Privilege-scoped compromise of Oracle Price Protection (a module of Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged attacker with local logon to the hosting infrastructure to read, create, delete, or modify all data accessible to the product. Oracle rates it CVSS 3.1 8.4 with a scope change, meaning a successful attack can significantly impact products beyond Price Protection itself. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle-reported EBS flaws are historically high-value targets.
Privilege-escalation and data-compromise flaw in Oracle Data Integrator 12.2.1.4.0 and 14.1.2.0.0 (Market Place component) lets a low-privileged user who can log on to the host running ODI read, create, delete, or modify all ODI-accessible data. Because the flaw carries a scope change, successful attacks can significantly impact other products beyond ODI itself, driving the CVSS 3.1 base score to 8.4. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle rates it 'easily exploitable' for an authenticated local user.
Complete takeover of Oracle Applications Manager (a management console within Oracle E-Business Suite) is possible through the Command Line - RapidClone component in EBS versions 12.2.3 through 12.2.15. An attacker who already has logon access to the host infrastructure where the component runs can compromise it without any application-level authentication, gaining full confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV; it was disclosed by Oracle in the July 2026 Critical Patch Update.
Sandbox confinement bypass in Canonical snapd (snap-confine) affects all supported Ubuntu LTS releases (16.04 through 26.04) because the default seccomp templates fail to block system calls that create or set set-user-ID flags on files. A process already running inside a strictly confined snap can compile or drop a binary, mark it setuid, and then execute it to escape confinement assumptions and perform privileged actions within the container namespace. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the CVSS 8.4 (scope-changed) rating reflects a genuine confinement-escape primitive.
Privilege-scoped data compromise in Oracle Communications Service Delivery Platform (Messaging Enabler component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged local user with logon access to the host read, create, modify, or delete all SDP-accessible data. Because the flaw carries a scope change (S:C), successful attacks can significantly impact adjacent Oracle products beyond SDP itself. There is no public exploit identified at time of analysis, and no EPSS or KEV signal is available in the provided data; Oracle disclosed it in the July 2026 Critical Patch Update.
Privilege escalation in FileGator (the open-source self-hosted PHP web file manager) lets an authenticated user who holds the 'chmod' permission set arbitrary Unix file modes via the '/chmoditems' API endpoint, ultimately elevating to root. The endpoint forwards attacker-supplied values straight to PHP's chmod() through octdec() with no validation or allow-listing, so a low-privileged operator can make sensitive binaries or files setuid/world-writable and gain full control of the host. No public exploit identified at time of analysis, and the issue is not in CISA KEV; EPSS was not provided.
XML external entity exposure in the Netty network framework affects the optional XmlDecoder handler in versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, where the underlying Aalto AsyncXMLInputFactory is instantiated without any security hardening. Any remote party able to push bytes into a channel pipeline that contains XmlDecoder can submit XML carrying a DOCTYPE/DTD declaration, and depending on Aalto async parser behavior DTD and entity processing remains active, creating a conditional path to reading local files or performing SSRF-style out-of-band requests. There is no public exploit identified at time of analysis, the issue is not on CISA KEV, and it is fixed in 4.1.136.Final and 4.2.16.Final.