Partial data disclosure in Oracle JDeveloper's ADF Faces component (versions 12.2.1.4.0 and 14.1.2.0.0) allows low-privileged network-authenticated attackers to read a subset of JDeveloper-accessible data via crafted HTTP requests. Despite the 'Authentication Bypass' tag, the CVSS PR:L metric confirms full authentication is required - the bypass is best understood as an authorization or access-control bypass within ADF Faces rather than full session bypass. No public exploit has been identified and no CISA KEV listing exists; the low CVSS score of 3.1 reflects high exploit complexity and limited impact scope.
Unauthorized read access to a subset of project manufacturing data is possible via the PJM Command Center component in Oracle Project Manufacturing V16, exploitable over HTTP by a low-privileged authenticated network attacker. Despite the 'Authentication Bypass' tag from EUVD, the CVSS vector (PR:L) confirms valid credentials are required, indicating the bypass operates at the authorization layer within PJM Command Center rather than bypassing the EBS login mechanism entirely. Exploitation is significantly constrained by high attack complexity (AC:H), the confidentiality impact is limited (C:L), and no public exploit or active exploitation has been identified at time of analysis.
Partial data integrity compromise in Oracle Labor Distribution (E-Business Suite versions 12.2.3-12.2.15) allows a low-privileged attacker with network access via HTTP to perform unauthorized insert, update, or delete operations on some accessible data within the product's Internal Operations component. The 'Authentication Bypass' tag in the intelligence data is notable but conflicts with the PR:L CVSS metric, suggesting this is more accurately an internal authorization bypass within an authenticated session rather than a full bypass of the login mechanism. No public exploit code exists and the vulnerability is not listed in CISA KEV; with a CVSS 3.1 score of 3.1 (Low) and AC:H, this represents a low-priority finding for most environments.
Unauthorized data manipulation in Oracle Public Sector Financials (E-Business Suite versions 12.2.3 through 12.2.15) is achievable by a low-privileged authenticated attacker over HTTP targeting the Internal Operations component. Despite the 'Authentication Bypass' tag, the CVSS PR:L metric confirms initial credentials are required, suggesting the flaw represents a post-authentication authorization control bypass rather than a full authentication bypass. Impact is constrained to limited integrity loss - partial unauthorized insert, update, or delete of accessible data - with no confidentiality or availability impact, and no public exploit or active exploitation identified at time of analysis.
JavaFX in Oracle Java SE 8u491 exposes a limited confidentiality breach to unauthenticated network attackers who can induce a user into executing untrusted Java content within a sandboxed client environment. The impact is strictly read-only access to a subset of sandbox-accessible data - no integrity or availability consequences are present. No public exploit has been identified at time of analysis, CISA has not listed this in KEV, and the high attack complexity alongside mandatory user interaction makes opportunistic or automated exploitation unlikely.
Partial denial-of-service affecting Oracle Time and Labor (E-Business Suite versions 12.2.3 through 12.2.15) is exploitable by a low-privileged network attacker over HTTP under high-complexity conditions. Successful exploitation degrades availability of the Internal Operations component only, with zero confidentiality or integrity impact. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog, placing it at the low end of operational priority.
Integrity bypass in Oracle Java SE's JavaFX component (version 8u491) allows a network-reachable unauthenticated attacker to perform limited unauthorized data modifications against clients running sandboxed Java Web Start applications or sandboxed Java applets. The attack requires high complexity and mandatory user interaction, constraining its practical impact to low-severity integrity effects (CVSS 3.1 score: 3.1). No public exploit code or active exploitation via CISA KEV has been identified at time of analysis; server-side Java deployments are explicitly excluded from the attack surface by Oracle.
Sandbox integrity bypass in the JavaFX component of Oracle Java SE 8u491 allows network-reachable unauthenticated attackers to perform unauthorized write, insert, or delete operations against data accessible within the Java security context. Exploitation is structurally constrained to client-side deployments running sandboxed Java Web Start applications or Java applets that load and execute untrusted code from the internet - server-side Java deployments running only administrator-installed code are explicitly outside the attack surface. No public exploit code exists and this CVE is not listed in the CISA KEV catalog; the low CVSS 3.1 score of 3.1 accurately reflects the narrow, integrity-only impact combined with high attack complexity and mandatory user interaction.
Unauthorized data read in the JavaFX component of Oracle Java SE 8u491 allows a remote unauthenticated attacker to access a subset of Oracle Java SE data by luring a victim into interacting with a malicious sandboxed Java Web Start application or Java applet. The attack is constrained exclusively to client-side Java deployments that run untrusted code within the Java sandbox, with high exploitation complexity (AC:H) and mandatory user interaction (UI:R) further limiting real-world reach. No public exploit code and no CISA KEV listing have been identified at time of analysis; the CVSS 3.1 score of 3.1 (Low) accurately reflects the narrow, confidentiality-only impact.
Cross-origin information disclosure in Google Chrome prior to 150.0.7871.182 allows a remote attacker who has already compromised the renderer process to leak sensitive data from other origins via a crafted HTML page. The vulnerability arises from an uninitialized use in the Skia graphics library. Exploitation is unlikely given high complexity and the prerequisite of a separate renderer compromise; no active exploitation or public exploit has been identified at the time of analysis.
Limited integrity compromise in the JavaFX component of Oracle Java SE 8u491 allows unauthenticated remote attackers to perform unauthorized data manipulation through a high-complexity, user-interaction-dependent attack path. The attack surface is narrowly scoped to client-side deployments - specifically sandboxed Java Web Start applications or Java applets that load and run untrusted code from the internet; server-side deployments loading only trusted code are explicitly excluded. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, consistent with its low CVSS score of 3.1 and the demanding exploitation prerequisites.
Blind server-side request forgery in Gitea's OAuth2 avatar synchronization path allows a low-privileged authenticated user to force the server to issue arbitrary outbound HTTP GET requests to attacker-controlled URLs. Gitea versions prior to 1.27.0, when configured with `[oauth2_client] UPDATE_AVATAR = true`, call Go's unrestricted `http.Get()` on the OIDC `picture` claim without applying the `hostmatcher.NewDialContext` restrictions used elsewhere in the codebase - enabling requests to loopback, RFC1918, and cloud metadata addresses such as `169.254.169.254`. No active exploitation is confirmed in CISA KEV, but a functional proof-of-concept is included in the vendor advisory, and the fix is available in Gitea v1.27.0.
HCL MyCloud leaks license keys in HTTP responses, enabling authenticated low-privilege users who can observe or intercept the relevant response to capture and misuse the exposed key material. All versions appear affected per CPE wildcard data (cpe:2.3:a:hclsoftware:mycloud:*:*:*:*:*:*:*:*), and the vulnerability is vendor-confirmed via HCL advisory KB0132381. No public exploit code has been identified and the issue is not listed in the CISA KEV catalog, placing overall risk at low severity consistent with the CVSS 3.1 score of 3.1.
Concurrent Login Vulnerability in HCL MyCloud permits authenticated users to sustain multiple simultaneous active sessions without invalidation, enabling session hijacking and unauthorized account access. The CVSS score of 3.1 (Low) reflects high attack complexity, a prerequisite of authenticated access, and impact confined to partial confidentiality - no integrity or availability impact applies. No public exploit code and no confirmed active exploitation (CISA KEV) have been identified at time of analysis.
TLS session confidentiality in HCL MyCloud is undermined by the LUCKY13 padding oracle vulnerability, enabling a network-positioned attacker to partially decrypt TLS/SSL-protected communications through carefully crafted timing side-channel queries. The flaw stems from non-constant-time MAC processing in CBC-mode cipher suites, a cryptographic weakness first publicly documented in 2013. With a CVSS base score of 3.1 (Low) and high attack complexity, no public exploit code has been identified and the vulnerability has not been added to the CISA KEV catalog, indicating limited immediate threat despite the information disclosure potential.
Local authentication bypass in MySQL Server and MySQL Cluster's Pluggable Auth component allows an unauthenticated local attacker to perform unauthorized data modification under high-complexity conditions. The flaw affects MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, as well as MySQL Cluster across 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. Impact is limited to low-severity integrity compromise - no confidentiality or availability impact - with no public exploit or CISA KEV listing identified at time of analysis.
Signed integer overflow in libarchive's ZIP writer (`archive_write_zip_header` in `archive_write_set_format_zip.c`) produces undefined behavior when ZIP encryption is enabled and a file entry size approaches INT64_MAX, causing the encryption overhead addition to wrap the int64_t type. The resulting undefined behavior may cause incorrect Zip64 extension logic - producing malformed archive structure - or, in worst-case scenarios, memory corruption that could affect availability of the consuming process. No public exploit or active exploitation has been identified; the CVSS score of 2.9 and high attack complexity reflect extreme trigger conditions that are practically unreachable in normal deployments.
Partial denial-of-service exposure in Oracle Agile Engineering Data Management 6.2.1 allows a local, low-privileged attacker to degrade availability of the Install component when a separate user interacts with the system. The CVSS 3.1 base score of 2.8 reflects the constrained impact: only availability is affected, no confidentiality or integrity loss occurs, and exploitation is bounded by local access and mandatory human interaction from a third party. No public exploit code or active exploitation has been identified at time of analysis.
Unauthorized data read in MySQL Server and MySQL Cluster's Performance Schema component exposes a subset of accessible data to highly privileged, network-connected attackers. Affected releases span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, disclosed as part of Oracle's July 2026 Critical Patch Update. No public exploit code and no CISA KEV listing are identified at time of analysis; the CVSS 2.7 score reflects the limited scope and elevated privilege bar.
Unauthorized data manipulation in Oracle Database Server's RDBMS component allows a highly privileged, network-connected attacker to perform insert, update, or delete operations against a subset of data accessible within the database. Affected versions span the 19.3-19.31, 21.3-21.22, and 23.4.0-23.26.2 release trains, all reachable over Oracle Net without user interaction. No public exploit has been identified at time of analysis; with a CVSS 3.1 score of 2.7 and integrity-only impact, the risk is primarily relevant to environments where high-privileged database credentials may be compromised or misused.
UI Misrepresentation of Critical Information in Tanium Server enables a highly privileged network-accessible attacker to alter how critical data is presented within the administrative interface, potentially causing other operators to make incorrect security decisions based on falsified or obscured information. Classified under CWE-451, the flaw carries a CVSS score of 2.7 (Low), reflecting the high privilege barrier required for exploitation. No public exploit identified at time of analysis, and no CISA KEV listing has been associated with this vulnerability.
Null pointer dereference in Gitea's AddTime API (versions prior to 1.27.0) allows an authenticated repository administrator to crash the server by specifying a non-existent username in a time-tracking request. The root cause is a missing `return` statement in `routers/api/v1/repo/issue_tracked_time.go` after `GetUserByName()` returns an error, causing `AddTime()` to dereference a nil user pointer and trigger a Go runtime panic. No active exploitation is confirmed (not in CISA KEV), but a proof-of-concept is embedded in the GHSA advisory, making the issue trivially reproducible by any repository administrator.
Cross-repository label-ID enumeration oracle in Gitea through v1.26.3 allows any authenticated user with write:issue permission on any repository to probe label ID existence across all repositories and organizations on the instance - including private ones they cannot access. The flaw arises because the DELETE /repos/{owner}/{repo}/issues/{index}/labels/{id} API handler performs a global, unscoped label lookup and leaks existence via differential HTTP status codes (204 vs. 422). No label names, colors, repository associations, or content are disclosed, and no cross-repository writes occur; however, a working proof of concept was verified against v1.26.3 and a fix is available in v1.27.0. No public exploit identified at time of analysis beyond the verified PoC in the advisory.
Partial availability disruption in Oracle Siebel CRM End User (Redwood UI component, versions 24.4 through 26.3) can be triggered by a highly privileged network attacker over HTTP under difficult exploitation conditions that also require victim interaction, potentially causing cascading availability degradation in interconnected systems due to a confirmed scope change. The CVSS 3.1 base score of 2.6 (Low) reflects the extremely restrictive prerequisite chain - high privileges, user interaction, and high attack complexity must all align. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Unauthorized partial data read in Oracle Siebel CRM Deployment (Application Interface component) is achievable by low-privileged, network-adjacent authenticated attackers over HTTP across versions 17.0 through 26.4. Exploitation is difficult due to high attack complexity and a mandatory human-interaction requirement, limiting exposure to targeted scenarios rather than opportunistic mass exploitation. No public exploit code or active exploitation has been identified at time of analysis; the low CVSS score of 2.6 reflects the constrained, confidentiality-only impact.
Session cookie exposure in HCL MyCloud arises from the cookie Path attribute not being set, causing authentication tokens to be transmitted to all paths within the application domain rather than restricted to intended endpoints. The CVSS 2.6 score reflects a genuinely limited-impact finding requiring both high attack complexity and authenticated user interaction to exploit, with only low confidentiality impact and no integrity or availability consequences. No public exploit code or active exploitation has been identified at time of analysis.
Local confidentiality exposure in Oracle PeopleSoft Enterprise FIN eSettlements 9.2 permits a high-privileged attacker with infrastructure-level logon access to read a subset of financial settlement data beyond their authorization. Disclosed via Oracle's July 2026 Critical Patch Update with a CVSS 3.1 score of 2.3 (Low), this vulnerability's real-world impact is significantly constrained by the local attack vector and high-privilege prerequisite. No active exploitation or public proof-of-concept has been identified at time of analysis.
Partial denial-of-service in Oracle MySQL Server and MySQL Cluster's Replication component affects multiple supported release lines, exploitable only by highly privileged, authenticated attackers over the network under difficult conditions. The attack yields only a partial availability impact with no confidentiality or integrity exposure, and no public exploit code has been identified at time of analysis. Given the CVSS score of 2.2 and the combination of high complexity and high privilege requirements, this represents a low-priority, low-impact finding in the context of Oracle's July 2026 Critical Patch Update.
Partial confidentiality exposure in Oracle HRMS (UK)'s UK Payroll component allows a network-adjacent, high-privileged attacker to read a limited subset of HRMS data under difficult exploitation conditions. Affecting E-Business Suite versions 12.2.3 through 12.2.15, this low-severity (CVSS 2.2) vulnerability is tagged as an authentication bypass, suggesting an authorization control weakness within an already-authenticated session rather than a full unauthenticated bypass - consistent with the PR:H and AC:H vector. No public exploit code exists and it is not listed in the CISA KEV catalog, placing real-world risk at the lower end of the spectrum.
Partial confidentiality exposure in Oracle HRMS (Ireland), a component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, permits a network-based high-privileged attacker to read a limited subset of HRMS data via HTTP under high-complexity conditions. The impact is confined solely to confidentiality with no integrity or availability consequence, and the CVSS 3.1 base score of 2.2 reflects how constrained exploitation is in practice. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog. Notably, the intelligence tag 'Authentication Bypass' conflicts with the PR:H vector - this discrepancy warrants verification against the Oracle July 2026 CPU advisory.
HCL MyCloud ships a bundled IIS Server component containing publicly disclosed vulnerabilities, classified under CWE-1104 (Use of Unmaintained Third-Party Components). The CVSS 2.2 score (AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N) reflects an extremely constrained attack surface: only a highly privileged attacker navigating high complexity can achieve limited confidentiality disclosure. No public exploit code or active exploitation has been identified at time of analysis.
Server version disclosure in HCL MyCloud exposes software version strings - likely via HTTP response headers or application-layer output - enabling attackers to fingerprint the exact deployment version and correlate it against public vulnerability databases. The vendor-provided CVSS vector (AV:N/AC:H/PR:H/UI:N) constrains realistic risk significantly: exploitation requires both high privilege and high attack complexity, meaning this is not an opportunistic or mass-exploitable weakness. The vulnerability functions primarily as a reconnaissance enabler for chaining into separate, more severe attacks; no public exploit or active exploitation has been identified at time of analysis.
Reflected cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows remote, unauthenticated attackers to inject arbitrary JavaScript into a victim's browser by manipulating the `day` parameter in `/BSIS.php`. The CVSS 4.0 score of 2.1 reflects constrained real-world impact — user interaction is required and integrity impact is low — though a public proof-of-concept has been disclosed via a GitHub issue, confirming exploitability. No active exploitation has been confirmed via CISA KEV.
Cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows remote attackers to inject arbitrary JavaScript into victim browsers by manipulating the `day` argument in /class.php, requiring only passive user interaction (UI:P). Publicly available exploit code exists per VulDB submission and a referenced GitHub proof-of-concept issue, though no CISA KEV listing has been issued. The CVSS 4.0 score of 2.1 reflects the narrow impact profile — limited integrity effect on the vulnerable system only, with no confidentiality or availability consequences recorded.
Cross-site scripting in Home Assistant Core's Shelly integration allows an attacker who controls a Shelly device to execute arbitrary JavaScript in the Home Assistant web origin. The `async_get_media_image()` method fetches the device's `thumb` field without validating that the returned content is an image MIME type, permitting a malicious `data:text/html` URI to be proxied and re-served by the HA backend with `Content-Type: text/html` to the victim's browser. Exploitation is conditional on attacker control of an integrated Shelly device and requires active user interaction; no CISA KEV listing or public proof-of-concept exists at time of analysis, but successful exploitation grants access to session tokens and authenticated control of locks, alarms, and covers.
Integrity compromise in Oracle E-Business Intelligence (component: Definition) affects versions 12.2.3 through 12.2.15, disclosed as part of Oracle's Critical Patch Update July 2026. A network-accessible, high-privileged attacker who can also induce victim interaction may perform unauthorized insert, update, or delete operations on a subset of accessible E-Business Intelligence data. The CVSS base score of 2.0 reflects the highly constrained exploitation requirements: high attack complexity, high privilege level, and mandatory user interaction, all of which drastically limit real-world exploitation probability. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Limited unauthorized data read in Oracle EDI Gateway (E-Business Suite versions 12.2.3-12.2.15) requires a high-privileged attacker with local logon access to the underlying infrastructure, combined with difficult exploitation conditions, to access a subset of EDI data without authorization. The confidentiality impact is narrow and no integrity or availability impact is present. No public exploit code or active exploitation has been identified at time of analysis; Oracle disclosed this via the July 2026 Critical Patch Update.
Oracle Property Manager versions 12.2.3 through 12.2.15 within Oracle E-Business Suite exposes a low-severity information disclosure flaw in the Internal Operations component that allows a highly privileged local attacker to read an unauthorized subset of Property Manager data under difficult exploitation conditions. The CVSS 3.1 score of 1.9 reflects the combined constraints of local infrastructure access, high privilege prerequisites, and high attack complexity, resulting in only partial confidentiality impact with no integrity or availability exposure. No public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis; this is addressed in Oracle's Critical Patch Update for July 2026.
Oracle Production Scheduling (E-Business Suite component) exposes an integrity-only vulnerability exploitable exclusively by high-privileged local attackers on the hosting infrastructure, across versions 12.2.3 through 12.2.15. Successful exploitation permits unauthorized write operations - insert, update, or delete - against a subset of the scheduling module's data, with no confidentiality or availability impact. No public exploit code exists and the vulnerability is not listed in CISA KEV; the extremely low CVSS score of 1.9 reflects the steep exploitation barrier imposed by local access and high privilege prerequisites.
Oracle Inventory Management within Oracle E-Business Suite 12.2.3 through 12.2.15 is susceptible to a local, highly constrained partial denial-of-service condition affecting only availability. Exploitation requires an already highly privileged attacker with direct logon access to the underlying infrastructure hosting the application, combined with high attack complexity, making successful exploitation extremely difficult in practice. No public exploit code or active exploitation has been identified; the CVSS score of 1.9 reflects the minimal real-world risk posed by this vulnerability.
Physical-access data disclosure in Oracle Siebel CRM Integration's Event Publish and Subscribe component exposes a subset of CRM data under conditions requiring physical proximity, high privileges, and difficult exploit circumstances (CVSS 1.9). Versions 17.0 through 26.4 are affected, and a scope change in the CVSS vector signals that a successful attack may also read data from additional products beyond the Integration component itself. No public exploit code exists and this CVE does not appear in the CISA KEV catalog; real-world risk is negligible outside of insider-threat or physical-intrusion scenarios.
Limited local data disclosure in Oracle Work in Process (E-Business Suite component: Internal Operations) versions 12.2.3 through 12.2.15 allows a high-privileged attacker with local infrastructure access to read a subset of accessible data under difficult exploitation conditions. The CVSS 3.1 base score of 1.9 reflects an extremely constrained attack surface - local vector, high complexity, and high privilege requirements combine to make this one of the lowest-severity issues addressed in the Oracle CPU July 2026 advisory. No public exploit identified at time of analysis, and no active exploitation has been reported.
Path traversal in BuildKit's low-level build API allows crafted messages to redirect the container rootfs file-deletion action onto the real host /tmp directory, wiping its contents. All published moby/buildkit versions are affected per the broad CPE cpe:2.3:a:moby:buildkit:*:*:*:*:*:*:*:*. No public exploit code or active exploitation has been identified at time of analysis; the vendor-assigned CVSS score of 3.3 (CVSS 4.0) correctly reflects a constrained impact - host /tmp destruction rather than arbitrary code execution or credential exposure.