Unauthorized information disclosure in Oracle JDeveloper (Fusion Middleware Security Framework) versions 12.2.1.4.0 and 14.1.2.0.0 lets a network attacker read critical data without credentials. Remote unauthenticated attackers reaching the product over HTTP can obtain complete access to all JDeveloper-accessible data, with a CVSS 3.1 base score of 7.5 driven entirely by confidentiality impact. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the vendor tag 'Authentication Bypass' suggests the flaw stems from a missing or broken authentication check.
Unauthorized data disclosure in Oracle PeopleSoft Enterprise CS Student Records 9.2.38 (Higher Ed Statistics Agency - UK HESA component) lets a remote, unauthenticated attacker reach all data accessible to the Student Records module over HTTP. The flaw is easily exploitable per Oracle and, tagged as an authentication bypass, yields high confidentiality impact with no integrity or availability effect (CVSS 3.1 7.5). No public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided.
Unauthenticated information disclosure in Oracle WebCenter Sites (versions 12.2.1.4.0 and 14.1.2.0.0) allows a remote attacker with only HTTP network access to read critical data and potentially all data accessible to the application. The flaw is tagged as an authentication bypass and carries a CVSS 3.1 base score of 7.5 with pure confidentiality impact; no public exploit has been identified at time of analysis and it is not listed in CISA KEV. Oracle addressed the issue in the July 2026 Critical Patch Update.
Unauthenticated data disclosure in Oracle Coherence (Oracle Fusion Middleware, Core component) versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 lets a remote attacker with only TCP network access read or fully access all Coherence-managed data. Oracle rates it CVSS 3.1 7.5 with confidentiality-only impact and classifies it as easily exploitable; the 'Authentication Bypass' tag indicates the flaw circumvents access controls to expose cluster data. No public exploit identified at time of analysis, and no EPSS or CISA KEV signal is present in the provided data.
Unauthorized data disclosure in Oracle Hospitality Simphony POS (versions 19.8-19.8.5, 19.9-19.9.3, and 19.10) lets a remote, unauthenticated attacker reach all data accessible to the application over HTTP. Oracle rates it CVSS 7.5 with confidentiality-only impact and describes it as 'easily exploitable,' and the vendor tags it as an Authentication Bypass. Disclosed in Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data disclosure in Oracle Hospitality Simphony (POS component) versions 19.8-19.8.5, 19.9-19.9.3, and 19.10 lets a remote, unauthenticated attacker read all data accessible to the application over HTTP. The flaw, tagged as an authentication bypass, requires no privileges or user interaction and yields high confidentiality impact (CVSS 3.1 base 7.5) with no impact to integrity or availability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation status is currently theoretical but the low attack complexity makes it a real patching priority.
Full compromise of the Oracle Project Portfolio Analysis module (Internal Operations component) in Oracle E-Business Suite releases 12.2.3 through 12.2.15 is achievable by a low-privileged, network-based attacker over HTTP, resulting in complete takeover of the affected product with high confidentiality, integrity, and availability impact. The CVSS 3.1 base score is 7.5, and the vector's AC:H rating means exploitation is difficult and likely requires specific timing or preconditions. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Full compromise of Oracle Service Fulfillment Manager (a Fulfillment Engine component of Oracle E-Business Suite 12.2.3 through 12.2.15) is possible where an authenticated, low-privileged attacker with network HTTP access can escalate to complete takeover of the module. Although rated CVSS 3.1 7.5 with confidentiality, integrity and availability impact, the attack complexity is high, meaning exploitation is non-trivial. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the fix ships in Oracle's July 2026 Critical Patch Update.
Full compromise of Oracle Public Sector Financials (a module of Oracle E-Business Suite, Internal Operations component) is possible over HTTP by a low-privileged authenticated attacker, per Oracle's July 2026 Critical Patch Update. Affecting EBS releases 12.2.3 through 12.2.15, a successful attack results in complete takeover of the product with full confidentiality, integrity, and availability impact. The CVSS 3.1 score is 7.5 and Oracle rates the flaw difficult to exploit (AC:H); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise (takeover) of the Oracle Public Sector Financials module in Oracle E-Business Suite 12.2.3 through 12.2.15 is possible by a low-privileged, authenticated attacker sending crafted HTTP requests to the Internal Operations component. The flaw carries a CVSS 3.1 base score of 7.5 and impacts confidentiality, integrity, and availability, but is rated hard to exploit (AC:H). There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; Oracle addressed it in the July 2026 Critical Patch Update.
Full compromise of Oracle Payroll (a module of Oracle E-Business Suite, Internal Operations component) is possible in supported releases 12.2.3 through 12.2.15, where a low-privileged attacker with HTTP network access can achieve complete takeover of the Payroll application. Oracle rates the flaw CVSS 3.1 7.5 with high confidentiality, integrity and availability impact, but flags it as difficult to exploit (AC:H). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so risk is elevated but not confirmed as active.
Full compromise of Oracle Quoting (a module of Oracle E-Business Suite) is possible for an authenticated, low-privileged attacker reaching the application over HTTP, per Oracle's July 2026 Critical Patch Update. Successful exploitation results in complete takeover of the Quoting component with high impact to confidentiality, integrity, and availability, though Oracle rates the attack complexity as high (difficult to exploit). No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Full compromise of the Oracle Quality module within Oracle E-Business Suite (Internal Operations component, versions 12.2.3 through 12.2.15) is possible for a low-privileged, authenticated attacker reaching the application over HTTP. Successful attacks lead to complete takeover of Oracle Quality with high confidentiality, integrity, and availability impact, though Oracle rates the attack complexity as high. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Denial-of-service in Oracle MySQL Router (versions 8.4.0-8.4.10 and 9.7.0-9.7.1) allows a remote unauthenticated attacker to send crafted HTTP traffic that hangs or repeatedly crashes the Router process, causing a complete availability outage. The flaw is rated CVSS 7.5 with only availability impact (no data confidentiality or integrity loss) and is described by Oracle as 'easily exploitable.' As of this analysis there is no public exploit identified and it is not listed in CISA KEV; the fix ships in Oracle's July 2026 Critical Patch Update.
Full application takeover in Oracle Lease and Finance Management (versions 12.2.11 through 12.2.15), a module of Oracle E-Business Suite's Internal Operations component, lets a low-privileged attacker with HTTP network access compromise the confidentiality, integrity, and availability of the product. Oracle rates the flaw CVSS 3.1 7.5 but marks it 'difficult to exploit' (AC:H) and disclosed it in the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis, and it is not listed on the CISA KEV catalog.
Full product takeover in Oracle Agile Product Lifecycle Management for Process 6.2.4 (Installation component) allows a low-privileged attacker with HTTP network access to fully compromise the application, yielding high confidentiality, integrity, and availability impact. The Oracle July 2026 Critical Patch Update rates this CVSS 3.1 7.5 but flags it as difficult to exploit (AC:H). No public exploit is identified at time of analysis and it is not listed in CISA KEV.
Full compromise of the Oracle Advanced Benefits module (Affordable Care Act component) within Oracle E-Business Suite 12.2.7 through 12.2.15 is possible by a low-privileged, authenticated attacker sending crafted HTTP requests over the network. Successful exploitation yields complete takeover of the module with high confidentiality, integrity, and availability impact. This is a July 2026 Oracle Critical Patch Update issue with no public exploit identified at time of analysis and no CISA KEV listing.
Full compromise of Oracle Application Object Library (the core security and application framework within Oracle E-Business Suite, DB Privileges component) is possible by a low-privileged, authenticated attacker sending crafted HTTP requests. Successful attacks yield complete takeover of the Application Object Library across supported EBS releases 12.2.3 through 12.2.15, impacting confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and the flaw is rated difficult to exploit (AC:H), but the CVSS 3.1 base score of 7.5 and the takeover impact make it a notable item in the Oracle July 2026 Critical Patch Update.
Takeover of Oracle Cost Management, the costing module of Oracle E-Business Suite (component: Costing Transaction Errors), is achievable by a low-privileged attacker with HTTP network access. Successful exploitation yields full confidentiality, integrity, and availability compromise of the module across EBS releases 12.2.3 through 12.2.15. Rated CVSS 3.1 7.5 but explicitly difficult to exploit (AC:H); no public exploit identified at time of analysis and it is not on the CISA KEV list.
Full compromise of Oracle Application Object Library (the core framework component of Oracle E-Business Suite) is possible in versions 12.2.3 through 12.2.15, where a low-privileged attacker with HTTP network access can escalate to complete takeover of the component. Oracle rates this CVSS 3.1 7.5 with full confidentiality, integrity, and availability impact, though the attack is flagged as difficult to exploit (AC:H). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the shared-infrastructure nature of AOL makes successful exploitation high-consequence.
Full application takeover in Oracle JD Edwards EnterpriseOne HCM Foundation 9.2 (Time Accounting and HRM Base component) allows an authenticated, low-privileged attacker to compromise the product over HTTP. Per the CVSS vector (PR:L), a valid low-privilege account is required and exploitation is difficult (AC:H), but success yields high confidentiality, integrity, and availability impact — effectively total compromise of the HCM Foundation instance. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was disclosed in the Oracle July 2026 Critical Patch Update.
Full takeover of Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 is possible for a low-privileged attacker with network (HTTP) access to the Security component, resulting in high confidentiality, integrity and availability impact. Oracle rates this CVSS 3.1 7.5 but flags it as difficult to exploit (AC:H), and it requires an authenticated (low-privilege) session. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the fix ships in Oracle's July 2026 Critical Patch Update.
Full compromise of Oracle PeopleSoft Enterprise CS Student Records version 9.2.38 (Research Tracking component) allows an authenticated, low-privileged attacker with network HTTP access to take over the module, impacting confidentiality, integrity, and availability. Oracle rates it CVSS 3.1 7.5 despite high attack complexity (AC:H), reflecting the severity of a complete takeover. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Full takeover of Oracle JD Edwards EnterpriseOne Human Resources Management 9.2 is possible when a low-privileged attacker with network access to the JDENET service chains a hard-to-exploit flaw in the Human Resources component. Successful exploitation yields high confidentiality, integrity, and availability impact (complete compromise of the HR module). No public exploit has been identified at time of analysis and it is not listed in CISA KEV; risk is tempered by high attack complexity (AC:H) and a required authenticated foothold (PR:L).
Full compromise of Oracle JD Edwards EnterpriseOne CRM Foundation 9.2 is possible when a low-privileged attacker with network access abuses the proprietary JDENET communication protocol, per Oracle's July 2026 Critical Patch Update. Successful exploitation yields complete takeover of the CRM Foundation component with high confidentiality, integrity, and availability impact, though Oracle rates the attack complexity as high. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Full product takeover of Oracle JD Edwards EnterpriseOne Advanced Pricing - Procurement (version 9.2) is possible via the proprietary JDENET network protocol, where a low-privileged, network-authenticated attacker can compromise confidentiality, integrity, and availability. Oracle rates this CVSS 3.1 7.5, tempered by high attack complexity (AC:H), meaning exploitation is not straightforward. There is no public exploit identified at time of analysis and it is not on CISA KEV; the fix ships in the Oracle Critical Patch Update of July 2026.
Full compromise of Oracle JD Edwards EnterpriseOne Requirements Planning 9.2 is possible for a low-privileged attacker reaching the proprietary JDENET network protocol, yielding confidentiality, integrity, and availability impact ("takeover"). The flaw carries a CVSS 3.1 base score of 7.5 but is rated hard to exploit (AC:H) and requires existing low-level privileges (PR:L). There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Full compromise of Oracle Cost Management (the Cost Maintenance component of Oracle E-Business Suite) is achievable over HTTP by a low-privileged, authenticated attacker, per Oracle's July 2026 Critical Patch Update. Successful exploitation yields complete takeover with high confidentiality, integrity, and availability impact, though Oracle rates it difficult to exploit (AC:H). There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthorized data modification in Oracle PeopleSoft Enterprise FIN Staffing Front Office 9.2 allows a remote, unauthenticated attacker to create, delete, or modify critical data via crafted HTTP requests. The flaw is confined to the Staffing Front Office component and carries an integrity-only impact (CVSS 3.1 7.5, C:N/I:H/A:N). No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Denial of service in Oracle Unified Directory (OUD Core) versions 12.2.1.4.0 and 14.1.2.1.0 lets an unauthenticated attacker with LDAP network access hang or repeatedly crash the directory server, producing a complete availability outage. Oracle rates it CVSS 3.1 7.5 with availability-only impact and describes it as easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; confidentiality and integrity are unaffected.
Remote denial-of-service in Oracle Unified Directory (OUD Core) 12.2.1.4.0 and 14.1.2.1.0 lets an unauthenticated network attacker send crafted LDAP traffic that hangs or repeatedly crashes the directory service, producing a complete availability outage. Addressed in the Oracle Critical Patch Update of July 2026, the flaw carries CVSS 7.5 (availability-only) with no impact to confidentiality or integrity. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation is currently theoretical rather than observed.
Unauthorized data disclosure in Oracle Data Integrator (Oracle Fusion Middleware, Patchset Assistant component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a remote, unauthenticated attacker read all data accessible to the product over HTTP. The flaw carries a CVSS 3.1 base score of 7.5 with confidentiality-only impact and was disclosed in Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis. Vendor tagging references an authentication-bypass theme, consistent with the PR:N (no-privilege) requirement.
Unauthorized data disclosure in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component), versions 22.3 through 26.5, lets a remote unauthenticated attacker reach sensitive data over HTTP. The flaw is tagged as an authentication bypass and, per Oracle's own scoring, is 'easily exploitable' with a high confidentiality impact but no integrity or availability effect (CVSS 3.1 base 7.5). No public exploit identified at time of analysis, and it is not listed in CISA KEV; EPSS was not provided in the source data.
Full product takeover of Oracle WebCenter Content (Content Server component) in versions 12.2.1.4.0 and 14.1.2.0.0 can be achieved by an unauthenticated remote attacker over HTTP, but only by luring a separate user into an interaction that triggers the flaw. Rated CVSS 3.1 7.5 with high confidentiality, integrity, and availability impact, the issue is classified 'difficult to exploit' due to high attack complexity and the required human interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so the practical risk is gated by the social-engineering step despite the severe potential impact.
Account/application takeover in Oracle WebCenter Content: Imaging (Core component of Fusion Middleware) affects supported versions 12.2.1.4.0 and 14.1.2.0.0, where a remote unauthenticated attacker who lures a legitimate user into interacting with malicious content over HTTP can fully compromise the Imaging application. Oracle rates it CVSS 3.1 7.5 with high confidentiality, integrity, and availability impact, but flags it as difficult to exploit (AC:H) and dependent on user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; a fix ships in the Oracle July 2026 Critical Patch Update.
Unauthenticated information disclosure in Oracle PeopleSoft Enterprise FIN Common Objects Brazil 9.1 (Staffing component) lets a remote attacker send crafted HTTP requests to read critical data, potentially achieving complete access to all data accessible to the affected module. Oracle rates it easily exploitable with a CVSS 3.1 base score of 7.5, but the impact is confined to confidentiality (no integrity or availability effect). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data disclosure in Oracle PeopleSoft Enterprise FIN Common Objects Brazil 9.1 (Common Objects component) allows a remote unauthenticated attacker to reach and read critical financial data over HTTP. Oracle rates it easily exploitable with a CVSS 3.1 base of 7.5 and confidentiality-only impact (C:H/I:N/A:N), and it is addressed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data disclosure in Oracle Application Object Library (a core component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) allows a remote, unauthenticated attacker to compromise confidentiality over HTTP, resulting in unauthorized access to critical data or complete access to all data accessible to Oracle Application Object Library. Fixed in Oracle's July 2026 Critical Patch Update, the flaw is tagged as an authentication bypass and carries a CVSS 3.1 base score of 7.5 driven entirely by confidentiality impact (C:H, I:N, A:N). There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Unauthenticated data disclosure in Oracle Application Testing Suite 13.3.0.1 lets a remote attacker with only TCP network access read critical application data, potentially gaining complete access to all data reachable by the product. The flaw is tagged as an authentication bypass and was disclosed in Oracle's July 2026 Critical Patch Update; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Impact is confined to confidentiality - integrity and availability are unaffected per the CVSS vector.
Integrity-protection bypass in libssh builds compiled against the OpenSSL crypto backend, caused by incorrect AES-GCM finalization checks that fail to verify the authentication tag. An in-path (man-in-the-middle) attacker positioned on an SSH session can silently alter plaintext bytes on the wire without triggering a MAC/integrity failure, defeating a core guarantee of the SSH transport layer. There is no public exploit identified at time of analysis, EPSS risk is low (0.28%, 20th percentile), and CISA SSVC rates exploitation as 'none' though 'automatable: yes'.
Unauthorized data disclosure in Oracle Complex Maintenance, Repair and Overhaul (CMRO), a module of Oracle E-Business Suite 12.2.3 through 12.2.15, lets a remote unauthenticated attacker abuse the Internal Operations component over HTTP to read critical CMRO data and make limited unauthorized modifications. Because the flaw carries a scope change, a successful attack can significantly impact products beyond CMRO itself. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the CVSS 3.1 base score is 7.5 with high attack complexity, so exploitation is rated difficult.
Unauthorized critical-data access in Oracle JDeveloper (Fusion Middleware, Data Visualization Tools component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a remote unauthenticated attacker read all JDeveloper-accessible data and modify some of it over HTTP, with a scope change that can significantly impact adjacent Oracle products. Oracle rates it CVSS 3.1 7.5 but flags it as difficult to exploit (AC:H). No public exploit identified at time of analysis and it is not listed in CISA KEV, so risk is currently theoretical but non-trivial given the unauthenticated network vector.
Full compromise (takeover) of Oracle Process Manufacturing Process Execution 12.2.15, a module of Oracle E-Business Suite (component: Internal Operations), is achievable by a low-privileged, authenticated attacker over HTTP. Successful exploitation yields high confidentiality, integrity, and availability impact against the module, though Oracle rates the attack complexity as high ('difficult to exploit'). No public exploit identified at time of analysis, and it is not listed in CISA KEV; the fix ships in Oracle's July 2026 Critical Patch Update.
Takeover of Oracle Purchasing (a module of Oracle E-Business Suite, Internal Operations component) is possible for a low-privileged, network-authenticated attacker in supported releases 12.2.11 through 12.2.15. Successful attacks yield full confidentiality, integrity, and availability compromise of the Purchasing application per Oracle's July 2026 Critical Patch Update. Exploitation is rated high-complexity (AC:H), and no public exploit identified at time of analysis; the issue was reported internally by Oracle's security alert team rather than a public researcher.
Missing authentication in exo-explore's exo 1.0.69 distributed AI inference framework lets remote unauthenticated attackers reach the GET /state and DELETE /instance/{instance_id} management endpoints, exposing cluster state and destroying running inference instances. Classified CWE-306 with CVSS 7.5 (availability-focused), it carries a low EPSS of 0.27% and is not on CISA KEV; a third-party writeup exists but no public exploit is confirmed. The practical effect is denial of service and unauthorized administrative control over the AI node cluster.
Information disclosure in Mozilla Firefox's Networking: WebSockets component allows remote attackers to read sensitive data across origin or trust boundaries without authentication or user interaction. The flaw affects Firefox releases prior to 153 and the ESR line prior to 140.13, and is corrected in those fixed builds. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the network-reachable, no-privilege CVSS 7.5 profile makes it a broad exposure across the very large Firefox install base.
Directory traversal in Knowns 0.11.4 (the 'knowns' npm CLI/MCP knowledge layer for AI-assisted development) lets an attacker supply a crafted folder name to the create_doc tool and cause documents to be created outside the intended workspace directory. Because create_doc is exposed to AI agents via MCP, a malicious or manipulated tool call can traverse the filesystem using sequences such as '../'. A researcher gist and an upstream fix commit are referenced, so publicly available exploit code exists; the flaw is not in CISA KEV and carries a low EPSS score (0.26%, 18th percentile), indicating no evidence of widespread active exploitation.
Arbitrary file read (and likely write) in the Knowns 0.11.4 AI knowledge-layer server allows remote attackers to escape the intended document directory by supplying crafted relative paths to its get_doc and update_doc MCP tools. Because Knowns exposes these tools to AI agents and self-hosted clients, an attacker who can reach the tool interface can retrieve or tamper with files outside the managed knowledge store. EPSS is low (0.26%, 18th percentile) and there is no public exploit identified at time of analysis, though an upstream fix commit and a researcher gist both exist.
Unauthorized data modification in Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition (Libraries component) lets a remote, unauthenticated attacker corrupt, create, or delete critical data by feeding crafted input to affected Java APIs, for example through a web service that passes data to those APIs. It carries CVSS 3.1 7.5 with an integrity-only impact (C:N/I:H/A:N) and is described by Oracle as easily exploitable over multiple network protocols. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the ubiquity of the Java runtime makes patching a priority.
Denial of service (and potential use-after-free) in libssh occurs when the library processes SSH data packets that arrive after a channel has been closed, causing channel data callbacks to fire against already-freed memory. Any application or system linking the affected libssh - including Red Hat Enterprise Linux 8, 9, and 10 and Red Hat Hardened Images - can be crashed by a malicious SSH peer that sends channel data at the wrong point in the connection lifecycle. There is no public exploit identified at time of analysis, EPSS is low (0.26%), and CISA SSVC scores exploitation as none, indicating a real but non-urgent memory-safety fix.