Unauthorized data disclosure in Oracle Retail Xstore Point of Service 21.0.3 allows a network-based, low-privileged attacker to read a subset of application data via the Xstore Mobile component over HTTP. Tagged as an Authentication Bypass, the flaw suggests a low-privileged authenticated session can exceed its authorized data access scope without elevated rights. No public exploit or active exploitation has been identified at time of analysis, and the CVSS score of 4.3 reflects a moderate, bounded confidentiality risk.
Missing capability checks in the Tutor LMS Elementor Addons WordPress plugin (Themeum) allow any authenticated WordPress user with Subscriber-level access or higher to activate the Tutor LMS and Elementor plugins without administrative authorization. Affected are all versions through 4.0.0, confirmed by Wordfence threat intelligence. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, and real-world impact is constrained by the requirement for a valid WordPress account.
Integrity compromise in Oracle Project Contracts (E-Business Suite versions 12.2.3-12.2.15) exposes an authorization bypass in the Internal Operations component, allowing a low-privileged, network-authenticated attacker to perform unauthorized insert, update, or delete operations on accessible contract data via HTTP. The tag 'Authentication Bypass' from the EUVD entry indicates the flaw permits a legitimately authenticated but restricted user to exceed their intended data-access boundaries within the application. No public exploit or CISA KEV listing exists at time of analysis, limiting immediate mass-exploitation risk, though the low attack complexity and no required user interaction make the vulnerability straightforwardly exploitable once an attacker holds any valid application credential.
Unauthorized access to workflow execution outputs in Kibana 9.3.0-9.3.7 and 9.4.0-9.4.3 allows an authenticated low-privileged user to read sensitive data returned by workflow steps - including results from connected data sources they are not authorized to query - by directly calling the workflow output endpoint without the authorization the documented API requires. The flaw is classified as Missing Authorization (CWE-862) via Privilege Abuse (CAPEC-122), with impact limited to confidentiality within the user's accessible Kibana space. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; Elastic has released patched versions 9.3.8 and 9.4.4.
Kibana's multi-tenancy Spaces model can be bypassed through an Insecure Direct Object Reference (IDOR) vulnerability, allowing authenticated users to read scheduled query results belonging to Spaces they are not authorized to access. Affected versions span Kibana 9.4.0 through 9.4.3, with the fix delivered in 9.4.4. The CVSS vector (PR:L, C:L) confirms the impact is limited to low-privilege authenticated access resulting in partial confidentiality loss - no integrity or availability impact is involved. No public exploit code exists and no CISA KEV listing has been identified at time of analysis.
RSS/Atom feed handlers in Gitea prior to v1.27.0 expose private repository content - commit metadata, release notes, tag names, and cross-repo activity streams - to holders of confined API tokens that are explicitly blocked from the same data via download routes. The bypass breaks the token-confinement guarantee introduced by PR #37698 for raw/archive/download handlers, which was never extended to the sibling feed endpoints despite those endpoints accepting identical token-based Basic auth. A working proof-of-concept is documented in the GHSA advisory verified against the official gitea/gitea:1.26.2 Docker image; the vulnerability is not confirmed in CISA KEV, and the primary realistic threat is a leaked or lower-trust token used in CI or third-party integrations circumventing its intended scope restrictions.
Partial denial of service in Oracle GoldenGate's Admin Server Executable component is reachable by unauthenticated attackers with access to the adjacent physical communication segment. Three major release trains are affected - 19.1.0.0.0 through 19.30.0.0, 21.3 through 21.21, and 23.4 through 23.26.1 - making this broadly relevant across GoldenGate deployments. No public exploit code and no CISA KEV listing have been identified at time of analysis; exploitation is bounded by the adjacent-network requirement.
Kibana's authorization layer fails to enforce ACLs correctly in certain code paths, allowing a lower-privileged authenticated user to cause data from restricted Elasticsearch sources to be processed under another user's elevated privileges - effectively a confused deputy attack resulting in unauthorized information disclosure. The CVSS 4.3 (Medium) rating reflects low confidentiality impact and the requirement for a valid Kibana account, but the real-world risk is material in multi-tenant or role-segregated deployments where data isolation is a compliance requirement. No active exploitation confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Token scope enforcement is bypassed on Gitea's repository home page handler (`repo.Home`), exposing private repository README, root file/directory tree, description, language statistics, license, and latest-release data to any authenticated PAT or OAuth2 token that lacks the `repository` scope or is marked `public-only`. This is the third in a series of related incomplete fixes - CVE-2026-20706 and CVE-2026-27761 patched sibling routes (archive download and RSS/Atom feeds) but the home route was overlooked, leaving it without the `CheckRepoScopedToken` guard applied to every neighboring handler. Publicly available exploit code exists in the form of a self-contained Docker-based proof-of-concept published in the vendor advisory; no active exploitation has been confirmed by CISA KEV.
OAuth token introspection in Gitea prior to v1.27.0 discloses token metadata - including active status, scope, username, and JWT registered claims - to any authenticated OAuth client regardless of whether that client is the token's intended audience, violating RFC 7662 section 4. Any registered OAuth application on the target instance can call `/login/oauth/introspect` with a token issued to a completely different client and receive a valid response. No public exploit is confirmed in CISA KEV, but a complete proof-of-concept reproduction script (`poc.sh`) is publicly attached to the GHSA advisory, making exploitation trivially reproducible by anyone with a registered OAuth client credential.
Incorrect Authorization in Kibana's Machine Learning management endpoint allows a low-privileged authenticated user to manipulate ML audit and notification records for arbitrary jobs across any space or user boundary. The endpoint validates only a coarse ML access privilege without enforcing resource-level authorization, and then uses Kibana's internally elevated credentials to write to restricted ML system indices on behalf of the requesting user. No public exploit has been identified at time of analysis, and CVSS scores this at Medium (4.3) given the limited integrity-only impact scope.
Incorrect authorization enforcement in Gitea's team API routes exposes private repository metadata and activity feed entries to public-only access tokens. Affected versions through 1.26.2 allow an authenticated team member holding a public-only scoped token to bypass the intended access restriction and retrieve private team repository listings and private activity feed data via /api/v1/teams/{id} endpoints. Publicly available exploit code (PoC) has been verified against Gitea 1.26.2 and nightly builds; no KEV listing at time of analysis. EPSS data not provided, but the CVSS score of 4.3 and limited confidentiality impact (metadata only, no code exfiltration) suggest moderate real-world risk.
Clickjacking exposure in HCL IntelliOps Event Management (IEM) allows network-based attackers to embed the application inside a malicious webpage via an iframe and deceive authenticated users into performing unintended administrative or operational actions. All tracked versions under the CPE wildcard are affected, per HCL advisory KB0132378. No public exploit identified at time of analysis, and the CVSS score of 3.1 (Low) reflects the non-trivial attack complexity and limited integrity-only impact.
Private repository metadata and issue titles leak to revoked Gitea users via two REST API endpoints that omit post-revocation authorization checks, constituting an incomplete fix relative to CVE-2026-20800. Former collaborators with a still-valid API token can call `GET /api/v1/user/starred` to receive full repository objects - including `clone_url` and `ssh_url` - for private repos they starred, and `GET /api/v1/user/times` to retrieve private issue titles and states for issues on which they logged time, indefinitely after repo access is revoked. Impact is metadata-only; no public exploit code has been identified at time of analysis and no CISA KEV listing exists.
Improper deserialization of untrusted data in NVIDIA Transformers4Rec (all versions per CPE wildcard) exposes systems running the library to code execution, data tampering, and information disclosure via a local attack path. The official CVSS vector assigns C:N/I:N/A:L - a score of 4.3 - which is materially inconsistent with the vendor's own description of potential remote code execution and data tampering; this discrepancy warrants independent verification with NVIDIA's product security team. No public exploit code has been identified at time of analysis, and KEV status is not confirmed.
Cleartext transmission of sensitive information in Zohocorp ManageEngine Endpoint Central before version 11.4.2528.34 exposes mail configuration credentials to network interception. Authenticated users who trigger mail-related functionality cause the application to transmit sensitive data - likely SMTP credentials and server configuration - without encryption, making it capturable by any attacker with a network vantage point between the client and server. No public exploit code or active exploitation (CISA KEV) has been identified; the CVSS score of 4.3 (Medium) reflects the limited scope and authentication prerequisite.
Heap out-of-bounds read in libsoup's multipart HTTP message parser allows remote attackers to crash affected applications or leak heap memory contents. An integer type mismatch between the calling code and soup_headers_parse() causes the length parameter to be incorrectly truncated, enabling a read beyond the allocated heap buffer boundary. No active exploitation has been identified (no CISA KEV listing, no public POC), and the CVSS score of 4.2 with AC:H/UI:R reflects meaningful real-world friction for successful exploitation.
Oracle HRMS (US) Internal Operations component in E-Business Suite versions 12.2.3 through 12.2.15 exposes a network-accessible flaw that allows a low-privileged authenticated attacker to read a subset of HRMS data and cause partial denial of service via HTTP under high-complexity conditions. Disclosed by Oracle via the July 2026 Critical Patch Update (CPU), the vulnerability carries a CVSS 3.1 score of 4.2 (Medium), with no public exploit and no active exploitation confirmed at time of analysis. The high attack complexity (AC:H) materially constrains real-world exploitability despite the network-accessible attack vector.
Partial authorization bypass in Oracle Contracts Integration (Oracle E-Business Suite 12.2.3-12.2.15) allows an authenticated low-privileged network attacker to perform unauthorized read, insert, update, or delete operations against a subset of contract data via HTTP under high-complexity conditions. Tagged as an Authentication Bypass, suggesting the flaw permits a low-privileged session to exceed its intended access boundary within the Internal Operations component. No public exploit code or CISA KEV listing has been identified at time of analysis, and the high attack complexity substantially limits opportunistic exploitation.
Oracle Enterprise Asset Management (EAM), a component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, exposes an authentication bypass condition in the Internal Operations component that allows a low-privileged, network-authenticated attacker to read and tamper with a subset of EAM data. Despite the medium CVSS score of 4.2, the 'Authentication Bypass' tag signals that a legitimately low-privileged account can cross authorization boundaries within the application. No public exploit code exists and this vulnerability is not listed in CISA KEV, making it a moderate but non-urgent priority for most organizations.
Unauthorized data access and manipulation is possible in Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.5) via a flaw in the Siebel Cloud Manager component, tagged as an Authentication Bypass. An unauthenticated attacker positioned on the same physical network segment as the hosting hardware can, under high-complexity conditions, read a subset of accessible CRM data and perform unauthorized inserts or modifications. No confirmed active exploitation (CISA KEV) and no public proof-of-concept have been identified at time of analysis, and the CVSS 4.2 score accurately reflects the constrained adjacency and complexity requirements.
Missing X-Content-Type-Options headers in Intelliops Event Management enable content-type sniffing attacks leading to script injection under man-in-the-middle conditions when user-controlled input is reflected. Exploitation requires high attack complexity, user browser interaction, and network positioning, with low integrity impact only (CVSS 3.1). No active exploitation or public exploit code identified.
Oracle Interaction Blending within E-Business Suite exposes a network-accessible RMI interface flaw that allows a high-privileged attacker to partially compromise confidentiality, integrity, and availability of application data. Affected deployments span versions 12.2.3 through 12.2.15 of the Internal Operations component. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, placing it at low immediate operational priority despite the triple-impact scope.
Denial-of-service exposure in MySQL Server and MySQL Cluster's Replication component allows a high-privileged local attacker to repeatedly crash or hang the database service under difficult-to-reproduce conditions. Affected are MySQL Server versions 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. Oracle addressed this in the July 2026 Critical Patch Update; no public exploit code or active exploitation has been identified at time of analysis.
Oracle Labor Distribution, an Internal Operations component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, permits a high-privileged local attacker to compromise data integrity by creating, deleting, or modifying critical application data. Despite carrying an 'Authentication Bypass' tag in available intelligence, the CVSS vector (AV:L/AC:H/PR:H) constrains exploitation to actors who already possess elevated logon access to the underlying infrastructure - suggesting an internal authorization bypass rather than a full authentication circumvention. No public exploit code exists and no active exploitation has been identified; this was disclosed as part of Oracle's Critical Patch Update for July 2026.
Insecure mmap backing-file creation in Data::DisjointSet::Shared (Perl/CPAN) before 0.02 exposes inter-process IPC payloads to any local user on the host. The module's dsu.h creates the shared segment with open(path, O_RDWR|O_CREAT, 0666), resulting in a 0644-mode file under the default umask - readable by all local accounts - typically placed in /tmp or /dev/shm. The absent O_EXCL flag silently adopts a pre-planted file, and the absent O_NOFOLLOW flag follows symlinks at the target path, enabling a local attacker to either read IPC data or redirect file operations. No active exploitation confirmed; EPSS is 0.16% (6th percentile), consistent with the niche deployment footprint.
Denial of service in libssh affects clients that use automatic certificate-based public key authentication, where logic errors cause the client to loop indefinitely when configured certificates are absent or are repeatedly rejected by the SSH server. Reported by Red Hat and shipped in Red Hat Enterprise Linux 8, 9, and 10 plus Red Hat Hardened Images, the flaw lets a hostile or misconfigured server hang a connecting client and consume CPU. There is no public exploit identified at time of analysis, and EPSS is low at 0.17% (7th percentile), consistent with an availability-only, client-side bug rather than a mass-exploited issue.
Shell metacharacter injection in libssh's ProxyCommand handling allows a crafted SSH username to break out of the intended command string when the %r token is expanded. Affecting libssh deployments that use ProxyCommand with %r substitution, a low-privileged local attacker who controls the username passed to the connection can cause the shell executing the ProxyCommand to expand environment variables or alter its behavior, leaking sensitive environment data. No public exploit is identified and this is not listed in CISA KEV; CVSS rates this Low (3.9), consistent with the constrained local attack surface and limited impact.
Oracle HRMS (Norway) Payroll component within E-Business Suite versions 12.2.3 through 12.2.15 exposes limited confidentiality and integrity risks to high-privileged authenticated network attackers over HTTP. A successfully exploited vulnerability enables unauthorized read access to a subset of Norway Payroll data and unauthorized update, insert, or delete operations on accessible records within that module. No public exploit code has been identified at time of analysis, CISA KEV listing is absent, and the CVSS 3.1 base score of 3.8 (Low) reflects the constrained scope and high privilege bar required.
Information disclosure in the Perl Data::Deque::Shared module before version 0.06 exposes inter-process communication queue contents to any local user due to a world-readable mmap backing file and unsafe open() flags. The shared segment is created in /tmp or /dev/shm with mode 0644 (after umask 022), and the absence of O_NOFOLLOW and O_EXCL permits symlink-following and pre-creation race attacks against the backing file path. Any local account on a multi-user host can passively read sensitive IPC payloads, or actively redirect the segment open via a pre-planted symlink. No active exploitation has been identified - EPSS is 0.16% (6th percentile) and the vulnerability is not in CISA KEV.
World-readable IPC segment exposure in Data::SpatialHash::Shared (Perl) before version 0.02 allows any local user on a multi-user system to read the contents of shared memory payloads written by other processes using the module. The root cause is a combination of overly permissive file creation mode (0666, yielding 0644 under default umask) and the absence of O_EXCL and O_NOFOLLOW flags when opening the mmap backing file in sphash.h, enabling both passive eavesdropping and pre-creation file/symlink attacks. No active exploitation has been identified (EPSS: 0.16%, 6th percentile; not in CISA KEV), and the fix is available in version 0.02.
Insecure file creation in Data::Intern::Shared for Perl (all versions before 0.02) exposes shared memory IPC payloads to any local user on the same host. The module's intern.h opens its mmap backing file with mode 0666 - effective 0644 under the standard umask - making the segment world-readable, while missing O_EXCL and O_NOFOLLOW flags independently enable a pre-creation file-race and a symlink-redirect attack. No public exploit has been identified and EPSS sits at 0.16% (6th percentile), consistent with the niche deployment footprint of this CPAN IPC library.
World-readable mmap backing file creation and missing symlink/exclusivity guards in Data::RingBuffer::Shared before version 0.04 expose inter-process IPC payloads to any local user on the host. The module creates its shared segment in ring.h with mode 0666 (effective 0644 under default umask 022), making contents in /tmp or /dev/shm readable by all local users; omission of O_EXCL and O_NOFOLLOW further enables pre-creation race and symlink-redirect attacks. No public exploit has been identified at time of analysis, and the EPSS score of 0.16% (6th percentile) reflects low exploitation probability commensurate with the module's niche deployment footprint.
World-readable mmap backing file creation in Data::HashMap::Shared (Perl CPAN module) versions before 0.14 exposes inter-process communication payloads to any local user co-resident on the same system. The module's shm_generic.h opens its shared memory segment with mode 0666 (resulting in 0644 under default umask 022) in world-accessible directories such as /tmp or /dev/shm, while omitting both the O_EXCL and O_NOFOLLOW flags - enabling a local attacker to either read IPC payloads directly from the world-readable file or redirect the open via a pre-planted symlink. No public exploit has been identified (EPSS 0.16%, 6th percentile) and there is no CISA KEV listing, but the primary information-disclosure vector requires no race condition and is trivially exploitable by any unprivileged local user on a multi-tenant system.
World-readable mmap backing file creation in Data::RadixTree::Shared before 0.02 exposes inter-process communication payloads to any authenticated local user on the system. The Perl module's radix.h opens the shared segment file with mode 0666 (resolving to 0644 under default umask), while omitting both O_EXCL and O_NOFOLLOW, enabling two distinct local attack paths: passive reading of IPC segment contents from /tmp or /dev/shm, and an active file-planting or symlink-redirection attack exploiting the missing exclusive-creation guard. No public exploit is identified at time of analysis; EPSS at 0.16% (6th percentile) and absence from CISA KEV indicate no current active exploitation.
World-readable mmap backing file creation in Data::SortedSet::Shared before 0.03 exposes IPC payloads to any local user and enables symlink or pre-creation race attacks on the same host. The module's sortedset.h opens the shared segment file with mode 0666 (yielding 0644 after umask), no O_EXCL, and no O_NOFOLLOW, meaning a local attacker can passively read any data written to the segment or actively redirect the open() to an attacker-controlled file. No public exploit has been identified at time of analysis; EPSS is 0.16% at the 6th percentile, consistent with the niche footprint of this Perl CPAN module.
World-readable mmap backing files in Data::ReqRep::Shared (Perl) versions before 0.05 expose IPC request-reply payloads to any local user on multiuser Unix/Linux systems. The module's reqrep.h creates shared memory segments in directories like /tmp or /dev/shm with open() using O_RDWR|O_CREAT and mode 0666, yielding 0644 under a default umask of 022 - readable by all local users. Two additional unsafe-open defects compound the issue: the absence of O_NOFOLLOW enables symlink redirection, and the absence of O_EXCL allows silent reuse of a pre-planted file. No public exploit code has been identified and EPSS is 0.16% (6th percentile), indicating no current broad exploitation interest.
Insecure shared-memory file creation in the Perl module Data::PubSub::Shared before version 0.07 exposes inter-process communication payloads to any local user on the system. The backing mmap file is created with mode 0666 (effective 0644 under umask 022), is placed in world-accessible directories such as /tmp or /dev/shm, and is opened without O_EXCL or O_NOFOLLOW, enabling both passive eavesdropping on IPC traffic and active pre-creation or symlink-redirect attacks. No public exploit code has been identified at time of analysis, and EPSS sits at the 6th percentile, indicating low current exploitation interest; however, the world-readable condition requires no race-winning and is trivially exploitable by any local authenticated user.
Local information disclosure in Oracle TimesTen In-Memory Database 26.1.1.1.0 (Kubernetes Operator component) permits a low-privileged local attacker to read a subset of database-accessible data. The CVSS scope change (S:C) indicates exploitation can extend impact beyond the vulnerable component itself, potentially affecting other workloads or namespaces co-located in the same Kubernetes cluster. No public exploit code exists and no active exploitation has been confirmed at time of analysis; overall real-world risk is constrained by the requirement for local infrastructure access.
Partial denial of service in JD Edwards EnterpriseOne Tools 9.2.26.3 is achievable by an unauthenticated remote attacker via the JDENET protocol, specifically through the Interoperability Security component. The vulnerability carries a low CVSS base score of 3.7 driven by high attack complexity and limited availability-only impact, with no confidentiality or integrity consequences. No public exploit code or active exploitation has been identified at time of analysis, placing this at low operational priority for most organizations.
Partial denial-of-service in the 2D component of Oracle Java SE and GraalVM platforms allows unauthenticated remote attackers to degrade availability via multiple network protocols. Affected versions span Java SE 8u491 through 26.0.1 and GraalVM for JDK 17.0.19/21.0.11, but exploitation is restricted to sandboxed client-side deployments - specifically Java Web Start applications or applets loading untrusted code - making the practical attack surface narrow given the near-obsolescence of these technologies. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV.
Unauthorized read access to a subset of student records data is possible in Oracle PeopleSoft Enterprise CS Student Records 9.2.38 via the Research Tracking component over HTTP. An unauthenticated network attacker exploiting an authentication bypass condition (tagged explicitly by the reporter) can retrieve confidential academic data without credentials, though the high attack complexity constrains opportunistic mass exploitation. No public exploit code or active exploitation has been identified; however, even partial disclosure of student records carries regulatory significance under FERPA regardless of the low CVSS score of 3.7.
Unauthorized read access to Oracle Time and Labor data is achievable by unauthenticated remote attackers targeting the Internal Operations component via HTTP, affecting E-Business Suite versions 12.2.3 through 12.2.15. Tagged as an Authentication Bypass, the flaw allows network-based attackers to circumvent access controls without credentials, though the high attack complexity (AC:H) constrains reliable exploitation. Impact is confined to partial confidentiality loss - no integrity or availability impact - and no public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
Unauthorized read access to Oracle iSupplier Portal (E-Business Suite versions 12.2.3-12.2.15) is possible for unauthenticated network attackers targeting the Internal Operations component over HTTP. The Authentication Bypass tag indicates the root cause involves inadequate access controls on internal HTTP endpoints, though exploitation is constrained by high attack complexity (AC:H), meaning specific conditions must be met. Impact is confined to partial confidentiality loss - no integrity or availability impact - with no public exploit code or active exploitation confirmed at time of analysis.
Unauthorized data read in Oracle JDeveloper's Data Visualization Tools component exposes a subset of accessible application data to remote unauthenticated attackers via HTTP. Affected versions are 12.2.1.4.0 and 14.1.2.0.0, with Oracle tagging this as an authentication bypass class issue. Despite the network-accessible attack vector with no privilege requirement, the high attack complexity (AC:H) and limited confidentiality impact (C:L) anchor this at CVSS 3.7 (Low). No public exploit code exists and it is not listed in the CISA KEV catalog.
Unauthorized read access to a subset of Oracle JDeveloper data is possible via an unauthenticated HTTP-based attack against the ADF Faces component in Oracle Fusion Middleware. Affected versions are 12.2.1.4.0 and 14.1.2.0.0, and while exploitation requires high attack complexity, no authentication is needed. No public exploit code has been identified at time of analysis, no active exploitation is confirmed, and the CVSS 3.1 score of 3.7 (Low) reflects the limited confidentiality impact and elevated exploitation difficulty.
Integrity compromise in Oracle Java SE's ImageIO component allows unauthenticated remote attackers to perform unauthorized data modification against a broad range of Java SE and GraalVM versions. Exploitation requires high attack complexity, limiting opportunistic mass exploitation, but the scope spans ten distinct supported releases across Java SE 8 through 26 and both GraalVM product lines. No public exploit has been identified and this vulnerability is not listed in CISA KEV; however, the low CVSS score of 3.7 belies a moderately wide attack surface given Java's deployment footprint.
Unauthorized data manipulation via authentication bypass in Oracle Siebel CRM Integration's Siebel Server Sync for Exchange component allows unauthenticated remote attackers to insert, update, or delete a subset of CRM-accessible data over HTTP. All versions from 17.0 through 26.5 are affected, with exploitation constrained by high attack complexity that substantially reduces real-world risk. No public exploit code or active exploitation has been identified at time of analysis, consistent with the low CVSS score of 3.7 reflecting limited, integrity-only impact.
HCL IntelliOps Event Management (IEM) fails to enforce HTTP Strict Transport Security (HSTS), enabling network-positioned attackers to perform SSL stripping and intercept communications that should be protected by TLS. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) indicates unauthenticated network exploitation but at high attack complexity, meaning the attacker must occupy a man-in-the-middle position on the network path. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, placing realistic risk in the low-to-moderate range confined to adversarial network environments.
Authentication bypass in Oracle JD Edwards EnterpriseOne Tools 9.2.26.3 (Installation Security component) permits an unauthenticated attacker on the same physical network segment to partially read and modify data accessible to the application. Exploitation is constrained by high attack complexity and a mandatory user-interaction requirement, making opportunistic attacks highly impractical. No public exploit code exists and the vulnerability is not listed in CISA KEV; CVSS 3.7 (Low) accurately reflects the limited real-world threat.