Local privilege-to-scope-change compromise in Oracle Product Lifecycle Analytics 3.6.1 (Oracle Supply Chain, Installation Issues component) lets an attacker with logon access to the host where the software runs take over the application without application-level credentials. Successful exploitation yields full read and write access to all data accessible to Oracle Product Lifecycle Analytics and, because of a CVSS scope change, may significantly impact other products on the same infrastructure. No public exploit identified at time of analysis; the flaw was reported by Oracle and fixed in the July 2026 Critical Patch Update.
Arbitrary file write in Home Assistant Core before 2026.6.0 lets unauthenticated attackers plant attacker-controlled files anywhere on the host by uploading a malicious backup archive during the initial onboarding window. Because the process frequently runs as root (e.g., in the supervised/OS install), this path traversal escalates to full host compromise. No public exploit is identified at time of analysis, and it is not listed in CISA KEV, but a vendor-released patch (2026.6.0) exists and the issue was reported by VulnCheck.
Out-of-bounds memory read in Apache Fory (formerly Apache Fury) versions 0.5.0 up to 1.4.0 allows remote attackers to read beyond the underlying buffer via a flaw in readAlignedVarUint() when out-of-band zero-copy deserialization is used. Because the affected code relies on sun.misc.Unsafe for direct memory access, an attacker supplying crafted serialized data to an application that has enabled this opt-in feature can disclose adjacent heap memory or crash the process. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but a fix (version 1.4.0) is available and the issue was reported by the Apache security team.