Account takeover in Oracle WebCenter Content (Fusion Middleware, Web Content Management component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged attacker with HTTP network access fully compromise the server. The CVSS 3.1 base score is 8.8 with high confidentiality, integrity, and availability impact, and Oracle rates it easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full account/system takeover in Oracle WebCenter Portal (versions 12.2.1.4.0 and 14.1.2.0.0, Runtime Tools component) allows an authenticated low-privileged attacker to compromise the product over HTTP and gain complete control. Oracle rates this 'easily exploitable' with CVSS 8.8 (C:H/I:H/A:H), meaning any user with minimal portal credentials can escalate to full compromise. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and Oracle's own 'easily exploitable' characterization make it a high-priority patch.
Full compromise of Oracle JD Edwards EnterpriseOne CRM Foundation 9.2 is possible by a low-privileged, network-based attacker over HTTP, with Oracle rating the flaw "easily exploitable" and assigning a CVSS 3.1 base score of 8.8 spanning confidentiality, integrity, and availability. An authenticated user holding only minimal privileges can escalate to a complete takeover of the CRM Foundation component, gaining read/write access to CRM data and the ability to disrupt the service. There is no public exploit identified at time of analysis and the CVE is not in CISA KEV; the issue is addressed in Oracle's July 2026 Critical Patch Update.
Full product takeover in Oracle JD Edwards EnterpriseOne CRM Foundation 9.2 lets an authenticated low-privileged attacker with HTTP network access compromise the CRM Foundation component and gain complete control over its confidentiality, integrity, and availability. Rated CVSS 3.1 8.8, the flaw is described by Oracle as easily exploitable and resolved in the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege-based takeover of Oracle WebCenter Content: Imaging (Core component) in Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged, network-authenticated attacker to fully compromise the product over HTTP, yielding high confidentiality, integrity, and availability impact. Fixed in Oracle's July 2026 Critical Patch Update, this flaw carries a CVSS 3.1 base score of 8.8 and is classed as easily exploitable, but there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise of Oracle WebCenter Content: Imaging (versions 12.2.1.4.0 and 14.1.2.0.0), a component of Oracle Fusion Middleware, is achievable by a low-privileged attacker with network HTTP access, per Oracle's July 2026 Critical Patch Update. Successful exploitation results in complete takeover of the Imaging component with high confidentiality, integrity, and availability impact (CVSS 3.1 8.8). No public exploit has been identified at time of analysis and it is not listed in CISA KEV.
Full compromise of Oracle Unified Directory (OUD Core) is possible when a low-privileged attacker with network access sends malicious traffic over LDAP, per the July 2026 Oracle Critical Patch Update. Affected supported releases are 12.2.1.4.0 and 14.1.2.1.0, and Oracle rates the flaw as easily exploitable with a CVSS 3.1 base score of 8.8, resulting in complete takeover of the directory service. No public exploit identified at time of analysis and the CVE is not on CISA KEV, but authenticated LDAP reachability makes it a strong patching priority for exposed directory servers.
Takeover of Oracle Unified Directory is possible in the OUD Core component of Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0, where a low-privileged attacker with network access over LDAP can fully compromise the directory service. Rated CVSS 3.1 8.8 with high confidentiality, integrity, and availability impact, Oracle describes the flaw as 'easily exploitable', meaning an authenticated LDAP user can escalate to full control of the directory. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and authenticated-user prerequisite make it a high priority for LDAP-exposed deployments.
Privilege escalation to full product takeover in Oracle GoldenGate (Admin Server Executable) lets a low-privileged, network-adjacent attacker seize complete control of the GoldenGate instance over HTTPS. Affected releases span the 19c (19.1.0.0.0-19.30.0.0), 21c (21.3-21.21), and 23ai (23.4-23.26.1) branches, and Oracle rates the impact 8.8 with full confidentiality, integrity, and availability loss. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but a fix is delivered in the Oracle Critical Patch Update of July 2026.
Full takeover of Oracle Coherence is possible over the network in this Oracle Fusion Middleware Core-component flaw affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. A low-privileged attacker with TCP network access to a Coherence cluster member can leverage it to fully compromise confidentiality, integrity, and availability (CVSS 8.8). No public exploit identified at time of analysis, and the fix ships in Oracle's July 2026 Critical Patch Update.
Full compromise of Oracle Access Manager 14.1.2.1.0 (Oracle Fusion Middleware) is possible through its Authentication Engine, allowing a low-privileged attacker with HTTP network access to take over the identity and access management platform. Oracle rates this CVSS 3.1 8.8 with high impact to confidentiality, integrity, and availability, and describes it as easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full takeover of Oracle WebCenter Content (Web Content Management component) is possible when a remote, unauthenticated attacker lures a victim into interacting with malicious content over HTTP. Affecting supported versions 12.2.1.4.0 and 14.1.2.0.0, successful exploitation yields complete compromise of confidentiality, integrity, and availability (CVSS 3.1 base 8.8). No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; it was reported through Oracle's own Critical Patch Update process (July 2026).
Full takeover of Oracle WebCenter Content (Content Server component) in Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0 is achievable by a remote, unauthenticated attacker over HTTP when a legitimate user is lured into interacting with attacker-influenced content. Because the CVSS vector is AV:N/AC:L/PR:N/UI:R with high Confidentiality, Integrity and Availability impact (8.8), the flaw yields complete compromise of the content management system, though the required human interaction meaningfully narrows practical exploitation. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, so exploitation status remains theoretical based on Oracle's July 2026 CPU disclosure.
Full takeover of Oracle WebCenter Content (Content Server component) in Oracle Fusion Middleware allows a remote unauthenticated attacker to fully compromise confidentiality, integrity, and availability, but only after luring an authenticated victim into interacting with an attacker-supplied trigger (UI:R). It affects supported versions 12.2.1.4.0 and 14.1.2.0.0, carries a CVSS 3.1 base score of 8.8, and is addressed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full product takeover in Oracle WebCenter Content (Content Server component) 12.2.1.4.0 and 14.1.2.0.0 allows a remote unauthenticated attacker to compromise confidentiality, integrity, and availability by luring a victim into interacting with a malicious HTTP request or link. The flaw carries a CVSS 3.1 base score of 8.8 and results in complete takeover, but exploitation requires human interaction from a legitimate user. No public exploit identified at time of analysis and the issue is not listed in CISA KEV; it was fixed in Oracle's July 2026 Critical Patch Update.
Full takeover of Oracle WebCenter Content (Content Server component) is possible when an unauthenticated remote attacker over HTTP lures a legitimate user into interacting with malicious content, per Oracle's July 2026 Critical Patch Update. Affected supported releases are 12.2.1.4.0 and 14.1.2.0.0, and the CVSS 3.1 base score of 8.8 reflects high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so risk is currently theoretical but rated high due to the complete-compromise outcome.
Full takeover of Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) is possible when an unauthenticated remote attacker abuses a flaw in the Metadata Plugin component over HTTPS and induces an authorized user to interact with attacker-controlled content. Because the compromise yields high confidentiality, integrity, and availability impact against a central management console for Oracle estates, one successful attack can hand an adversary control of the platform. There is no public exploit identified at time of analysis and no CISA KEV listing, but the low attack complexity and unauthenticated network vector make it a priority patch in this quarter's Oracle Critical Patch Update.
Full takeover of Oracle Enterprise Command Center Framework V16 (a component of Oracle E-Business Suite) is possible for an unauthenticated attacker positioned on the same physical/adjacent network segment as the host. Oracle rates this CVSS 8.8 with high confidentiality, integrity, and availability impact, and the vector's adjacent attack surface (AV:A) plus low complexity make it trivial to exploit once network adjacency is achieved. There is no public exploit identified at time of analysis, it is not listed in CISA KEV, and no EPSS score was supplied.
Full compromise of Oracle Coherence (Core component) is possible for an unauthenticated attacker who can reach the cluster's physical communication segment, per Oracle's July 2026 Critical Patch Update. Affected releases 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 can be taken over completely, yielding high confidentiality, integrity, and availability impact (CVSS 8.8, AV:A). No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but Oracle rates it 'easily exploitable' with no privileges or user interaction required.
Full takeover of Oracle Coherence (Core component) is possible by an unauthenticated attacker positioned on the same physical communication segment as the server, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 8.8 with high impact to confidentiality, integrity and availability, and affects Fusion Middleware deployments running Coherence 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Privilege-abusing account takeover in Oracle Applications Framework (Web Utilities component) of Oracle E-Business Suite 12.2.11 through 12.2.15 lets a low-privileged, network-authenticated attacker fully compromise the framework over HTTP, gaining full confidentiality, integrity, and availability impact (CVSS 8.8). No public exploit identified at time of analysis and the CVE is not on CISA KEV; it was disclosed through the Oracle July 2026 Critical Patch Update.
Full takeover of Oracle Demantra Demand Management (versions 12.2.3 through 12.2.15) is possible when a low-privileged, network-authenticated attacker submits crafted SQL against the Product Security component, yielding complete loss of confidentiality, integrity, and availability. Oracle rates this 8.8 (CVSS 3.1) and addresses it in the July 2026 Critical Patch Update; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The 'via SQL' wording combined with the tags points to a SQL-injection-class weakness in an authenticated interface.
Full compromise of Oracle Yard Management (part of Oracle E-Business Suite, Internal Operations component) is possible for a low-privileged, network-authenticated attacker over HTTP, per Oracle's July 2026 Critical Patch Update. Affecting supported versions 12.2.6 through 12.2.15, the flaw carries a CVSS 3.1 base score of 8.8 and, on successful exploitation, results in complete takeover of the Yard Management application with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Account takeover in Oracle Public Sector Financials (a module of Oracle E-Business Suite, Internal Operations component) allows a low-privileged, network-adjacent attacker to fully compromise the product over HTTP. Any authenticated user with minimal EBS privileges can escalate to complete control of the Public Sector Financials application (CVSS 8.8, high confidentiality/integrity/availability impact). There is no public exploit identified at time of analysis, but Oracle E-Business Suite is a recurring, high-value target for post-authentication attacks, and the July 2026 Critical Patch Update remediates it.
Account takeover in Oracle Public Sector Payroll (a component of Oracle E-Business Suite 12.2.3 through 12.2.15) lets a low-privileged, network-adjacent attacker fully compromise the module over HTTP. The CVSS 3.1 base score of 8.8 reflects complete confidentiality, integrity, and availability impact, and the flaw resides in the Internal Operations component. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the fix ships in Oracle's Critical Patch Update for July 2026.
Remote code execution / full-server takeover in Oracle WebLogic Server (Fusion Middleware Core component) allows a low-privileged attacker with network access via the RMI protocol to fully compromise the server. Affected supported versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, with CVSS 3.1 base score 8.8 and full confidentiality, integrity and availability impact. There is no public exploit identified at time of analysis and the CVE is not on CISA KEV, but WebLogic RMI flaws are a historically favored target, so patching from the July 2026 Oracle CPU should be prioritized.
Privilege escalation via authentication bypass in libssh affects servers that enable GSSAPIKeyExchange, where the gssapi-keyex authentication path fails to confirm that the authenticated Kerberos principal is actually authorized for the local user account being requested. An already-authenticated client holding any valid Kerberos principal in the realm can therefore log in as an arbitrary user, including potentially privileged accounts, on Red Hat Enterprise Linux 8, 9, and 10 and Red Hat Hardened Images. No public exploit is identified at time of analysis and the issue is not listed in CISA KEV, but the CVSS of 8.8 reflects a straightforward, low-complexity abuse once a valid Kerberos credential is held.
Full takeover of Oracle Coherence (part of Oracle Fusion Middleware, Core component) is possible by an unauthenticated attacker positioned on the same physical/adjacent network segment as the affected host, per Oracle's July 2026 Critical Patch Update. The flaw is rated CVSS 3.1 8.8 with high confidentiality, integrity, and availability impact and is described by Oracle as easily exploitable, though no public exploit identified at time of analysis and it is not listed in CISA KEV. Affected supported releases are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.
Arbitrary code execution within the sandbox in Google Chrome prior to 150.0.7871.182 via a type confusion flaw in the WebAudio API. A remote attacker can craft an HTML page that, when opened by a victim, triggers memory corruption leading to code execution in the renderer process. No public exploit or active exploitation has been identified, and EPSS indicates a low exploitation probability despite a high CVSS score.
Arbitrary code execution inside the renderer sandbox in Google Chrome before version 150.0.7871.182 due to an input validation flaw in the WebAudio implementation when handling a crafted HTML page. An attacker can execute arbitrary code within the sandbox by luring a user to a malicious site. No active exploitation reported; a vendor patch is available.
Stack buffer overflow in V8, Chrome's JavaScript engine, enables remote code execution confined to the renderer sandbox when a victim visits a specially crafted HTML page. Affects all Google Chrome releases prior to 150.0.7871.182 on all desktop platforms. No public exploit code or active exploitation has been confirmed at time of analysis; vendor-released patch 150.0.7871.182 is available and should be applied immediately given the broad attack surface.
Use-after-free in the Google Chrome UI component (fixed in 150.0.7871.182) allows a remote attacker to induce heap corruption when a victim visits a crafted HTML page and performs specific UI gestures, potentially leading to arbitrary code execution in the renderer. Rated High by Chromium and CVSS 8.8; no public exploit identified at time of analysis, though the vendor patch is available. Exploitation is gated on user interaction, reducing drive-by risk relative to zero-click browser bugs.
Full compromise of Oracle PeopleSoft Enterprise FIN Cash Management 9.2 is possible by a low-privileged user who already has logon access to the infrastructure hosting the application. Because the flaw carries a scope change, a successful attack can pivot beyond the Cash Management module to significantly impact additional Oracle products, resulting in complete takeover of the affected component. Fixed in the Oracle July 2026 Critical Patch Update; no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Full compromise of Oracle SDP Number Portability (a Service Delivery Platform component of Oracle E-Business Suite versions 12.2.3 through 12.2.15) is achievable by a low-privileged attacker who already holds a logon on the host where the product runs; because the CVSS scope is changed, a successful attack can pivot to significantly impact other products beyond the vulnerable component. The flaw yields high confidentiality, integrity and availability impact and results in product takeover. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Privilege escalation in Mozilla Firefox's DOM Content Processes component allows an attacker who influences a sandboxed content process to break out of the renderer sandbox and gain elevated privileges on the host, affecting Firefox before 153 and Firefox ESR before 140.13. Mozilla assigns a critical CVSS of 9.8, though the 'content process' scope suggests the practical entry point is attacker-controlled web content rather than a fully unauthenticated network service. No public exploit is identified at time of analysis, and the EPSS exploitation probability is very low (0.15%, 5th percentile).
Privilege escalation in Mozilla Firefox's DOM Navigation component allows remote attackers to elevate privileges, and given the CVSS network vector (AV:N/PR:N/UI:N) an attacker could compromise confidentiality, integrity, and availability without authentication or user interaction. The flaw affects Firefox before version 153 and Firefox ESR before 140.13, and was fixed by Mozilla in those releases. No public exploit identified at time of analysis, and EPSS exploitation probability is low (0.15%, 5th percentile).
Use-after-free in the WebRTC Audio/Video component of Mozilla Firefox allows a remote attacker to corrupt memory and potentially achieve arbitrary code execution when a victim visits a malicious page or joins a crafted WebRTC session. All Firefox builds prior to 153 and ESR builds prior to 140.13 are affected, with high impact to confidentiality, integrity and availability. There is no public exploit identified at time of analysis and the EPSS probability is low (0.15%), but browser memory-corruption bugs of this class are historically attractive exploitation targets.
Privilege escalation in the WebExtensions subsystem of Mozilla Firefox lets a WebExtension gain capabilities beyond its granted permission set, corresponding to CWE-269 (Improper Privilege Management). Mozilla, the reporting vendor, fixed the issue in Firefox 153 and Firefox ESR 140.13 (advisories MFSA2026-68/70/71/72). No public exploit has been identified at time of analysis and the EPSS probability is low at 0.14% (4th percentile), despite the vendor-supplied 9.8 CVSS score.
Privilege escalation in Mozilla Firefox's DOM Content Processes component allows attackers to escape or elevate beyond the sandboxed content process, gaining higher browser privileges on affected versions prior to Firefox 153. The flaw is a CWE-269 improper privilege management issue reported by Mozilla and patched in Firefox 153 (advisory MFSA2026-68). No public exploit has been identified and EPSS is low (0.14%, 4th percentile), indicating no observed exploitation activity at time of analysis despite the high CVSS 9.8 rating.
Privilege escalation in Mozilla Firefox's DOM Navigation component (fixed in Firefox 153) allows an attacker to improperly gain elevated privileges within the browser, per Mozilla advisory MFSA2026-68. The flaw carries a CVSS 9.8 rating claiming full confidentiality, integrity, and availability impact with no privileges or user interaction, though this is atypical for a browser DOM bug. There is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.14%, 4th percentile).
Privilege escalation in Mozilla Firefox's DOM: Workers component lets remote attackers gain elevated privileges within the browser through web-facing content, potentially enabling sandbox/privilege boundary compromise. The flaw was resolved in Firefox 153 and is described in Mozilla advisory MFSA2026-68. There is no public exploit identified at time of analysis, and the EPSS score is low (0.14%, 4th percentile), indicating no evidence of active or imminent widespread exploitation.
Privilege escalation in Mozilla Firefox's Data Loss Prevention (DLP) component allows an attacker to gain elevated privileges beyond those intended for the affected process or policy context, with all confidentiality, integrity, and availability impacts rated high. Mozilla assigned a CVSS base score of 9.8, though the network/unauthenticated vector conflicts with the 'privilege escalation' framing typical of local flaws. There is no public exploit identified at time of analysis, and EPSS estimates only a 0.13% exploitation probability (3rd percentile), indicating low near-term real-world weaponization despite the high CVSS.
Privilege escalation to full application takeover in Oracle PeopleSoft Enterprise SCM Supplier Contract Management 9.2 (Security component) lets a low-privileged attacker with logon access to the hosting infrastructure compromise the module, with a scope change that can significantly impact additional connected products. The flaw carries an Oracle-assigned CVSS 3.1 score of 8.8 with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not in CISA KEV, though it is remediated in Oracle's July 2026 Critical Patch Update.
Remote denial of service in Ollama (HEAD f0078ae) allows unauthenticated attackers to crash the entire server by uploading a sub-1KB crafted GGUF file whose attacker-controlled string lengths, tensor dimension counts, and metadata array counts are trusted as allocation sizes without bounds checking against the remaining file size. Reachable through the blob upload plus model create/pull API endpoints, the flaw triggers unrecoverable Go runtime out-of-memory fatal errors or makeslice panics that bypass the server's recovery middleware, taking down the whole process rather than a single request. No public exploit is identified at time of analysis and the CVE is not in CISA KEV, but a vendor patch is available and VulnCheck has published an advisory.
Uncontrolled native-memory consumption in Netty's SPDY-to-HTTP codec (SpdyHttpDecoder) lets a remote unauthenticated peer exhaust off-heap memory and crash the server. Affected versions are 4.2.0.Final–4.2.15.Final and 4.1.0.Final–4.1.135.Final; the decoder allocates a pooled ByteBuf for an in-flight SYN_STREAM request but fails to release it when the stream is aborted via RST_STREAM or when content exceeds maxContentLength. There is no public exploit identified at time of analysis, and this CVE is not listed in CISA KEV; impact is denial of service only (VC:N/VI:N/VA:H).
Remote denial of service in the Netty networking framework (codec-haproxy module) versions 4.1.0.Final through 4.1.135 and 4.2.0.Final through 4.2.15.Final lets unauthenticated attackers exhaust JVM direct memory. The HAProxyMessageDecoder mis-parses a PROXY protocol v2 header whose version byte is 0xFF, sign-extending it to -1, which collides with the decoder's 'need more data' sentinel, so ByteToMessageDecoder accumulates inbound bytes in an unbounded cumulation buffer until the process runs out of direct memory. No public exploit identified at time of analysis; the CVSS 4.0 score of 8.7 reflects high availability impact with no confidentiality or integrity effect.
Error-based SQL injection in the DHIS2 core SqlView API (the `filter` parameter of `/api/sqlViews/{viewId}/data.json`) lets an authenticated user who has access to a SqlView inject arbitrary SQL that PostgreSQL evaluates, with the result reflected in the application error message to exfiltrate arbitrary database content. It affects DHIS2 core across the 2.37 through 2.44 lines (2.37-2.39 reached end-of-support on 2026-06-09), and the root cause is an unquoted column name concatenated into the query, fixed in PR #24162 by wrapping it in SqlUtils.quote(). There is no public exploit identified at time of analysis and no CISA KEV listing, but the vendor-issued GHSA advisory and CVSS 8.8 mark it as a high-priority patch for any DHIS2 instance where SqlView access is broadly granted.
Denial of service in Amazon's smithy-rs code generation framework allows remote attackers to abort the process via stack exhaustion by sending a small request containing deeply nested data that matches a recursive model shape. The flaw affects generated deserializers for JSON, CBOR, and XML across the AWS SDK for Rust and any custom clients or servers built with smithy-rs codegen; because deserialization runs before business logic, a compact malicious payload can crash the target. This carries a CVSS 4.0 base score of 8.7 (availability-only impact), and no public exploit was identified at time of analysis.
Data compromise in Oracle Service Fulfillment Manager (Fulfillment Engine component of Oracle E-Business Suite) allows a high-privileged, authenticated attacker with HTTP network access to read, create, delete, or modify all data accessible to the application, with a scope change that may significantly impact additional Oracle products. Affected releases span 12.2.3 through 12.2.15, and Oracle rates it CVSS 8.7 (confidentiality and integrity impact, no availability impact). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though it is addressed in the Oracle July 2026 Critical Patch Update.
Unauthenticated information disclosure in Feedbin (self-hosted RSS reader, commit 739884a) lets remote attackers read any user's private article content via GET /api/v2/entries/:id/text, which explicitly skipped the authorization filter. Because entry IDs are sequential integers, an attacker can enumerate and harvest plain-text bodies of private newsletters, page-saves, and articles from every user's private subscriptions across the instance. No public exploit identified at time of analysis, though a technical write-up describing the flaw exists; the CVSS 4.0 base score is 8.7 (High) driven purely by confidentiality impact.