Out-of-bounds heap read in libssh exposes small amounts of server memory during GSSAPI key exchange, exploitable by remote unauthenticated attackers. When a client submits a Curve25519 public key shorter than the expected 32 bytes during server-side GSSAPI key exchange, libssh copies the key without validating its length, triggering a read beyond the intended buffer boundary. No public exploit has been identified at time of analysis; exploitation is constrained to servers with GSSAPI key exchange explicitly enabled, which is a non-default configuration.
Unauthenticated read access in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 allows remote attackers to retrieve a subset of protected campus data via HTTP without credentials. The 'Authentication Bypass' tag indicates the Security component fails to enforce access controls on at least one network-accessible endpoint, exposing data - likely student records, enrollment data, or PII - to anonymous network queries. No public exploit code or CISA KEV listing has been identified at time of analysis, though Oracle explicitly characterizes this as 'easily exploitable.'
Remote unauthenticated information disclosure in Oracle GoldenGate's Admin Server Executable allows network-accessible attackers to read a subset of GoldenGate-accessible data over HTTPS without any credentials. Affected versions span two active branches: 21.3-21.21 and 23.4-23.26.1. No public exploit or CISA KEV listing has been identified at time of analysis; Oracle classifies this as easily exploitable with a CVSS 5.3 Medium score reflecting limited confidentiality impact and no integrity or availability consequence.
Unauthorized data disclosure in Oracle Access Manager's Authentication Engine allows unauthenticated remote attackers to read a subset of OAM-accessible data over HTTP. Affected versions are 12.2.1.4.0 and 14.1.2.1.0 of Oracle Fusion Middleware's OAM component. Tagged as an Authentication Bypass, the flaw carries a CVSS 5.3 (Medium) rating with low confidentiality impact and no integrity or availability consequences; no public exploit or KEV listing has been identified at time of analysis.
Unauthorized read access to Oracle Coherence data is achievable by unauthenticated network attackers targeting the Core component via HTTP across all current supported releases (12.2.1.4.0 through 15.1.1.0.0). The 'Authentication Bypass' tag combined with a PR:N CVSS vector confirms that no credentials are required, but impact is bounded to a partial subset of accessible data (C:L), not full cluster compromise. No public exploit or CISA KEV listing exists at time of analysis, placing this in the medium-priority tier despite the trivially low exploitation complexity.
Unauthenticated remote read access in Oracle Coherence's Core component allows network attackers to retrieve a subset of data via HTTP without any credentials. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivially exploitable network access with no authentication barrier, consistent with the 'Authentication Bypass' tag applied to this CVE. All four current supported release lines - 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 - are affected; no public exploit or confirmed active exploitation has been identified at time of analysis.
Unauthorized data read in Oracle Coherence Core enables unauthenticated remote attackers to access a subset of data stored within the in-memory data grid via TCP, with no credentials or user interaction required. Affected versions span the three current release trains: 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, all part of Oracle Fusion Middleware. No public exploit identified at time of analysis; the 'Authentication Bypass' tag combined with a PR:N vector confirms the Core component fails to enforce access controls on inbound TCP connections.
Unauthorized data read in Oracle APEX 24.1, 24.2, and 26.1 is achievable by unauthenticated remote attackers via HTTP, exploiting an authentication bypass in the General component. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial network reachability with no authentication required, allowing exposure of a subset of APEX-accessible data. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low complexity and zero-auth requirements make this a credible opportunistic threat against internet-facing APEX deployments.
Unauthenticated information disclosure in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) allows remote attackers to read a subset of accessible platform data via the Agent Next Gen component over HTTPS without credentials. Tagged as an Authentication Bypass, this network-accessible flaw carries a low-complexity attack profile (AV:N/AC:L/PR:N/UI:N), meaning any network-reachable adversary can exploit it with minimal effort. No public exploit code or CISA KEV listing is confirmed at time of analysis, but the absence of authentication requirements and zero attack complexity make this straightforward to operationalize, particularly given that OEM manages critical enterprise infrastructure.
Unauthenticated information disclosure in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) exposes a subset of platform data to remote attackers via HTTPS. The vulnerability resides in the Agent Next Gen component and is classified as an authentication bypass, enabling network-accessible exploitation without credentials or user interaction. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, its low complexity and zero-authentication requirement make it straightforwardly exploitable by any internet-accessible instance.
Denial of service in Oracle Agile Engineering Data Management 6.2.1 allows a low-privileged network attacker to crash or hang the application via a crafted HTTP request targeting the Install component. The vulnerability carries a CVSS 3.1 score of 5.3 (Medium), with high attack complexity tempering the real-world risk. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Unauthorized read access to critical data in Oracle Work in Process (E-Business Suite versions 12.2.3-12.2.15) is achievable by a low-privileged, network-connected attacker exploiting an authentication bypass in the Internal Operations component via HTTP. The flaw is rated difficult to exploit (AC:H) and carries no integrity or availability impact, but successful exploitation grants complete access to all data accessible within the Work in Process module. No public exploit code or CISA KEV listing is associated with this vulnerability at time of analysis.
Partial denial-of-service in Oracle Java SE's Libraries component allows unauthenticated network attackers to disrupt availability across a broad range of supported versions, including the current releases 25.0.3 and 26.0.1. The attack surface is unusually wide: exploitation is possible through any protocol supported by the JVM, via APIs exposed in the Libraries component, through web services that internally invoke those APIs, and through the sandboxed Java Web Start or applet execution path when loading untrusted code. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the trivial exploitation conditions (AC:L/PR:N/UI:N) and the ubiquity of Java deployments elevate realistic risk beyond the moderate CVSS score alone.
Partial denial-of-service exposure in the 2D graphics component of Oracle Java SE and GraalVM platforms allows unauthenticated remote attackers to disrupt service availability with no authentication and low attack complexity. Affected releases span a broad range including Java SE 8u491 through 26.0.1, GraalVM for JDK 17.0.19 and 21.0.11, and GraalVM Enterprise Edition 21.3.18 - covering virtually every supported Java SE release as of the July 2026 CPU. No public exploit has been identified at time of analysis and no CISA KEV listing exists, though Oracle characterizes the vulnerability as 'easily exploitable', indicating automated exploitation is plausible.
Partial denial-of-service in the JavaFX component of Oracle Java SE 8u491 is remotely exploitable by unauthenticated attackers across multiple network protocols, confirmed by Oracle's Critical Patch Update for July 2026. The vulnerability manifests in two distinct deployment contexts: server-side web services that pass externally supplied data to JavaFX APIs, and client-side sandboxed environments (Java Web Start applications or Java applets) that load and execute untrusted internet code. No public exploit has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV; however, the low-complexity, no-authentication-required attack surface makes exploitation straightforward should a proof-of-concept emerge.
Partial denial-of-service exposure in the JSSE component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows unauthenticated remote attackers to degrade service availability by supplying malformed data via TLS. Affected releases span five Oracle Java SE versions (11.0.31 through 26.0.1) and both GraalVM product lines, as disclosed in Oracle's CPU July 2026 advisory (EUVD-2026-46459). No public exploit identified at time of analysis and no CISA KEV listing; the CVSS 5.3 rating reflects a genuine but bounded availability impact rather than a critical or confidentiality-affecting risk.
Unbounded memory growth in libssh's SFTP client allows a malicious server to exhaust client-side memory by sending responses for unknown request IDs, resulting in a denial-of-service condition against any application using libssh for SFTP operations. Affected deployments include libssh as packaged in Red Hat Enterprise Linux 8, 9, 10, and Red Hat Hardened Images. No public exploit code and no active exploitation have been identified at time of analysis; the CVSS score of 5.3 (Medium) reflects the limited availability impact and the requirement that a victim client connect to an attacker-controlled server.
Unauthorized data disclosure in Oracle Production Scheduling (E-Business Suite versions 12.2.3 through 12.2.15) allows a low-privileged network attacker to gain complete read access to all data within the application via a difficult-to-exploit flaw in the User Interface component. Tagged as an authentication bypass, the vulnerability suggests improper access control enforcement in the UI layer that permits privilege escalation beyond the attacker's normally granted permissions, enabling full confidentiality compromise of Production Scheduling data. No public exploit code or active exploitation has been identified; Oracle addressed this in the Critical Patch Update for July 2026.
Unauthorized access to critical data in Oracle Production Scheduling (versions 12.2.3 through 12.2.15) is achievable by unauthenticated remote attackers via a network-based authentication bypass in the Internal Operations component, though exploitation requires high attack complexity and human interaction from a third party. The confidentiality impact is complete - attackers can access all data accessible to Production Scheduling - while integrity and availability remain unaffected. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle disclosed this through the July 2026 Critical Patch Update.
Unauthenticated information disclosure in Oracle Enterprise Manager Base Platform's Agent Next Gen component permits remote attackers to read a subset of platform-accessible data over HTTPS without credentials. Versions 13.5 and 24.1 are confirmed affected per Oracle's Critical Patch Update for July 2026. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis, though the Authentication Bypass tag suggests a structural access control failure rather than a simple misconfiguration.
Confidential data exposure in Oracle Contracts Integration (Oracle E-Business Suite) versions 12.2.3 through 12.2.15 enables a low-privileged authenticated attacker with HTTP network access to bypass internal authorization controls in the Internal Operations component, gaining unauthorized access to critical or all accessible contract data. The CVSS confidentiality impact is rated High despite the moderate overall score of 5.3, reflecting complete in-scope data exposure when exploitation succeeds. No public exploit code or active exploitation has been identified at time of analysis; the high attack complexity (AC:H) constrains real-world opportunistic risk.
Unauthorized read access to critical data is possible in Oracle iStore (E-Business Suite Shopping Cart component, versions 12.2.3-12.2.15) via an authentication bypass condition exploitable by low-privileged network attackers over HTTP. The attack is rated difficult to exploit (AC:H), limiting opportunistic risk, but a successful attempt yields high confidentiality impact - complete access to all iStore-accessible data. No public exploit code or CISA KEV listing has been identified at time of analysis; the vulnerability was disclosed by Oracle via their July 2026 Critical Patch Update.
Column-value inference via observable discrepancy in Electric Postgres Sync below 1.6.10 allows authenticated remote attackers to deduce the values of columns intentionally excluded from shape responses. By crafting subset WHERE clause conditions against shape endpoints and observing whether rows are matched or returned, an attacker can systematically enumerate sensitive field data that the application's column-based access restrictions are designed to conceal. No public exploit code or active exploitation has been identified at time of analysis; a vendor patch is available at version 1.6.10.
Integrity compromise in Oracle Time and Labor (E-Business Suite versions 12.2.3 through 12.2.15) allows a low-privileged, network-authenticated attacker to create, delete, or modify critical application data via HTTP under high-complexity conditions. The vulnerability resides in the Internal Operations component and is tagged as an Authentication Bypass, suggesting insufficient internal authorization enforcement rather than a perimeter access failure. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the I:H integrity impact makes successful exploitation consequential for workforce and payroll data integrity.
Improper permission enforcement in Checkmk's Business Intelligence (BI) module allows any authenticated low-privileged user to view and modify BI packs and rules regardless of their assigned permission set. Affected versions span four release branches - 2.5.0 through 2.5.0p8, 2.4.0 through 2.4.0p33, 2.3.0 through 2.3.0p48, and the end-of-life 2.2.0 branch - creating an access control bypass in a core monitoring configuration surface. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Apple's Find My backend service allows an attacker who holds a valid PET (Private Endpoint Token) to enumerate devices on an Apple ID account and silently remove offline devices without triggering two-factor authentication or ownership verification - a CWE-287 Improper Authentication flaw. The vulnerability affects the service through at least December 17, 2025, with researcher-published proof-of-concept code on GitHub demonstrating the technique. EPSS sits at 0.19% (9th percentile) and the vulnerability is not listed in CISA KEV, pointing toward targeted rather than opportunistic exploitation; however, the account-manipulation impact makes it meaningful for high-value Apple ID targets.
Cross-tenant information disclosure in OpenRemote versions before 1.26.2 allows any authenticated user holding the read:rules role to retrieve operational syslog events from arbitrary tenants by querying the GET /api/{realm}/syslog/event endpoint. The SyslogResource REST endpoint fails to scope log retrieval to the caller's own realm, exposing asset IDs, agent connection details, rule names, and protocol errors belonging to other organizations in the same multi-tenant deployment. No public exploit code or active exploitation has been identified at time of analysis; the vendor has addressed the issue in version 1.26.2.
Nginx server version disclosure in HCL IntelliOps Event Management (IEM) exposes the underlying web server version to unauthenticated remote attackers. This reconnaissance-class vulnerability allows adversaries to fingerprint the software stack, identify whether the nginx instance is outdated, and pivot to targeting known CVEs or publicly available exploits against that specific version. No public exploit code and no CISA KEV listing are associated with this CVE; the primary risk is as an enabler for follow-on attacks rather than direct exploitation.
kirby-modules through version 5.5.7 exposes the complete plaintext commercial license key to any authenticated Kirby Panel user - including non-admin roles such as editors and authors - via a single GET request to the modules/activate dialog endpoint. The root cause is a missing authorization check (CWE-862) in lib/areas.php: the handler calls ModulesLicense::readKey() without verifying administrator status, relying instead on the access.system permission that defaults to true for all non-admin Panel roles. No active exploitation is confirmed by CISA KEV and no public exploit code has been identified, but the CVSS 4.0 vector (PR:L, AC:L, AV:N) indicates this is trivially reproducible by any Panel account holder, with the primary downstream consequence being unauthorized activation of the plugin on third-party Kirby installations.
Private repository existence disclosure in Gitea allows fully unauthenticated remote attackers to confirm the existence, enumerate names, harvest clone URLs, and identify default branch names of private repositories by appending the `?go-get=1` query parameter to any repository-scoped URL. All Gitea instances running versions prior to 1.27.0 are affected regardless of repository visibility configuration. No public exploit identified at time of analysis as a dedicated exploit tool, though a detailed proof-of-concept with working `curl` and shell enumeration scripts is published in the GHSA advisory, making exploitation trivially repeatable.
Open redirect in Trino 481's OAuth2/OIDC authentication component allows remote, unauthenticated attackers to manipulate the redirect_uri parameter in ExternalUriInfo.java, redirecting authenticated users to attacker-controlled external sites. Exploitation requires user interaction - a victim must follow a crafted authentication URL - making this primarily a phishing and token-harvesting enabler rather than a direct system compromise vector. No active exploitation has been confirmed (not in CISA KEV), no public exploit code exists, and the trinodb project had not responded to the responsible disclosure report at time of analysis.
Stored cross-site scripting in FOG Project's inventory pipeline allows an unauthenticated network-adjacent attacker who knows any registered host's MAC address to inject persistent JavaScript payloads into the FOG database via POST requests to `/service/inventory.php`. When an administrator opens the Group Inventory tab, the unescaped payload executes in their browser, enabling session hijacking or unauthorized admin-level actions. No public exploit has been identified at time of analysis; patches are available in versions 1.5.10.1832 (stable) and 1.6.0-beta.2313 (beta).
Oracle Service Delivery Platform's Messaging Enabler component in versions 12.2.1.4.0 and 14.1.2.0.0 allows low-privileged local users to perform unauthorized read and write operations on platform data, with a documented scope change that extends impact to additional co-deployed Oracle Fusion Middleware products. The vulnerability requires only a low-privileged local account on the hosting infrastructure, making insider threats and compromised service accounts the primary risk vector. No public exploit has been identified at time of analysis; this was disclosed as part of Oracle's July 2026 Critical Patch Update.
Oracle Workflow Notification Mailer in E-Business Suite versions 12.2.3 through 12.2.15 exposes a denial-of-service and limited data manipulation condition exploitable only by a high-privileged, local attacker under complex circumstances. Successful exploitation can cause a complete hang or repeatable crash of the Workflow service, alongside minor unauthorized read and write access to a subset of its data. No public exploit or active exploitation has been identified at time of analysis, and Oracle classifies this as difficult to exploit.
Stored XSS in Grav CMS shortcode-core attribute handlers allows authenticated users with admin.pages permission to inject persistent JavaScript payloads that bypass the CMS's XSS detection filter and execute in any visitor's browser. The filter flaw is root-cause critical: it only flags payloads containing literal angle brackets, leaving event-handler and attribute-based injection vectors entirely unblocked. When an administrator views an affected page, the injected script can steal admin session nonces, enabling full account takeover. No public exploit code or CISA KEV listing has been identified at time of analysis, but the impact chain - from low-privilege content editor to admin session hijack - is straightforward.
MySQL Cluster's NDB Operator component allows a local, unauthenticated attacker with logon access to the infrastructure host to bypass authentication controls and gain complete read access to all MySQL Cluster data. Three active release lines are affected - 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1 - as confirmed by Oracle's July 2026 Critical Patch Update. No public exploit has been identified at time of analysis, and the high attack complexity (AC:H) together with the local-only access vector (AV:L) substantially constrain realistic exploitation, though the data-exposure consequence remains significant for environments handling sensitive workloads.
Partial compromise of Oracle Installed Base (Create Item Instance component) within Oracle E-Business Suite versions 12.2.4 through 12.2.15 is achievable by a low-privileged authenticated attacker over HTTP, subject to high attack complexity conditions. Successful exploitation results in unauthorized read access to a subset of Installed Base data, unauthorized data manipulation (insert/update/delete), and the ability to cause a partial denial of service. No public exploit or active exploitation has been identified at time of analysis; the Oracle CPU July 2026 advisory addresses this issue.
Missing RBAC authorization on the ZenML 0.94.2 `get_deployed_stack` endpoint allows any authenticated user to enumerate all deployed stacks across all users and tenants. The root failure is twofold: the HTTP handler lacks endpoint-level authorization, and the internal server-side `Client()` object bypasses the RBAC enforcement layer by querying `SqlZenStore` directly, making tenant isolation ineffective. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified, but the low attack complexity and cross-tenant data exposure make this a meaningful risk in ZenML Pro/Cloud multi-tenant deployments.
Outbound request restriction bypass in Kibana's Reporting feature enables authenticated low-privileged attackers to cause the reporting service to issue HTTP requests to network destinations explicitly denied by administrator-configured security policy. Affected versions span Kibana 8.x through 8.19.18, 9.0.x through 9.3.7, and 9.4.x through 9.4.3. The scope-changed CVSS vector (S:C) confirms the impact extends beyond Kibana itself to internal network resources, making this a server-side request forgery (SSRF)-class issue. No public exploit code or CISA KEV listing identified at time of analysis.
Oracle Contracts Integration within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) exposes a network-accessible HTTP endpoint susceptible to exploitation by unauthenticated remote attackers, contingent on high attack complexity and required victim interaction. Successful exploitation yields limited unauthorized read access to a subset of Contracts Integration data, unauthorized data manipulation (insert, update, delete), and partial denial of service against the component. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists; the AC:H and UI:R constraints substantially lower real-world exploitation likelihood relative to the raw CVSS vector.
Denial of service in MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows a network-connected, high-privileged attacker to cause a complete hang or repeatable crash of the database server by targeting the Server: Optimizer component. Oracle classifies the vulnerability as 'easily exploitable' once credentials are obtained, though the high-privilege prerequisite (PR:H) substantially constrains real-world exposure. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Denial of service in Oracle MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows a high-privileged authenticated attacker to cause a complete, repeatable crash or hang of the database service by exploiting a flaw in the Server: JSON Duality component over any supported network protocol. The vulnerability is rated medium severity (CVSS 4.9) due to the high privilege prerequisite, limiting real-world exposure primarily to environments where privileged credentials have been compromised or where insider threat is a concern. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Denial of service in MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows a high-privileged network attacker to cause a complete hang or repeatable crash of the database server via the JSON Duality component. The vulnerability is rated CVSS 4.9, with the PR:H requirement substantially limiting real-world exposure to authenticated administrators or compromised high-privilege accounts. No public exploit code or active exploitation has been identified at time of analysis.
Oracle MySQL Cluster's Server: Optimizer component in versions 8.0.0 through 8.0.47 can be exploited by a high-privileged remote attacker to cause a complete denial of service via repeated hang or crash of the cluster. Oracle disclosed and patched this in the July 2026 Critical Patch Update (CPU). No public exploit code or active exploitation has been identified at time of analysis, and CISA KEV listing is absent.
MySQL Server and MySQL Cluster's Optimizer component can be crashed or hung by a high-privileged attacker with network access, resulting in complete denial of service. Affected deployments span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, as well as MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, per Oracle's July 2026 Critical Patch Update. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, making real-world exploitation contingent on access to high-privileged database credentials.
Denial-of-service vulnerability in Oracle MySQL Server and MySQL Cluster's InnoDB storage engine component allows high-privileged network-authenticated attackers to cause a complete, frequently repeatable crash or hang of the database server. Affected deployments span MySQL Server 8.4.x and 9.7.x, as well as MySQL Cluster 8.0.x through 9.7.x, making this a broad cross-version exposure within Oracle's primary database products. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the high privilege requirement substantially narrows the real-world attacker population.
Unauthorized data disclosure in Oracle PeopleSoft Enterprise PeopleTools (PIA Core Technology component) allows a high-privileged attacker with HTTP network access to read critical or all accessible PeopleSoft data. Affecting supported versions 8.61 and 8.62, Oracle classifies this as easily exploitable despite the PR:H requirement, yielding a CVSS 3.1 score of 4.9 with confidentiality-only impact. No public exploit code and no CISA KEV listing exist at time of analysis; however, the 'Authentication Bypass' tag in the advisory metadata warrants attention in environments with multiple admin-tier users.
Denial of service in MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows a high-privileged network-authenticated attacker to cause a complete, repeatably triggerable crash or hang of the database server via the Optimizer component. Disclosed in Oracle's Critical Patch Update for July 2026, the vulnerability carries a CVSS 3.1 score of 4.9 (Medium), with the moderate score driven entirely by the high privilege requirement (PR:H) that constrains the attack surface to users holding elevated database credentials. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Denial of service in Oracle MySQL Server and MySQL Cluster's Replication component allows a high-privileged, network-connected attacker to cause repeated crashes or indefinite hangs across affected 8.0, 8.4, and 9.7 release branches. Exploitation is straightforward (AC:L) but gated entirely by the requirement for high database privileges, substantially narrowing the realistic threat population. No public exploit identified at time of analysis and no CISA KEV listing; risk is most acute in replication-dependent high-availability clusters where availability SLAs are critical.
Denial-of-service in Oracle MySQL Server and MySQL Cluster versions 9.7.0-9.7.1 allows a high-privileged, network-adjacent attacker to repeatedly hang or crash the InnoDB storage engine via multiple supported protocols. The CVSS 3.1 score of 4.9 reflects the PR:H prerequisite, which significantly limits the exploitable population to authenticated database administrators or equivalently privileged accounts. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.