Unauthorized critical-data access and partial denial of service in Oracle Product Lifecycle Analytics 3.6.1 (Supply Chain suite, Installation Issues component) allows a remote, unauthenticated attacker over HTTP to fully read all data the application can access and partially disrupt service. The flaw carries a scope change, so successful attacks may significantly impact adjacent Oracle products beyond the analytics component itself. Rated CVSS 3.1 9.3 (Critical); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Scope-changing information disclosure and data tampering in Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 lets an unauthenticated network attacker who lures a victim into a single interaction read or alter all data the product can access. Rated CVSS 3.1 9.3 (C:H/I:H, scope change), the flaw is dangerous because compromise can spill into other integrated Oracle Fusion Middleware products, though availability is unaffected. No public exploit identified at time of analysis and it is not on CISA KEV, so exploitation is currently theoretical but the criticality warrants prompt patching.
Unauthorized data compromise in Oracle Coherence (Oracle Fusion Middleware Core component) lets an unauthenticated network attacker read and modify all Coherence-accessible data and impact additional products through a scope change, provided a legitimate user is tricked into a required interaction. It affects supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, carries an Oracle CVSS 3.1 base score of 9.3, and has no public exploit identified at time of analysis. Fixes ship in the Oracle July 2026 Critical Patch Update.
Unauthorized data compromise in Oracle PeopleSoft Enterprise SCM eProcurement 9.2 (Manage Requisition Status component) lets a remote, unauthenticated attacker read all module-accessible data and perform limited updates over HTTP, with a scope change that can significantly impact additional connected products. Rated CVSS 3.1 9.3 (Critical) and tagged as an authentication bypass, the flaw is easily exploitable without user interaction. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Cross-scope compromise of Oracle WebCenter Content (Content Server component) in Fusion Middleware releases 12.2.1.4.0 and 14.1.2.0.0 lets a remote, unauthenticated attacker read and tamper with all Content Server data and pivot into other connected products. Exploitation is network-based over HTTP and requires luring a victim to trigger the attack (UI:R), with a resulting CVSS 3.1 score of 9.3 driven by a scope change and High confidentiality/integrity impact. No public exploit identified at time of analysis; this entry is disclosed via Oracle's July 2026 Critical Patch Update and is not listed in CISA KEV.
Privilege escalation in SolarWinds Serv-U allows an authenticated domain administrator account to abuse an insecure direct object reference (IDOR) and elevate to a system administrator, ultimately executing commands as the root user on the underlying host. The flaw affects Serv-U file transfer server deployments, with a reduced impact on Windows installations, and carries a CVSS 9.1 rating driven by a scope change from application admin to OS-level root. There is no public exploit identified at time of analysis and no CISA KEV listing, but SolarWinds self-reported and shipped a fix in the Serv-U 2026-3 release.
Cross-site request forgery in djangoSIGE through 1.10 enables unauthenticated remote attackers to cancel sales quotations, sales orders, purchase quotations, and purchase orders on behalf of authenticated users with order-management permissions, with no public exploit identified at time of analysis per KEV, though a publicly available exploit exists. The vulnerability stems from business-critical state-changing operations (CancelarOrcamentoVendaView, CancelarPedidoVendaView, CancelarOrcamentoCompraView, CancelarPedidoCompraView) being implemented inside HTTP GET handlers, which Django's CsrfViewMiddleware explicitly exempts from CSRF token enforcement. An upstream fix is available via GitHub PR #163 (GET-to-POST method migration), but a patched tagged release version has not been independently confirmed.
Full compromise of Oracle Coherence (Fusion Middleware Core component) is possible by an unauthenticated attacker who holds a local logon on the host where Coherence runs, per Oracle's July 2026 Critical Patch Update. The flaw scores CVSS 9.3 because a successful attack yields complete confidentiality, integrity, and availability loss and, via a scope change, can significantly impact additional products beyond Coherence itself. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle rates it 'easily exploitable.'
Sandbox escape in the Chromecast component of Google Chrome before 150.0.7871.182 lets a local attacker corrupt memory through an integer overflow (CWE-190) triggered by crafted network traffic, potentially breaking out of the renderer sandbox to gain broader access on the host. Google rated the Chromium severity High, and the CVSS score is 9.3 driven by the scope change from a sandbox escape. There is no public exploit identified at time of analysis, EPSS exploitation probability is very low (0.10%), and CISA SSVC marks exploitation as none.
Path-traversal to remote code execution in Home Assistant Core before 2026.6.0 lets an authenticated user who can supply a backup archive overwrite arbitrary files on the host. The backup-restore routine trusts a tar SYMTYPE (symlink) entry whose linkname is an absolute path outside the extraction directory, then writes a following regular-file entry through that unvalidated symlink; because the official Docker image runs the process as root, an attacker can drop code into auto-imported Python paths (e.g. site-packages/sitecustomize.py) and gain code execution. Reported by VulnCheck with a vendor patch available (2026.6.0); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Stored cross-site scripting in the Ninja Forms WordPress plugin (versions 3.10.4 through 3.14.9) lets unauthenticated visitors persist script payloads through the Repeatable Fieldset feature that later execute in an administrator's browser when they review form submissions. Because it requires no authentication and fires inside a privileged admin session, a successful hit can lead to admin-account takeover, malicious plugin installation, and full site compromise. No public exploit identified at time of analysis, though the flaw was reported by VulnCheck and a vendor patch is available; the CVSS 4.0 base score is 9.3 (Critical).
Remote code execution in Grav CMS 2.0.4 (fixed in 2.0.7) lets an authenticated user holding the admin.pages or api.pages.write permission plant a malicious Class::method callable directive in page frontmatter, which Blueprint::dynamicData() feeds unfiltered into call_user_func_array(). The injected command then executes as the web-server user for any subsequent visitor to the page, including unauthenticated ones. Reported by VulnCheck (CWE-94, CVSS 4.0 base 9.3); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Server-side request forgery in Weaviate's Verba (GoldenVerba) RAG application version 2.1.3 lets unauthenticated remote attackers coerce the server into issuing arbitrary outbound HTTP GET requests. The flaw stems from a same-origin middleware bypass: any Origin header prefixed with a single quote defeats the localhost origin check, after which attacker-supplied host and port values passed to the /api/connect endpoint are fetched by the server. No public exploit code exists, but a detailed VulnCheck advisory and a third-party technical write-up document the exact bypass; there is no CISA KEV listing and EPSS was not provided.
Server-side request forgery in Verba (Weaviate's open-source RAG application) version 2.1.3 lets unauthenticated attackers coerce the backend into issuing arbitrary HTTP GET requests to attacker-chosen URLs. By connecting to the unauthenticated /ws/import_files WebSocket endpoint and supplying a malicious URL in the HTMLReader configuration, an attacker can reach internal-only services such as co-located databases or cloud instance metadata endpoints to harvest credentials. No public exploit code has been identified at time of analysis, though a detailed technical disclosure exists; the CVSS 4.0 base score is 9.2 (Critical).
Server-side request forgery in Keep (keephq/keep) as of commit 91c75e0 lets unauthenticated attackers coerce the backend into issuing arbitrary outbound HTTP requests by POSTing a crafted host value to an unprotected providers healthcheck endpoint. Because the endpoint requires no authentication, a remote attacker can pivot into internal services and cloud metadata endpoints (e.g. 169.254.169.254) to steal cloud credentials and map internal networks. No public exploit identified at time of analysis, though the flaw was reported by VulnCheck and a corresponding GitHub issue is public; the CVSS 4.0 base score is 9.2 (Critical).
Privilege-scoped remote code execution in SolarWinds Serv-U managed file transfer server stems from an insecure direct object reference that lets an authenticated domain administrator reference objects outside their intended authorization boundary to run code on the host. The flaw carries a 9.1 CVSS due to network reach, scope change, and full confidentiality/integrity/availability impact, though the practical bar is high because domain administrator access is a prerequisite, and impact is reduced on Windows deployments. No public exploit is identified at time of analysis and it is not listed in CISA KEV.
Privilege-to-root remote code execution in SolarWinds Serv-U managed file transfer server stems from an insecure direct object reference (CWE-639) that an authenticated domain administrator with read/write access to the home directory can abuse to execute code as root on the underlying host. The CVSS 3.1 score of 9.1 reflects a scope change from application-admin context to full OS compromise, with the impact explicitly noted as lower on Windows deployments. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, so this is a high-severity but authentication-gated flaw rather than a mass-exploitable unauthenticated bug.
Remote code execution in SolarWinds Serv-U managed file transfer/FTP server allows an attacker to run arbitrary code remotely, executing as root on Unix/Linux deployments while impact is reduced on Windows. The flaw stems from an access-control weakness (CWE-284) and is corroborated by a vendor 'Authentication Bypass' tag, carrying a CVSS 9.1 (scope-changed) rating. No public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation is currently theoretical rather than confirmed.
Privilege escalation to remote code execution as root in SolarWinds Serv-U stems from an insecure direct object reference (IDOR) that lets an authenticated group administrator manipulate object references beyond their authority. The flaw carries a CVSS 9.1 rating because a scope change allows a lower-tier admin to fully compromise the underlying host on Linux/Unix, though impact is reduced on Windows deployments. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the high privilege prerequisite (group admin) is realistic in multi-tenant MFT environments.
Unauthenticated data compromise and denial of service in Oracle Commerce Guided Search Platform Services 11.4.0 (Forge component) lets a remote attacker send crafted HTTP requests to read all data accessible to the service and to crash or hang it completely. Rated CVSS 3.1 9.1 (Critical) with high confidentiality and availability impact and no integrity impact; disclosed in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis, but the combination of network reachability, no authentication, and low complexity makes it an urgent patch priority.
Unauthenticated remote compromise of Oracle Net Services affects Oracle Database Server versions 19.3-19.31, 21.3-21.22, and 23.4.0-23.26.2, letting a network attacker reaching the database listener over Oracle Net (typically TCP 1521) read all data accessible to the component and hang or repeatedly crash it for a complete denial of service. Rated CVSS 3.1 9.1 with high confidentiality and availability impact and no integrity impact, it requires no authentication or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and network-facing nature make it a high remediation priority.
Full takeover of Oracle PeopleSoft Enterprise HCM Global Payroll Switzerland 9.2 is possible via network-facing HTTP by an attacker who already holds high application privileges, per Oracle's July 2026 Critical Patch Update. Because the flaw carries a scope change, successful attacks can reach beyond the Global Payroll Switzerland component into additional PeopleSoft products, yielding full confidentiality, integrity, and availability loss. No public exploit identified at time of analysis, but the low attack complexity (CVSS 9.1) makes it a priority patch for organizations running this payroll module.
Account takeover in SolarWinds Serv-U managed file transfer server lets an authenticated user access and hijack other users' accounts through an insecure direct object reference (CWE-639), where user-controlled identifiers are not properly authorization-checked. Any valid low-effort authenticated session can be leveraged to reach objects belonging to other accounts, with the vendor noting reduced impact on Windows deployments (implying greater exposure on non-Windows/Linux installs). No public exploit has been identified at time of analysis; the issue was reported by SolarWinds and is fixed in the Serv-U 2026-3 release.
Data tampering and denial of service in Oracle Hospitality Simphony (POS component) versions 19.8-19.8.5, 19.9-19.9.3 and 19.10 allow a remote unauthenticated attacker to compromise the point-of-sale platform over HTTP. Successful attacks can create, delete or modify all Simphony-accessible critical data and can hang or repeatedly crash the service for a complete denial of service. Rated CVSS 3.1 9.1 with no confidentiality impact; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote unauthenticated compromise of Oracle WebLogic Server (Fusion Middleware Core component) lets network attackers read, create, delete, or modify any server-accessible data over HTTP. Tagged as an authentication bypass and scored CVSS 3.1 9.1, it affects supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 and was disclosed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the trivial exploitability (AC:L/PR:N/UI:N) makes it a high-priority patch for internet-facing deployments.
Privilege escalation to root/code execution in SolarWinds Serv-U (managed/secure file transfer server) arises from a broken access control flaw that grants arbitrary file read and write on the host. An attacker already holding domain administrator access can abuse this to overwrite privileged files and run code as root, with reduced impact on Windows installations. Reported by SolarWinds with no public exploit identified at time of analysis, though the 9.1 CVSS reflects the high confidentiality, integrity, and availability impact once the precondition is met.
Privilege escalation in SolarWinds Serv-U lets an authenticated group member elevate their access to system administrator and execute code as root on Linux/Unix deployments, with reduced impact on Windows. The root cause is improper authorization (CWE-285) reachable over the network; the vendor rates it CVSS 9.1 due to a scope change and full CIA impact, but there is no public exploit identified at time of analysis and it is not in CISA KEV. Fixed in the Serv-U 2026-3 release.
Unauthenticated remote compromise of Oracle Identity Manager (OIM Legacy UI component) in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0 allows attackers with only network/HTTP access to read, create, delete, or modify any data the identity platform can reach. Tagged by the reporter as an authentication bypass, this flaw carries a CVSS 9.1 rating driven by high confidentiality and integrity impact, and because OIM governs enterprise identity and account provisioning, a successful attack effectively hands over control of user identity data. There is no public exploit identified at time of analysis and this CVE is not listed in CISA KEV.
Unauthenticated remote compromise of Oracle Agile Product Lifecycle Management for Process 6.2.4 (Product Quality Management component) lets network attackers read, create, modify, or delete all data accessible to the application over HTTP. Oracle rates it 'easily exploitable' with a CVSS 3.1 base score of 9.1 driven by full confidentiality and integrity impact, and community tagging labels it an authentication bypass. No public exploit identified at time of analysis, and it is not listed in CISA KEV; no EPSS score was provided.
Unauthenticated data compromise in Oracle Agile PLM 9.3.6 (Security component) allows a remote attacker with only HTTP network access to read, create, delete, or modify all data accessible to the application. The flaw is tagged as an authentication bypass and carries a CVSS 3.1 base score of 9.1; no public exploit identified at time of analysis, and it is not listed in CISA KEV. It was reported by Oracle's own security team and addressed in the Oracle July 2026 Critical Patch Update.
Unauthenticated data compromise in Oracle Commerce Guided Search Platform Services 11.4.0 (Forge component) allows remote attackers over HTTPS to read, create, modify, or delete all data accessible to the service without any credentials. Oracle rates this CVSS 9.1 with high confidentiality and integrity impact and characterizes it as 'easily exploitable,' and the intelligence tags flag an authentication-bypass class issue. No public exploit code has been identified and it is not listed in CISA KEV at time of analysis.
Authentication bypass in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Experience Manager component) allows a remote, unauthenticated attacker to read and modify all data accessible to the application over HTTP. The flaw carries a CVSS 3.1 base score of 9.1 (high confidentiality and integrity impact, no availability impact) and is easily exploitable per Oracle. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low-complexity, no-privileges vector makes it a high-priority patch.
Unauthenticated data compromise in Oracle PeopleSoft Enterprise SCM Order Management 9.2 (Security component) lets remote attackers read, create, modify, or delete all data accessible to the application over HTTP. Tagged as an authentication bypass, the flaw carries a CVSS 3.1 base score of 9.1 with high confidentiality and integrity impact but no availability impact, and was disclosed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated data compromise in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 (Fusion Middleware Web Content Management component) lets a remote attacker read, create, delete, or modify all data accessible to the product over HTTP with no credentials or user interaction. Oracle rates it CVSS 9.1 (C:H/I:H) and vendor tags describe it as an authentication bypass, making it a high-priority patch from the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data compromise in Oracle PeopleSoft Enterprise CC Common Application Objects 9.2 allows a remote, unauthenticated attacker to read, create, modify, or delete critical application data over HTTP. The flaw is tagged as an authentication bypass and carries a CVSS 3.1 base score of 9.1 (high confidentiality and integrity impact, no availability impact), making it easily exploitable without user interaction. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and lack of authentication make it a high-priority patching target.
Data compromise in Oracle Coherence (Oracle Fusion Middleware Core component) lets an unauthenticated attacker with network access via TLS read, create, delete, or modify all Coherence-accessible data. Oracle rates it 9.1 (CVSS 3.1) with high confidentiality and integrity impact but no availability impact, and the intelligence tags flag it as an authentication bypass. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote unauthenticated compromise of Oracle Commerce Platform 11.4.0 (Dynamo Application Framework component) lets a network attacker reach sensitive data and knock the service offline over HTTP. With no authentication or user interaction required and a CVSS 3.1 base of 9.1, a successful attack yields access to all Commerce Platform-accessible data plus a complete, repeatable denial of service. Disclosed in Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege escalation in SolarWinds Serv-U file transfer server arises from an insecure direct object reference (IDOR) that lets an actor already holding domain administrator access reference and manipulate objects across an authorization boundary. The flaw is fixed in the Serv-U 2026-3 release and has no public exploit identified at time of analysis; SolarWinds itself reported it. Impact is reduced in Windows deployments, which tempers real-world severity despite the 9.1 CVSS score.
Account takeover in SolarWinds Serv-U is enabled by an insecure direct object reference (IDOR) that lets an authenticated user hijack the SMTP/email flow and seize arbitrary accounts, per SolarWinds' own advisory. Because the flaw crosses a trust boundary (CVSS scope-changed) with high confidentiality, integrity, and availability impact, a single privileged account can be leveraged against other users' accounts; Windows deployments are described by the vendor as lower-impact. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Privilege escalation in SolarWinds Serv-U managed file transfer server allows an existing domain administrator to elevate their Serv-U account from a standard user type to a full system administrator, granting complete control over the file transfer service and its data. The flaw stems from missing authorization (CWE-862) and carries a CVSS 9.1 rating, driven by a scope change and high confidentiality, integrity, and availability impact. SolarWinds notes the impact is lower in Windows deployments, and there is no public exploit identified at time of analysis.
Privilege escalation in SolarWinds Serv-U managed file transfer allows a user holding domain administrator privileges to create Serv-U system administrator accounts, crossing an authorization boundary the product is expected to enforce independently. Tracked as CVE-2026-28309 (CWE-862, Missing Authorization) and reported by SolarWinds, it carries a 9.1 CVSS due to scope change and full C/I/A impact, though the vendor notes the impact is lower in Windows deployments. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege escalation in SolarWinds Serv-U allows an authenticated member of a domain user group to be elevated into an administrator group, granting full administrative control over the managed file transfer server. The flaw stems from improper access control (CWE-284) and carries a vendor CVSS of 9.1 due to a scope change and full confidentiality, integrity, and availability impact, though SolarWinds notes the impact is lower on Windows deployments. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege escalation in SolarWinds Serv-U allows a domain administrator to elevate to a full Serv-U system administrator, granting complete control over the managed file transfer server and its data (CVSS 9.1, CWE-284 improper access control). Exploitation requires existing domain-administrator privileges (PR:H) but no user interaction, and the vendor notes the impact is reduced on Windows deployments, implying non-Windows (Linux) installs are more severely affected. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so this is a defense-in-depth priority rather than a confirmed active threat.
Authentication bypass in Oracle Access Manager (Oracle Fusion Middleware, Authentication Engine) versions 12.2.1.4.0 and 14.1.2.1.0 allows a remote, unauthenticated attacker to read and modify all data accessible to the product via crafted HTTP requests. Rated CVSS 3.1 9.1 with high confidentiality and integrity impact, the flaw was disclosed by Oracle in the July 2026 Critical Patch Update; there is no public exploit identified at time of analysis, and the low attack complexity plus no-privilege/no-interaction requirements make it a top-priority patch for any Oracle IAM deployment.
Unauthenticated data compromise in Oracle PeopleSoft Enterprise FIN Manufacturing Argentina 9.1 (Manufacturing component) lets a remote attacker read, create, modify, or delete all data accessible to the module over HTTP with no credentials. Oracle rates it CVSS 3.1 9.1 (Confidentiality and Integrity High, Availability None); it was disclosed in the Oracle Critical Patch Update of July 2026 and carries an 'Authentication Bypass' tag. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data compromise in Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 (eProcurement component) allows a remote, unauthenticated attacker over HTTP to read, create, delete, or modify all data accessible to the module. The CVSS 3.1 base score is 9.1 (C:H/I:H, no availability impact) and the flaw is described by Oracle as easily exploitable, with an "Authentication Bypass" tag reinforcing the PR:N vector. No public exploit is identified at time of analysis and it is not listed in CISA KEV; a fix ships in the Oracle Critical Patch Update of July 2026.
Unauthenticated data compromise in Oracle Identity Manager (Fusion Middleware, OIM Legacy UI component) versions 12.2.1.4.0 and 14.1.2.1.0 lets remote attackers read and modify all OIM-accessible data over HTTP. Tagged as an authentication bypass, the flaw carries a CVSS 9.1 and was addressed in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis.
Unauthenticated compromise of Oracle HTTP Server 12.2.1.4.0 and 14.1.2.0.0 (a Fusion Middleware component) is possible over the network via HTTP against the mod_ssl module, letting a remote attacker read, create, delete or modify all server-accessible data. Rated CVSS 3.1 9.1 with high confidentiality and integrity impact but no availability impact, and tagged as an authentication bypass. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability (AV:N/AC:L/PR:N/UI:N) makes it a high-priority patch.
Full takeover of the Oracle Applications Framework (Web Utilities component) is possible in Oracle E-Business Suite 12.2.8 through 12.2.15, where a high-privileged attacker with HTTP network access can compromise confidentiality, integrity, and availability. Oracle rates it CVSS 9.1 largely because the scope-changed impact extends beyond the framework to additional bundled EBS products. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but it was fixed in Oracle's July 2026 Critical Patch Update.
Unauthenticated media upload in the Membership Pro subscription extension for Joomla (all versions 1.0 through 4.6.1) lets remote attackers push arbitrary media assets to the server without any account or login, due to an insecure default configuration. The flaw carries a CVSS 9.1 rating and CISA's SSVC framework marks it as automatable with total technical impact, but there is no public exploit identified at time of analysis and it is not listed in CISA KEV. It is fixed in version 4.6.2.