Memory corruption in the Audio/Video Gecko Media Plugin (GMP) component of Mozilla Firefox lets remote attackers trigger a buffer overflow through crafted media content, which per CVSS can disclose sensitive process memory and corrupt process state (C:H/I:H). The flaw affects Firefox before 153 and the ESR 115.x and 140.x branches; Mozilla shipped fixes in Firefox 153, ESR 115.38, and ESR 140.13. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the 9.1 CVSS reflects an unauthenticated, network-reachable memory-safety bug in a core browser subsystem.
Security mitigation bypass in the Networking component of Mozilla Firefox before version 153 lets remote attackers defeat a built-in protection mechanism, carrying high confidentiality and integrity impact per the CVSS 9.1 rating. The flaw was reported and fixed by Mozilla in Firefox 153 (advisory MFSA2026-68) and is classified under CWE-693 (Protection Mechanism Failure), with tags indicating an authentication/authorization bypass. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Protection mechanism failure in the DOM: Security component of Mozilla Firefox lets remote attackers bypass a browser security mitigation, undermining defenses that isolate web content and enforce origin/policy boundaries. Mozilla rates this Critical (CVSS 9.1) with high confidentiality and integrity impact and no authentication or user interaction required per the assigned vector; it is corrected in Firefox 153 (MFSA 2026-68). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege-abusing compromise of the Oracle Enterprise Manager Base Platform UI Framework lets a low-privileged, network-adjacent attacker read all EM-accessible data and partially tamper with or degrade the platform over HTTPS. The scope-changing flaw (CVSS 9.1) means a successful attack can spill beyond EM into other managed products, and Oracle's own tags flag authentication-bypass and denial-of-service behavior. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and network vector make it a high patch priority.
Broken authorization in Gitea (self-hosted Git server) versions before 1.27.0 lets a token scoped as public-only,write:repository push commits into a private pull-request head branch it should never touch. Because Gitea only evaluates the public-only restriction against the public base repository named in the route (POST /api/v1/repos/{owner}/{repo}/pulls/{index}/update) and never re-applies it to the private head repository, an attacker holding such a token can force a server-side write into the private repo and, where Actions is enabled, trigger its push workflow. This is CWE-863 incorrect authorization; a publicly available exploit code exists in the vendor advisory, EPSS is low at 0.24%, and it is not listed in CISA KEV.
Identity-claim disclosure in Gitea (self-hosted Git server) before 1.27.0 lets any holder of a valid personal access token retrieve their email and organization/team membership from the OIDC userinfo endpoint (GET /login/oauth/userinfo) even when the token's scopes (e.g. only read:misc) would deny the equivalent REST API calls. The endpoint accepts API tokens as bearer credentials but skips the scope enforcement applied elsewhere, collapsing the authorization boundary that scoped tokens are meant to provide. Publicly available exploit code exists; the flaw is not in CISA KEV and EPSS is low (0.17%).
Out-of-bounds memory disclosure in Data::Intern::Shared before 0.02, a Perl shared-memory string interning module, lets a local peer who can write the shared backing file leak adjacent process memory. The attach-time validator (si_validate_header) checks header magic, version, offsets, total_size and counts but never bounds-checks the slot, reverse, and arena arrays it subsequently trusts, so a poisoned index in si_idx_find drives a triple-indirection read past valid bounds. No public exploit is identified at time of analysis and EPSS risk is low (0.17%), but a vendor patch (0.02) is available.
Out-of-bounds read in the Perl module Data::HashMap::Shared before 0.14 lets a local peer that can write the shared-memory backing file corrupt per-record offset and length values, causing the map to copy attacker-controlled regions out of the arena. The flaw affects the each, keys, values, pop, shift, take, swap, drain and cursor code paths and can leak adjacent process memory or crash the process. There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.16%, 5th percentile).
Out-of-bounds read in the Data::RadixTree::Shared Perl module (all versions before 0.02) lets a local peer with write access to the shared memory-mapped backing file corrupt trusted node records and force a lookup to dereference attacker-controlled node and arena indices, leaking adjacent process memory or crashing the process. The attach-time validator rdx_validate_header checks the header and region layout but never bounds-checks the node records that rdx_find_locked subsequently trusts. No public exploit identified at time of analysis; EPSS is low (0.16%, 5th percentile) and the flaw is not in CISA KEV.
Out-of-bounds memory read in the Perl module Data::SortedSet::Shared before 0.03 lets a local peer who can write the shared mmap-backed file poison tree link indices, causing the next rank, min, or max query to dereference an out-of-bounds node and leak adjacent process memory or crash. The flaw stems from an attach-time validator that checks only the root index, deferring the full structural check to a separate, rarely-invoked validate method. No public exploit has been identified at time of analysis, EPSS risk is low (0.16%, 5th percentile), and it is not on the CISA KEV list.
Out-of-bounds read in the Perl module Data::ReqRep::Shared before 0.05 lets a local peer with write access to the shared mmap-backed file leak adjacent process memory or crash the process. The flaw sits in reqrep_recv_locked, which trusts an arena offset and length read straight from the shared segment without bounding them against the arena capacity. There is no public exploit identified at time of analysis, EPSS risk is low (0.16%, 5th percentile), and it is not listed in CISA KEV.
Protection-mechanism bypass in Mozilla Firefox's Enterprise Policies component allows attackers to circumvent security restrictions that administrators enforce through managed policy, undermining controls an organization relies on to lock down the browser. Mozilla rates the flaw CVSS 9.1 (network vector, low complexity, no privileges or user interaction) affecting Firefox before 153 and Firefox ESR before 140.13. There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.16%, 6th percentile).
Same-origin policy bypass in Mozilla Firefox's Networking DNS component allows remote attackers to circumvent origin isolation and read or manipulate data belonging to other web origins. Affects Firefox before 153 and Firefox ESR before 140.13, exploitable over the network without authentication or user interaction (CVSS 9.1). No public exploit identified at time of analysis; EPSS is low (0.16%, 6th percentile).
Persistent account takeover in Gitea (self-hosted Git service) versions up to and including 1.26.4 arises because a stolen Remember-Me cookie is never revoked after theft is detected. When the split-token (ID:Hash) design detects a hash mismatch - the canonical signal of a compromised token per the Paragonie remember-me guidance - CheckAuthToken only returns ErrAuthTokenInvalidHash and autoSignIn merely clears the victim's local cookie, leaving the attacker's rotated token live in the database. The result is indefinite attacker access to the victim's account. Fixed in 1.27.0; no public exploit identified at time of analysis, and EPSS is low at 0.16%.
Protection mechanism bypass in the Networking component of Mozilla Firefox (versions prior to 153) allows remote attackers to circumvent a built-in security mitigation over the network without authentication or user interaction, per the CVSS vector (AV:N/AC:L/PR:N/UI:N). Mozilla (MFSA2026-68) tags this as an authentication/mitigation bypass with high confidentiality and integrity impact but no availability impact. No public exploit identified at time of analysis, and EPSS exploitation probability is low at 0.15% (5th percentile).
Protection-mechanism bypass in the DOM: Networking component of Mozilla Firefox lets a remote, unauthenticated attacker circumvent a browser security mitigation, exposing confidential data and enabling integrity compromise (CVSS 9.1) without user interaction. Reported by Mozilla and fixed in Firefox 153, the flaw affects users browsing to attacker-controlled web content. No public exploit identified at time of analysis, and the low EPSS score (0.15%) suggests exploitation is not yet widespread.
Integrity and availability impact in Firefox's JIT JavaScript engine allows remote attackers to cause malicious script outcomes or denial of service. Versions prior to 153 are affected. Exploitation requires a victim to visit a crafted
Memory-corruption in Mozilla Firefox's Audio/Video Playback component allows a remote attacker to achieve confidentiality and integrity compromise (potentially arbitrary code execution) by delivering crafted media content to a victim's browser. Rooted in incorrect boundary conditions (buffer overflow, CWE-119), the flaw affects Firefox versions prior to 153 and carries a CVSS 9.1 rating, though EPSS exploitation probability is low (0.14%, 4th percentile) and no public exploit identified at time of analysis.
Memory corruption in Mozilla Firefox's WebGPU graphics component (fixed in Firefox 153) lets a remote attacker serving crafted web content trigger an out-of-bounds memory operation, enabling sensitive memory disclosure and browser crashes. The flaw is a CWE-119 boundary-condition error rated CVSS 9.1 (C:H/A:H, no integrity impact), consistent with an information-leak-plus-denial-of-service primitive rather than confirmed code execution. No public exploit identified at time of analysis, and EPSS is low (0.13%, 3rd percentile), indicating no evidence of active exploitation despite the high base score.
Full takeover of Oracle Communications Converged Application Server 8.2 and 8.3 is possible for a remote, unauthenticated attacker over TCP/IP, per Oracle's July 2026 Critical Patch Update. Rated CVSS 3.1 9.0 with a scope change (S:C), a successful attack can compromise confidentiality, integrity, and availability of the server and significantly impact additional connected products, though high attack complexity (AC:H) makes exploitation non-trivial. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise of Oracle PeopleSoft Enterprise CRM Common Objects 9.2.23 is possible by a remote, unauthenticated attacker over HTTP, per Oracle's July 2026 Critical Patch Update. Although the flaw resides in the CRM Common Objects component, a scope change means a successful attack can cascade into other PeopleSoft products and result in complete takeover of the affected component. Oracle rates it CVSS 9.0 but flags it as difficult to exploit (AC:H); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Account takeover in Oracle PeopleSoft Enterprise FIN Program Management 9.2 (Primavera Integration component) lets a low-privileged, authenticated remote attacker fully compromise the module by luring a separate legitimate user into interacting with malicious HTTP content, with a scope change that spills the impact into other integrated Oracle products. Oracle rates it CVSS 3.1 9.0 with full confidentiality, integrity, and availability loss. No public exploit identified at time of analysis; it is disclosed only via the Oracle July 2026 Critical Patch Update.
Full compromise of Oracle Unified Directory is possible in the OUD Core component of Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0, where a remote attacker interacting over LDAP can take over the directory service and impact other trusting systems due to a scope change. The flaw scores CVSS 9.0 but is rated high attack complexity (AC:H), meaning exploitation is difficult despite requiring no authentication. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise of Oracle Coherence (Oracle Fusion Middleware, Core component) is possible for a low-privileged attacker positioned on the same physical/logical network segment as the host, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.0 with a scope change, meaning successful exploitation not only results in takeover of Coherence itself but can significantly impact other products sharing the environment. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Local privilege-to-scope-change compromise in Oracle Product Lifecycle Analytics 3.6.1 (Oracle Supply Chain, Installation Issues component) lets an attacker with logon access to the host where the software runs take over the application without application-level credentials. Successful exploitation yields full read and write access to all data accessible to Oracle Product Lifecycle Analytics and, because of a CVSS scope change, may significantly impact other products on the same infrastructure. No public exploit identified at time of analysis; the flaw was reported by Oracle and fixed in the July 2026 Critical Patch Update.
Arbitrary file write in Home Assistant Core before 2026.6.0 lets unauthenticated attackers plant attacker-controlled files anywhere on the host by uploading a malicious backup archive during the initial onboarding window. Because the process frequently runs as root (e.g., in the supervised/OS install), this path traversal escalates to full host compromise. No public exploit is identified at time of analysis, and it is not listed in CISA KEV, but a vendor-released patch (2026.6.0) exists and the issue was reported by VulnCheck.
OS command injection in Tenable Security Center (formerly Tenable.sc) lets authenticated users abuse the audit file upload handler, which fails to sanitize filenames and lets shell metacharacters reach a system command call. Rated CVSS 4.0 8.7 (High), the flaw is described as reaching full command execution when chained with a related vulnerability, giving an attacker code execution on the appliance. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Denial of service in websocket-driver-ruby (all versions before 0.8.2) allows any unauthenticated remote client to crash a Ruby WebSocket server process by sending an HTTP Upgrade request containing a syntactically invalid Host header value. The root cause is an unhandled URI::InvalidURIError exception raised during Host header parsing in the request.complete() method, which propagates uncaught to the top level and terminates the server process. No public exploit has been identified at time of analysis, but the attack technique is trivially constructible from the CVE description and the published patch diff alone.
Privilege escalation to arbitrary code execution in HPE Aruba Networking AOS-CX switches allows a remote low-privileged, authenticated user to exploit a buffer overflow in the command line interface (CLI) and run arbitrary code as a privileged user on the underlying switch operating system. Because the CVSS vector is AV:N/PR:L, an attacker who already holds any valid low-level CLI account (e.g., an operator-level login over SSH) can escalate to full device control. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; risk is driven by the high CVSS (8.8) and full C/I/A impact.
Account/instance takeover in Oracle Process Manufacturing Systems (Internal Operations component of Oracle E-Business Suite 12.2.3 through 12.2.15) lets a low-privileged attacker with HTTP network access fully compromise the module, achieving high confidentiality, integrity, and availability impact. Oracle rates it CVSS 8.8 and calls it 'easily exploitable'; no public exploit is identified at time of analysis, and it is not listed in CISA KEV. The fix ships in Oracle's July 2026 Critical Patch Update.
Full compromise of Oracle Advanced Collections (Internal Operations component of Oracle E-Business Suite) is achievable by a low-privileged attacker with HTTP network access, per Oracle's July 2026 Critical Patch Update. Rated CVSS 3.1 8.8, successful exploitation yields complete takeover of the module with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and single-privilege prerequisite make it a strong patching priority.
Full takeover of Oracle Transportation Execution (a module of Oracle E-Business Suite, Internal Operations component) is possible for a low-privileged attacker with only network HTTP access to the application. Any authenticated user account can be leveraged to fully compromise confidentiality, integrity, and availability of the module, per the CVSS 3.1 8.8 vector. No public exploit identified at time of analysis; the fix ships in Oracle's July 2026 Critical Patch Update.
Full account takeover of Oracle Labor Distribution (part of Oracle E-Business Suite, Internal Operations component) is possible when a low-privileged attacker sends crafted HTTP requests to affected servers running versions 12.2.3 through 12.2.15. The flaw compromises confidentiality, integrity, and availability of the module and, per Oracle, results in complete takeover of Labor Distribution. No public exploit identified at time of analysis, though the CVSS 8.8 rating and network-reachable, low-complexity nature make it a high-priority patch in the Oracle July 2026 Critical Patch Update.
Account takeover in the Public Sector Payroll module (Internal Operations component) of Oracle E-Business Suite 12.2.3 through 12.2.15 lets a low-privileged attacker with network HTTP access fully compromise the payroll application. Oracle rates it CVSS 3.1 8.8 with high confidentiality, integrity, and availability impact and calls it 'easily exploitable,' meaning a single low-tier authenticated account is enough to seize the module. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the low attack complexity and network reach make it a prompt-patch item from the July 2026 Critical Patch Update.
Account/component takeover in the Oracle Customer Care module of Oracle E-Business Suite (versions 12.2.3 through 12.2.15) allows a low-privileged, authenticated attacker with HTTP network access to fully compromise the Customer Care component. The flaw carries a CVSS 3.1 base score of 8.8 with high confidentiality, integrity, and availability impact, and low attack complexity. It was reported by Oracle's own security team and fixed in the July 2026 Critical Patch Update; no public exploit identified at time of analysis.
Privilege-based takeover of Oracle Project Intelligence (a module of Oracle E-Business Suite 12.2.3-12.2.15) allows a low-privileged attacker with HTTP network access to fully compromise the component, resulting in high confidentiality, integrity, and availability impact. Oracle rates it CVSS 3.1 8.8 and delivered the fix in the July 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV, though EBS components are historically attractive post-authentication targets.
Full compromise of Oracle Payroll (Oracle E-Business Suite, Internal Operations component) is possible when a low-privileged attacker sends crafted HTTP requests to the affected application, per Oracle's July 2026 Critical Patch Update. The flaw affects EBS releases 12.2.3 through 12.2.15 and, given the CVSS 3.1 base score of 8.8 with high confidentiality, integrity, and availability impact, allows takeover of Oracle Payroll. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and 'easily exploitable' vendor characterization warrant prompt patching.
Full takeover of Oracle Payroll (component: Internal Operations) in Oracle E-Business Suite 12.2.3 through 12.2.15 is achievable by a low-privileged, authenticated attacker over HTTP, yielding complete compromise of confidentiality, integrity, and availability (CVSS 8.8). The flaw is described by Oracle as easily exploitable, but there is no public exploit identified at time of analysis and it is not listed in CISA KEV. It was disclosed and fixed in the Oracle Critical Patch Update of July 2026.
Full compromise of Oracle Order Management, a module of Oracle E-Business Suite (EBS), is possible via the Product Diagnostic Tools component, where a low-privileged attacker with HTTP network access can achieve complete takeover of the module. Oracle rates the flaw 8.8 (High) and describes it as 'easily exploitable,' with full confidentiality, integrity, and availability impact across EBS releases 12.2.3 through 12.2.15. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low complexity and low privilege bar make it a strong patch priority.
Full compromise of Oracle Advanced Pricing (Pricing Installation component of Oracle E-Business Suite) is achievable by a low-privileged, network-adjacent attacker over HTTP, per Oracle's July 2026 Critical Patch Update. Affecting EBS releases 12.2.3 through 12.2.15, successful exploitation yields complete takeover of the Advanced Pricing module with high confidentiality, integrity, and availability impact (CVSS 3.1 8.8). There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Account takeover in Oracle Sales Offline, a module of Oracle E-Business Suite (Internal Operations component) versions 12.2.3 through 12.2.15, lets a low-privileged authenticated attacker with HTTP network access fully compromise the product. Oracle rates it CVSS 3.1 8.8 with high confidentiality, integrity, and availability impact, describing it as 'easily exploitable' and resulting in complete takeover. No public exploit identified at time of analysis and it is not listed in CISA KEV, but its inclusion in Oracle's July 2026 Critical Patch Update warrants prompt patching.
Account takeover in Oracle General Ledger (Oracle E-Business Suite 12.2.3 through 12.2.15) lets a low-privileged attacker with network access via SOAP fully compromise the General Ledger module, gaining high impact to confidentiality, integrity, and availability. The Oracle July 2026 Critical Patch Update rates it CVSS 3.1 8.8 and describes it as easily exploitable, resulting in complete takeover of the affected component. No public exploit has been identified at time of analysis and it is not listed in CISA KEV.
Takeover of Oracle Trade Management (component: Claim LOV) within Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a low-privileged attacker with HTTP network access to fully compromise confidentiality, integrity, and availability of the module. The flaw is easily exploitable (AC:L) and requires only a low level of authenticated access (PR:L), carrying a CVSS 3.1 base score of 8.8. No public exploit identified at time of analysis, and it is not currently listed in CISA KEV.
Full compromise of the Oracle E-Business Suite TeleSales module (Internal Operations component) is possible over the network via HTTP by a low-privileged authenticated user. Affecting EBS releases 12.2.3 through 12.2.15, successful exploitation results in complete takeover of TeleSales with high confidentiality, integrity, and availability impact (CVSS 3.1 8.8). This flaw was disclosed in the Oracle July 2026 Critical Patch Update; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise of Oracle Payables (Oracle E-Business Suite, Internal Operations component) allows a low-privileged, network-authenticated attacker to take over the module via HTTP, with high impact to confidentiality, integrity, and availability (CVSS 3.1 8.8). Any user holding a valid low-privilege EBS session can escalate to full control of the Payables application. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and 'easily exploitable' vendor language make it a strong patching priority.
Privilege-based takeover of Oracle Product Hub (Oracle E-Business Suite, Internal Operations component) allows a low-privileged, network-authenticated attacker to fully compromise the product via HTTP. Affected releases span EBS 12.2.3 through 12.2.15, and the CVSS 3.1 vector (8.8) reflects high confidentiality, integrity, and availability impact with low attack complexity. No public exploit identified at time of analysis; disclosed through Oracle's July 2026 Critical Patch Update.
Takeover of Oracle Process Manufacturing (OPM) Product Development is possible in Oracle E-Business Suite 12.2.15 via its Quality Management Specs component, where a low-privileged attacker with HTTP network access can fully compromise the module. Oracle rates this 8.8 (High) with full confidentiality, integrity, and availability impact, and flags it as easily exploitable, meaning a valid but low-privilege application account is the only barrier. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Account takeover in Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 (Staffing component) lets a low-privileged, network-based attacker fully compromise the module over HTTP. Oracle rates the flaw CVSS 8.8 with high confidentiality, integrity, and availability impact and classifies it as "easily exploitable," meaning an authenticated user with minimal privileges can escalate to full control of the affected product. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but Oracle's own "easily exploitable" language signals a low barrier once credentials are held.
Full product takeover in Oracle Agile Product Lifecycle Management for Process 6.2.4 (Product Quality Management component) allows a low-privileged, network-authenticated attacker to compromise confidentiality, integrity, and availability over HTTP. Oracle rates this 8.8 and describes it as 'easily exploitable,' meaning any user holding a valid low-level account can escalate to full application control. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but the low attack complexity and high impact make it a strong patch priority.
Full product takeover in Oracle Agile Product Lifecycle Management for Process 6.2.4 (Product Quality Management component) allows a low-privileged, network-authenticated attacker to compromise the entire application over HTTP. Oracle rates the flaw as easily exploitable with high confidentiality, integrity, and availability impact (CVSS 8.8). No public exploit identified at time of analysis, and it is not on CISA KEV; the only source is Oracle's July 2026 Critical Patch Update.