Broken authorization in the Ninja Forms WordPress plugin (versions 3.14.8 and prior) lets an authenticated Author-level user expose stored form submissions to any unauthenticated site visitor by embedding the `ninja-forms/submissions-table` Gutenberg block with an arbitrary formID on a published post. Because the block's render callback performs no capability check and injects a signed bearer token into every visitor's browser via `wp_localize_script`, anyone loading the page can replay that token against the REST submissions endpoint and read all saved field values, including PII such as names, emails, and phone numbers. Reported by VulnCheck; a vendor patch is available, but no public exploit code was identified at time of analysis and the flaw is not in CISA KEV - no public exploit identified at time of analysis.
Data tampering and partial denial-of-service in Oracle Contracts Integration (a module of Oracle E-Business Suite, Internal Operations component) affects supported EBS releases 12.2.3 through 12.2.15. An unauthenticated remote attacker who can lure a legitimate user into interacting with a crafted HTTP request can create, delete, or modify all Contracts-Integration-accessible data and partially disrupt the service. No public exploit identified at time of analysis, and it is not listed in CISA KEV; Oracle rates it CVSS 3.1 7.1.
Information disclosure and limited data tampering in Oracle E-Business Suite's Process Manufacturing Logistics module (Internal Operations component) lets a low-privileged, network-based attacker reach critical application data over HTTP. Affecting supported EBS releases 12.2.3 through 12.2.15, a successful attack yields full read access to all Process Manufacturing Logistics data plus partial write (insert/update/delete) capability. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; EPSS was not provided.
Unauthorized data compromise in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Experience Manager component) allows a low-privileged, network-based attacker over HTTP to gain complete read access to all accessible data plus limited update, insert, and delete capability. Rated CVSS 7.1 and tagged as an authentication bypass, it was disclosed by Oracle in the July 2026 Critical Patch Update and requires only low-level credentials with no user interaction. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Unauthorized data access in Oracle Communications Unified Inventory Management (versions 7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0, and 8.0.1) allows a low-privileged attacker with HTTP network access to compromise the Security component, gaining read access to all UIM-accessible data plus limited update, insert, or delete capability. Rated CVSS 3.1 7.1 (C:H/I:L) and flagged by Oracle as easily exploitable, though no public exploit has been identified and it is not listed in CISA KEV. The vendor 'Authentication Bypass' tag suggests the flaw undermines authorization controls despite requiring only low privileges to begin.
Unauthorized data access in Oracle Installed Base (a module of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) lets a low-privileged, network-based attacker read all data accessible to the Installed Base application and modify some of it via HTTP. Oracle rates it CVSS 7.1, driven by high confidentiality impact and partial integrity impact with no availability effect. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though it is disclosed as part of the Oracle July 2026 Critical Patch Update.
Unauthorized data access and partial data manipulation in Oracle Advanced Pricing (the Pricing Installation component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) allows a low-privileged attacker with network access over HTTP to read all data accessible to the module and to insert, update, or delete some of it. The flaw is rated CVSS 3.1 7.1 (High) with high confidentiality impact and low integrity impact; Oracle disclosed it in the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though EBS pricing modules are attractive targets in enterprise ERP environments.
Sensitive data exposure in Oracle Compensation Workbench (Oracle E-Business Suite 12.2.3 through 12.2.15) lets a low-privileged, network-authenticated attacker read all data accessible to the component and perform limited unauthorized inserts, updates, or deletes over HTTP. Rated CVSS 7.1 (C:H/I:L/A:N), it was disclosed in the Oracle July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not on CISA KEV, though EBS is a high-value target and Oracle CPU flaws have historically drawn attacker interest.
Unauthorized data access in Oracle E-Business Suite's Compensation Workbench component (versions 12.2.3 through 12.2.15) allows a low-privileged, authenticated attacker with HTTP network access to read all data accessible to the module and to modify some of it. Oracle rates this CVSS 7.1 (C:H/I:L). No public exploit is identified at time of analysis and it is not listed in CISA KEV, though it was disclosed in Oracle's July 2026 Critical Patch Update.
Unauthorized data access in Oracle Applications Framework (the OAF layer of Oracle E-Business Suite) lets a low-privileged, network-based attacker abuse the Search Bean [Incl. Advanced] component to read all OAF-accessible data and perform limited unauthorized updates, inserts, or deletes. Affected releases span EBS 12.2.3 through 12.2.15, and the flaw is rated CVSS 3.1 7.1 with high confidentiality and low integrity impact. No public exploit has been identified at time of analysis, and it is addressed in Oracle's July 2026 Critical Patch Update.
Information disclosure and partial data tampering in Oracle Enterprise Command Center Framework V16 (a component of Oracle E-Business Suite) allows a low-privileged, network-authenticated attacker to reach critical data and make limited unauthorized modifications over HTTP. Disclosed in Oracle's July 2026 Critical Patch Update, the flaw carries a CVSS 3.1 score of 7.1 with high confidentiality impact and is described by Oracle as easily exploitable. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Information disclosure and partial data tampering in the Imaging component (Core) of Oracle WebCenter Content, part of Oracle Fusion Middleware, affects supported versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with HTTP network access can compromise the Imaging service, gaining unauthorized read access to all Imaging-accessible data and limited unauthorized update, insert, or delete capability, addressed in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis; the record carries an 'Authentication Bypass' tag despite the CVSS requiring low privileges (PR:L).
Data manipulation and denial-of-service in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 (Person Data component) lets a low-privileged, network-authenticated attacker create, delete or modify critical data, read a subset of accessible data, and trigger a repeatable crash of the module. The flaw carries a CVSS 3.1 base score of 7.1 and is flagged as difficult to exploit (AC:H). No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Data tampering and information disclosure in Oracle Price Protection (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a low-privileged attacker with HTTP network access create, delete, or modify critical Price Protection data and read a subset of accessible data. The flaw carries a CVSS 3.1 base score of 7.1 (C:L/I:H/A:N) and was disclosed in Oracle's July 2026 Critical Patch Update. No public exploit has been identified at time of analysis, the issue is not listed in CISA KEV, and no EPSS score was provided.
Data tampering in the Oracle Project Portfolio Analysis module of Oracle E-Business Suite (Internal Operations component, versions 12.2.3 through 12.2.15) lets a low-privileged, network-authenticated attacker create, delete, or modify critical application data and read a subset of accessible data over HTTP. Oracle rates it 7.1 (CVSS 3.1) and describes it as easily exploitable, though impact is confined to data integrity and limited confidentiality with no availability effect. No public exploit identified at time of analysis; it was disclosed in the Oracle Critical Patch Update of July 2026.
Data tampering in Oracle Price Protection (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged remote attacker with an authenticated HTTP session to create, delete, or modify critical application data and read a subset of Price Protection data. The CVSS 3.1 base score is 7.1, driven primarily by high integrity impact (I:H) with limited confidentiality exposure (C:L) and no availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Data tampering and partial denial of service in Oracle Project Portfolio Analysis (a module of Oracle E-Business Suite versions 12.2.3 through 12.2.15) lets a low-privileged, network-based attacker over HTTP create, delete, or modify all data accessible to the application via its Internal Operations component. Oracle rates it CVSS 3.1 7.1 with high integrity and low availability impact and no confidentiality impact. No public exploit identified at time of analysis and it is not in CISA KEV; it was disclosed and fixed in Oracle's July 2026 Critical Patch Update.
Unauthorized information disclosure and case-attachment tampering in Elastic Kibana lets a low-privileged authenticated user with limited file-management permissions read, alter, or delete case attachments belonging to feature areas they should not reach, including sensitive Security Solution cases. The flaw stems from Kibana's file-access authorization check and its resource retrieval using two different resolution mechanisms, allowing the authorization gate to be bypassed. No public exploit identified at time of analysis; not listed in CISA KEV, and EPSS was not provided.
Gitea's Actions permission engine grants fork-PR task tokens unauthorized code-read access to third private repositories via a missing fork-PR discriminator in the collaborative-owner branch of `GetActionsUserRepoPermission`. All Gitea instances running versions up to and including 1.26.4 are affected when the collaborative-owner Actions feature is configured, as confirmed by vendor advisory GHSA-fj8v-hjwv-qm88 and EUVD-2026-58151. An attacker who has had at least one fork PR previously approved can exploit this to clone the full source of a private repository they were never authorized to access; impact is strictly read-only, with no write or code-execution capability. A functional PoC was included in the security advisory; this CVE is not in the CISA KEV catalog and no EPSS score was provided in the available data.
Data compromise in Oracle MySQL Connector/J (MySQL Connectors 9.7.0 through 9.7.1) allows a low-privileged attacker with network access over multiple protocols to read, create, delete, or modify all data accessible to the connector and to cause a partial denial of service. Oracle rates this CVSS 3.1 7.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L), reflecting high difficulty of exploitation but broad confidentiality and integrity impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the fix ships in Oracle's July 2026 Critical Patch Update.
Data tampering in Oracle Coherence (Core component) of Oracle Fusion Middleware allows a low-privileged attacker with TCP network access to create, delete, or modify critical data and read a subset of accessible data. Versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 are affected, with Oracle rating the flaw easily exploitable (CVSS 3.1 base 7.1, high integrity impact). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was disclosed in Oracle's July 2026 Critical Patch Update.
Unauthorized critical-data access in Oracle Advanced Pricing (Pricing Installation component) of Oracle E-Business Suite versions 12.2.14 through 12.2.15 allows a low-privileged, network-authenticated attacker over HTTP to read all data accessible to the module and to make limited unauthorized inserts, updates, or deletes. Because the flaw carries a scope change, successful exploitation may significantly impact additional integrated E-Business Suite products beyond Pricing itself. Disclosed in Oracle's July 2026 Critical Patch Update with a CVSS 3.1 base score of 7.1; no public exploit has been identified at time of analysis and it is not listed in CISA KEV.
Denial of service in Atlassian Confluence Data Center allows an authenticated attacker to render the application unavailable to legitimate users by triggering resource exhaustion that disrupts the host's services. Affected releases span the 9.0.x through 10.2.x branches, with a CVSS 4.0 score of 7.1 (High) driven entirely by availability impact. No public exploit has been identified at time of analysis; the flaw was discovered internally via Atlassian's penetration testing program rather than through in-the-wild activity.
Sensitive data disclosure in Oracle HRMS (UK) UK Payroll, part of Oracle E-Business Suite 12.2.3 through 12.2.15, lets a low-privileged attacker with HTTP network access read all HRMS-accessible data and modify some of it. The flaw is exploitable by an authenticated user (CVSS 3.1 PR:L) and carries a base score of 7.1 with high confidentiality and low integrity impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though Oracle E-Business Suite payroll modules are high-value targets holding PII and financial data.
Unauthorized data access in Oracle Field Service (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, remotely authenticated attacker to read all Field Service-accessible data and make limited unauthorized modifications over HTTP. Rated CVSS 3.1 7.1 (high) with high confidentiality and low integrity impact, the flaw is described by Oracle as easily exploitable and is tagged as an authentication bypass. There is no public exploit identified at time of analysis, it is not on CISA KEV, and no EPSS score was supplied.
Unauthorized data access and partial data manipulation in Oracle WebCenter Content: Imaging (Fusion Middleware component: Core) lets a low-privileged, network-based attacker read all Imaging-accessible data and modify some of it over HTTP. Versions 12.2.1.4.0 and 14.1.2.0.0 are affected, with a CVSS 3.1 base score of 7.1 driven by high confidentiality and low integrity impact. No public exploit identified at time of analysis and the flaw is not on CISA KEV; the Oracle-supplied 'Authentication Bypass' tag is somewhat at odds with the CVSS PR:L requirement and should be verified against the vendor advisory.
Data tampering in Oracle Project Portfolio Analysis (a module of Oracle E-Business Suite, component Internal Operations), versions 12.2.3 through 12.2.15, lets a low-privileged attacker with network HTTP access create, delete, or modify critical application data and read a subset of accessible data. Oracle rates it CVSS 3.1 7.1 with high integrity impact, and describes it as easily exploitable. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Data tampering in Oracle E-Business Suite's Financials Common Modules (Common Components) lets a low-privileged, network-authenticated attacker perform unauthorized creation, deletion, and modification of critical financial data across all module-accessible records, plus read access to a subset of that data. Affected releases span 12.2.3 through 12.2.15, remediated in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV, though the tag 'Authentication Bypass' warrants scrutiny given the authenticated CVSS profile.
Data manipulation in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1, Metadata Plugin component) allows a low-privileged attacker with HTTPS network access to create, delete, or modify critical data and read a subset of data across the platform. Rated CVSS 3.1 7.1 by Oracle, the flaw is described as easily exploitable and tagged as an authentication-bypass class issue. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Broken access control in HumHub 1.13.0 through 1.18.2 lets any authenticated user delete every member of any Space, regardless of whether they belong to or hold any role in that Space. The flaw is a missing authorization rule on the Space member-management controller's 'remove-all' action (CWE-862), fixed in 1.18.3. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial-to-trigger, authenticated-only nature makes it a realistic insider/low-privilege abuse risk.
Elevated information disclosure and data tampering in Oracle Solaris 11.4 allows a low-privileged, network-authenticated attacker to abuse the Remote Administration Daemon (RAD) utility component to gain complete read access to all Solaris-accessible data and modify a subset of it, with a scope change that can significantly impact other products on the host. Oracle rates it CVSS 3.1 7.1 with high attack complexity, and it is addressed in the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not in CISA KEV, so exploitation is not confirmed in the wild.
Full takeover of Oracle Production Scheduling (part of Oracle E-Business Suite, Internal Operations component) is possible for an unauthenticated attacker positioned on the same physical/adjacent network segment as the host, provided a legitimate user is tricked into interacting. Affecting EBS releases 12.2.3 through 12.2.15, successful exploitation compromises the confidentiality, integrity, and availability of the Production Scheduling engine. There is no public exploit identified at time of analysis, and the high attack complexity combined with adjacent-network and user-interaction requirements substantially constrains real-world exploitability.
Unauthorized data access in Oracle HRMS (US) within Oracle E-Business Suite (US Payroll Year End component) lets a low-privileged, network-based attacker read all HRMS-accessible data and modify some of it. Affected supported releases are 12.2.3 through 12.2.15, addressed in the Oracle July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and no CISA KEV listing, so this is not confirmed as actively exploited despite the sensitive payroll data at stake.
Blind SQL injection in Tenable Security Center (formerly Tenable.sc/SecurityCenter) lets an authenticated, low-privileged user manipulate report filtering parameters to read unauthorized data from the backend database. Because the vulnerable manager aggregates vulnerability, asset, and scan data across the enterprise, a successful attacker can exfiltrate sensitive security posture information belonging to other users and organizations. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; it was self-reported by Tenable under advisory TNS-2026-19.
Cross-tenant IDOR (broken authorization) in Shelf (shelf.nu) asset-tracking platform before version 1.20.2 allows an authenticated user in one organization to read, update, or connect records belonging to a different organization by supplying entity IDs that are never validated against the caller's workspace. Because Shelf is multi-tenant with per-organization data isolation, this breaks the core tenant boundary; a low-privilege user in Org A who learns or guesses an ID from Org B can act on Org B's data, and a loader-only restriction on personal-workspace bookings is bypassable via a crafted POST. No public exploit identified at time of analysis and the issue is not on CISA KEV, but the flaw is straightforward to abuse once a foreign ID is known.
Cross-site-scripting-style compromise of Oracle PeopleSoft Enterprise PeopleTools 8.62 (PIA Core Technology) lets a remote, unauthenticated attacker who lures an authenticated user into interacting with a crafted HTTP request achieve limited read/write access to PeopleSoft data and cause partial denial of service. The scope-change flag (S:C) means the impact can extend beyond PeopleTools into additional integrated products. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; CVSS 3.1 base score is 7.1.
Unauthorized data access in Oracle WebLogic Server 14.1.2.0.0 and 15.1.1.0.0 (Console component) allows an attacker with local logon to the hosting infrastructure to compromise the server and read all WebLogic-accessible data, with a scope change that can significantly impact other collocated products. Oracle rates it CVSS 3.1 7.1 (confidentiality-only). This is addressed in the Oracle Critical Patch Update of July 2026; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data compromise in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Endeca Application Controller) allows a low-privileged local attacker with logon access to read, create, modify, or delete all data accessible to the product. The flaw carries a CVSS 3.1 base score of 7.1 (C:H/I:H, no availability impact) and is described by Oracle as 'easily exploitable.' No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; it was disclosed in the Oracle Critical Patch Update of July 2026.
Repository visibility and template status in Gitea (self-hosted Git service) before 1.27.0 can be silently toggled by any repository owner or admin-collaborator through undocumented git push options (repo.private, repo.template) processed by the post-receive hook, bypassing all audit logging, webhooks, and notifications. An insider can flip a private repository to public long enough to clone proprietary code, then revert it, leaving only two ordinary push events in the activity feed. No CISA KEV listing and no separately published exploit tool exist, but the GHSA advisory ships full working reproduction commands, and the CVSS 3.1 base score is 7.1 (High).
Local privilege-abuse in the Filesystems component of Oracle Solaris 11.4 allows a low-privileged user with logon access to the host to corrupt or destroy critical operating-system data and to trigger a complete, repeatable denial of service (hang or crash) of the OS. Disclosed in Oracle's July 2026 Critical Patch Update and rated CVSS 3.1 7.1 with high Integrity and Availability impact but no confidentiality loss. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data access in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 (Content Server component) lets an attacker who already holds a login session on the host infrastructure read or take complete access to all data the product can reach, and because of a scope change the impact can extend to additional connected products. Addressed in Oracle's July 2026 Critical Patch Update, the flaw carries a CVSS 3.1 base score of 7.1 with confidentiality-only impact; no public exploit is identified at time of analysis and it is not listed in CISA KEV. The Oracle-supplied tag 'Authentication Bypass' suggests the flaw circumvents application-level access controls once local/infrastructure logon is obtained.
Data compromise in Oracle Interaction Blending (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged attacker with local logon access to the hosting infrastructure to read, create, delete, or modify all data accessible to the product. The flaw carries a CVSS 3.1 base score of 7.1 with high confidentiality and integrity impact but no availability impact, and no public exploit has been identified at time of analysis. It was disclosed by Oracle in the July 2026 Critical Patch Update.
Authenticated data compromise in the Enterprise Command Center component of Oracle Human Resources (Oracle E-Business Suite 12.2.14–12.2.15) lets a low-privileged user with logon access to the hosting infrastructure read, create, delete, or modify all data the HR application can reach. Oracle rates it CVSS 3.1 7.1 with High confidentiality and integrity impact and no availability impact, and it is addressed in the Oracle Critical Patch Update of July 2026. No public exploit is identified at time of analysis and it is not listed in CISA KEV.
Multi-factor authentication bypass in Zohocorp ManageEngine ADSelfService Plus (all versions before build 6524) allows an actor holding valid first-factor credentials to circumvent the second authentication factor, per the vendor advisory CVE-2026-3183. The flaw (CWE-290, authentication bypass by spoofing) is network-reachable and low-complexity but requires low-level privileges (PR:L), and there is no public exploit identified at time of analysis. Because ADSelfService Plus governs self-service password reset and account management across Active Directory, a bypass here undermines a core identity-security control.
Unauthorized data access in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component), versions 22.3 through 26.5, lets an unauthenticated remote attacker over HTTP read all Siebel-accessible data, tamper with some records, and cause a partial denial of service. Oracle rates it CVSS 7.0 but flags it as difficult to exploit (AC:H), and no public exploit identified at time of analysis. Disclosed via the Oracle July 2026 Critical Patch Update.
Data tampering and information disclosure in Oracle Enterprise Manager Base Platform (Discovery Framework component, versions 13.5 and 24.1) allows a remote, unauthenticated attacker to reach the console over HTTPS and, if the difficult-to-exploit conditions are met, create, delete, or modify critical data and read a subset of application data, plus cause a partial denial of service. Oracle rates this CVSS 3.1 7.0 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Denial-of-service and partial data tampering in Oracle JD Edwards EnterpriseOne General Ledger 9.2 (E1 Foundation component) lets a remote, unauthenticated attacker reach the application over HTTP to cause a complete hang or repeatable crash, plus limited unauthorized read and write access to General Ledger data. The CVSS 3.1 base score is 7.0 with high attack complexity, meaning exploitation is possible without credentials but not trivially repeatable. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score supplied in the input.
Local privilege escalation and full compromise in Oracle Solaris 11.4 (Utility component) allows a low-privileged local user with logon access to the host to take over the operating system, impacting confidentiality, integrity, and availability. Oracle rates it CVSS 3.1 7.0 and flags it as difficult to exploit (AC:H). There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the fix ships in Oracle's July 2026 Critical Patch Update.
Full compromise of Oracle HRMS (US) within Oracle E-Business Suite is possible via the Internal Operations component, letting a low-privileged user with local logon access escalate to complete takeover of the HRMS application, with confidentiality, integrity and availability all fully impacted. Rated CVSS 3.1 7.0 but explicitly high-complexity (AC:H), so exploitation is non-trivial and requires an existing account. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege-based compromise in Oracle JDeveloper 12.2.1.4.0 and 14.1.2.0.0 (Security Framework component of Oracle Fusion Middleware) allows a low-privileged attacker with an interactive logon to the host to fully take over the JDeveloper installation, impacting confidentiality, integrity, and availability. Fixed in the Oracle July 2026 Critical Patch Update, the flaw is rated CVSS 7.0 but is explicitly high-complexity (AC:H) and requires local access, so no public exploit identified at time of analysis and no active exploitation is confirmed. It is tagged as an Information Disclosure issue by Oracle, though the vector shows full C/I/A impact consistent with a complete component takeover.