Incorrect Authorization in Kibana's Machine Learning management endpoint allows a low-privileged authenticated user to manipulate ML audit and notification records for arbitrary jobs across any space or user boundary. The endpoint validates only a coarse ML access privilege without enforcing resource-level authorization, and then uses Kibana's internally elevated credentials to write to restricted ML system indices on behalf of the requesting user. No public exploit has been identified at time of analysis, and CVSS scores this at Medium (4.3) given the limited integrity-only impact scope.
Incorrect authorization enforcement in Gitea's team API routes exposes private repository metadata and activity feed entries to public-only access tokens. Affected versions through 1.26.2 allow an authenticated team member holding a public-only scoped token to bypass the intended access restriction and retrieve private team repository listings and private activity feed data via /api/v1/teams/{id} endpoints. Publicly available exploit code (PoC) has been verified against Gitea 1.26.2 and nightly builds; no KEV listing at time of analysis. EPSS data not provided, but the CVSS score of 4.3 and limited confidentiality impact (metadata only, no code exfiltration) suggest moderate real-world risk.
Clickjacking exposure in HCL IntelliOps Event Management (IEM) allows network-based attackers to embed the application inside a malicious webpage via an iframe and deceive authenticated users into performing unintended administrative or operational actions. All tracked versions under the CPE wildcard are affected, per HCL advisory KB0132378. No public exploit identified at time of analysis, and the CVSS score of 3.1 (Low) reflects the non-trivial attack complexity and limited integrity-only impact.
Private repository metadata and issue titles leak to revoked Gitea users via two REST API endpoints that omit post-revocation authorization checks, constituting an incomplete fix relative to CVE-2026-20800. Former collaborators with a still-valid API token can call `GET /api/v1/user/starred` to receive full repository objects - including `clone_url` and `ssh_url` - for private repos they starred, and `GET /api/v1/user/times` to retrieve private issue titles and states for issues on which they logged time, indefinitely after repo access is revoked. Impact is metadata-only; no public exploit code has been identified at time of analysis and no CISA KEV listing exists.
Improper deserialization of untrusted data in NVIDIA Transformers4Rec (all versions per CPE wildcard) exposes systems running the library to code execution, data tampering, and information disclosure via a local attack path. The official CVSS vector assigns C:N/I:N/A:L - a score of 4.3 - which is materially inconsistent with the vendor's own description of potential remote code execution and data tampering; this discrepancy warrants independent verification with NVIDIA's product security team. No public exploit code has been identified at time of analysis, and KEV status is not confirmed.
Cleartext transmission of sensitive information in Zohocorp ManageEngine Endpoint Central before version 11.4.2528.34 exposes mail configuration credentials to network interception. Authenticated users who trigger mail-related functionality cause the application to transmit sensitive data - likely SMTP credentials and server configuration - without encryption, making it capturable by any attacker with a network vantage point between the client and server. No public exploit code or active exploitation (CISA KEV) has been identified; the CVSS score of 4.3 (Medium) reflects the limited scope and authentication prerequisite.
Heap out-of-bounds read in libsoup's multipart HTTP message parser allows remote attackers to crash affected applications or leak heap memory contents. An integer type mismatch between the calling code and soup_headers_parse() causes the length parameter to be incorrectly truncated, enabling a read beyond the allocated heap buffer boundary. No active exploitation has been identified (no CISA KEV listing, no public POC), and the CVSS score of 4.2 with AC:H/UI:R reflects meaningful real-world friction for successful exploitation.
Oracle HRMS (US) Internal Operations component in E-Business Suite versions 12.2.3 through 12.2.15 exposes a network-accessible flaw that allows a low-privileged authenticated attacker to read a subset of HRMS data and cause partial denial of service via HTTP under high-complexity conditions. Disclosed by Oracle via the July 2026 Critical Patch Update (CPU), the vulnerability carries a CVSS 3.1 score of 4.2 (Medium), with no public exploit and no active exploitation confirmed at time of analysis. The high attack complexity (AC:H) materially constrains real-world exploitability despite the network-accessible attack vector.
Partial authorization bypass in Oracle Contracts Integration (Oracle E-Business Suite 12.2.3-12.2.15) allows an authenticated low-privileged network attacker to perform unauthorized read, insert, update, or delete operations against a subset of contract data via HTTP under high-complexity conditions. Tagged as an Authentication Bypass, suggesting the flaw permits a low-privileged session to exceed its intended access boundary within the Internal Operations component. No public exploit code or CISA KEV listing has been identified at time of analysis, and the high attack complexity substantially limits opportunistic exploitation.
Oracle Enterprise Asset Management (EAM), a component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, exposes an authentication bypass condition in the Internal Operations component that allows a low-privileged, network-authenticated attacker to read and tamper with a subset of EAM data. Despite the medium CVSS score of 4.2, the 'Authentication Bypass' tag signals that a legitimately low-privileged account can cross authorization boundaries within the application. No public exploit code exists and this vulnerability is not listed in CISA KEV, making it a moderate but non-urgent priority for most organizations.
Unauthorized data access and manipulation is possible in Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.5) via a flaw in the Siebel Cloud Manager component, tagged as an Authentication Bypass. An unauthenticated attacker positioned on the same physical network segment as the hosting hardware can, under high-complexity conditions, read a subset of accessible CRM data and perform unauthorized inserts or modifications. No confirmed active exploitation (CISA KEV) and no public proof-of-concept have been identified at time of analysis, and the CVSS 4.2 score accurately reflects the constrained adjacency and complexity requirements.
Missing X-Content-Type-Options headers in Intelliops Event Management enable content-type sniffing attacks leading to script injection under man-in-the-middle conditions when user-controlled input is reflected. Exploitation requires high attack complexity, user browser interaction, and network positioning, with low integrity impact only (CVSS 3.1). No active exploitation or public exploit code identified.
Oracle Interaction Blending within E-Business Suite exposes a network-accessible RMI interface flaw that allows a high-privileged attacker to partially compromise confidentiality, integrity, and availability of application data. Affected deployments span versions 12.2.3 through 12.2.15 of the Internal Operations component. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, placing it at low immediate operational priority despite the triple-impact scope.
Denial-of-service exposure in MySQL Server and MySQL Cluster's Replication component allows a high-privileged local attacker to repeatedly crash or hang the database service under difficult-to-reproduce conditions. Affected are MySQL Server versions 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. Oracle addressed this in the July 2026 Critical Patch Update; no public exploit code or active exploitation has been identified at time of analysis.
Oracle Labor Distribution, an Internal Operations component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, permits a high-privileged local attacker to compromise data integrity by creating, deleting, or modifying critical application data. Despite carrying an 'Authentication Bypass' tag in available intelligence, the CVSS vector (AV:L/AC:H/PR:H) constrains exploitation to actors who already possess elevated logon access to the underlying infrastructure - suggesting an internal authorization bypass rather than a full authentication circumvention. No public exploit code exists and no active exploitation has been identified; this was disclosed as part of Oracle's Critical Patch Update for July 2026.
Insecure mmap backing-file creation in Data::DisjointSet::Shared (Perl/CPAN) before 0.02 exposes inter-process IPC payloads to any local user on the host. The module's dsu.h creates the shared segment with open(path, O_RDWR|O_CREAT, 0666), resulting in a 0644-mode file under the default umask - readable by all local accounts - typically placed in /tmp or /dev/shm. The absent O_EXCL flag silently adopts a pre-planted file, and the absent O_NOFOLLOW flag follows symlinks at the target path, enabling a local attacker to either read IPC data or redirect file operations. No active exploitation confirmed; EPSS is 0.16% (6th percentile), consistent with the niche deployment footprint.