Denial of service in the golang.org/x/text/unicode/norm package (versions before 0.39.0) allows remote attackers to cause an unrecoverable infinite loop by supplying input containing invalid UTF-8 bytes to a norm.Iter. Any Go service that Unicode-normalizes untrusted input using this widely-used supplementary library can be hung with a single malformed request, consuming CPU until the process is killed. No public exploit identified at time of analysis; EPSS is low (0.22%, 13th percentile), but the network-reachable, no-authentication, no-interaction profile makes it broadly triggerable.
Information disclosure in DayuanJiang next-ai-draw-io 0.4.13, an open-source Next.js application that generates draw.io diagrams via AI providers, allows a remote attacker to obtain sensitive information through the x-ai-provider component. The flaw is reported as unauthenticated and network-reachable (CVSS 7.5, confidentiality-only), and no public exploit was identified at time of analysis, though a third-party technical write-up exists. EPSS is low (0.22%, 13th percentile) and the CVE is not listed in CISA KEV.
Full compromise of the Oracle Enterprise Command Center Framework (Core component of Oracle E-Business Suite) V16 is possible for an unauthenticated attacker who has adjacent-network access to the physical segment attached to the host, resulting in complete takeover with high confidentiality, integrity, and availability impact. Exploitation is rated difficult (high attack complexity) and requires the attacker to already sit on the same communication segment as the server, so it is not a remotely-reachable internet flaw. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; it was reported by Oracle's own security team and addressed in the July 2026 Critical Patch Update.
Information disclosure in aiflowy (an open-source Java/Spring-based AI workflow / low-code platform) versions 2.1.2 and earlier lets remote unauthenticated attackers extract sensitive information through the JobUtil.java scheduling component. The public technical writeup titled 'Any SpringBean invocation' indicates the flaw stems from unrestricted invocation of arbitrary Spring beans, which can be abused to read internal application state and secrets. No CISA KEV listing and a low EPSS score (0.19%, 9th percentile) suggest no observed mass exploitation, but a public technical analysis describing the technique exists.
SQL injection in AiFlowy versions 2.1.2 and earlier lets remote attackers extract sensitive database contents through the getPageData method in DatacenterQuery.java. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates unauthenticated, low-complexity network exploitation with high confidentiality impact but no integrity or availability effect. A public technical write-up with reproduction details exists on GitHub, though the low EPSS score (0.19%, 8th percentile) and absence from CISA KEV indicate no confirmed active exploitation at time of analysis.
Improper TLS certificate validation in Gitea versions prior to 1.27.0 lets an on-path attacker intercept the internal API channel and steal the static, high-privilege INTERNAL_TOKEN. The internal API HTTP client (modules/private/internal.go) hardcodes InsecureSkipVerify:true with no config override, so gitea serv / gitea hook subprocesses accept any certificate when LOCAL_ROOT_URL uses HTTPS to a non-loopback host. A detailed proof-of-concept is published in the vendor advisory, but there is no evidence of active exploitation; the token grants full control over every /api/internal/* endpoint, including server shutdown, SSH key authorization, and arbitrary git command execution.
Server-side request forgery in Gitea ≤1.26.4 allows privileged users to bypass the platform's own hostmatcher SSRF defenses via three unprotected raw http.Get() code paths in the migration and OAuth avatar subsystems, enabling retrieval of cloud instance metadata (AWS IMDSv1, GCP tokens), local file read (e.g., app.ini with database credentials and JWT secrets), and internal network scanning. A detailed proof-of-concept exploit is publicly available in the GitHub Security Advisory GHSA-2wm4-vwp6-v7xc. EPSS is low at 0.16% (6th percentile), consistent with the privilege requirements limiting opportunistic exploitation, but the disclosed PoC and the sensitivity of reachable data elevate real-world risk for cloud-hosted deployments. No active exploitation is confirmed in CISA KEV at time of analysis.
Private organization member enumeration in Gitea allows any authenticated user to retrieve the full member roster - including emails - of a private organization via the /api/v1/orgs/{org}/members endpoint. The root cause is an incomplete fix: PR #38145 added visibility guards to ListPublicMembers and IsPublicMember but omitted the same guard from ListMembers, leaving a single missing HasOrgOrUserVisible check in routers/api/v1/org/member.go. Proof-of-concept code is publicly available in the GitHub Security Advisory; no active exploitation has been confirmed in CISA KEV, and the EPSS score of 0.16% (5th percentile) indicates low probability of widespread automated exploitation.
Gitea's REST API leaks private organization membership through the `GET /orgs/{org}/public_members/{username}` endpoint, bypassing the visibility controls that correctly conceal this information in the web UI. All versions up to and including 1.26.4 are affected, permitting any user with a valid API token to confirm whether a specific user belongs to a hidden organization - data intentionally withheld from the web interface. No public exploit is confirmed in CISA KEV, though a detailed proof-of-concept with curl commands is documented in GHSA-jr5x-6h83-wrxf; EPSS stands at 0.16% (5th percentile), indicating low observed exploitation probability.
Unauthenticated denial of service in Gitea's Locale middleware allows any remote attacker to consume ~2 seconds of server CPU per HTTP request by crafting a ~1 MiB Accept-Language header composed of underscore separators, bypassing the existing CVE-2022-32149 guard in golang.org/x/text which only counts dash characters. All Gitea releases from 1.22.x through 1.26.x are affected because the middleware at modules/web/middleware/locale.go:38 passes the raw, unfiltered header directly to the quadratic-time ParseAcceptLanguage parser; ten concurrent attackers consuming ~10 MiB/s of upstream bandwidth can saturate all cores of a ten-core host indefinitely. Publicly available exploit code exists in the GHSA advisory; no active exploitation has been confirmed by CISA KEV at time of analysis.
Information disclosure in Mozilla Firefox's ImageLib graphics component allows remote attackers to read sensitive data (likely uninitialized or out-of-bounds process memory) when a victim renders attacker-controlled image content, per the CWE-200 classification and the C:H CVSS impact. Affected builds are Firefox before 153 and the ESR 115.x and 140.x branches, all fixed by Mozilla in Firefox 153, ESR 115.38, and ESR 140.13. There is no public exploit identified at time of analysis and EPSS is low (0.15%, 5th percentile), consistent with a vendor-reported browser memory-disclosure issue rather than one under active exploitation.
Private repository metadata leaks through the starred and watched repository API endpoints in Gitea versions prior to 1.27.0, allowing former collaborators to continue retrieving - and receiving live updates to - repository metadata after access revocation. Any authenticated user who starred a private Gitea repository while holding collaborator access can call GET /api/v1/user/starred with their existing API token and receive current repository metadata, including description changes made after their removal. A public proof-of-concept is available; the vulnerability is not in CISA KEV and EPSS indicates low observed exploitation activity at 0.15% (5th percentile).
Information disclosure in Mozilla Firefox's Storage: IndexedDB component allows a remote attacker to leak sensitive data across origins or from other browsing contexts without authentication or user interaction. The flaw affects Firefox releases prior to 153 and ESR builds prior to 140.13; there is no public exploit identified at time of analysis, and its EPSS score (0.15%, 5th percentile) indicates low near-term exploitation likelihood despite a CVSS of 7.5. Mozilla has released fixed builds, so the practical priority is prompt browser updating rather than emergency response.
Information disclosure in the Firefox DevTools Framework component allows an attacker to read data that should remain isolated, affecting Mozilla Firefox prior to 153 and Firefox ESR prior to 140.13. Reported by Mozilla and carrying a CVSS 7.5 (high) rating driven by high confidentiality impact, there is no public exploit identified at time of analysis and the EPSS probability is low at 0.15% (5th percentile). The issue is fixed and not listed in CISA KEV.
Broken access control in Gitea's issue-dependency removal endpoint allows any authenticated user with issue-write access on one repository to delete cross-repository dependency links and inject attacker-authored comments into private repositories they have no read or write access to. All Gitea releases through v1.26.4 are affected; the sibling AddDependency function in the same source file performs the correct cross-repository permission check that RemoveDependency entirely omits. A working proof-of-concept curl command is published in the GitHub Security Advisory GHSA-xv9x-fj9g-vj6h, though no confirmed active exploitation (CISA KEV) has been identified and EPSS sits at 0.15% (4th percentile).
Information disclosure in Mozilla Firefox's Graphics WebGPU component allows a malicious web page to read uninitialized process memory, potentially leaking sensitive data such as heap contents, pointers, or cross-origin material, before the fix in Firefox 153. The flaw stems from WebGPU operating on memory that was never initialized (CWE-908), and while CVSS rates confidentiality impact High (7.5), EPSS is very low (0.14%, 4th percentile) with no public exploit and no CISA KEV listing. Exploitation is browser-based, requiring a victim to load attacker-controlled WebGPU content.
Information disclosure in Mozilla Firefox's Graphics WebGPU component allows a remote attacker to read leftover uninitialized memory, potentially exposing sensitive data such as other pages' content, GPU buffers, or process memory. The flaw stems from a WebGPU code path returning memory that was never zeroed, and is fixed in Firefox 153; there is no public exploit identified at time of analysis and the EPSS score is low (0.14%, 4th percentile).
Information disclosure in Mozilla Firefox's Graphics: WebGPU component allows remote attackers to read uninitialized memory contents via crafted WebGPU operations, potentially leaking sensitive process memory such as heap data, addresses, or other page content. The flaw is network-reachable without authentication or user interaction beyond visiting a malicious page, but carries no integrity or availability impact. There is no public exploit identified at time of analysis, and EPSS estimates a low 0.14% exploitation probability.
Information disclosure in Mozilla Firefox before version 153 stems from an input-validation flaw in the DOM Copy & Paste and Drag & Drop component, allowing remote content to potentially read data that should remain isolated. The provided CVSS vector rates confidentiality impact as High with no privileges or user interaction, and Mozilla has shipped a fix in Firefox 153. There is no public exploit identified at time of analysis, and the EPSS score of 0.14% (4th percentile) indicates low near-term exploitation likelihood.
Remote denial-of-service in Mozilla Firefox's Graphics: WebGPU component allows a malicious web page to exhaust browser resources and crash or hang the browser without any user credentials or interaction. The flaw affects Firefox versions prior to 153 and is triggered simply by loading attacker-controlled content that abuses the WebGPU API. There is no public exploit identified at time of analysis, and EPSS scores the exploitation likelihood at only 0.14%, indicating low near-term probability of widespread exploitation.
Information disclosure in the Privacy component of Mozilla Firefox for Android allows remote attackers to expose sensitive user data, with the flaw carrying a high confidentiality impact (CVSS 7.5). Mozilla self-reported and fixed the issue in Firefox 153 per advisory MFSA2026-68; there is no public exploit identified at time of analysis, and the EPSS probability is low (0.14%, 4th percentile). The Privacy component context suggests leakage of protected browsing state or user data that the browser is designed to isolate.
Denial of service in Mozilla Firefox before version 153 arises from an invalid pointer access (CWE-824) in the PSM (Personal Security Manager) security component, which brokers TLS/certificate and NSS cryptographic operations. Remote content processed by the browser can trigger the invalid pointer dereference, crashing the affected process; the assigned CVSS 3.1 vector scopes impact to availability only (A:H) with no confidentiality or integrity loss. There is no public exploit identified at time of analysis, and the EPSS probability is low at 0.13% (3rd percentile), consistent with a stability/crash bug rather than a code-execution primitive.
Information disclosure in Mozilla Firefox's DOM: Security component allows remote attackers to read sensitive cross-origin or in-process data via crafted web content, undermining the browser's same-origin and security boundary enforcement. Any Firefox version prior to 153 is affected, and exploitation is remote and unauthenticated with no user interaction beyond visiting a malicious page. The issue was reported and fixed by Mozilla; no public exploit identified at time of analysis and EPSS exploitation probability is low (0.13%).
Cross-origin information disclosure in Mozilla Firefox's DOM: Navigation component allows a malicious web page to bypass site isolation (Fission) boundaries and read data belonging to another origin. The flaw affects Firefox versions prior to 153 and is remotely reachable over the network with no privileges required, though impact is limited to confidentiality. There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.13%).
Information disclosure in Mozilla Firefox before version 153 stems from a site isolation weakness in the Graphics component, allowing a remote attacker to read cross-origin data that should be siloed between sites. The confidentiality-only flaw (CVSS 7.5, C:H) is network-reachable without authentication or user interaction, but carries no public exploit and a low EPSS score (0.13%, 3rd percentile), indicating theoretical rather than active risk. It is not listed in CISA KEV; no public exploit identified at time of analysis.
Takeover of Oracle Communications Converged Application Server 8.3 is possible via a flaw in its RTP Proxy component, exploitable only by a high-privileged attacker with local logon to the host where the server runs. The CVSS 3.1 vector (AV:L/AC:H/PR:H/S:C) reflects difficult exploitation requiring existing elevated access, but a scope change means a successful attack can impact additional products beyond the server itself, with full confidentiality, integrity, and availability compromise. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; it was disclosed in Oracle's July 2026 Critical Patch Update.
Local privilege-boundary compromise in Oracle Solaris 11.3 and 11.4 (Utility component) allows a low-privileged attacker with a local logon to gain unauthorized read and write access to critical Solaris data, with a scope change that can significantly impact additional products beyond Solaris itself. The flaw carries a CVSS 3.1 base score of 7.5 despite requiring high attack complexity, reflecting the high confidentiality and integrity impact combined with scope change. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Privilege-scoped data compromise in Oracle PeopleSoft Enterprise SCM Mobile Inventory Management 9.2 (Security component) allows a low-privileged, authenticated attacker with local logon to the hosting infrastructure to read, create, delete, or modify all data accessible to the application, with a scope change that can significantly impact additional connected PeopleSoft products. Oracle rates this CVSS 3.1 7.5, but exploitation is explicitly rated difficult (AC:H), and there is no public exploit identified at time of analysis nor CISA KEV listing. The Oracle-supplied 'Authentication Bypass' tag suggests the flaw may let an attacker escalate beyond their assigned authorization boundary, though Oracle's terse advisory does not detail the mechanism.
Full host takeover in Oracle VM VirtualBox 7.2.12 (Core component) allows a high-privileged local attacker who is already logged into the infrastructure running VirtualBox to compromise the hypervisor, with a scope change (CVSS S:C) indicating impact beyond VirtualBox itself - consistent with a guest-to-host or component-crossing escape. Oracle rates it CVSS 3.1 7.5 with full confidentiality, integrity, and availability impact, though exploitation is difficult (AC:H, PR:H). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege-escalating host compromise in Oracle VM VirtualBox 7.2.12 (Core component) lets a high-privileged local attacker with a logon to the host take over the VirtualBox hypervisor and, because of a scope change, impact additional products beyond VirtualBox itself. The flaw carries full confidentiality, integrity, and availability impact but is rated difficult to exploit, requiring high privileges and high attack complexity. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Domain spoofing in Google Chrome on Linux prior to 150.0.7871.182 lets an attacker in a privileged network position present a malicious site under a trusted domain identity by exploiting insufficient validation of untrusted certificate input. The flaw carries a High Chromium severity and a CVSS of 7.5 driven entirely by integrity impact (I:H, C:N, A:N); Google's release notes confirm a fix is available. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Command injection in the command line interface of HPE Aruba/EdgeConnect SD-WAN Gateway (ECOS) allows a highly privileged, authenticated remote attacker to break out of certain CLI commands and run arbitrary commands on the underlying operating system. Because the flaw requires administrative-level CLI access (CVSS PR:H) it primarily enables an already-trusted operator to escalate from restricted CLI to full OS-level control, with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; EPSS data was not provided.
Denial of service in React's Server Components runtime (react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack) lets remote unauthenticated attackers spike CPU to exhaustion by POSTing specially crafted HTTP requests to Server Function ('use server') endpoints across versions 19.0.0-19.0.7, 19.1.0-19.1.8, and 19.2.0-19.2.7. The flaw was reported by Meta (React's maintainer) and carries CVSS 7.5 (availability-only impact). No public exploit is identified at time of analysis and it is not listed in CISA KEV.
Integrity and availability compromise in Oracle PeopleSoft Enterprise HCM Human Resources 9.2 (Core component) allows a network-based, unauthenticated attacker to create, delete or modify critical data and to trigger a complete, repeatable denial of service. The flaw is rated CVSS 7.4 and is fixed in the Oracle Critical Patch Update of July 2026; there is no public exploit identified at time of analysis, and confidentiality is not impacted. Despite requiring no authentication, the CVSS vector flags high attack complexity (AC:H), which meaningfully raises the bar for reliable exploitation.
Data compromise in Oracle PeopleSoft Enterprise FIN Common Objects Brazil 9.1 (eProcurement component) lets a remote unauthenticated attacker read, create, modify, or delete all data accessible to the module over HTTP. The flaw is rated CVSS 3.1 7.4 with high confidentiality and integrity impact but no availability impact, and is difficult to exploit (AC:H); no public exploit identified at time of analysis and it is not listed in CISA KEV. The vendor advisory ties the fix to the Oracle July 2026 Critical Patch Update.
Unauthorized data compromise in Oracle PeopleSoft Enterprise SCM Manufacturing 9.2 (Security component) lets a remote, unauthenticated attacker read, create, modify, or delete all data accessible to the application over HTTPS. Rated CVSS 3.1 7.4 with high confidentiality and integrity impact but no availability impact, and flagged by Oracle with an Authentication Bypass characteristic. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; exploitation is rated high-complexity by Oracle.
Unauthorized data access and manipulation in Oracle Agile PLM 9.3.6 (Security component) allows a remote unauthenticated attacker with HTTP access to read, create, delete, or modify all Agile PLM-accessible data. The high attack complexity (AC:H) means exploitation requires specific conditions the attacker cannot fully control, which lowers real-world exploitability despite the network-facing, no-authentication vector. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the 'Authentication Bypass' tag and full confidentiality/integrity impact make this a meaningful patch priority for exposed deployments.
Unauthorized data compromise in Oracle Commerce Guided Search / Experience Manager 11.4.0 lets a remote unauthenticated attacker reach the Content Acquisition System over HTTPS and read, create, modify, or delete all data accessible to the product. The 'Authentication Bypass' tagging combined with PR:N in the CVSS vector indicates the flaw defeats access controls without credentials, though the high attack complexity (AC:H) means exploitation is non-trivial. No public exploit identified at time of analysis and the issue is not in CISA KEV; it was disclosed by Oracle in the July 2026 Critical Patch Update.
Data compromise in Oracle Commerce Platform 11.4.0 (Dynamo Application Framework component) lets a remote, unauthenticated attacker read, create, modify, or delete all data accessible to the platform over HTTP. The flaw carries a CVSS 3.1 score of 7.4 with high confidentiality and integrity impact but no availability impact, and Oracle flags it as difficult to exploit (AC:H). Disclosed in the Oracle Critical Patch Update of July 2026; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote data compromise in Oracle Application Object Library (the shared framework layer of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) allows an unauthenticated network attacker to read, create, delete, or modify all data accessible to the component over HTTP. The high attack complexity (AC:H) makes reliable exploitation non-trivial, but success yields full confidentiality and integrity impact against a core ERP platform. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the vendor tags associate it with an authentication bypass pattern.
Data compromise in Oracle MySQL Router 8.4.0-8.4.10 and 9.7.0-9.7.1 allows a network attacker to gain unauthorized read and write access to all data reachable through the Router component. The flaw is reachable unauthenticated over HTTP (PR:N) but is rated hard to exploit (AC:H), and there is no public exploit identified at time of analysis. Oracle's tagging references an authentication-bypass class of issue, consistent with the unauthenticated network vector.
Unauthorized data access and modification in Oracle MySQL Connectors (Connector/C++) versions 9.7.0 through 9.7.1 lets an unauthenticated remote attacker reach and tamper with all data accessible to the connector. The flaw is rated CVSS 7.4 with high confidentiality and integrity impact but no availability impact, and is described by Oracle as difficult to exploit (high attack complexity). No public exploit has been identified at time of analysis and it is not listed in CISA KEV; the fix ships in Oracle's July 2026 Critical Patch Update.
Unauthorized data access and modification in the Scripting component of Oracle Java SE 8u491, 8u491-perf, and 11.0.31 allows a remote unauthenticated attacker to compromise the confidentiality and integrity of all Java-accessible data via APIs reachable over multiple network protocols. Rated CVSS 3.1 7.4 (High) by Oracle, the flaw is difficult to exploit (AC:H) and carries no availability impact; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. It also affects sandboxed Java Web Start/applet deployments that run untrusted code and rely on the Java sandbox.
Data compromise in Oracle Retail EFTLink (versions 21.0.0 through 25.0.0) allows a remote unauthenticated attacker with HTTPS network access to read, create, delete, or modify all data accessible to the EFTLink service, despite a high attack-complexity barrier. Disclosed in Oracle's July 2026 Critical Patch Update with a CVSS 3.1 base score of 7.4 (C:H/I:H, no availability impact); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Cross-context integrity compromise in Oracle iSupport (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a remote unauthenticated attacker to manipulate, create, or delete critical data after luring a victim into interacting with malicious content, with impact spilling into other Oracle EBS products due to a scope change. Addressed in Oracle's July 2026 Critical Patch Update, it carries a CVSS 3.1 base score of 7.4 with integrity-only impact and no public exploit identified at time of analysis. The requirement for victim interaction lowers the practical exploitation rate relative to a fully unauthenticated automated attack.
Unauthorized access to critical data in Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 is possible via the bundled OpenSearch Dashboards component, where a remote unauthenticated attacker can compromise confidentiality by luring a victim into interacting with attacker-supplied content (UI:R). The scope-change and confidentiality-only vector (S:C/C:H/I:N/A:N), combined with the vendor's 'Authentication Bypass' tag, is characteristic of a client-side flaw such as cross-site scripting in the Dashboards UI that lets an attacker read data across products the victim can reach. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; it is addressed in Oracle's July 2026 Critical Patch Update.
Data compromise in Oracle iSupport (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a remote unauthenticated attacker to reach the application over HTTP and gain read and write access to all iSupport-accessible data. The flaw carries a CVSS 3.1 base score of 7.4 with high confidentiality and integrity impact but no availability impact, and Oracle rates it difficult to exploit (AC:H). No public exploit has been identified at time of analysis, it is not listed in CISA KEV, and no EPSS score was supplied.
Data compromise in Oracle MySQL Connectors (Connector/Net component) versions 9.7.0 through 9.7.1 allows a remote, unauthenticated attacker with network access via multiple protocols to read, create, delete, or modify all data accessible to the connector. Tagged as an Authentication Bypass, the flaw carries a CVSS 3.1 base score of 7.4 with full confidentiality and integrity impact but no availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, and the high attack complexity (AC:H) tempers real-world exploitability.
Unauthorized data disclosure in Oracle Agile Product Lifecycle Management for Process 6.2.4 (Installation component) allows an unauthenticated attacker on the adjacent network segment to compromise confidentiality and, due to a scope change, impact additional connected products. The flaw is rated CVSS 3.1 7.4 with confidentiality-only impact and no integrity or availability effect. There is no public exploit identified at time of analysis, and it was disclosed by Oracle in the July 2026 Critical Patch Update.
Integrity and availability compromise in Oracle VM VirtualBox 7.2.8 (Core component) allows a high-privileged local user, with the aid of a separate tricked user, to modify or destroy critical data and force a complete denial of service, with impact crossing into additional products due to a scope change. Rated CVSS 3.1 7.4 and disclosed in Oracle's July 2026 Critical Patch Update, it carries no confidentiality impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.