Remote unauthenticated compromise of Oracle WebLogic Server (Fusion Middleware Core component) lets network attackers read, create, delete, or modify any server-accessible data over HTTP. Tagged as an authentication bypass and scored CVSS 3.1 9.1, it affects supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 and was disclosed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the trivial exploitability (AC:L/PR:N/UI:N) makes it a high-priority patch for internet-facing deployments.
Privilege escalation to root/code execution in SolarWinds Serv-U (managed/secure file transfer server) arises from a broken access control flaw that grants arbitrary file read and write on the host. An attacker already holding domain administrator access can abuse this to overwrite privileged files and run code as root, with reduced impact on Windows installations. Reported by SolarWinds with no public exploit identified at time of analysis, though the 9.1 CVSS reflects the high confidentiality, integrity, and availability impact once the precondition is met.
Privilege escalation in SolarWinds Serv-U lets an authenticated group member elevate their access to system administrator and execute code as root on Linux/Unix deployments, with reduced impact on Windows. The root cause is improper authorization (CWE-285) reachable over the network; the vendor rates it CVSS 9.1 due to a scope change and full CIA impact, but there is no public exploit identified at time of analysis and it is not in CISA KEV. Fixed in the Serv-U 2026-3 release.
Unauthenticated remote compromise of Oracle Identity Manager (OIM Legacy UI component) in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0 allows attackers with only network/HTTP access to read, create, delete, or modify any data the identity platform can reach. Tagged by the reporter as an authentication bypass, this flaw carries a CVSS 9.1 rating driven by high confidentiality and integrity impact, and because OIM governs enterprise identity and account provisioning, a successful attack effectively hands over control of user identity data. There is no public exploit identified at time of analysis and this CVE is not listed in CISA KEV.
Unauthenticated remote compromise of Oracle Agile Product Lifecycle Management for Process 6.2.4 (Product Quality Management component) lets network attackers read, create, modify, or delete all data accessible to the application over HTTP. Oracle rates it 'easily exploitable' with a CVSS 3.1 base score of 9.1 driven by full confidentiality and integrity impact, and community tagging labels it an authentication bypass. No public exploit identified at time of analysis, and it is not listed in CISA KEV; no EPSS score was provided.
Unauthenticated data compromise in Oracle Agile PLM 9.3.6 (Security component) allows a remote attacker with only HTTP network access to read, create, delete, or modify all data accessible to the application. The flaw is tagged as an authentication bypass and carries a CVSS 3.1 base score of 9.1; no public exploit identified at time of analysis, and it is not listed in CISA KEV. It was reported by Oracle's own security team and addressed in the Oracle July 2026 Critical Patch Update.
Unauthenticated data compromise in Oracle Commerce Guided Search Platform Services 11.4.0 (Forge component) allows remote attackers over HTTPS to read, create, modify, or delete all data accessible to the service without any credentials. Oracle rates this CVSS 9.1 with high confidentiality and integrity impact and characterizes it as 'easily exploitable,' and the intelligence tags flag an authentication-bypass class issue. No public exploit code has been identified and it is not listed in CISA KEV at time of analysis.
Authentication bypass in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Experience Manager component) allows a remote, unauthenticated attacker to read and modify all data accessible to the application over HTTP. The flaw carries a CVSS 3.1 base score of 9.1 (high confidentiality and integrity impact, no availability impact) and is easily exploitable per Oracle. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low-complexity, no-privileges vector makes it a high-priority patch.
Unauthenticated data compromise in Oracle PeopleSoft Enterprise SCM Order Management 9.2 (Security component) lets remote attackers read, create, modify, or delete all data accessible to the application over HTTP. Tagged as an authentication bypass, the flaw carries a CVSS 3.1 base score of 9.1 with high confidentiality and integrity impact but no availability impact, and was disclosed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated data compromise in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 (Fusion Middleware Web Content Management component) lets a remote attacker read, create, delete, or modify all data accessible to the product over HTTP with no credentials or user interaction. Oracle rates it CVSS 9.1 (C:H/I:H) and vendor tags describe it as an authentication bypass, making it a high-priority patch from the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data compromise in Oracle PeopleSoft Enterprise CC Common Application Objects 9.2 allows a remote, unauthenticated attacker to read, create, modify, or delete critical application data over HTTP. The flaw is tagged as an authentication bypass and carries a CVSS 3.1 base score of 9.1 (high confidentiality and integrity impact, no availability impact), making it easily exploitable without user interaction. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and lack of authentication make it a high-priority patching target.
Data compromise in Oracle Coherence (Oracle Fusion Middleware Core component) lets an unauthenticated attacker with network access via TLS read, create, delete, or modify all Coherence-accessible data. Oracle rates it 9.1 (CVSS 3.1) with high confidentiality and integrity impact but no availability impact, and the intelligence tags flag it as an authentication bypass. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote unauthenticated compromise of Oracle Commerce Platform 11.4.0 (Dynamo Application Framework component) lets a network attacker reach sensitive data and knock the service offline over HTTP. With no authentication or user interaction required and a CVSS 3.1 base of 9.1, a successful attack yields access to all Commerce Platform-accessible data plus a complete, repeatable denial of service. Disclosed in Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege escalation in SolarWinds Serv-U file transfer server arises from an insecure direct object reference (IDOR) that lets an actor already holding domain administrator access reference and manipulate objects across an authorization boundary. The flaw is fixed in the Serv-U 2026-3 release and has no public exploit identified at time of analysis; SolarWinds itself reported it. Impact is reduced in Windows deployments, which tempers real-world severity despite the 9.1 CVSS score.
Account takeover in SolarWinds Serv-U is enabled by an insecure direct object reference (IDOR) that lets an authenticated user hijack the SMTP/email flow and seize arbitrary accounts, per SolarWinds' own advisory. Because the flaw crosses a trust boundary (CVSS scope-changed) with high confidentiality, integrity, and availability impact, a single privileged account can be leveraged against other users' accounts; Windows deployments are described by the vendor as lower-impact. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Privilege escalation in SolarWinds Serv-U managed file transfer server allows an existing domain administrator to elevate their Serv-U account from a standard user type to a full system administrator, granting complete control over the file transfer service and its data. The flaw stems from missing authorization (CWE-862) and carries a CVSS 9.1 rating, driven by a scope change and high confidentiality, integrity, and availability impact. SolarWinds notes the impact is lower in Windows deployments, and there is no public exploit identified at time of analysis.
Privilege escalation in SolarWinds Serv-U managed file transfer allows a user holding domain administrator privileges to create Serv-U system administrator accounts, crossing an authorization boundary the product is expected to enforce independently. Tracked as CVE-2026-28309 (CWE-862, Missing Authorization) and reported by SolarWinds, it carries a 9.1 CVSS due to scope change and full C/I/A impact, though the vendor notes the impact is lower in Windows deployments. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege escalation in SolarWinds Serv-U allows an authenticated member of a domain user group to be elevated into an administrator group, granting full administrative control over the managed file transfer server. The flaw stems from improper access control (CWE-284) and carries a vendor CVSS of 9.1 due to a scope change and full confidentiality, integrity, and availability impact, though SolarWinds notes the impact is lower on Windows deployments. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege escalation in SolarWinds Serv-U allows a domain administrator to elevate to a full Serv-U system administrator, granting complete control over the managed file transfer server and its data (CVSS 9.1, CWE-284 improper access control). Exploitation requires existing domain-administrator privileges (PR:H) but no user interaction, and the vendor notes the impact is reduced on Windows deployments, implying non-Windows (Linux) installs are more severely affected. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so this is a defense-in-depth priority rather than a confirmed active threat.
Authentication bypass in Oracle Access Manager (Oracle Fusion Middleware, Authentication Engine) versions 12.2.1.4.0 and 14.1.2.1.0 allows a remote, unauthenticated attacker to read and modify all data accessible to the product via crafted HTTP requests. Rated CVSS 3.1 9.1 with high confidentiality and integrity impact, the flaw was disclosed by Oracle in the July 2026 Critical Patch Update; there is no public exploit identified at time of analysis, and the low attack complexity plus no-privilege/no-interaction requirements make it a top-priority patch for any Oracle IAM deployment.
Unauthenticated data compromise in Oracle PeopleSoft Enterprise FIN Manufacturing Argentina 9.1 (Manufacturing component) lets a remote attacker read, create, modify, or delete all data accessible to the module over HTTP with no credentials. Oracle rates it CVSS 3.1 9.1 (Confidentiality and Integrity High, Availability None); it was disclosed in the Oracle Critical Patch Update of July 2026 and carries an 'Authentication Bypass' tag. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data compromise in Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 (eProcurement component) allows a remote, unauthenticated attacker over HTTP to read, create, delete, or modify all data accessible to the module. The CVSS 3.1 base score is 9.1 (C:H/I:H, no availability impact) and the flaw is described by Oracle as easily exploitable, with an "Authentication Bypass" tag reinforcing the PR:N vector. No public exploit is identified at time of analysis and it is not listed in CISA KEV; a fix ships in the Oracle Critical Patch Update of July 2026.
Unauthenticated data compromise in Oracle Identity Manager (Fusion Middleware, OIM Legacy UI component) versions 12.2.1.4.0 and 14.1.2.1.0 lets remote attackers read and modify all OIM-accessible data over HTTP. Tagged as an authentication bypass, the flaw carries a CVSS 9.1 and was addressed in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis.
Unauthenticated compromise of Oracle HTTP Server 12.2.1.4.0 and 14.1.2.0.0 (a Fusion Middleware component) is possible over the network via HTTP against the mod_ssl module, letting a remote attacker read, create, delete or modify all server-accessible data. Rated CVSS 3.1 9.1 with high confidentiality and integrity impact but no availability impact, and tagged as an authentication bypass. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability (AV:N/AC:L/PR:N/UI:N) makes it a high-priority patch.
Full takeover of the Oracle Applications Framework (Web Utilities component) is possible in Oracle E-Business Suite 12.2.8 through 12.2.15, where a high-privileged attacker with HTTP network access can compromise confidentiality, integrity, and availability. Oracle rates it CVSS 9.1 largely because the scope-changed impact extends beyond the framework to additional bundled EBS products. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but it was fixed in Oracle's July 2026 Critical Patch Update.
Unauthenticated media upload in the Membership Pro subscription extension for Joomla (all versions 1.0 through 4.6.1) lets remote attackers push arbitrary media assets to the server without any account or login, due to an insecure default configuration. The flaw carries a CVSS 9.1 rating and CISA's SSVC framework marks it as automatable with total technical impact, but there is no public exploit identified at time of analysis and it is not listed in CISA KEV. It is fixed in version 4.6.2.
Memory corruption in the Audio/Video Gecko Media Plugin (GMP) component of Mozilla Firefox lets remote attackers trigger a buffer overflow through crafted media content, which per CVSS can disclose sensitive process memory and corrupt process state (C:H/I:H). The flaw affects Firefox before 153 and the ESR 115.x and 140.x branches; Mozilla shipped fixes in Firefox 153, ESR 115.38, and ESR 140.13. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the 9.1 CVSS reflects an unauthenticated, network-reachable memory-safety bug in a core browser subsystem.
Security mitigation bypass in the Networking component of Mozilla Firefox before version 153 lets remote attackers defeat a built-in protection mechanism, carrying high confidentiality and integrity impact per the CVSS 9.1 rating. The flaw was reported and fixed by Mozilla in Firefox 153 (advisory MFSA2026-68) and is classified under CWE-693 (Protection Mechanism Failure), with tags indicating an authentication/authorization bypass. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Protection mechanism failure in the DOM: Security component of Mozilla Firefox lets remote attackers bypass a browser security mitigation, undermining defenses that isolate web content and enforce origin/policy boundaries. Mozilla rates this Critical (CVSS 9.1) with high confidentiality and integrity impact and no authentication or user interaction required per the assigned vector; it is corrected in Firefox 153 (MFSA 2026-68). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege-abusing compromise of the Oracle Enterprise Manager Base Platform UI Framework lets a low-privileged, network-adjacent attacker read all EM-accessible data and partially tamper with or degrade the platform over HTTPS. The scope-changing flaw (CVSS 9.1) means a successful attack can spill beyond EM into other managed products, and Oracle's own tags flag authentication-bypass and denial-of-service behavior. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and network vector make it a high patch priority.
Broken authorization in Gitea (self-hosted Git server) versions before 1.27.0 lets a token scoped as public-only,write:repository push commits into a private pull-request head branch it should never touch. Because Gitea only evaluates the public-only restriction against the public base repository named in the route (POST /api/v1/repos/{owner}/{repo}/pulls/{index}/update) and never re-applies it to the private head repository, an attacker holding such a token can force a server-side write into the private repo and, where Actions is enabled, trigger its push workflow. This is CWE-863 incorrect authorization; a publicly available exploit code exists in the vendor advisory, EPSS is low at 0.24%, and it is not listed in CISA KEV.
Identity-claim disclosure in Gitea (self-hosted Git server) before 1.27.0 lets any holder of a valid personal access token retrieve their email and organization/team membership from the OIDC userinfo endpoint (GET /login/oauth/userinfo) even when the token's scopes (e.g. only read:misc) would deny the equivalent REST API calls. The endpoint accepts API tokens as bearer credentials but skips the scope enforcement applied elsewhere, collapsing the authorization boundary that scoped tokens are meant to provide. Publicly available exploit code exists; the flaw is not in CISA KEV and EPSS is low (0.17%).
Out-of-bounds memory disclosure in Data::Intern::Shared before 0.02, a Perl shared-memory string interning module, lets a local peer who can write the shared backing file leak adjacent process memory. The attach-time validator (si_validate_header) checks header magic, version, offsets, total_size and counts but never bounds-checks the slot, reverse, and arena arrays it subsequently trusts, so a poisoned index in si_idx_find drives a triple-indirection read past valid bounds. No public exploit is identified at time of analysis and EPSS risk is low (0.17%), but a vendor patch (0.02) is available.
Out-of-bounds read in the Perl module Data::HashMap::Shared before 0.14 lets a local peer that can write the shared-memory backing file corrupt per-record offset and length values, causing the map to copy attacker-controlled regions out of the arena. The flaw affects the each, keys, values, pop, shift, take, swap, drain and cursor code paths and can leak adjacent process memory or crash the process. There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.16%, 5th percentile).
Out-of-bounds read in the Data::RadixTree::Shared Perl module (all versions before 0.02) lets a local peer with write access to the shared memory-mapped backing file corrupt trusted node records and force a lookup to dereference attacker-controlled node and arena indices, leaking adjacent process memory or crashing the process. The attach-time validator rdx_validate_header checks the header and region layout but never bounds-checks the node records that rdx_find_locked subsequently trusts. No public exploit identified at time of analysis; EPSS is low (0.16%, 5th percentile) and the flaw is not in CISA KEV.
Out-of-bounds memory read in the Perl module Data::SortedSet::Shared before 0.03 lets a local peer who can write the shared mmap-backed file poison tree link indices, causing the next rank, min, or max query to dereference an out-of-bounds node and leak adjacent process memory or crash. The flaw stems from an attach-time validator that checks only the root index, deferring the full structural check to a separate, rarely-invoked validate method. No public exploit has been identified at time of analysis, EPSS risk is low (0.16%, 5th percentile), and it is not on the CISA KEV list.
Out-of-bounds read in the Perl module Data::ReqRep::Shared before 0.05 lets a local peer with write access to the shared mmap-backed file leak adjacent process memory or crash the process. The flaw sits in reqrep_recv_locked, which trusts an arena offset and length read straight from the shared segment without bounding them against the arena capacity. There is no public exploit identified at time of analysis, EPSS risk is low (0.16%, 5th percentile), and it is not listed in CISA KEV.
Protection-mechanism bypass in Mozilla Firefox's Enterprise Policies component allows attackers to circumvent security restrictions that administrators enforce through managed policy, undermining controls an organization relies on to lock down the browser. Mozilla rates the flaw CVSS 9.1 (network vector, low complexity, no privileges or user interaction) affecting Firefox before 153 and Firefox ESR before 140.13. There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.16%, 6th percentile).
Same-origin policy bypass in Mozilla Firefox's Networking DNS component allows remote attackers to circumvent origin isolation and read or manipulate data belonging to other web origins. Affects Firefox before 153 and Firefox ESR before 140.13, exploitable over the network without authentication or user interaction (CVSS 9.1). No public exploit identified at time of analysis; EPSS is low (0.16%, 6th percentile).
Persistent account takeover in Gitea (self-hosted Git service) versions up to and including 1.26.4 arises because a stolen Remember-Me cookie is never revoked after theft is detected. When the split-token (ID:Hash) design detects a hash mismatch - the canonical signal of a compromised token per the Paragonie remember-me guidance - CheckAuthToken only returns ErrAuthTokenInvalidHash and autoSignIn merely clears the victim's local cookie, leaving the attacker's rotated token live in the database. The result is indefinite attacker access to the victim's account. Fixed in 1.27.0; no public exploit identified at time of analysis, and EPSS is low at 0.16%.
Protection mechanism bypass in the Networking component of Mozilla Firefox (versions prior to 153) allows remote attackers to circumvent a built-in security mitigation over the network without authentication or user interaction, per the CVSS vector (AV:N/AC:L/PR:N/UI:N). Mozilla (MFSA2026-68) tags this as an authentication/mitigation bypass with high confidentiality and integrity impact but no availability impact. No public exploit identified at time of analysis, and EPSS exploitation probability is low at 0.15% (5th percentile).
Protection-mechanism bypass in the DOM: Networking component of Mozilla Firefox lets a remote, unauthenticated attacker circumvent a browser security mitigation, exposing confidential data and enabling integrity compromise (CVSS 9.1) without user interaction. Reported by Mozilla and fixed in Firefox 153, the flaw affects users browsing to attacker-controlled web content. No public exploit identified at time of analysis, and the low EPSS score (0.15%) suggests exploitation is not yet widespread.
Integrity and availability impact in Firefox's JIT JavaScript engine allows remote attackers to cause malicious script outcomes or denial of service. Versions prior to 153 are affected. Exploitation requires a victim to visit a crafted
Memory-corruption in Mozilla Firefox's Audio/Video Playback component allows a remote attacker to achieve confidentiality and integrity compromise (potentially arbitrary code execution) by delivering crafted media content to a victim's browser. Rooted in incorrect boundary conditions (buffer overflow, CWE-119), the flaw affects Firefox versions prior to 153 and carries a CVSS 9.1 rating, though EPSS exploitation probability is low (0.14%, 4th percentile) and no public exploit identified at time of analysis.
Memory corruption in Mozilla Firefox's WebGPU graphics component (fixed in Firefox 153) lets a remote attacker serving crafted web content trigger an out-of-bounds memory operation, enabling sensitive memory disclosure and browser crashes. The flaw is a CWE-119 boundary-condition error rated CVSS 9.1 (C:H/A:H, no integrity impact), consistent with an information-leak-plus-denial-of-service primitive rather than confirmed code execution. No public exploit identified at time of analysis, and EPSS is low (0.13%, 3rd percentile), indicating no evidence of active exploitation despite the high base score.
Full takeover of Oracle Communications Converged Application Server 8.2 and 8.3 is possible for a remote, unauthenticated attacker over TCP/IP, per Oracle's July 2026 Critical Patch Update. Rated CVSS 3.1 9.0 with a scope change (S:C), a successful attack can compromise confidentiality, integrity, and availability of the server and significantly impact additional connected products, though high attack complexity (AC:H) makes exploitation non-trivial. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise of Oracle PeopleSoft Enterprise CRM Common Objects 9.2.23 is possible by a remote, unauthenticated attacker over HTTP, per Oracle's July 2026 Critical Patch Update. Although the flaw resides in the CRM Common Objects component, a scope change means a successful attack can cascade into other PeopleSoft products and result in complete takeover of the affected component. Oracle rates it CVSS 9.0 but flags it as difficult to exploit (AC:H); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Account takeover in Oracle PeopleSoft Enterprise FIN Program Management 9.2 (Primavera Integration component) lets a low-privileged, authenticated remote attacker fully compromise the module by luring a separate legitimate user into interacting with malicious HTTP content, with a scope change that spills the impact into other integrated Oracle products. Oracle rates it CVSS 3.1 9.0 with full confidentiality, integrity, and availability loss. No public exploit identified at time of analysis; it is disclosed only via the Oracle July 2026 Critical Patch Update.
Full compromise of Oracle Unified Directory is possible in the OUD Core component of Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0, where a remote attacker interacting over LDAP can take over the directory service and impact other trusting systems due to a scope change. The flaw scores CVSS 9.0 but is rated high attack complexity (AC:H), meaning exploitation is difficult despite requiring no authentication. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise of Oracle Coherence (Oracle Fusion Middleware, Core component) is possible for a low-privileged attacker positioned on the same physical/logical network segment as the host, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.0 with a scope change, meaning successful exploitation not only results in takeover of Coherence itself but can significantly impact other products sharing the environment. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.