Partial confidentiality exposure in Oracle HRMS (Ireland), a component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, permits a network-based high-privileged attacker to read a limited subset of HRMS data via HTTP under high-complexity conditions. The impact is confined solely to confidentiality with no integrity or availability consequence, and the CVSS 3.1 base score of 2.2 reflects how constrained exploitation is in practice. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog. Notably, the intelligence tag 'Authentication Bypass' conflicts with the PR:H vector - this discrepancy warrants verification against the Oracle July 2026 CPU advisory.
HCL MyCloud ships a bundled IIS Server component containing publicly disclosed vulnerabilities, classified under CWE-1104 (Use of Unmaintained Third-Party Components). The CVSS 2.2 score (AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N) reflects an extremely constrained attack surface: only a highly privileged attacker navigating high complexity can achieve limited confidentiality disclosure. No public exploit code or active exploitation has been identified at time of analysis.
Server version disclosure in HCL MyCloud exposes software version strings - likely via HTTP response headers or application-layer output - enabling attackers to fingerprint the exact deployment version and correlate it against public vulnerability databases. The vendor-provided CVSS vector (AV:N/AC:H/PR:H/UI:N) constrains realistic risk significantly: exploitation requires both high privilege and high attack complexity, meaning this is not an opportunistic or mass-exploitable weakness. The vulnerability functions primarily as a reconnaissance enabler for chaining into separate, more severe attacks; no public exploit or active exploitation has been identified at time of analysis.
Reflected cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows remote, unauthenticated attackers to inject arbitrary JavaScript into a victim's browser by manipulating the `day` parameter in `/BSIS.php`. The CVSS 4.0 score of 2.1 reflects constrained real-world impact — user interaction is required and integrity impact is low — though a public proof-of-concept has been disclosed via a GitHub issue, confirming exploitability. No active exploitation has been confirmed via CISA KEV.
Cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows remote attackers to inject arbitrary JavaScript into victim browsers by manipulating the `day` argument in /class.php, requiring only passive user interaction (UI:P). Publicly available exploit code exists per VulDB submission and a referenced GitHub proof-of-concept issue, though no CISA KEV listing has been issued. The CVSS 4.0 score of 2.1 reflects the narrow impact profile — limited integrity effect on the vulnerable system only, with no confidentiality or availability consequences recorded.
Cross-site scripting in Home Assistant Core's Shelly integration allows an attacker who controls a Shelly device to execute arbitrary JavaScript in the Home Assistant web origin. The `async_get_media_image()` method fetches the device's `thumb` field without validating that the returned content is an image MIME type, permitting a malicious `data:text/html` URI to be proxied and re-served by the HA backend with `Content-Type: text/html` to the victim's browser. Exploitation is conditional on attacker control of an integrated Shelly device and requires active user interaction; no CISA KEV listing or public proof-of-concept exists at time of analysis, but successful exploitation grants access to session tokens and authenticated control of locks, alarms, and covers.
Integrity compromise in Oracle E-Business Intelligence (component: Definition) affects versions 12.2.3 through 12.2.15, disclosed as part of Oracle's Critical Patch Update July 2026. A network-accessible, high-privileged attacker who can also induce victim interaction may perform unauthorized insert, update, or delete operations on a subset of accessible E-Business Intelligence data. The CVSS base score of 2.0 reflects the highly constrained exploitation requirements: high attack complexity, high privilege level, and mandatory user interaction, all of which drastically limit real-world exploitation probability. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Limited unauthorized data read in Oracle EDI Gateway (E-Business Suite versions 12.2.3-12.2.15) requires a high-privileged attacker with local logon access to the underlying infrastructure, combined with difficult exploitation conditions, to access a subset of EDI data without authorization. The confidentiality impact is narrow and no integrity or availability impact is present. No public exploit code or active exploitation has been identified at time of analysis; Oracle disclosed this via the July 2026 Critical Patch Update.
Oracle Property Manager versions 12.2.3 through 12.2.15 within Oracle E-Business Suite exposes a low-severity information disclosure flaw in the Internal Operations component that allows a highly privileged local attacker to read an unauthorized subset of Property Manager data under difficult exploitation conditions. The CVSS 3.1 score of 1.9 reflects the combined constraints of local infrastructure access, high privilege prerequisites, and high attack complexity, resulting in only partial confidentiality impact with no integrity or availability exposure. No public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis; this is addressed in Oracle's Critical Patch Update for July 2026.
Oracle Production Scheduling (E-Business Suite component) exposes an integrity-only vulnerability exploitable exclusively by high-privileged local attackers on the hosting infrastructure, across versions 12.2.3 through 12.2.15. Successful exploitation permits unauthorized write operations - insert, update, or delete - against a subset of the scheduling module's data, with no confidentiality or availability impact. No public exploit code exists and the vulnerability is not listed in CISA KEV; the extremely low CVSS score of 1.9 reflects the steep exploitation barrier imposed by local access and high privilege prerequisites.
Oracle Inventory Management within Oracle E-Business Suite 12.2.3 through 12.2.15 is susceptible to a local, highly constrained partial denial-of-service condition affecting only availability. Exploitation requires an already highly privileged attacker with direct logon access to the underlying infrastructure hosting the application, combined with high attack complexity, making successful exploitation extremely difficult in practice. No public exploit code or active exploitation has been identified; the CVSS score of 1.9 reflects the minimal real-world risk posed by this vulnerability.
Physical-access data disclosure in Oracle Siebel CRM Integration's Event Publish and Subscribe component exposes a subset of CRM data under conditions requiring physical proximity, high privileges, and difficult exploit circumstances (CVSS 1.9). Versions 17.0 through 26.4 are affected, and a scope change in the CVSS vector signals that a successful attack may also read data from additional products beyond the Integration component itself. No public exploit code exists and this CVE does not appear in the CISA KEV catalog; real-world risk is negligible outside of insider-threat or physical-intrusion scenarios.
Limited local data disclosure in Oracle Work in Process (E-Business Suite component: Internal Operations) versions 12.2.3 through 12.2.15 allows a high-privileged attacker with local infrastructure access to read a subset of accessible data under difficult exploitation conditions. The CVSS 3.1 base score of 1.9 reflects an extremely constrained attack surface - local vector, high complexity, and high privilege requirements combine to make this one of the lowest-severity issues addressed in the Oracle CPU July 2026 advisory. No public exploit identified at time of analysis, and no active exploitation has been reported.
Path traversal in BuildKit's low-level build API allows crafted messages to redirect the container rootfs file-deletion action onto the real host /tmp directory, wiping its contents. All published moby/buildkit versions are affected per the broad CPE cpe:2.3:a:moby:buildkit:*:*:*:*:*:*:*:*. No public exploit code or active exploitation has been identified at time of analysis; the vendor-assigned CVSS score of 3.3 (CVSS 4.0) correctly reflects a constrained impact - host /tmp destruction rather than arbitrary code execution or credential exposure.