Denial of service in MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows a network-connected, high-privileged attacker to cause a complete hang or repeatable crash of the database server by targeting the Server: Optimizer component. Oracle classifies the vulnerability as 'easily exploitable' once credentials are obtained, though the high-privilege prerequisite (PR:H) substantially constrains real-world exposure. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Denial of service in Oracle MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows a high-privileged authenticated attacker to cause a complete, repeatable crash or hang of the database service by exploiting a flaw in the Server: JSON Duality component over any supported network protocol. The vulnerability is rated medium severity (CVSS 4.9) due to the high privilege prerequisite, limiting real-world exposure primarily to environments where privileged credentials have been compromised or where insider threat is a concern. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Denial of service in MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows a high-privileged network attacker to cause a complete hang or repeatable crash of the database server via the JSON Duality component. The vulnerability is rated CVSS 4.9, with the PR:H requirement substantially limiting real-world exposure to authenticated administrators or compromised high-privilege accounts. No public exploit code or active exploitation has been identified at time of analysis.
Oracle MySQL Cluster's Server: Optimizer component in versions 8.0.0 through 8.0.47 can be exploited by a high-privileged remote attacker to cause a complete denial of service via repeated hang or crash of the cluster. Oracle disclosed and patched this in the July 2026 Critical Patch Update (CPU). No public exploit code or active exploitation has been identified at time of analysis, and CISA KEV listing is absent.
MySQL Server and MySQL Cluster's Optimizer component can be crashed or hung by a high-privileged attacker with network access, resulting in complete denial of service. Affected deployments span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, as well as MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, per Oracle's July 2026 Critical Patch Update. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, making real-world exploitation contingent on access to high-privileged database credentials.
Denial-of-service vulnerability in Oracle MySQL Server and MySQL Cluster's InnoDB storage engine component allows high-privileged network-authenticated attackers to cause a complete, frequently repeatable crash or hang of the database server. Affected deployments span MySQL Server 8.4.x and 9.7.x, as well as MySQL Cluster 8.0.x through 9.7.x, making this a broad cross-version exposure within Oracle's primary database products. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the high privilege requirement substantially narrows the real-world attacker population.
Unauthorized data disclosure in Oracle PeopleSoft Enterprise PeopleTools (PIA Core Technology component) allows a high-privileged attacker with HTTP network access to read critical or all accessible PeopleSoft data. Affecting supported versions 8.61 and 8.62, Oracle classifies this as easily exploitable despite the PR:H requirement, yielding a CVSS 3.1 score of 4.9 with confidentiality-only impact. No public exploit code and no CISA KEV listing exist at time of analysis; however, the 'Authentication Bypass' tag in the advisory metadata warrants attention in environments with multiple admin-tier users.
Denial of service in MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows a high-privileged network-authenticated attacker to cause a complete, repeatably triggerable crash or hang of the database server via the Optimizer component. Disclosed in Oracle's Critical Patch Update for July 2026, the vulnerability carries a CVSS 3.1 score of 4.9 (Medium), with the moderate score driven entirely by the high privilege requirement (PR:H) that constrains the attack surface to users holding elevated database credentials. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Denial of service in Oracle MySQL Server and MySQL Cluster's Replication component allows a high-privileged, network-connected attacker to cause repeated crashes or indefinite hangs across affected 8.0, 8.4, and 9.7 release branches. Exploitation is straightforward (AC:L) but gated entirely by the requirement for high database privileges, substantially narrowing the realistic threat population. No public exploit identified at time of analysis and no CISA KEV listing; risk is most acute in replication-dependent high-availability clusters where availability SLAs are critical.
Denial-of-service in Oracle MySQL Server and MySQL Cluster versions 9.7.0-9.7.1 allows a high-privileged, network-adjacent attacker to repeatedly hang or crash the InnoDB storage engine via multiple supported protocols. The CVSS 3.1 score of 4.9 reflects the PR:H prerequisite, which significantly limits the exploitable population to authenticated database administrators or equivalently privileged accounts. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Public-only personal access token scope enforcement in Gitea's REST API is inconsistently applied across two organization endpoints, allowing a token holder to enumerate private organization memberships and retrieve detailed permission data (ownership, admin status, write access, repository-creation capability) that the public-only restriction was explicitly designed to block. All Gitea versions prior to 1.27.0 are affected via GET /api/v1/user/orgs and GET /api/v1/users/{username}/orgs/{org}/permissions. Publicly available exploit code with full HTTP request/response traces is confirmed in the GHSA advisory; no CISA KEV listing exists, indicating no confirmed opportunistic mass exploitation at time of analysis.
Stored Cross-Site Scripting in WPForms (AI Form Builder for WordPress) through version 2.0.0.1 allows contributor-level authenticated attackers to inject persistent malicious scripts into WordPress pages via an unsanitized data-sitekey attribute in the OptinMonster integration handler. Exploitation is constrained by a high-complexity attack condition: the target site must have OptinMonster installed, configured with an active inline campaign emitting matching #om-{id} markup, since WPForms only processes the vulnerable attribute when OptinMonster fires its 'om.Campaign.load' event. No public exploit code or CISA KEV listing has been identified at time of analysis. The CVSS-assigned scope change (S:C) reflects that injected scripts execute in victims' browser sessions, crossing the security boundary from the server-side WordPress context.
Oracle Workflow's Notification Mailer component in Oracle E-Business Suite exposes an unauthenticated SMTP-based attack path allowing partial data manipulation and partial denial of service. Versions 12.2.3 through 12.2.15 are confirmed affected per Oracle's July 2026 Critical Patch Update. No public exploit has been identified at time of analysis, and Oracle rates this difficult to exploit (AC:H), placing the practical risk below the moderate CVSS 4.8 score for most organizations.
PeopleSoft Enterprise FIN eSettlements 9.2 exposes financial settlement data to unauthenticated network attackers via an HTTP-accessible authentication bypass, enabling limited unauthorized read access and write manipulation of settlement records. Carrying a CVSS 3.1 score of 4.8 with high attack complexity (AC:H), exploitation is not trivial and resists easy automation, but the financial nature of the affected data - electronic payments and settlement instructions - amplifies business risk well beyond the moderate numeric score. No active exploitation has been confirmed (not in CISA KEV), and no public proof-of-concept has been identified at the time of this analysis.
Partial authentication bypass in Oracle PeopleSoft Enterprise FIN Grants 9.2 exposes limited data read and write capabilities to unauthenticated network attackers over HTTP. Exploitation is rated difficult (AC:H), meaning the attacker must satisfy specific, unstated preconditions to succeed, constraining real-world risk despite the absence of authentication requirements. Impact is bounded: only a subset of Grants data is accessible for reading, and unauthorized inserts, updates, or deletes are limited to some accessible data - full database compromise is not implied. No public exploit code or active exploitation has been identified at time of analysis.
Oracle JDeveloper's ADF Faces component on versions 12.2.1.4.0 and 14.1.2.0.0 is susceptible to an authentication bypass exploitable over HTTP by unauthenticated network attackers. Successful exploitation yields partial unauthorized read and write/insert/delete access to data accessible within the JDeveloper context - confidentiality and integrity are both impacted at a limited scope. No public exploit has been identified at time of analysis, and the CVSS AC:H rating indicates meaningful technical barriers to exploitation, reducing the practical threat level despite the unauthenticated attack vector.
ACL bypass in kronosnet (versions ≤ 1.34) allows remote unauthenticated attackers to inject arbitrary data packets into cluster communication channels under a specific dual-condition deployment configuration. By spoofing a valid link ID in crafted network frames, an attacker circumvents the ACL subsystem entirely, potentially causing data corruption or service instabilities in clustering stacks shipped with Red Hat Enterprise Linux 8, 9, 10 and OpenShift Container Platform 4. No public exploit code and no active exploitation have been identified at time of analysis.
Oracle Production Scheduling versions 12.2.3 through 12.2.15 within Oracle E-Business Suite exposes its Internal Operations component to exploitation by high-privileged remote attackers over HTTP. Successful exploitation yields partial unauthorized read and write access to accessible data alongside a partial denial of service condition. No public exploit code or confirmed active exploitation has been identified at time of analysis; CVSS score of 4.7 (Medium) reflects the significant mitigation from the high-privilege prerequisite.
Local privilege abuse in Oracle Project Manufacturing V16 (PJM Command Center component, part of Oracle E-Business Suite) permits a highly privileged, locally authenticated attacker to bypass access controls and gain unauthorized read access to all Oracle Project Manufacturing data as well as limited write access. The CVSS vector (AV:L/AC:H/PR:H) confirms this is neither remotely exploitable nor accessible to low-privileged users, substantially constraining real-world impact despite the High confidentiality impact rating. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Unauthorized data manipulation in Oracle Applications Framework (Oracle E-Business Suite) versions 12.2.8 through 12.2.15 exposes the Upload Attachments component to low-privileged network attackers who can read and modify a subset of accessible application data. Exploitation requires human interaction from a third party, consistent with a cross-site request forgery or social-engineering-assisted vector. No public exploit code or CISA KEV listing has been identified at time of analysis; CVSS 3.1 base score of 4.6 (Medium) reflects limited impact scope with no availability impact.
Unauthorized data access and manipulation in Oracle Utilities Network Management System exposes the Security component across five supported release trains to network-based exploitation by low-privileged authenticated users. A successful attack requires human interaction from a victim other than the attacker, enabling partial confidentiality and integrity compromise - specifically unauthorized read access to a subset of NMS data and unauthorized insert, update, or delete operations. No public exploit code exists and this CVE is not listed in the CISA KEV catalog at time of analysis; the 'Authentication Bypass' tag in source intelligence appears to describe privilege escalation within the application rather than full authentication circumvention, given the CVSS PR:L metric.
Denial of service in Oracle MySQL Server and MySQL Cluster's Replication component allows a high-privileged network attacker to cause a complete, repeatable crash or hang of the database service. Affected are MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. No public exploit identified at time of analysis; the CVSS 3.1 score of 4.4 (Medium) accurately reflects the high privilege requirement and elevated attack complexity that substantially constrain real-world risk.
Denial-of-service exposure in the MySQL Server and MySQL Cluster Replication component allows a high-privileged, network-connected attacker to crash or hang the database instance repeatedly. Affected releases span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, as confirmed by Oracle's July 2026 Critical Patch Update and ENISA EUVD-2026-46593. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, its presence in a broadly deployed database product warrants patch prioritization within normal maintenance cycles for affected installations.
Denial-of-service in Oracle MySQL Server and MySQL Cluster's Group Replication Plugin allows a high-privileged, network-authenticated attacker to cause a complete hang or frequently repeatable crash of the database server. Affected deployments span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, as well as MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, as confirmed by Oracle's July 2026 Critical Patch Update. No public exploit code and no CISA KEV listing exist at time of analysis; the high attack complexity and high privilege requirement substantially limit real-world exploitation reach.
Denial-of-service in Oracle MySQL Server and MySQL Cluster's Replication component allows a high-privileged, network-connected attacker to cause a complete hang or frequently repeatable crash of the database server. Affected are MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; the combination of high attack complexity and high privilege requirements substantially limits realistic exploitation risk.
Denial-of-service in MySQL Server and MySQL Cluster's Replication component allows a high-privileged, network-based attacker to cause a repeatable server hang or crash under difficult-to-reproduce conditions. Affected deployments span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, plus MySQL Cluster 8.0.0-8.0.47 and the same 8.4/9.7 ranges, with Oracle issuing a fix via the July 2026 Critical Patch Update. No public exploit has been identified and this CVE is not listed in CISA KEV, but the broad version coverage across active MySQL release trains warrants timely patching for environments running MySQL replication.
Denial-of-service exploitation in Oracle MySQL Server and MySQL Cluster via the Clone Plugin allows a high-privileged, network-connected attacker to cause a complete hang or repeatedly repeatable crash of the database server. Affected version ranges span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, disclosed in Oracle's July 2026 Critical Patch Update. No public exploit or active exploitation has been identified; attack complexity is high and requires pre-existing high database privileges, significantly constraining real-world risk to insider or post-breach scenarios.
Denial-of-service in Oracle MySQL Server and MySQL Cluster's Clone Plugin allows a high-privileged, network-connected attacker to crash or hang the database server through a difficult-to-exploit attack path. Affected are MySQL Server versions 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster versions 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. No public exploit identified at time of analysis, and Oracle disclosed this via its July 2026 Critical Patch Update; exploitation would result in complete availability loss for the targeted database instance.
Denial-of-service in Oracle MySQL Server and MySQL Cluster's Optimizer component allows a high-privileged, network-connected attacker to crash or hang the database server. Affected products span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, as well as MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, per Oracle's July 2026 Critical Patch Update. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis; the high privilege and high complexity requirements materially constrain real-world risk.
Local file inclusion in Gitea's restore-repo CLI command allows operator-level attackers to exfiltrate arbitrary server-side files by embedding file:// URIs in release attachment DownloadURL fields within a crafted restore archive. Affected across all releases through v1.22.x (and unpatched master builds), with a fixed version available at 1.27.0. A working proof-of-concept was published by the reporting researchers; no active exploitation has been confirmed by CISA KEV, but successful exploitation yields direct access to high-value secrets including database credentials, SSH private keys, TLS certificates, and cloud provider tokens stored on the Gitea host.
Denial of service in Oracle MySQL Server and MySQL Cluster's replication component allows a high-privileged network attacker to cause a complete hang or repeatedly crash the database server. Affected deployments span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, as well as MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. No public exploit code and no confirmed active exploitation have been identified; the high privilege and high complexity requirements substantially constrain real-world risk to insider threats or compromised DBA-level accounts.
Denial-of-service in Oracle MySQL Server and MySQL Cluster's DDL component allows a high-privileged, network-connected attacker to cause a complete server hang or repeatable crash under difficult-to-reproduce conditions. Affected product lines span MySQL Server 8.4.x and 9.7.x and MySQL Cluster 8.0.x through 9.7.x, as confirmed in Oracle's July 2026 Critical Patch Update (EUVD-2026-46462). No public exploit or confirmed active exploitation has been identified at time of analysis.
Siebel Cloud Manager in Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.5) exposes an authentication bypass that permits low-privileged local users to read and modify CRM data beyond their authorized scope. The flaw requires an existing logon to the infrastructure hosting the application, constraining the attack surface to internal or compromised users rather than remote internet-based attackers. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; the CVSS 4.4 Medium rating reflects these limiting factors.
Local privilege abuse in Oracle GoldenGate's Libraries component allows low-privileged OS users on the GoldenGate host to read and modify a subset of GoldenGate-accessible data without proper authorization. Three major version branches are affected - 19.x, 21.x, and 23.x - covering a broad deployment window documented in Oracle's Critical Patch Update for July 2026. No public exploit or active exploitation has been identified at time of analysis; the moderate CVSS 4.4 score correctly reflects the local-only attack vector and constrained data impact.
Local integrity and availability compromise in Oracle Agile Engineering Data Management 6.2.1's Document Management component enables low-privileged local users to perform unauthorized data manipulation and trigger partial denial-of-service conditions. Oracle classifies this as 'easily exploitable' given low attack complexity, though the local infrastructure access requirement significantly constrains the realistic attacker pool. No public exploit code has been identified and the vulnerability is absent from CISA KEV; the CVSS 4.4 Medium score reflects the bounded impact ceiling - partial integrity and availability loss only, with no confidentiality exposure.
Integrity compromise in Oracle PeopleSoft Enterprise FIN Common Objects 9.2 allows a low-privileged local attacker to perform unauthorized creation, deletion, or modification of critical financial data when human interaction from another user is obtained. The vulnerability resides in the Security component and carries a CVSS 3.1 base score of 4.4, reflecting high attack complexity and a local-only attack vector. No public exploit code or active exploitation has been identified at time of analysis, and Oracle has disclosed the issue via its July 2026 Critical Patch Update.
Local access control weakness in Oracle Enterprise Manager Base Platform's Enterprise Config Management component allows low-privileged users with host logon rights to read a subset of OEM-accessible data and perform unauthorized inserts, updates, or deletes against accessible data records. Versions 13.5 and 24.1 are confirmed affected per Oracle's July 2026 Critical Patch Update. No public exploit code and no CISA KEV listing have been identified at time of analysis, and the local-only attack vector substantially constrains real-world exploitation to insider threats or previously compromised accounts.
Partial denial-of-service in Oracle Coherence 15.1.1.0.0 (Core component) allows a low-privileged attacker with TCP network access to intermittently degrade availability of the in-memory data grid. The CVSS 3.1 score of 4.3 reflects constrained impact - confidentiality and integrity are unaffected, and no complete service outage is possible. No public exploit code and no active exploitation via CISA KEV have been identified at time of analysis; Oracle addressed this vulnerability in the July 2026 Critical Patch Update.
Oracle EDI Gateway versions 12.2.3 through 12.2.15, a component of Oracle E-Business Suite, exposes an information disclosure vulnerability allowing low-privileged network-authenticated attackers to read a subset of EDI transaction data without proper authorization. Tagged as an authentication bypass, the flaw is exploitable over HTTP with low attack complexity and no user interaction required, suggesting an access-control deficiency that permits privilege escalation within the application layer rather than a full bypass of authentication. No public exploit code and no active exploitation have been identified at time of analysis; Oracle addressed this in the July 2026 Critical Patch Update.
Oracle EDI Gateway versions 12.2.3 through 12.2.15 exposes an information disclosure vulnerability via HTTP that enables low-privileged authenticated network attackers to read a subset of EDI transaction data without proper authorization. The vulnerability is tagged 'Authentication Bypass' in threat intelligence sources, yet the CVSS vector assigns PR:L, suggesting the bypass operates within an authenticated session - likely circumventing object-level authorization controls rather than bypassing session authentication entirely. No public exploit code or CISA KEV listing has been identified at time of analysis, keeping real-world urgency moderate despite the vendor's characterization of the flaw as 'easily exploitable.'
Unauthorized data disclosure in Oracle U.S. Federal Financials (Oracle E-Business Suite, Internal Operations component) allows a low-privileged, network-authenticated attacker to read a subset of sensitive financial data via HTTP. Versions 12.2.3 through 12.2.15 are confirmed affected. No public exploit code or CISA KEV listing has been identified at time of analysis, and the CVSS score of 4.3 reflects a moderate-severity information disclosure with no integrity or availability impact.
Unauthorized read access to Oracle GoldenGate data is possible through a flaw in the Admin Server Executable component, affecting three major release trains spanning versions 19.1.0.0.0 through 23.26.1. A low-privileged network attacker can exploit this Authentication Bypass issue over HTTP without user interaction to read a subset of GoldenGate-accessible data. No public exploit code and no CISA KEV listing have been identified at time of analysis; risk is elevated primarily for deployments exposing the Admin Server to untrusted networks.
Partial denial of service in Oracle Coherence's Core component allows a low-privileged, network-connected attacker to degrade availability across four supported release lines (12.2.1.4.0 through 15.1.1.0.0) via HTTP with low attack complexity. The CVSS 3.1 vector confirms a straightforward network path requiring only a valid low-privilege account and no user interaction, with impact strictly bounded to partial availability loss - confidentiality and integrity are unaffected. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA's KEV catalog.
Partial denial-of-service exposure in Oracle TimesTen In-Memory Database's Kubernetes Operator component (version 26.1.1.1.0) allows a low-privileged, network-authenticated attacker to degrade database availability via crafted HTTPS requests. The attack requires no user interaction and is rated easily exploitable by Oracle, though impact is limited to partial availability loss with no confidentiality or integrity effects. No public exploit code or CISA KEV listing has been identified at time of analysis.
FlexCity by Universal Software Inc. exposes an authentication rate-limiting failure (CWE-307) across versions 5.536.0 through 11052026, allowing low-privileged network attackers to submit unbounded authentication requests and cause excessive server-side resource allocation that degrades availability. The CVSS vector (AV:N/AC:L/PR:L/A:L) indicates a moderate, network-reachable flaw requiring existing credentials, though the vendor-applied 'Information Disclosure' tag conflicts with the C:N CVSS metric and raises the possibility of concurrent username enumeration not captured in the base score. Reported by TR-CERT; no public exploit code and no CISA KEV listing exist at time of analysis.
Privilege escalation in Eclipse hawkBit's Direct Device Integration (DDI) Controller allows any authenticated device to download firmware artifacts beyond those explicitly assigned to it, within the same tenant. The flaw - rooted in missing object-level authorization (CWE-284/CWE-862) - means a valid device credential is sufficient to access arbitrary firmware artifacts belonging to other devices in the same tenant, not just the device's own assigned updates. A secondary enumeration weakness in the software modules listing endpoint compounds the issue by enabling targeted discovery of available artifacts. No public exploit has been identified at time of analysis, and no CISA KEV listing is present.
Unauthorized data read in Oracle Coherence Core component affects all four supported release lines (12.2.1.4.0 through 15.1.1.0.0) via HTTP, allowing a low-privileged network attacker to access a subset of cached data without proper authorization. The vendor-assigned 'Authentication Bypass' tag suggests the root cause is an authorization control deficiency in the HTTP-facing Core layer rather than a complete absence of authentication - low-privilege credentials appear sufficient to bypass higher-tier access controls. No public exploit or active exploitation has been identified at time of analysis; EPSS data was not provided in the input.
Unauthorized data exposure in Oracle Transportation Management 6.5.3 allows low-privileged remote attackers to read a subset of application data via HTTP, exploiting a flaw in the Authentication component. The vulnerability is tagged as an Authentication Bypass and is rated easily exploitable by Oracle, requiring only a low-privilege account and network access - no user interaction or complex conditions apply. No public exploit code or CISA KEV listing has been identified at time of analysis, and the CVSS score of 4.3 reflects a constrained confidentiality-only impact.
Unauthorized data read in Oracle TimesTen In-Memory Database 26.1.1.1.0 is possible through the Kubernetes Operator component via HTTPS, allowing low-privileged authenticated network attackers to access a subset of database data they should not be authorized to read. The ENISA EUVD threat intelligence tags this as 'Authentication Bypass,' suggesting the Kubernetes Operator fails to enforce proper authorization controls after initial authentication, effectively allowing privilege overreach within an authenticated session. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis.
Unauthorized data read in Oracle Utilities Network Management System's Mobile component allows low-privileged, network-adjacent attackers to access a subset of confidential NMS data via HTTP. Affected are five distinct version branches spanning 2.5.0.1.x through 25.12.0.0.x, as detailed in Oracle's July 2026 Critical Patch Update. Oracle classifies this as 'easily exploitable,' and the 'Authentication Bypass' tag suggests authorization control weaknesses beyond the low-privilege requirement implied by PR:L; no public exploit or CISA KEV listing exists at time of analysis.