Broken access control in HumHub 1.13.0 through 1.18.2 lets any authenticated user delete every member of any Space, regardless of whether they belong to or hold any role in that Space. The flaw is a missing authorization rule on the Space member-management controller's 'remove-all' action (CWE-862), fixed in 1.18.3. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial-to-trigger, authenticated-only nature makes it a realistic insider/low-privilege abuse risk.
Elevated information disclosure and data tampering in Oracle Solaris 11.4 allows a low-privileged, network-authenticated attacker to abuse the Remote Administration Daemon (RAD) utility component to gain complete read access to all Solaris-accessible data and modify a subset of it, with a scope change that can significantly impact other products on the host. Oracle rates it CVSS 3.1 7.1 with high attack complexity, and it is addressed in the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not in CISA KEV, so exploitation is not confirmed in the wild.
Full takeover of Oracle Production Scheduling (part of Oracle E-Business Suite, Internal Operations component) is possible for an unauthenticated attacker positioned on the same physical/adjacent network segment as the host, provided a legitimate user is tricked into interacting. Affecting EBS releases 12.2.3 through 12.2.15, successful exploitation compromises the confidentiality, integrity, and availability of the Production Scheduling engine. There is no public exploit identified at time of analysis, and the high attack complexity combined with adjacent-network and user-interaction requirements substantially constrains real-world exploitability.
Unauthorized data access in Oracle HRMS (US) within Oracle E-Business Suite (US Payroll Year End component) lets a low-privileged, network-based attacker read all HRMS-accessible data and modify some of it. Affected supported releases are 12.2.3 through 12.2.15, addressed in the Oracle July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and no CISA KEV listing, so this is not confirmed as actively exploited despite the sensitive payroll data at stake.
Blind SQL injection in Tenable Security Center (formerly Tenable.sc/SecurityCenter) lets an authenticated, low-privileged user manipulate report filtering parameters to read unauthorized data from the backend database. Because the vulnerable manager aggregates vulnerability, asset, and scan data across the enterprise, a successful attacker can exfiltrate sensitive security posture information belonging to other users and organizations. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; it was self-reported by Tenable under advisory TNS-2026-19.
Cross-tenant IDOR (broken authorization) in Shelf (shelf.nu) asset-tracking platform before version 1.20.2 allows an authenticated user in one organization to read, update, or connect records belonging to a different organization by supplying entity IDs that are never validated against the caller's workspace. Because Shelf is multi-tenant with per-organization data isolation, this breaks the core tenant boundary; a low-privilege user in Org A who learns or guesses an ID from Org B can act on Org B's data, and a loader-only restriction on personal-workspace bookings is bypassable via a crafted POST. No public exploit identified at time of analysis and the issue is not on CISA KEV, but the flaw is straightforward to abuse once a foreign ID is known.
Cross-site-scripting-style compromise of Oracle PeopleSoft Enterprise PeopleTools 8.62 (PIA Core Technology) lets a remote, unauthenticated attacker who lures an authenticated user into interacting with a crafted HTTP request achieve limited read/write access to PeopleSoft data and cause partial denial of service. The scope-change flag (S:C) means the impact can extend beyond PeopleTools into additional integrated products. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; CVSS 3.1 base score is 7.1.
Unauthorized data access in Oracle WebLogic Server 14.1.2.0.0 and 15.1.1.0.0 (Console component) allows an attacker with local logon to the hosting infrastructure to compromise the server and read all WebLogic-accessible data, with a scope change that can significantly impact other collocated products. Oracle rates it CVSS 3.1 7.1 (confidentiality-only). This is addressed in the Oracle Critical Patch Update of July 2026; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data compromise in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Endeca Application Controller) allows a low-privileged local attacker with logon access to read, create, modify, or delete all data accessible to the product. The flaw carries a CVSS 3.1 base score of 7.1 (C:H/I:H, no availability impact) and is described by Oracle as 'easily exploitable.' No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; it was disclosed in the Oracle Critical Patch Update of July 2026.
Repository visibility and template status in Gitea (self-hosted Git service) before 1.27.0 can be silently toggled by any repository owner or admin-collaborator through undocumented git push options (repo.private, repo.template) processed by the post-receive hook, bypassing all audit logging, webhooks, and notifications. An insider can flip a private repository to public long enough to clone proprietary code, then revert it, leaving only two ordinary push events in the activity feed. No CISA KEV listing and no separately published exploit tool exist, but the GHSA advisory ships full working reproduction commands, and the CVSS 3.1 base score is 7.1 (High).
Local privilege-abuse in the Filesystems component of Oracle Solaris 11.4 allows a low-privileged user with logon access to the host to corrupt or destroy critical operating-system data and to trigger a complete, repeatable denial of service (hang or crash) of the OS. Disclosed in Oracle's July 2026 Critical Patch Update and rated CVSS 3.1 7.1 with high Integrity and Availability impact but no confidentiality loss. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data access in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 (Content Server component) lets an attacker who already holds a login session on the host infrastructure read or take complete access to all data the product can reach, and because of a scope change the impact can extend to additional connected products. Addressed in Oracle's July 2026 Critical Patch Update, the flaw carries a CVSS 3.1 base score of 7.1 with confidentiality-only impact; no public exploit is identified at time of analysis and it is not listed in CISA KEV. The Oracle-supplied tag 'Authentication Bypass' suggests the flaw circumvents application-level access controls once local/infrastructure logon is obtained.
Data compromise in Oracle Interaction Blending (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged attacker with local logon access to the hosting infrastructure to read, create, delete, or modify all data accessible to the product. The flaw carries a CVSS 3.1 base score of 7.1 with high confidentiality and integrity impact but no availability impact, and no public exploit has been identified at time of analysis. It was disclosed by Oracle in the July 2026 Critical Patch Update.
Authenticated data compromise in the Enterprise Command Center component of Oracle Human Resources (Oracle E-Business Suite 12.2.14–12.2.15) lets a low-privileged user with logon access to the hosting infrastructure read, create, delete, or modify all data the HR application can reach. Oracle rates it CVSS 3.1 7.1 with High confidentiality and integrity impact and no availability impact, and it is addressed in the Oracle Critical Patch Update of July 2026. No public exploit is identified at time of analysis and it is not listed in CISA KEV.
Multi-factor authentication bypass in Zohocorp ManageEngine ADSelfService Plus (all versions before build 6524) allows an actor holding valid first-factor credentials to circumvent the second authentication factor, per the vendor advisory CVE-2026-3183. The flaw (CWE-290, authentication bypass by spoofing) is network-reachable and low-complexity but requires low-level privileges (PR:L), and there is no public exploit identified at time of analysis. Because ADSelfService Plus governs self-service password reset and account management across Active Directory, a bypass here undermines a core identity-security control.
Unauthorized data access in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component), versions 22.3 through 26.5, lets an unauthenticated remote attacker over HTTP read all Siebel-accessible data, tamper with some records, and cause a partial denial of service. Oracle rates it CVSS 7.0 but flags it as difficult to exploit (AC:H), and no public exploit identified at time of analysis. Disclosed via the Oracle July 2026 Critical Patch Update.
Data tampering and information disclosure in Oracle Enterprise Manager Base Platform (Discovery Framework component, versions 13.5 and 24.1) allows a remote, unauthenticated attacker to reach the console over HTTPS and, if the difficult-to-exploit conditions are met, create, delete, or modify critical data and read a subset of application data, plus cause a partial denial of service. Oracle rates this CVSS 3.1 7.0 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Denial-of-service and partial data tampering in Oracle JD Edwards EnterpriseOne General Ledger 9.2 (E1 Foundation component) lets a remote, unauthenticated attacker reach the application over HTTP to cause a complete hang or repeatable crash, plus limited unauthorized read and write access to General Ledger data. The CVSS 3.1 base score is 7.0 with high attack complexity, meaning exploitation is possible without credentials but not trivially repeatable. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score supplied in the input.
Local privilege escalation and full compromise in Oracle Solaris 11.4 (Utility component) allows a low-privileged local user with logon access to the host to take over the operating system, impacting confidentiality, integrity, and availability. Oracle rates it CVSS 3.1 7.0 and flags it as difficult to exploit (AC:H). There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the fix ships in Oracle's July 2026 Critical Patch Update.
Full compromise of Oracle HRMS (US) within Oracle E-Business Suite is possible via the Internal Operations component, letting a low-privileged user with local logon access escalate to complete takeover of the HRMS application, with confidentiality, integrity and availability all fully impacted. Rated CVSS 3.1 7.0 but explicitly high-complexity (AC:H), so exploitation is non-trivial and requires an existing account. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege-based compromise in Oracle JDeveloper 12.2.1.4.0 and 14.1.2.0.0 (Security Framework component of Oracle Fusion Middleware) allows a low-privileged attacker with an interactive logon to the host to fully take over the JDeveloper installation, impacting confidentiality, integrity, and availability. Fixed in the Oracle July 2026 Critical Patch Update, the flaw is rated CVSS 7.0 but is explicitly high-complexity (AC:H) and requires local access, so no public exploit identified at time of analysis and no active exploitation is confirmed. It is tagged as an Information Disclosure issue by Oracle, though the vector shows full C/I/A impact consistent with a complete component takeover.
Data disclosure and tampering in Sony FeliCa IC chips manufactured in or before 2017 stems from a missing cryptographic step (CWE-325) in the chip's contactless security handling. An attacker with physical/NFC proximity to an affected card or device can read or alter data stored on the chip, undermining the confidentiality and integrity of stored credentials, balances, or identity data. No public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV; the CVSS 4.0 base score is 7.0 (High), driven entirely by high impact under a physical attack vector.
Memory leak in Amazon s2n-tls's QUIC transport parameters handler exposes server-side QUIC deployments to gradual heap exhaustion by unauthenticated remote clients. The flaw is rooted in incorrect allocator use during TLS 1.3 HelloRetryRequest (HRR) flows - a standard protocol exchange that can be deliberately forced by clients advertising key share groups the server will reject - causing up to approximately 64 KB of unreachable memory per handshake. No active exploitation or public exploit code has been identified; vendor-confirmed patch v1.7.6 is available.
Out-of-bounds memory read in Apache Fory (formerly Apache Fury) versions 0.5.0 up to 1.4.0 allows remote attackers to read beyond the underlying buffer via a flaw in readAlignedVarUint() when out-of-band zero-copy deserialization is used. Because the affected code relies on sun.misc.Unsafe for direct memory access, an attacker supplying crafted serialized data to an application that has enabled this opt-in feature can disclose adjacent heap memory or crash the process. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but a fix (version 1.4.0) is available and the issue was reported by the Apache security team.
Incorrect interface method dispatch in Eclipse OpenJ9 up to version 0.60 causes the JVM to silently execute an unintended interface default method instead of raising AbstractMethodError or IllegalAccessError when a previously JIT-compiled concrete superclass method is subsequently recompiled as abstract. Applications running on OpenJ9 with dynamic class-loading or OSGi-style hot deployment are at risk of integrity violations - untended code paths execute where exceptions should be thrown. No confirmed active exploitation exists and this CVE does not appear in CISA KEV; EPSS data was not provided, and the high attack complexity (AC:H) and specific attack prerequisites (AT:P) significantly limit real-world exploitability.
Validation bypass in Ninja Forms WordPress plugin 3.14.8 allows unauthenticated remote attackers to submit arbitrary content to any form by overriding server-side field definitions at the client layer before validation executes. By crafting a malicious AJAX payload targeting the WordPress nopriv (unauthenticated) AJAX endpoint, an attacker can strip required-field flags, override field types, and neutralize CAPTCHA protections - causing form actions such as email notifications and database writes to fire with fully attacker-controlled data. No public exploit code has been identified at time of analysis, and this vulnerability is not currently listed in the CISA KEV catalog, though the trivial attack complexity and zero-authentication requirement make opportunistic abuse straightforward.
Schema identifier disclosure in Parse Server allows unauthenticated callers to reconstruct hidden GraphQL schema elements by exploiting 'Did you mean ...?' suggestions emitted during variable coercion error handling - a pathway left ungated by the graphQLPublicIntrospection: false hardening control, which only covered the validation phase. Affected versions span the 9.x line (9.0.0 through 9.10.0-alpha.4) and the 8.x line (before 8.6.85), and the flaw represents a confirmed bypass of prior fix GHSA-8cph-rgr4-g5vj. An attacker bearing only the public application ID can iteratively enumerate Cloud Code function names, Parse class names, and field names without triggering the introspection guard; no public exploit code is confirmed and no CISA KEV listing is present at time of analysis.
Unauthenticated information disclosure in Taiga 6.10.1 exposes the full member roster and internal workflow configuration of private projects to any network-reachable attacker. The filters_data endpoints on four viewsets - UserStory, Task, Issue, and Epic - fail to enforce the authorization controls correctly applied elsewhere in the project API, allowing unauthenticated GET requests parameterized with sequential integer project IDs to return user IDs, full names, and gravatar hashes of private project members. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the trivially automatable enumeration path elevates practical risk for externally accessible deployments.
Path traversal in the BuildKit daemon allows a client with valid control API access to craft a malicious upload request that writes files outside the BuildKit-controlled state directory, breaking container build sandbox boundaries. Affected products span all tracked versions of moby/buildkit per CPE data, and the vulnerability carries a CVSS 4.0 score of 6.9 with high integrity and availability impact on the vulnerable system. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthorized critical data disclosure in Oracle Order Management (Oracle E-Business Suite) versions 12.2.3 through 12.2.15 stems from a flaw in the Product Diagnostic Tools component, exploitable by a high-privileged attacker over HTTP with no user interaction. Successful exploitation triggers a scope change, meaning the compromise can extend to additional Oracle products accessible through the Order Management context, resulting in complete access to all confidential data within that reach. No public exploit has been identified at time of analysis, and a fix is available via Oracle's Critical Patch Update for July 2026.
Authentication bypass in Oracle Commerce Platform 11.4.0 exposes full data confidentiality and integrity through the Dynamo Application Framework component, allowing a low-privileged network attacker to read or modify all platform data via HTTP. The CVSS 3.1 score of 6.8 reflects meaningful exploitation complexity (AC:H) and the requirement for at least some authenticated access (PR:L), limiting opportunistic mass exploitation. No public exploit code or active exploitation has been identified at time of analysis, and remediation is available via Oracle's July 2026 Critical Patch Update.
Oracle iSetup (versions 12.2.3 through 12.2.15), the General Ledger Update Transform and Reports component within Oracle E-Business Suite, allows a low-privileged authenticated attacker with network access via HTTP to bypass authorization controls and achieve complete confidentiality and integrity compromise of all iSetup-accessible data. Successful exploitation enables unauthorized read access to critical financial data and the ability to create, modify, or delete ledger records - a significant business risk in financial and compliance contexts despite the CVSS 3.1 medium score of 6.8. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Oracle addressed this in the July 2026 Critical Patch Update.
Oracle Cost Management in E-Business Suite versions 12.2.3 through 12.2.15 exposes an authentication bypass in the Internal Operations component, allowing a low-privileged remote attacker to gain unauthorized read and write access to sensitive cost management data over HTTP. The CVSS 3.1 score of 6.8 (C:H/I:H) reflects the potential for complete data exfiltration and manipulation - including creation, deletion, and modification of critical financial records - moderated by a High attack complexity that limits opportunistic targeting. No public exploit code or active exploitation has been identified at time of analysis.
Critical data exposure and unauthorized modification in Oracle PeopleSoft Enterprise CS Financial Aid 9.2.38 allows a low-privileged, network-authenticated attacker to bypass access controls within the Commonline Loans component via HTTP. Successful exploitation yields complete read and write access to all financial aid data accessible to the application, including sensitive student loan records. No public exploit code has been identified at time of analysis, and no active exploitation is confirmed.
Full takeover of the JDBC component in Oracle Database Server is achievable by a high-privileged network attacker operating via Oracle Net, contingent on inducing human interaction from a separate party. All three actively maintained Oracle Database release tracks - 19c, 21c, and 23ai - are confirmed affected across their respective patch set ranges. No public exploit code or CISA KEV listing has been identified at time of analysis; however, successful exploitation yields complete confidentiality, integrity, and availability compromise of the JDBC layer.
Unauthorized access to sensitive federal financial data is possible in Oracle U.S. Federal Financials (versions 12.2.3-12.2.15, part of Oracle E-Business Suite) via a network-accessible authentication bypass in the Internal Operations component. An unauthenticated remote attacker with network access over HTTPS can, under high-complexity conditions, bypass authentication controls to read critical or complete confidential data - with scope change impact extending to additional E-Business Suite products beyond the directly targeted component. No public exploit code or CISA KEV listing has been identified at time of analysis, though the 'Authentication Bypass' tag and scope-change designation elevate concern for federal agency deployments.
Oracle PeopleSoft Enterprise HCM Human Resources 9.2 exposes a Security component flaw that enables a low-privileged, network-accessible attacker to bypass access controls via Oracle Net, resulting in complete confidentiality and integrity compromise of all HCM HR data. The vulnerability permits unauthorized creation, deletion, and modification of critical HR records alongside full read access to all accessible data within the system. No public exploit has been identified at time of analysis, and the CVSS AC:H designation indicates specific, undisclosed preconditions must be met for successful exploitation.
Unauthorized critical data disclosure in Oracle HRMS (US) versions 12.2.3 through 12.2.15 exposes complete read access to all HRMS-accessible data via network HTTP, with a confirmed scope change that can impact additional Oracle E-Business Suite modules beyond HRMS itself. The CVSS vector (PR:H, S:C, C:H) indicates a high-privileged authenticated attacker operating over the network with low complexity can breach data boundaries across co-deployed EBS components. An 'Authentication Bypass' tag in the intelligence feed creates analytical tension with the PR:H prerequisite and warrants vendor clarification; no public exploit code has been identified at time of analysis, and Oracle disclosed this issue via the July 2026 Critical Patch Update.
Server-Side Request Forgery in Red Hat Quay 3 and Mirror Registry for Red Hat OpenShift 2 allows an authenticated repository administrator to pivot the Quay mirror worker through Skopeo to reach internal network services, cloud metadata endpoints (such as AWS IMDSv1), or other off-limits resources. The flaw arises because the repository-level mirror API handlers in endpoints/api/mirror.py accept an external_reference parameter without invoking the validate_external_registry_url() check that protects the organization-level equivalents. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the CVSS scope change (S:C) reflects real lateral reach into infrastructure beyond the Quay application boundary.
Webhook persistence after collaborator revocation in Gitea (versions prior to 1.27.0) enables a former admin collaborator to receive ongoing real-time exfiltration of private repository content indefinitely after their access is removed. The `DeleteCollaboration()` function cleans watches and assignees but never removes or disables webhooks created by the departing user, and the webhook delivery subsystem fires payloads on every subsequent repository event without re-validating the creator's current access. The attack is invisible to the repository owner, requires no further action by the attacker post-revocation, and was runtime-confirmed on gitea/gitea:1.25.4; no public exploit has been identified at time of analysis.
Heap use-after-free in the SyncTeX parser shipped with TeX Live and embedded by GNOME Evince allows crash or potential arbitrary code execution when a user opens a malformed .synctex or .synctex.gz file. The flaw stems from a NULL parent pointer condition in _synctex_post_process_ref() that bypasses node detachment, causing recursive freeing of live tree nodes and leaving dangling pointers later accessed during document parsing. Exploitation requires local file access and active user interaction (UI:A per CVSS 4.0), no public exploit has been confirmed, but a detailed researcher blog post by the discoverer (Fatih Çelik) is publicly available and the RCE tag suggests demonstrated impact potential.
Oracle Product Lifecycle Analytics 3.6.1 exposes a network-exploitable flaw in its Installation Issues component, allowing a high-privileged attacker to achieve full confidentiality and integrity compromise of all accessible application data alongside partial service disruption via HTTP. The 'Installation Issues' component designation and the 'Authentication Bypass' intelligence tag together suggest the flaw may reside in insecure post-installation artifacts, exposed setup endpoints, or improperly secured administrative interfaces left accessible after deployment. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.
Unauthorized data access and denial of service in Oracle Mobile Application Server's MWA Terminal Server component (E-Business Suite versions 12.2.3-12.2.15) can be achieved by a high-privileged attacker over HTTP. Successful exploitation grants complete read access to all data accessible by the Mobile Application Server, limited write capability (insert/update/delete on some data), and the ability to cause a complete, repeatable denial-of-service crash. The 'Authentication Bypass' tag in the intelligence data conflicts with the PR:H CVSS metric, suggesting the flaw may allow an authenticated administrator to bypass authorization controls beyond their intended access scope. No public exploit or CISA KEV listing has been identified at time of analysis.
Oracle Time and Labor (part of Oracle E-Business Suite) versions 12.2.3 through 12.2.15 allows a high-privileged, network-accessible attacker to achieve full confidentiality and integrity compromise of all accessible labor data, plus limited availability disruption via HTTP. The 'Authentication Bypass' tag in associated intelligence sources introduces a notable discrepancy with the CVSS PR:H rating - if the flaw enables privilege escalation or access-control bypass within the product, the effective impact of an already-privileged session would be materially higher than the base CVSS score of 6.7 suggests. No public exploit code exists and exploitation is not confirmed by CISA KEV at time of analysis.
Webhook authorization headers in Gitea are decrypted and returned as plaintext in API responses, exposing Bearer tokens, Basic auth credentials, and API keys to any repository admin who queries the webhook listing endpoints. All Gitea installations running versions prior to 1.27.0 are affected, confirmed by GitHub Advisory GHSA-3r5c-2xxx-h872 and verified against commit 19f0169. Although these secrets are encrypted at rest using the server's SecretKey, the ToHook() function strips that protection before serializing the API response - effectively converting a write-only secret into a readable credential. No public exploit has been identified and this vulnerability is not listed in CISA KEV, but the business impact of leaking third-party API keys in multi-admin environments exceeds what the CVSS 2.7 Low score implies.
Full takeover of Oracle Application Object Library in Oracle E-Business Suite 12.2.3 through 12.2.15 is achievable by a high-privileged local attacker exploiting a flaw in the AOL Generic Loader component. The CVSS vector (AV:L/AC:L/PR:H) confirms this is a local, infrastructure-level attack requiring existing privileged access to the host, yet yields complete confidentiality, integrity, and availability compromise once triggered. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Full takeover of Oracle E-Business Suite's Pasta component (Internal Operations) is achievable by a high-privileged attacker with local logon access to the host infrastructure running versions 12.2.3 through 12.2.15. Successful exploitation yields complete confidentiality, integrity, and availability compromise of the Pasta service, consistent with the tags noting Information Disclosure as a primary impact vector alongside full control. Patched in Oracle Critical Patch Update July 2026; no public exploit identified at time of analysis and the component is not listed in CISA KEV.
Oracle Production Scheduling versions 12.2.3 through 12.2.15 in Oracle E-Business Suite exposes a local exploitation path through its Internal Operations component, enabling a low-privileged attacker - given co-presence of a second interacting user - to achieve unauthorized creation, deletion, or modification of critical data with a scope change that can cascade impact to additional Oracle EBS products. Tagged as an authentication bypass by ENISA EUVD-2026-47258, the flaw is addressed in Oracle's Critical Patch Update for July 2026. No public exploit code or CISA KEV listing has been identified at time of analysis.
Full system takeover is achievable in Oracle Agile Product Lifecycle Management for Process 6.2.4 via the Data Import component, exploitable by a high-privileged attacker with local infrastructure access. Oracle classifies this as 'easily exploitable,' resulting in complete compromise of confidentiality, integrity, and availability despite the constrained attack surface. No public exploit code or CISA KEV listing exists at time of analysis, limiting immediate real-world risk to insider threat and post-compromise escalation scenarios.
Full takeover of Oracle TimesTen In-Memory Database 26.1.1.1.0 is achievable by a high-privileged attacker with local logon access to the infrastructure through a flaw in the Kubernetes Operator component. The attack requires no user interaction and is characterized by Oracle as 'easily exploitable,' resulting in complete compromise of confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.