Unrestricted file upload in ZS-Admin (zsadmin2025/zs-admin-java) exposes the /api/system/file/upload API endpoint to malicious file submission by authenticated low-privilege users. The SysFileController component fails to validate or restrict file types, allowing an attacker to upload arbitrary content to the server. A public proof-of-concept exists via the project's GitHub issue tracker; the vendor has not yet responded or issued a patch as of the time of disclosure.
Cross-site scripting or request-forgery class vulnerability in Oracle Time and Labor (E-Business Suite component: Internal Operations) enables unauthenticated remote attackers to compromise confidentiality and integrity via HTTP when a victim user interacts with attacker-controlled content, with scope change indicating impact extends beyond the vulnerable component to additional E-Business Suite products. Affected deployments span versions 12.2.3 through 12.2.15. The Oracle July 2026 CPU addresses this; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthorized data manipulation and read access in Oracle Contracts Integration (E-Business Suite 12.2.3-12.2.15) is achievable by unauthenticated network attackers over HTTP when a victim user interacts with a crafted request. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) combined with the reported 'Authentication Bypass' tag indicates a web-injection pattern - most likely reflected or stored Cross-Site Scripting - within the Internal Operations component, where a successful attack can pivot beyond the directly vulnerable module to affect adjacent Oracle EBS components due to scope change. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog.
Cross-site scripting or client-side injection in Oracle Contracts Integration (part of Oracle E-Business Suite) versions 12.2.3 through 12.2.15 allows unauthenticated remote attackers to compromise victim sessions via crafted HTTP requests requiring user interaction. The CVSS scope-change indicator (S:C) and UI:R flag confirm the attack pivots through a victim's browser to affect a secondary security context, resulting in unauthorized read access to a subset of data and unauthorized write/insert/delete to accessible Contracts Integration data. No public exploit code has been identified at time of analysis, and a patch is available through Oracle's Critical Patch Update for July 2026.
The Search component of Oracle Knowledge Management in E-Business Suite versions 12.2.5 through 12.2.15 allows unauthenticated network attackers to compromise data confidentiality and integrity when a victim user interacts with a crafted HTTP request, with successful exploitation producing a scope change that can impact additional E-Business Suite products. Disclosed via Oracle's July 2026 Critical Patch Update, the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) scores 6.1 and is consistent with a reflected injection class - likely Cross-Site Scripting - given the combination of no-privilege network access, required human interaction, and cross-product scope change. No public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-site injection in Oracle iStore's Shopping Cart component (E-Business Suite versions 12.2.3-12.2.15) enables unauthenticated remote attackers to read a subset of iStore-accessible data and perform unauthorized data modifications, with a scope change indicating impact can extend to adjacent Oracle E-Business Suite modules. The attack requires victim interaction via HTTP but no credentials, and Oracle has published a fix in the July 2026 Critical Patch Update. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis, though the vendor-assigned tag of 'Authentication Bypass' suggests the client-side injection may circumvent session-level controls beyond what the CVSS score alone implies.
Cross-site scripting or client-side injection in Oracle E-Business Intelligence 12.2.3 through 12.2.15 enables unauthenticated remote attackers to read a subset of accessible data and perform unauthorized data modifications when a victim user interacts with a crafted HTTP request. The scope change (S:C in CVSS) indicates successful exploitation extends impact beyond the vulnerable component - characteristic of a browser-context attack such as reflected XSS through the Internal Operations component. No public exploit code or CISA KEV listing has been identified at time of analysis, though the tagging as 'Authentication Bypass' alongside PR:N merits close attention in enterprise deployments.
Cross-site injection in Oracle iSupport (E-Business Suite component) versions 12.2.3 through 12.2.15 enables unauthenticated remote attackers to compromise both iSupport and additional EBS components via HTTP. The CVSS scope change (S:C) combined with the 'Authentication Bypass' tag indicates the vulnerability can break out of iSupport's security boundary into adjacent Oracle EBS products, enabling unauthorized read and write access to application data. No public exploit code or CISA KEV listing exists at time of analysis; exploitation requires a victim user to interact with attacker-controlled content.
Cross-site scripting or session-hijacking class vulnerability in Oracle Enterprise Manager Base Platform's UI Framework component exposes versions 13.5 and 24.1 to unauthorized data access and manipulation via HTTPS. An unauthenticated remote attacker can exploit this with no privilege prerequisite, but requires a victim user to interact with attacker-controlled content, after which the attack scope extends beyond the directly targeted component. Successful exploitation yields limited unauthorized read and write access to Enterprise Manager data. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
SQL injection in itsourcecode Hospital Management System 1.0 allows remote authenticated attackers to manipulate database queries via the `editid` parameter in `/prescriptionorder.php`. The CVSS 4.0 vector (PR:L) confirms low-privilege authenticated access is required, limiting opportunistic exploitation but not targeted abuse by authorized users or compromised accounts. A publicly available proof-of-concept exploit exists on GitHub, lowering the barrier for exploitation. No patch has been identified; no public exploit identified at time of analysis in CISA KEV.
Cross-site scripting (XSS) in aiflowy 2.1.2 and earlier allows unauthenticated remote attackers to inject malicious scripts via the UploadController.java file upload endpoint, which are then executed in victim users' browsers. The scope change in the CVSS vector (S:C) confirms the attack crosses the application's security boundary into the browser context, enabling session hijacking or credential theft. No active exploitation is confirmed in CISA KEV, and EPSS sits at 0.19% (9th percentile), indicating low current exploitation probability despite a publicly referenced writeup on GitHub.
Client-side injection in Oracle Banking Origination 14.5.0.16.0's Configuration component allows unauthenticated remote attackers over HTTP to read a subset of accessible banking origination data and perform unauthorized data modifications when a legitimate user interacts with a crafted payload. The CVSS scope change (S:C) confirms exploitation can cascade beyond the primary application into other Oracle Financial Services components sharing the same deployment context. Disclosed in Oracle's Critical Patch Update July 2026 with no confirmed active exploitation or public exploit code at time of analysis.
Unauthorized read and write access to Oracle Access Manager data is achievable by unauthenticated remote attackers through a network-accessible HTTP attack against the Authentication Engine component, affecting versions 12.2.1.4.0 and 14.1.2.1.0. The vulnerability carries a scope change, meaning successful exploitation can impact products beyond Oracle Access Manager itself - consistent with an authentication-layer flaw such as open redirect or reflected cross-site scripting that can compromise dependent applications sharing the SSO context. No public exploit code has been identified at time of analysis, and this CVE is not currently listed in the CISA KEV catalog.
Oracle Commerce Service Center 11.4.0 exposes an unauthenticated network-exploitable vulnerability that requires victim interaction and produces a scope change, consistent with a client-side injection or authentication-bypass pattern affecting additional downstream products. Tagged as an authentication bypass by the reporting source, the flaw allows a remote unauthenticated attacker to achieve unauthorized read access to a subset of Commerce Service Center data and unauthorized write, insert, or delete access to some accessible data - outcomes typical of session hijacking or reflected injection chains. No public exploit code has been identified at time of analysis, and this CVE has not been added to the CISA Known Exploited Vulnerabilities catalog.
Local data integrity compromise in Oracle PeopleSoft Enterprise CS Financial Aid 9.2.38 enables low-privileged users with logon access to the host infrastructure to bypass application-layer authorization controls within the Institutional Methodology Need Analysis component. Successful exploitation permits unauthorized creation, deletion, or modification of critical financial aid records and partial read access to accessible data. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists; however, the low attack complexity makes exploitation straightforward for any insider or attacker with an existing host foothold.
Oracle VM VirtualBox 7.2.12 on the host infrastructure is vulnerable to a local denial-of-service and limited data integrity attack requiring human interaction from a third party. An attacker with logon access to the host - but no specific privileges on VirtualBox - can trigger a complete hang or repeated crash of the hypervisor, plus unauthorized modification of a subset of accessible VM data. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, the low complexity and no-privileges-required local vector make this straightforward to execute once host access is obtained.
Open redirect in Universal Software Inc. FlexCity (versions 5.536.0 through 11052026) enables remote unauthenticated attackers to craft trusted-domain URLs that silently redirect victims to arbitrary external sites, facilitating phishing and credential harvesting. The CVSS 6.1 (Medium) vector carries S:C (Changed scope), confirming the impact escapes the application boundary to affect users on third-party systems. No public exploit code and no CISA KEV listing have been identified at time of analysis, reported by TR-CERT.
Oracle VM VirtualBox 7.2.12 contains a Core component vulnerability exploitable by high-privileged local attackers that produces a scope change, potentially compromising systems beyond VirtualBox itself. Successful exploitation yields complete confidentiality loss of all VirtualBox-accessible data and a partial denial of service, making this an isolation-breach risk in multi-tenant or shared virtualization environments. No public exploit identified at time of analysis, and the AC:H rating signals difficult exploitation, but the scope change (S:C) elevates real-world concern for environments where VirtualBox hosts sensitive guest workloads.
SQL injection in ZS-Admin (zsadmin2025) exposes authenticated remote attackers to database manipulation via the orderField parameter in the department pagination API. The vulnerable sorting functions OrderItem.asc and OrderItem.desc in SysDeptController accept unsanitized input and construct ORDER BY clauses through string concatenation, enabling injection against all instances up to commit b52e14536d59fda11e56e2536a1c32e82a38cead. A public exploit has been disclosed through the project's own GitHub issue tracker, and no vendor response or patch has been issued at time of analysis.
Command injection in D-Link's remote backup CGI handler exposes approximately 20 NAS and NVR device models - including DNS-320, DNS-325, DNS-1200-05, and DNS-1550-04 - to remote OS command execution by authenticated low-privilege users. The vulnerable parameter is the 'ip' argument passed to the cgi_check_rsync_rw function in /cgi-bin/remote_backup.cgi, which fails to sanitize shell metacharacters before constructing system commands (CWE-77). No public exploit identified at time of analysis as confirmed CISA KEV listing, but a proof-of-concept has been made public, and most affected devices are likely end-of-life with no patch forthcoming.
Denial of service in Docker BuildKit (moby/buildkit) allows a malicious or compromised client or frontend to crash the BuildKit daemon (buildkitd) by sending a specially crafted request that triggers an unhandled Go panic. The vulnerability affects all versions of moby/buildkit (CPE cpe:2.3:a:moby:buildkit:*). Any authenticated BuildKit client or frontend - including those operating in CI/CD pipelines, Kubernetes build nodes, or Docker Desktop environments - with network access to the daemon can exploit this to disrupt all concurrent and subsequent build operations. No public exploit is identified at time of analysis and the vulnerability has not been added to the CISA KEV catalog.
Oracle Coherence Core in versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 exposes a confidentiality flaw that allows a high-privileged local attacker to gain complete unauthorized read access to all data accessible by the Coherence service, with scope change potential extending that breach to additional Oracle Fusion Middleware products sharing the same infrastructure. The CVSS scope change metric (S:C) is the most operationally significant signal here - exploitation is not contained within Oracle Coherence and may expose data in adjacent Oracle products. No public exploit code and no CISA KEV listing exist at time of analysis, and the local attack vector with high-privilege prerequisite significantly constrains real-world exploitability to insider threat or post-compromise scenarios.
Oracle VM VirtualBox 7.2.12 Core component allows a high-privileged local attacker to cause a complete denial-of-service by crashing or hanging the hypervisor, with a scope change indicating the impact can extend beyond the primary VirtualBox process to affect additional products on the same infrastructure. The vulnerability is confirmed by Oracle's July 2026 Critical Patch Update. No public exploit code or active exploitation has been identified at time of analysis.
Integrity compromise in JD Edwards EnterpriseOne Tools 9.2.26.3 allows a high-privileged local attacker to perform unauthorized creation, deletion, or modification of critical data - including all data accessible to the EnterpriseOne Tools platform - with a scope change that may extend impact to additional dependent products. The vulnerability resides in the Installation Security component and is tagged as an Authentication Bypass, suggesting the high-privilege requirement may be circumvented or bypassed under specific conditions. No public exploit code and no CISA KEV listing have been identified at time of analysis; this is a July 2026 Oracle Critical Patch Update disclosure.
Unauthorized data disclosure in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 allows unauthenticated network attackers via HTTPS to access critical or complete application data through an authentication bypass in the Security component. Disclosed as part of Oracle's Critical Patch Update for July 2026, the CVSS 3.1 score of 5.9 (Medium) reflects high attack complexity (AC:H), meaning exploitation requires specific non-trivial conditions. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Unauthenticated network exploitation of the ADF Faces component in Oracle JDeveloper 12.2.1.4.0 and 14.1.2.0.0 enables complete confidentiality compromise of all data accessible within the IDE environment via HTTP. Tagged explicitly as an Authentication Bypass by Oracle's security team (secalert_us@oracle.com), the flaw allows a remote attacker with no credentials to circumvent access controls, though the CVSS AC:H rating constrains opportunistic exploitation by requiring attacker-controlled preconditions to be met. No public exploit or CISA KEV listing exists at time of analysis, and the impact is limited strictly to data exfiltration - no integrity or availability risk is present.
Unauthenticated confidentiality breach in Oracle Coherence's Core component exposes complete cached data over TLS to network attackers across all current supported versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0). The flaw is tagged as an Authentication Bypass, allowing a remote unauthenticated attacker reachable via TLS to read all data accessible within the Coherence grid - including potentially sensitive application state, session data, and business records. No active exploitation is confirmed (not in CISA KEV) and no public exploit code exists at time of analysis; however, the PR:N/UI:N profile combined with complete confidentiality loss makes this a material concern for enterprises running exposed Coherence clusters.
Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 expose an authentication bypass in the UI Framework component, reachable over HTTPS without credentials. Unauthenticated remote attackers who satisfy the high-complexity attack precondition can gain complete read access to all data visible within the OEM platform - a significant exposure given OEM's privileged visibility into monitored databases, hosts, and infrastructure credentials. No public exploit has been identified at time of analysis, and no CISA KEV listing exists, but the Authentication Bypass classification warrants prioritized patching in environments where the OEM console is network-accessible.
Oracle E-Business Intelligence versions 12.2.3 through 12.2.15 contains a flaw in its Internal Operations component that, under high-complexity conditions, permits a network-accessible highly privileged attacker to gain unauthorized read and write access to critical business intelligence data. Despite high confidentiality and integrity impact metrics, the overall CVSS 3.1 score of 5.9 reflects the mitigating effects of AC:H and PR:H, meaning exploitation is neither trivial nor broadly accessible. Notably, the 'Authentication Bypass' tag attached to this vulnerability is in tension with the PR:H CVSS metric, suggesting the bypass may circumvent a secondary authorization layer rather than the initial authentication mechanism - no public exploit or CISA KEV listing has been identified at time of analysis.
High-privileged network exploitation of Oracle Enterprise Asset Management's Internal Operations component allows unauthorized read and write access to critical EAM data across versions 12.2.3 through 12.2.15. Tagged as an Authentication Bypass by Oracle, the flaw requires an attacker who already holds high-level privileges to navigate high-complexity conditions over HTTP - suggesting an internal authorization bypass rather than a complete pre-auth bypass. Oracle addressed this in the July 2026 Critical Patch Update; no public exploit or CISA KEV listing exists at time of analysis.
Oracle JDeveloper's Java Business Objects component exposes a network-accessible confidentiality and availability flaw in versions 12.2.1.4.0 and 14.1.2.0.0, allowing low-privileged remote attackers to gain unauthorized access to critical or all JDeveloper-accessible data alongside a partial denial of service. The attack complexity is rated high, requiring specific conditions to be met, but no user interaction is needed beyond initial low-privilege authentication. No public exploit code or active exploitation has been identified at time of analysis; this was disclosed as part of Oracle's Critical Patch Update for July 2026.
Integrity compromise via TLS in Oracle Java SE's JSSE component allows an unauthenticated remote attacker to perform unauthorized creation, deletion, or modification of critical application data across seven affected Java SE releases and three GraalVM variants. The attack targets the TLS stack directly - not through applets or Web Start - and is tagged as an authentication bypass, suggesting the flaw undermines TLS-level authentication controls within JSSE. No public exploit code and no CISA KEV listing have been identified at time of analysis; the AC:H metric constrains real-world risk to adversaries capable of achieving precise network positioning or TLS session manipulation.
Integrity compromise and partial denial-of-service in Oracle PeopleSoft Enterprise FIN General Ledger Argentina 9.1 allows a low-privileged, network-based attacker to create, delete, or modify critical financial data and partially disrupt service availability via HTTP. Exploitation is rated difficult (AC:H), and no confidentiality impact is indicated, suggesting the flaw is scoped to data-write and availability disruption within the Argentina General Ledger component. No public exploit code or active exploitation has been identified at time of analysis.
Ethereum transaction signing on Trezor Safe 3, Safe 5, and Safe 7 hardware wallets can be silently subverted because the device displays and requests on-screen confirmation only for the initial calldata chunk but cryptographically commits the entire streamed calldata into the final signature. A malicious dApp operator or man-in-the-middle attacker can present a benign-looking initial chunk for the victim to approve on the physical device, then stream a manipulated calldata tail that alters the actual transaction semantics - for example changing a token-approval recipient, amount, or contract target. No public exploit has been identified at time of analysis, and the flaw is fixed in upstream commit 70c9b0c per the vendor's firmware repository.
Oracle Contracts Integration (E-Business Suite Internal Operations component, versions 12.2.3-12.2.15) exposes a network-accessible authentication bypass that allows unauthenticated remote attackers to create, delete, or modify critical contract data via HTTP. The attack requires high complexity (AC:H), indicating specific timing, system state, or protocol conditions must be satisfied - ruling out trivial mass exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the Authentication Bypass tag combined with PR:N and network exposure makes this a meaningful integrity risk for organizations running Oracle EBS in environments reachable from untrusted networks.
Integrity and partial availability compromise in Oracle PeopleSoft Enterprise HCM Global Payroll Mexico 9.2 is reachable by low-privileged network attackers over HTTP, though exploitation requires high complexity to trigger. Successful exploitation enables unauthorized creation, deletion, or modification of critical payroll data, as well as a partial denial of service against the Global Payroll Mexico component. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA KEV; however, the Oracle CPU July 2026 advisory confirms the issue and presumably includes a patch.
Authentication bypass in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 (Security component) enables an unauthenticated attacker positioned on the adjacent physical network segment to access critical application data and manipulate select records. The exploit is rated difficult due to adjacent-network positioning requirements and high attack complexity, yielding a moderate CVSS 5.9 score despite the high confidentiality impact. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, limiting immediate mass-exploitation risk.
Cross-repository attachment re-linking in Gitea exposes private issue and comment attachments to authenticated attackers who know a victim's attachment UUID. An attacker with issue-editing rights in any repository they can access can inject a victim UUID into the files[] parameter of an issue or comment edit request, causing Gitea to re-link that attachment into the attacker's authorization context; subsequent requests to /attachments/{uuid} then resolve access against the attacker's repository rather than the victim's, delivering the private file. No public exploit code has been identified at time of analysis, but the GHSA advisory (GHSA-6c6r-5xr4-cr5m) includes a detailed step-by-step reproduction runbook. The vendor-released fix is Gitea v1.27.0.
Draft release attachment disclosure in Gitea exposes files uploaded to draft releases to unauthenticated network callers via UUID-based web endpoints, bypassing access controls that correctly gate the parallel API handlers. This is an incomplete fix for CVE-2026-27660: that advisory's PR #36659 added `canAccessReleaseDraft` checks to every API code path but left the web-side `ServeAttachment` handler ungated, allowing anyone who obtains an attachment UUID to download its contents with no authentication. A working proof-of-concept is documented in the advisory and confirmed against Gitea v1.27.0+dev; no public exploit identified at time of analysis beyond the advisory PoC, and the vulnerability does not appear in CISA KEV.
Signal misdelivery in libssh's ProxyCommand handling allows a low-privileged local user to trigger a local denial of service affecting their entire accessible process tree. When fork() fails during ProxyCommand execution, the error return value of -1 is stored unchecked as a child process ID; at cleanup, libssh signals PID -1, which Linux interprets as a broadcast to all processes the caller has permission to signal. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's KEV catalog, but the CVSS scope-changed metric (S:C) confirms that impact extends beyond the libssh component itself to co-located user processes.
Unauthenticated remote exploitation of the RDBMS component in Oracle Database Server 19c, 21c, and 23ai allows network-accessible attackers to perform unauthorized data manipulation - INSERT, UPDATE, or DELETE - against RDBMS-accessible data via Oracle Net. The CVSS vector (S:C) confirms a scope change, meaning successful exploitation may cascade to additional products or components beyond the targeted database instance. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the zero-barrier network entry (PR:N, AC:L, UI:N) across three actively supported Oracle release families represents a meaningful priority for internet-exposed or multi-tenant Oracle Database environments.
Buffer underflow (CWE-124) in Eclipse OpenJ9 versions through 0.60 allows memory corruption via the JVM method argument tracing subsystem when the -Xtrace diagnostic flag is active, with potential high integrity and availability impact to the running JVM process. The defect resides in traceMethodArguments() within the trace runtime, where the cursor pointer could be decremented past the start of the allocated trace buffer when constructing an ellipsis truncation marker - a classic buffer underwrite. No active exploitation is confirmed in CISA KEV, and no public exploit code has been disclosed at time of analysis.
Oracle GoldenGate Libraries contain a local, high-complexity flaw affecting versions 19.1.0.0.0 through 19.30.0.0, 21.3 through 21.21, and 23.4 through 23.26.2 that allows a high-privileged local attacker - with an additional required victim interaction - to gain complete read access to all GoldenGate-accessible data, partially manipulate data integrity, and cause a complete denial of service via hang or repeatable crash. Tagged as an authentication bypass by intelligence sources, the vulnerability likely allows an already-privileged operator to circumvent an internal GoldenGate security control within the Libraries component, elevating their effective access beyond their authorized scope. No public exploit code or CISA KEV listing has been identified at time of analysis.
Sensitive memory exposure in kronosnet (versions <=1.34) allows a local attacker to recover live cluster encryption keys from freed heap memory following cryptographic configuration changes. Affected deployments include Red Hat Enterprise Linux 8, 9, 10, and OpenShift Container Platform 4, where kronosnet underpins the high-availability networking stack. Successful key recovery enables full decryption of cluster communications or malicious packet injection capable of destabilizing HA cluster quorum - no public exploit code identified and no CISA KEV listing at time of analysis.
Out-of-bounds read in Eclipse OMR's arraycmp SIMD JIT implementation for IBM Z (s390x) and IBM POWER (P10) architectures - versions up to 0.11 - allows a low-privileged network-reachable attacker to trigger an application crash when a zero-length array comparison is JIT-compiled and executed. The flaw exists exclusively in the SIMD code-generation paths for these two architectures and has no impact on x86 or ARM deployments. No active exploitation has been confirmed (no CISA KEV listing) and no public exploit has been identified at time of analysis; exploitation is further constrained by high attack complexity and the requirement for user interaction.
Oracle Service Contracts (E-Business Suite versions 12.2.3-12.2.15) exposes a network-accessible integrity and confidentiality flaw in its Internal Operations component that allows a high-privileged, authenticated attacker to bypass authorization controls and gain unauthorized read or write access to all Service Contracts data. The attack is rated difficult to exploit and requires human interaction from a third party, substantially limiting opportunistic exploitation. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, though the 'Authentication Bypass' tag signals a meaningful authorization control gap rather than a simple privilege escalation.
Local privilege abuse in Oracle E-Business Suite's Applications Technology Stack Configuration component exposes critical data to high-privileged local attackers across versions 12.2.3 through 12.2.15. The vulnerability allows an authenticated, high-privileged attacker with local infrastructure access to achieve both full confidentiality and integrity compromise of all data accessible to the Applications Technology Stack, including unauthorized creation, deletion, and modification of critical records. No public exploit has been identified at time of analysis, and the vulnerability is tagged as an authentication bypass despite the PR:H requirement - suggesting the bypass may escalate effective access beyond what the initial privilege level should permit.
Local privilege abuse in Oracle Project Manufacturing V16 (PJM Command Center component of Oracle E-Business Suite) enables a high-privileged attacker with local infrastructure access to achieve unauthorized read and write access to critical application data. Despite the 'Authentication Bypass' tag in intelligence sources, the CVSS vector explicitly requires high privileges (PR:H) and local access (AV:L), suggesting the bypass operates within application-layer authorization controls rather than at the authentication perimeter. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Oracle Project Manufacturing V16 (PJM Command Center component) exposes a local privilege-abuse flaw allowing a high-privileged attacker with infrastructure logon access to bypass authorization controls and gain unauthorized read and write access to all Project Manufacturing data. The CVSS vector (AV:L/AC:H/PR:H) constrains real-world risk significantly - exploitation requires existing elevated access on the host infrastructure and high attack complexity. No public exploit code and no CISA KEV listing have been identified at time of analysis, keeping this vulnerability in a watchlist rather than emergency-response category for most organizations.
TimesTen In-Memory Database 26.1.1.1.0 contains a medium-severity flaw in its Kubernetes Operator component, exploitable by local high-privileged attackers to gain partial unauthorized read, write, and denial-of-service capability against database data. Critically, the CVSS scope change (S:C) signals that a successful attack may cascade to additional products sharing the Kubernetes cluster, elevating the real-world blast radius beyond the individual component score. No public exploit code and no CISA KEV listing have been identified at time of analysis; Oracle confirmed the issue in the July 2026 Critical Patch Update.