Information disclosure in Tanium Connect exposes sensitive data to local administrators via process invocation metadata. The vulnerability (CWE-214) allows a locally authenticated, highly privileged user to observe sensitive information - such as credentials or tokens - that the Connect component surfaces through visible process arguments or environment state. No active exploitation has been identified and no public proof-of-concept exists, but the high confidentiality impact (C:H) means exposed data could facilitate lateral movement or privilege escalation within the Tanium management plane.
Persistent denial of service in the NXP LPUART serial driver for Zephyr RTOS allows an unprivileged userspace thread to deterministically crash the entire embedded system by issuing a uart_configure() call with an unsupported parameter value while CONFIG_UART_USE_RUNTIME_CONFIGURE is enabled. The driver's configure path calls LPUART_Deinit() before validating the requested configuration, gating the peripheral clock; if validation then rejects the parameters, the clock is never restored, and any subsequent LPUART register access - from any thread or interrupt handler - triggers a hard fault and system reset. No public exploit code or CISA KEV listing has been identified at time of analysis, but the fault path is trivially and deterministically reproducible from userspace on affected NXP MCU targets.
Oracle VM VirtualBox 7.2.12 Core component allows a low-privileged local user to repeatedly crash or hang the hypervisor, causing a complete denial of service against all guest virtual machines running on the affected host. This vulnerability is not listed in the CISA KEV catalog and no public exploit code has been identified at time of analysis. The practical blast radius is limited to shared-access VirtualBox hosts where untrusted or semi-trusted local accounts exist, which is more common in developer workstations than hardened production environments.
Local denial-of-service in Oracle VM VirtualBox 7.2.12 allows a low-privileged attacker with local logon access to the host system to repeatedly crash or hang the VirtualBox process, rendering the hypervisor unavailable. The flaw resides in the Core component and requires no user interaction once the attacker has a local session on the infrastructure host. No public exploit code or active exploitation has been identified at time of analysis, and the impact is limited to availability - confidentiality and integrity are unaffected.
Oracle SDP Number Portability versions 12.2.3 through 12.2.15, a component of Oracle E-Business Suite, exposes a medium-severity flaw in its Installation sub-component that permits low-privileged authenticated network attackers to manipulate accessible data and partially disrupt service availability via HTTP. The CVSS 3.1 score of 5.4 reflects limited scope - no confidentiality impact and only partial integrity and availability degradation - with no confirmed active exploitation (not listed in CISA KEV) and no publicly available proof-of-concept at time of analysis. Oracle disclosed this vulnerability as part of the Critical Patch Update for July 2026, classifying it as 'easily exploitable' given the low attack complexity and absence of required user interaction.
Unauthorized data access in Oracle Property Manager (E-Business Suite component: Internal Operations) allows low-privileged authenticated network attackers to read and manipulate property management data via HTTP. Affected versions span 12.2.3 through 12.2.15. No public exploit code has been identified and this vulnerability is not listed in CISA KEV, but the low attack complexity and broad version range make patching a near-term priority for EBS deployments.
Partial authorization bypass in Oracle Call Center Technology (E-Business Suite 12.2.3 through 12.2.15) allows a low-privileged, network-authenticated attacker to read a subset of sensitive CCT data and perform unauthorized insert, update, or delete operations against that data over HTTP. The RDBMS and UI component fails to enforce access boundaries for authenticated sessions, exposing data integrity and partial confidentiality. No public exploit code has been identified at time of analysis, and CISA KEV listing is absent, though the Oracle Security Alert tag of 'Authentication Bypass' warrants prompt patching in internet-accessible deployments.
Oracle Scripting's Scripting Admin component in Oracle E-Business Suite versions 12.2.3 through 12.2.15 is exploitable by low-privileged, network-authenticated attackers over HTTP, enabling unauthorized read and write access to accessible Scripting data. Tagged as an Authentication Bypass, this flaw requires only a valid low-privilege account and no user interaction, making the realistic threat surface broader than the medium CVSS score alone suggests for large enterprise environments. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the Oracle July 2026 Critical Patch Update addresses this issue.
Unauthorized data access in Oracle Knowledge Management (E-Business Suite versions 12.2.3-12.2.15) is achievable by a low-privileged attacker over HTTP without user interaction. Exploitation allows unauthorized read access to a subset of Knowledge Management data and unauthorized insert, update, or delete operations against accessible data records. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists, though the 'Authentication Bypass' tag warrants scrutiny given the CVSS PR:L rating.
Unauthorized data access in the UK Payroll component of Oracle HRMS (UK) within Oracle E-Business Suite allows low-privileged, authenticated network attackers to read and manipulate payroll records beyond their intended authorization level. Affected versions span 12.2.3 through 12.2.15 and the attack path requires only HTTP access with no user interaction. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog at time of analysis.
Unauthorized data access and modification in Oracle iSupport's Call Back component exposes versions 12.2.3 through 12.2.15 of Oracle E-Business Suite to low-privileged network-based attack. Authenticated attackers with only basic network access via HTTP can bypass authorization controls - consistent with the 'Authentication Bypass' tag despite the PR:L vector - to read a subset of iSupport data and perform unauthorized insert, update, or delete operations. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the low attack complexity and absence of user-interaction requirements make it straightforward to exploit once credentials are obtained.
Unauthorized data access and modification in Oracle HRMS (New Zealand) 12.2.3-12.2.15 exposes the New Zealand Payroll component to low-privileged network attackers over HTTP. Exploiting this flaw, a low-privileged authenticated user can read a subset of HRMS payroll data and perform unauthorized insert, update, or delete operations on accessible records - consistent with an authorization bypass within the application layer. No active exploitation is confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis; EPSS data was not provided in source intelligence.
Unauthorized data access in Oracle HRMS (Hong Kong), a component of Oracle E-Business Suite, exposes payroll records to low-privileged network attackers via HTTP. Affected versions 12.2.13 through 12.2.15 allow an authenticated low-privileged user to read a subset of restricted payroll data and perform unauthorized insert, update, or delete operations against accessible Hong Kong Payroll data. No public exploit or CISA KEV listing has been identified at time of analysis, though the low attack complexity and network accessibility make this a credible insider or compromised-credential risk for affected tenants.
Unauthorized data access and modification in Oracle Item Master (Oracle E-Business Suite versions 12.2.3 through 12.2.15) is achievable by any low-privileged authenticated attacker over HTTP, with no user interaction required. The vulnerability resides in the iSet-up component and enables an attacker to read a subset of Item Master data and perform unauthorized inserts, updates, or deletes beyond their intended authorization scope. No public exploit code has been identified at time of analysis, and this CVE is not currently listed in the CISA KEV catalog; however, the 'Authentication Bypass' tag suggests an authorization boundary failure that could be straightforward to exploit once an attacker holds any valid account.
Oracle Labor Distribution (part of Oracle E-Business Suite) versions 12.2.3 through 12.2.15 exposes an authorization bypass in its Internal Operations component, enabling a low-privileged authenticated attacker with network access to read a subset of labor distribution data and perform unauthorized insert, update, or delete operations. The vulnerability is classified as 'easily exploitable' by Oracle with a CVSS 3.1 score of 5.4 (Medium), reflecting low attack complexity and no user interaction required. No public exploit code or CISA KEV listing has been identified at time of analysis; remediation is available via Oracle's July 2026 Critical Patch Update.
Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 exposes low-privileged authenticated users to unauthorized read and write access on platform data via HTTP. Disclosed as part of Oracle's Critical Patch Update for July 2026 and tagged as an authentication bypass issue, the vulnerability enables a low-privileged network attacker to read a subset of data and perform unauthorized insert, update, or delete operations within the Experience Manager component. No public exploit code or active exploitation has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Oracle Performance Management (E-Business Suite, Appraisals component, versions 12.2.3-12.2.15) exposes a network-accessible authorization bypass that allows low-privileged authenticated users to read and manipulate appraisal data beyond their intended access scope via HTTP. Tagged as an Authentication Bypass, the flaw enables partial confidentiality and integrity compromise against a widely-deployed enterprise ERP module. No public exploit code or CISA KEV listing has been identified at time of analysis; disclosure is tied to Oracle's CPU July 2026 advisory cycle.
Unauthorized data access in Oracle Public Sector Human Resources (E-Business Suite versions 12.2.3 through 12.2.15) allows a low-privileged authenticated attacker operating over HTTP to read a subset of HR data and perform unauthorized insert, update, or delete operations within the Regression Testing component. The vulnerability is rated CVSS 5.4 Medium with no availability impact, confined to confidentiality and integrity. No public exploit code or CISA KEV listing has been identified at time of analysis, though the 'Authentication Bypass' tag in the source intelligence warrants further investigation given its tension with the PR:L CVSS metric.
Oracle Self-Service Human Resources within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) exposes an exploitable authorization control weakness in its Internal Operations component, reachable over HTTP without requiring high privileges. A low-privileged authenticated attacker can perform unauthorized read, insert, update, and delete operations against a subset of HR data - impacting both confidentiality and data integrity. No active exploitation has been confirmed by CISA KEV, and no public proof-of-concept has been identified at time of analysis; however, the low attack complexity and network-accessible vector make this straightforward to exploit for any authenticated user.
Unauthorized data access and manipulation in Oracle iRecruitment (E-Business Suite versions 12.2.3 through 12.2.15) is achievable by any low-privileged attacker with network HTTP access, requiring no user interaction. The 'Authentication Bypass' tag from EUVD suggests the flaw likely allows an authenticated user to circumvent authorization controls within the Install/Upgrade component, gaining read and write access to recruitment data beyond their assigned permissions. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, though the low attack complexity makes this straightforward for any authenticated insider or compromised account.
Unauthorized data access in Oracle E-Business Suite Secure Enterprise Search versions 12.2.3 through 12.2.15 allows a low-privileged network attacker to read and modify data within the Search Integration Engine component via HTTP. Despite requiring a valid low-privilege account, the vulnerability is tagged as an Authentication Bypass, suggesting attackers can circumvent authorization controls within the search subsystem to access data beyond their permitted scope. No public exploit code or CISA KEV listing exists at time of analysis, and Oracle has addressed this in the July 2026 Critical Patch Update.
Unauthorized data access in Oracle TeleSales (E-Business Suite versions 12.2.3-12.2.15) allows a low-privileged, network-authenticated attacker to read, insert, update, or delete subsets of TeleSales data via HTTP without additional complexity. Tagged as an authentication bypass, the vulnerability likely represents an authorization control failure where a low-privilege account can exceed its intended data permissions within the Internal Operations component. No public exploit code or CISA KEV listing exists at time of analysis, but Oracle rates it 'easily exploitable' with low attack complexity.
Unauthorized data access and modification in Oracle Customer Interaction History (part of Oracle E-Business Suite) allows a network-adjacent low-privileged attacker to read a subset of confidential records and perform unauthorized insert, update, or delete operations via HTTP. Affected deployments span versions 12.2.3 through 12.2.15. The vulnerability was disclosed as part of Oracle's Critical Patch Update for July 2026; no public exploit or CISA KEV listing has been identified at time of analysis.
Unauthorized data access in Oracle Complex Maintenance, Repair and Overhaul (CMRO) versions 12.2.3 through 12.2.15 allows low-privileged authenticated attackers with HTTP network access to read a subset of CMRO application data and perform unauthorized insert, update, or delete operations against accessible records via the Common Utilities component. The vulnerability is tagged as an Authentication Bypass, suggesting that despite requiring a low-privileged account, exploitation circumvents authorization controls to access data beyond the attacker's sanctioned scope. No public exploit code or confirmed active exploitation has been identified at time of analysis; the issue was disclosed as part of Oracle's Critical Patch Update for July 2026.
Oracle Enterprise Asset Management (EAM) versions 12.2.3 through 12.2.15, a component of Oracle E-Business Suite, contains an authorization control weakness in its Work Definition Issues component that permits low-privileged authenticated network attackers to partially compromise data integrity and confidentiality over HTTPS. Successful exploitation enables unauthorized read access to a subset of EAM-accessible data as well as unauthorized update, insert, or delete operations against EAM records. No public exploit has been identified and this vulnerability is not listed in the CISA KEV catalog; however, the 'Authentication Bypass' intelligence tag suggests the flaw involves insufficient privilege enforcement within the Work Definition Issues component rather than a full pre-authentication bypass.
Unauthorized data access and manipulation in the French HR Payroll component of Oracle HRMS (France) within Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a network-based, low-privileged authenticated attacker to read, insert, update, or delete sensitive payroll data via HTTP. The 'Authentication Bypass' tag from multi-source intelligence suggests the root mechanism involves insufficient authorization controls within the payroll component, enabling privilege escalation beyond the attacker's assigned role. No confirmed active exploitation (KEV) or public exploit code exists at time of analysis, but the sensitivity of French HR payroll data - salaries, tax records, employee details - elevates real-world business risk well above what the moderate CVSS score of 5.4 alone conveys.
Oracle Coherence (Core component) across all currently supported versions exposes authenticated low-privileged network attackers to unauthorized data access and manipulation over HTTP, enabling both partial read access and unauthorized insert, update, or delete operations on Coherence-accessible cached data. Disclosed as part of Oracle's July 2026 Critical Patch Update, this medium-severity flaw is tagged as an Authentication Bypass, suggesting that a low-privileged credential confers data access beyond its intended authorization scope rather than enforcing proper boundary controls. No public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis, but the low attack complexity (AC:L) and absence of required user interaction mean exploitation is straightforward for any attacker holding valid Coherence credentials.
Oracle Application Object Library (AOL), the foundational Core framework component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, permits a network-authenticated low-privileged user to bypass authorization controls and perform unauthorized read, insert, update, or delete operations on data outside their assigned access scope. Tagged as an Authentication Bypass by ENISA EUVD-2026-46560, the flaw is reachable over HTTP with no attack complexity and no user interaction required beyond a valid low-privilege session. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the low-complexity, broadly network-accessible nature of the flaw in a widely deployed enterprise ERP platform warrants prompt application of Oracle's July 2026 Critical Patch Update.
Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 expose an authorization bypass in the Web Services Framework component, allowing low-privileged authenticated attackers to access and manipulate restricted data over HTTPS. Despite requiring valid credentials, the flaw circumvents authorization controls, enabling unauthorized read of a subset of platform data and unauthorized write/insert/delete operations against accessible records. No public exploit code or active CISA KEV listing has been identified at time of analysis.
Cross-site or session-riding exploit in Oracle HRMS (Japanese) - specifically the Oracle Payroll Japanese component within Oracle E-Business Suite versions 12.2.3 through 12.2.15 - allows unauthenticated remote attackers to manipulate HR and payroll data by deceiving an authenticated user into triggering a malicious HTTPS request. The attack results in unauthorized read access to a subset of HR data and unauthorized insert, update, or delete operations against Oracle HRMS (Japanese) accessible records. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated-yet-user-interaction-required attack pattern and Authentication Bypass tag strongly suggest a client-side vector such as CSRF or reflected XSS targeting active user sessions.
Cross-site or client-side injection in Oracle PeopleSoft Enterprise PeopleTools Panel Processor (versions 8.61 and 8.62) enables unauthenticated remote attackers to achieve limited unauthorized data read and write access by luring an authenticated user into interacting with a crafted HTTP request. The attack requires no privileges and no special configuration, but depends on human interaction from a victim - consistent with a reflected attack surface in the Panel Processor UI component. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog. Despite the 'Authentication Bypass' tag, the CVSS vector and impact scope indicate this is a partial, integrity-and-confidentiality-affecting client-side flaw rather than a full authentication bypass.
Oracle Public Sector Financials (E-Business Suite component: Internal Operations) versions 12.2.3 through 12.2.15 allows an authenticated low-privileged network attacker to exploit an authorization control weakness via HTTP, requiring a victim user to interact with attacker-influenced content to trigger a scope change affecting additional Oracle EBS products. Successful exploitation yields unauthorized read access to a subset of data and unauthorized write/insert/delete capability against accessible data, with impact propagating beyond the directly targeted component. No public exploit code or CISA KEV listing has been identified at time of analysis, though the Oracle July 2026 CPU discloses this as part of a batch advisory.
Unauthorized data access and modification in Oracle Flow Manufacturing (component: Internal Operations) allows a low-privileged, network-adjacent attacker to compromise confidentiality and integrity of Flow Manufacturing data, with a scope change that may impact additional Oracle E-Business Suite products. Affected versions span 12.2.3 through 12.2.15, a wide deployment window covering over a decade of releases. The attack requires human interaction from a victim beyond the attacker, suggesting a social-engineering or UI-based exploitation vector. No public exploit code or CISA KEV listing has been identified at time of analysis; this is a medium-severity finding addressed in Oracle's July 2026 Critical Patch Update.
Cross-product data exposure in Oracle Transportation Execution (E-Business Suite 12.2.3-12.2.15) allows an authenticated low-privileged attacker over HTTP to read and modify a subset of Transportation data while also impacting additional EBS products due to a scope change. The attack requires victim interaction, suggesting a client-side injection vector (consistent with the 'Authentication Bypass' tag and scope change in the CVSS vector), where attacker-controlled content is rendered by another user. Disclosed in Oracle's July 2026 Critical Patch Update with no confirmed public exploit or CISA KEV listing at time of analysis.
Unauthorized data access and modification in Oracle Property Manager (Oracle E-Business Suite versions 12.2.3 through 12.2.15) is achievable by a network-authenticated low-privileged attacker via HTTP when a victim user interacts with attacker-controlled content, triggering a scope change that may impact additional EBS components. The vulnerability permits unauthorized read access to a subset of Property Manager data and unauthorized insert, update, or delete operations on accessible data. No public exploit code or CISA KEV listing is identified at time of analysis, but the 'Authentication Bypass' tag signals a potential authorization control failure beyond the base CVSS score suggests.
Cross-site scripting or authorization bypass in Oracle Enterprise Asset Management (E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 enables a low-privileged authenticated attacker to read a subset of accessible data and perform unauthorized write operations, with confirmed scope change that may impact additional E-Business Suite products. The attack is network-delivered via HTTP and requires a victim user to interact, consistent with a stored or reflected XSS-class injection despite the tag indicating authentication bypass. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this in the medium-severity tier warranting patch prioritization for internet-facing or multi-tenant E-Business Suite deployments.
Missing authorization controls in Kibana's Cloud Connect endpoints allow any authenticated low-privilege user to read and modify Cloud Connect configuration and service settings that should be restricted to users with specific feature privileges. Exploitation occurs via direct HTTP requests to insufficiently protected internal API endpoints, bypassing Kibana's privilege enforcement layer entirely. No public exploit code exists and this vulnerability is not listed in CISA KEV; however, the low barrier - requiring only a valid Kibana account - elevates practical risk in multi-tenant or externally accessible deployments.
Unauthorized data access in Oracle Public Sector Financials (component: Internal Operations) within Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker to read a subset of financial data and perform unauthorized insert, update, or delete operations via HTTP. The 'Authentication Bypass' tag associated with this vulnerability suggests the flaw may permit a low-privilege user to exceed their intended authorization scope within the Internal Operations component, rather than bypassing authentication entirely. No public exploit code or confirmed active exploitation has been identified at time of analysis, though Oracle's July 2026 Critical Patch Update addresses this issue.
Unauthorized data access in Oracle Coherence allows a low-privileged, network-adjacent attacker to read, insert, update, or delete data within the Coherence data grid via TCP. Affected versions span the current supported lifecycle: 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Despite a moderate CVSS score of 5.4, the 'easily exploitable' descriptor and Authentication Bypass tag suggest the barrier to exploitation is low once an attacker holds any valid low-privileged credential or session token - making this a meaningful data integrity and confidentiality risk in multi-tenant or externally-accessible Coherence deployments. No public exploit code or CISA KEV listing identified at time of analysis.
Oracle HRMS (Republic of Korea) versions 12.2.3 through 12.2.15 exposes a network-accessible flaw in the Korean Payroll component that allows unauthenticated attackers to read a subset of HR data and perform unauthorized insert, update, or delete operations on payroll records. Exploitation requires victim-side human interaction, consistent with a client-side attack pattern (e.g., CSRF or reflected XSS) that bypasses access controls - corroborated by the 'Authentication Bypass' intelligence tag. No public exploit code and no CISA KEV listing have been identified at time of analysis; the Oracle CPU July 2026 advisory is the authoritative remediation source.
Unauthenticated network exploitation of Oracle Coherence's Core component via HTTP allows partial unauthorized read and write access to Coherence-managed data, with a confirmed scope change indicating impact can extend to additional products beyond the directly targeted instance. Affecting four supported versions (12.2.1.4.0 through 15.1.1.0.0), the flaw is tagged as an Authentication Bypass, suggesting the HTTP-facing interface can be accessed without valid credentials under high-complexity attack conditions. No public exploit code has been identified at time of analysis, and Oracle disclosed this through its July 2026 Critical Patch Update.
Incorrect Authorization (CWE-863) in Kibana's Entity Analytics Watchlist feature allows low-privileged authenticated users with read-only Security Solution access to perform unauthorized write operations against watchlist configuration endpoints that should require elevated privileges. The CVSS 5.4 vector (AV:N/AC:L/PR:L/UI:N) confirms network-exploitable but credential-gated exploitation with limited confidentiality and integrity impact; under specific deployment conditions, affected users may additionally access data outside their authorized scope. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Cross-user attack in Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 enables a low-privileged network attacker to compromise confidentiality and integrity of data across component boundaries when a victim user interacts with attacker-controlled content. The Security component is the attack surface, consistent with stored or reflected client-side injection (e.g., XSS) that hijacks session or data context of another user. No public exploit identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Cross-boundary exploitation in Oracle PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62 allows a low-privileged, network-authenticated attacker to compromise confidentiality and integrity of data - including in additional downstream PeopleSoft products - by inducing a victim user to perform an action via HTTP. The CVSS scope-change indicator (S:C) and required user interaction (UI:R) are characteristic of a client-side injection class (e.g., stored or reflected XSS within the Security component) that crosses trust boundaries. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Cross-site scripting or client-side injection in the Panel Processor component of Oracle PeopleSoft Enterprise PeopleTools 8.62 permits a low-privileged, authenticated network attacker to compromise confidentiality and integrity of accessible PeopleTools data - and, due to a scope change, potentially additional Oracle products - when a victim user interacts with attacker-controlled content. The attack vector is HTTP, requires no elevated complexity, and is classified as easily exploitable. No public exploit code or active exploitation has been identified at time of analysis; Oracle disclosed this via the Critical Patch Update for July 2026.
Spoofing of the Omnibox (URL bar) in Google Chrome versions prior to 150.0.7871.182 allows a remote attacker to mislead users via a crafted HTML page, exploiting insufficient input validation in the browser's Extensions handling. This Medium-severity vulnerability (CVSS 5.4) has no evidence of active exploitation or publicly available exploit code, and its exploitation requires user interaction to visit a malicious page.
Unauthorized data access and modification in Oracle Performance Management (E-Business Suite Appraisals component, versions 12.2.3-12.2.15) is achievable by any low-privileged authenticated user with HTTP network access. The flaw enables partial reads of restricted appraisal data and unauthorized insert, update, or delete operations within the accessible data scope - an insider threat or compromised low-privilege account scenario. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing real-world urgency at moderate levels for enterprises running Oracle E-Business Suite with the Performance Management module active.
LFS deploy-key privilege escalation in Gitea (< 1.27.0) allows a holder of a write deploy key for any single repository owned by a victim to exfiltrate LFS objects from all private repositories that victim owns. The flaw originates in `routers/private/serv.go:275`, where Gitea embeds `repo.OwnerID` as the JWT `UserID` for deploy-key SSH sessions, causing the LFS batch handler at `services/lfs/server.go:268` to evaluate cross-repository authorization as if the repository owner - not the deploy key - were the requesting principal. If the victim is a Gitea site administrator, an unfiltered query in `models/git/lfs.go:226` exposes every LFS object on the entire instance. A public end-to-end PoC (poc.sh) is attached to the GitHub advisory; no CISA KEV listing exists at time of analysis.
Oracle Work in Process (part of Oracle E-Business Suite) versions 12.2.5 through 12.2.15 exposes an authorization flaw in its Internal Operations component, enabling a low-privileged authenticated attacker to perform unauthorized read, insert, update, and delete operations against accessible Work in Process data over HTTP. The scope change (S:C) in the CVSS vector confirms that successful exploitation can cascade to affect additional EBS modules beyond the directly targeted component. No public exploit code or CISA KEV listing has been identified at time of analysis, and the mandatory victim interaction requirement (UI:R) reduces opportunistic exploitation risk.
Partial denial of service in Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 allows unauthenticated remote attackers to disrupt the Cash Management component via HTTP. The vulnerability is rated Medium (CVSS 5.3) with availability-only impact - confidentiality and integrity are unaffected. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle addressed this in the July 2026 Critical Patch Update.