Inconsistent access control enforcement in Joomla! CMS REST API webservice endpoints allows authenticated users with insufficient permissions to perform mutation operations that are explicitly restricted in the backend UI, effectively bypassing the platform's ACL system. Affected deployments span Joomla 4.0.0 through 5.4.7 and 6.0.0 through 6.1.2, covering both actively maintained long-term and current release branches. No public exploit code or active exploitation has been confirmed at time of analysis, though the Authentication Bypass classification and CWE-284 root cause indicate the ACL gap is structurally straightforward to discover and abuse by any user with a valid session.
Unauthorized data access and partial data manipulation in Oracle Helidon 3.2.18's Imperative Web Server component allows a low-privileged attacker with HTTP network access to gain complete read access to all Helidon-accessible data and limited write capability. The vulnerability carries a scope change, meaning successful exploitation can cascade to impact additional products beyond Helidon itself within the Oracle Fusion Middleware ecosystem. No public exploit code has been identified at time of analysis, but the low attack complexity and absence of required user interaction make this a realistic target for authenticated internal or service-account-level adversaries.
Path traversal in ArcadeDB versions before 26.8.1 enables authenticated root users to write and delete arbitrary files outside the designated database directory via the POST /api/v1/server REST API endpoint. By embedding ../ sequences within database names passed to create database or drop database commands, a root-privileged attacker can place files at arbitrary filesystem paths or recursively delete directories accessible to the server process. No public exploit has been identified and no CISA KEV listing exists, but the CVSS 4.0 score of 8.4 reflects high integrity and availability impact across both the ArcadeDB process and the underlying OS filesystem.
Server-side request forgery in RAGFlow before v0.26.3 allows authenticated users who can create or trigger agent workflows to direct the server to make HTTP requests to arbitrary internal destinations, including RFC 1918 addresses, loopback interfaces, link-local ranges, and cloud instance metadata endpoints. The vulnerable 'Invoke' component in agent/component/invoke.py bypasses the shared assert_url_is_safe validator consistently applied in other fetch paths (crawler, SearXNG, file-upload, RSS), and returns the fetched response body directly to the caller. No public exploit has been identified at time of analysis, though two patch commits are publicly visible on GitHub and the vulnerable code location is documented in the references.
Sandbox escape via link following in Google Chrome's CredentialProvider component on Windows allows a local attacker to execute arbitrary code outside the browser's security sandbox, affecting all Chrome versions prior to 151.0.7922.169. The vulnerability stems from improper symbolic link or junction resolution (CWE-59) in the CredentialProvider, a Windows-specific subsystem handling credential operations, enabling a local attacker to redirect file access operations to attacker-controlled paths. No public exploit code has been identified and CISA's SSVC assessment confirms no known exploitation; however, the full CIA triad impact and sandbox escape potential make this a meaningful local privilege boundary violation.
Local privilege escalation with scope change in Oracle Hyperion Financial Management 11.2.25.0.000 enables a low-privileged authenticated user on the host system to bypass security controls within the Security component, achieving complete unauthorized read and write access to all application data. The CVSS scope change (S:C) means successful exploitation can cascade into additional Oracle products sharing the same infrastructure, amplifying the blast radius beyond the immediate application. No public exploit code or CISA KEV listing exists at time of analysis; the vulnerability was disclosed through Oracle's Critical Security Patch Update for August 2026.
Local privilege escalation in Oracle Hyperion Financial Management 11.2.25.0.000 enables low-privileged authenticated host users to fully compromise the application's confidentiality and data integrity via a flaw in the Security component. Critically, the CVSS scope change indicator (S:C) signals that successful exploitation may cascade beyond the HFM application boundary to impact additional co-hosted Oracle products. No public exploit code has been identified at time of analysis, but the low attack complexity and absence of required user interaction make exploitation straightforward for any attacker holding a valid local system account.
Local privilege exploitation in Oracle WebCenter Content 14.1.2.0.0 enables a low-privileged, authenticated user with system logon access to fully compromise the Content Server component. The attacker can read, create, delete, or modify all data accessible within Oracle WebCenter Content, and the confirmed scope change means attacks can cascade into additional co-hosted Oracle Fusion Middleware products. No public exploit has been identified at time of analysis, but the low attack complexity and wide data impact make this a high-priority patch target for any environment running this middleware version.
Path traversal in Streambert's Electron desktop app before version 2.6.0 allows a compromised renderer process to direct the privileged main process to create directories, write renderer-controlled JSON data, and delete files at arbitrary filesystem locations outside the intended backup directory. The vulnerable `perform-scheduled-backup` IPC handler in `src/ipc/storage.js` accepts `settings.path` from the renderer without validating it against an authorized backup location, enabling traversal via absolute paths or `../../`-style sequences. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the high integrity and availability impact across both the vulnerable system and subsequent systems is reflected in the CVSS 4.0 score of 8.4.
Local privilege escalation and denial-of-service in Oracle Autonomous Health Framework's Trace File Analyzer component affects versions 26 through 26.5.2, enabling low-privileged infrastructure users to corrupt or destroy critical data and crash the framework with scope change to dependent Oracle products. The CVSS 3.1 score of 8.4 reflects ease of exploitation once local access is obtained, with no user interaction required. No public exploit or CISA KEV listing has been identified at time of analysis; this disclosure originates from Oracle's Critical Security Patch Update for August 2026.
Post revision operations in Vvveb CMS prior to 1.0.8.4 expose an Insecure Direct Object Reference that allows any authenticated Author-role user to read, restore, or delete revision records belonging to other authors. The affected controller passes caller-supplied post_id, language_id, and created_at values directly to SQL queries without enforcing admin_id ownership, enabling cross-author access across list, read, restore, and delete operations. No public exploit code has been identified at time of analysis, and a vendor-released patch is available in version 1.0.8.4.
Insecure direct object reference in Vvveb CMS prior to 1.0.8.4 allows any authenticated Vendor-role user to read, restore, and delete product revision records belonging to other Vendors by supplying arbitrary caller-controlled product_id values to the backend revision controller. All Vvveb multi-vendor deployments running versions before 1.0.8.4 are affected across MySQL, PostgreSQL, and SQLite database backends. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the low barrier to entry - only a valid Vendor session is required - makes lateral abuse within shared storefronts realistic.
Oracle Warehouse Management versions 12.2.3 through 12.2.15 - a component of Oracle E-Business Suite - exposes a high-severity vulnerability in its Internal Operations component allowing low-privileged, network-authenticated attackers to compromise confidentiality, integrity, and availability via HTTP. Successful exploitation enables unauthorized read and write access to critical warehouse management data, including creation, deletion, and modification of records, alongside a partial denial of service. No public exploit code has been identified at time of analysis, and the vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Compromise of Oracle Siebel CRM Cloud Applications (versions 22.3-26.6) is achievable by a low-privileged, network-authenticated attacker over HTTP targeting the Siebel Cloud Manager component. Successful exploitation yields unauthorized creation, deletion, or modification of critical CRM data (high integrity impact), partial unauthorized read of CRM data (low confidentiality impact), and the ability to cause a complete, repeatable denial-of-service crash of the application. No public exploit code and no CISA KEV listing are confirmed at time of analysis; EPSS data was not supplied in the source intelligence.
Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 exposes critical data and modification capabilities to low-privileged network attackers through a flaw in the BI Platform Security component, reachable via HTTP. The CVSS vector (AV:N/AC:L/PR:L/UI:N) combined with the 'Authentication Bypass' tag suggests an authenticated-but-low-privileged attacker can escalate access beyond their authorization boundary, achieving complete read and write access to all BI data plus partial availability disruption. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and high data impact make this a meaningful priority for organizations running this version.
Sandbox escape via heap-based buffer overflow in ANGLE's graphics engine on Chrome for Android allows a threat actor who has already achieved renderer process compromise to execute arbitrary code entirely outside the Chrome sandbox. All Chrome for Android versions prior to 151.0.7922.169 are affected; the vulnerability requires a two-stage exploit chain combining a separate renderer compromise with this ANGLE flaw. Google has released a patched build (151.0.7922.169); no public exploit code or CISA KEV listing has been identified at time of analysis, though the two-stage nature indicates likely use in sophisticated targeted attack chains.
Arbitrary file read in ArcadeDB's OpenCypher LOAD CSV FROM clause allows any authenticated user with read query privileges to exfiltrate arbitrary server-side files. All versions prior to 26.8.1 are affected, as confirmed by the vendor's GitHub security advisory GHSA-hfp5-6gcp-8c75. An attacker issuing a crafted LOAD CSV FROM 'file:///etc/shadow' statement receives the file contents directly in the query response, exposing credentials, private keys, and configuration data readable by the server process - no public exploit or CISA KEV listing has been identified at time of analysis.
Sandbox escape via race condition in Google Chrome's USB subsystem (all versions prior to 151.0.7922.169) enables arbitrary code execution on the host system when chained with a renderer process compromise. This is a second-stage exploit: an attacker must already have code execution within Chrome's sandboxed renderer before the USB TOCTOU race can be leveraged to cross the sandbox boundary, triggered through a crafted HTML page. No public exploit code or CISA KEV listing has been identified at time of analysis, though the scope-changed CVSS rating of 8.3 (S:C, C:H/I:H/A:H) underscores that a successful chain achieves full host-level compromise.
Insecure Direct Object Reference (IDOR) in Vvveb CMS prior to 1.0.8.4 enables any authenticated Author-role user to bypass ownership enforcement and access, duplicate, or permanently delete posts belonging to other authors. The PHP controller `admin/controller/content/posts.php` accepts a caller-controlled `filter[admin_id]` parameter that overrides the server-assigned identity restriction, and the underlying SQL layer (MySQL, PostgreSQL, and SQLite backends) lacked consistent `admin_id` enforcement on delete and list operations. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog, but the patch is available as of release 1.0.8.4.
Unauthenticated network exploitation of Oracle Helidon 4.5.3's Imperative Web Server component allows remote attackers to partially compromise confidentiality, integrity, and availability of the affected system, with a confirmed scope change meaning attacks can extend impact to additional co-located products or services. The vulnerability is rated 8.3 (High) under CVSS 3.1, elevated by the scope change despite individually low CIA impact ratings. No public exploit code has been identified at time of analysis, and Oracle disclosed this through its August 2026 Critical Patch Update.
Unvalidated protocol forwarding in Streambert's open-external IPC handler (src/ipc/downloads.js) allows a compromised renderer to pass arbitrary URIs - including file: and OS-registered custom schemes - directly to shell.openExternal, enabling local file access, invocation of system protocol handlers, and potential script execution on the host OS. All Streambert versions prior to 2.6.0 are affected. No public exploit identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Oracle BI Publisher's BI Platform Security component allows a low-privileged, network-adjacent attacker to compromise confidentiality, integrity, and availability of the platform via HTTP without user interaction. Affected versions span the full supported lifecycle - 8.2.0.0.0, 12.2.1.4.0, and the current 26.01.0.0.0 - making this broadly applicable across Oracle Analytics deployments. The flaw is tagged as an authentication bypass, meaning a minimally authenticated user may escalate access well beyond their assigned privileges to read or destroy critical report data and partially disrupt service. No public exploit or CISA KEV listing has been identified at time of analysis.
Unauthenticated remote exploitation of Oracle Helidon 4.5.3's Imperative Web Server component allows network attackers over HTTP to achieve partial confidentiality disclosure, data manipulation, and denial of service - with a confirmed scope change indicating the impact can extend to components beyond Helidon's own security boundary. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C) places this among the most easily reachable vulnerability classes: no credentials, no user interaction, and no elevated complexity required. Disclosed in Oracle's August 2026 Critical Security Patch Update, no public exploit code or CISA KEV listing has been identified at time of analysis.
Secret environment variable disclosure in MagicMirror² before 2.37.0 allows adjacent network attackers to recover live SECRET_* credential values by exploiting a logic inversion in the socket dispatcher. The hideConfigSecrets feature is intended to redact environment secrets from browser-facing config responses, but the node_helper socket catch-all unconditionally expands **SECRET_NAME** placeholders in every inbound payload before routing to module helpers. Any unauthenticated client connected to a module namespace (such as the default weather helper) can submit a crafted INIT_WEATHER payload embedding a secret placeholder and receive the expanded real secret value echoed back in the WEATHER_ERROR response. No public exploit has been identified at time of analysis, and a vendor-released patch is available as of version 2.37.0.
Stored XSS in Trilium Notes via the #iconClass note label escalates to full operating-system code execution due to the Electron runtime's enabled nodeIntegration and disabled contextIsolation. An attacker with note-write access (CVSS PR:H) can set a crafted #iconClass attribute value that auto-executes when any victim opens a new tab or invokes quick search (Ctrl+J), granting arbitrary OS command execution as the victim user. Fixed in v0.103.0; no active exploitation (KEV) or public POC identified at time of analysis.
Unauthenticated remote exploitation of Oracle Hyperion Financial Reporting 11.2.25.0.000 allows network attackers to obtain complete access to all financial reporting data and cause a partial denial of service via HTTPS. The vulnerability resides in the Server component and is tagged as an authentication bypass, meaning no credentials are required to trigger the flaw against a network-exposed instance. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis, but the low attack complexity and zero authentication requirement make this a high-priority patch target for any organization running this specific version.
Remote unauthenticated exploitation of Oracle Business Intelligence Enterprise Edition's Pod Admin component allows attackers to access critical analytics data and cause partial service disruption over HTTP without credentials. Versions 8.2.0.0.0 and 26.01.0.0.0 are confirmed affected, with a CVSS 3.1 score of 8.2 reflecting low attack complexity and no authentication or user interaction requirement. No public exploit has been identified at time of analysis, and this vulnerability is not currently listed in the CISA KEV catalog; Oracle has addressed it in the August 2026 Critical Patch Update.
Unauthenticated remote access to sensitive financial data in Oracle Hyperion Financial Management 11.2.25.0.000 is possible via a network-accessible HTTP attack against the Security component. The CVSS vector confirms no authentication, no user interaction, and no special conditions are required, placing this squarely in the high-severity, easily exploitable category. Successful exploitation yields complete read access to all data accessible by the application and a partial denial of service, making this a critical risk for financial institutions running the affected build. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated remote exploitation of Oracle Hyperion Financial Management 11.2.25.0.000 exposes the Security component to authentication bypass via HTTP, enabling attackers to read critical or all accessible financial data and inflict a partial denial of service. The vulnerability is rated CVSS 8.2 (High) with a low-complexity, network-accessible attack vector requiring no privileges or user interaction. No public exploit code or CISA KEV listing has been identified at the time of analysis, though the authentication bypass tag and unauthenticated attack surface make this a meaningful priority for any organization running the affected version.
Unauthenticated remote access to Oracle Siebel CRM Integration's REST component (versions 17.0 through 26.6) exposes all CRM integration data to unauthorized disclosure and enables partial denial of service via plain HTTP. The vulnerability requires no credentials, no user interaction, and no special configuration beyond the REST interface being reachable, making it exploitable by any network-adjacent or internet-facing attacker. No public exploit has been identified at time of analysis, but Oracle's Critical Patch Update for August 2026 confirms the issue and its severity classification of CVSS 8.2.
Unauthenticated remote exploitation of Oracle Advanced Inbound Telephony (versions 12.2.3-12.2.15) within Oracle E-Business Suite allows a network attacker to perform unauthorized creation, deletion, or modification of critical telephony data and cause a partial denial of service via HTTPS. The CVSS 3.1 base score of 8.2 reflects high integrity impact and low availability impact with no confidentiality exposure. No public exploit code or active exploitation (CISA KEV listing) has been identified at time of analysis.
Remote denial-of-service and partial data exposure in Oracle Helidon 4.5.0 allows unauthenticated network attackers via HTTP/2 to cause a complete hang or crash of the Helidon Imperative Web Server, alongside unauthorized read access to a subset of accessible data. The vulnerability is classified as easily exploitable with no authentication, user interaction, or special configuration required. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and network-accessible vector make this a realistic denial-of-service threat against any exposed Helidon 4.5.0 deployment.
Broken authentication in SupportCandy WordPress plugin versions up to and including 3.5.1 allows unauthenticated remote attackers to bypass access controls and invoke privileged plugin functionality without credentials. The vulnerability, rooted in CWE-266 (Incorrect Privilege Assignment), exposes customer support ticket data - potentially including personally identifiable information - to any external party with network access to the site. No public exploit code or CISA KEV listing has been identified at time of analysis, though the zero-authentication, low-complexity attack path makes exploitation trivial against any unpatched installation.
Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 within the Fusion Middleware stack expose an unauthenticated remote attack surface over HTTP, enabling network-accessible attackers to perform unauthorized creation, deletion, or modification of critical content data across all accessible WebCenter Sites instances, as well as cause a partial denial of service. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L) confirms minimal attack complexity with no authentication or user interaction required, which Oracle's own advisory characterizes as 'easily exploitable'. No public exploit or CISA KEV listing has been identified at time of analysis, though the zero-prerequisite exploitation profile elevates urgency for exposed deployments.
Unauthenticated remote exploitation of Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 allows network-adjacent or internet-facing attackers to perform unauthorized creation, deletion, or modification of critical content data, and to partially degrade service availability via HTTP. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms that no authentication, user interaction, or special configuration is required, placing this in the highest-risk category for unauthenticated web vulnerabilities. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis, but the low attack complexity warrants prompt remediation.
Remote unauthenticated denial-of-service and partial data integrity compromise in Oracle MySQL Cluster's NDB Operator component allows network attackers to crash or hang the cluster and perform unauthorized data modifications. Affected versions span three active release lines: 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog, but the low attack complexity and zero authentication requirement make exploitation straightforward against exposed deployments.
Oracle WebCenter Content's Content Server component, within the Oracle Fusion Middleware stack, exposes a network-reachable integrity compromise affecting versions 12.2.1.4.0 and 14.1.2.0.0. High-privileged authenticated attackers can access the service via HTTP to arbitrarily create, delete, or modify critical repository data, read a subset of accessible content, and cause partial denial of service - with a confirmed scope change indicating potential cascading impact on additional Oracle Fusion Middleware products. No public exploit code or CISA KEV listing has been identified at time of analysis.
Multi-factor authentication bypass in Joomla! CMS versions 4.0.0 through 5.4.7 and 6.0.0 through 6.1.2 allows remote attackers to circumvent 2FA controls and gain authenticated access using only the first-factor credential. Insufficient state validation in the MFA flow exposes a logic path that skips the second-factor verification step entirely. No public exploit or CISA KEV listing has been identified at the time of analysis, though the vulnerability's network accessibility and lack of required privileges make it a meaningful account-takeover risk for any Joomla site with MFA-enrolled users.
Authentication bypass in Oracle Hyperion Data Relationship Management 11.2.25.0.000 exposes all DRM-managed master data to unauthenticated remote attackers over HTTPS. The flaw resides in the Access and Security component - the gatekeeper for the application - and permits complete read access to critical DRM data alongside limited unauthorized write capability. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS vector (PR:N, AC:L) confirms trivial unauthenticated exploitability from any network-adjacent position with HTTPS reachability.
Unauthenticated remote access to critical HR data is possible in Oracle HCM Common Architecture (Knowledge Integration component) across versions 12.2.3 through 12.2.15 of Oracle E-Business Suite, exploitable over HTTP without credentials or user interaction. Successful exploitation yields full read access to all HCM-accessible data and partial write capability (insert/update/delete) against some HCM data stores, as confirmed by Oracle's own CVSS breakdown (C:H, I:L). Tagged as an authentication bypass by Oracle's security team, this represents a significant exposure for any organization running HCM within a network-reachable deployment. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated remote exploitation of the File Transmission component in Oracle Payments (E-Business Suite 12.2.3-12.2.15) allows network-accessible attackers over HTTP to gain complete read access to all Oracle Payments data and perform limited unauthorized write operations. Oracle classifies this as 'easily exploitable' with a CVSS 3.1 score of 8.2, and the Authentication Bypass tag confirms no credentials are required. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-prerequisite attack profile makes this a high-priority patching target for any organization running Oracle EBS with the Payments module active.
Authentication bypass in Oracle WebCenter Sites (versions 12.2.1.4.0 and 14.1.2.0.0) enables unauthenticated remote attackers to gain unauthorized read access to critical application data and perform limited write operations via HTTP. Rated CVSS 8.2, this flaw requires no credentials, no user interaction, and no special network position, making it exploitable against any internet-exposed WebCenter Sites deployment. No public exploit code has been identified at time of analysis; the vulnerability was disclosed through Oracle's August 2026 Critical Patch Update.
Unauthenticated remote access in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 exposes the full confidential data set accessible to the platform and permits limited unauthorized data modification via standard HTTP, with no credentials or user interaction required. Oracle confirmed this in its August 2026 Critical Patch Update (CPU), classifying it as easily exploitable with a network attack vector. No public exploit code or CISA KEV listing has been identified at time of analysis, but the authentication bypass nature and low attack complexity make this a high-priority remediation target for all organizations running the affected versions.
Oracle Hyperion Data Relationship Management (DRM) version 11.2.23.0.000 exposes its Web Client - Unicode component to unauthenticated remote attackers over HTTP. Exploitation allows complete read access to all DRM-accessible data - which in a master data management context often includes sensitive financial hierarchies and organizational structures - plus the ability to induce a partial denial of service. No public exploit has been identified at time of analysis, but the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates trivially low attack complexity with no authentication barrier.
Path traversal in Grav CMS before 2.0.15 allows unauthenticated remote attackers to read arbitrary files from sibling directories outside the intended asset root by exploiting a string prefix collision in the static asset handler. The index.php front controller validates asset paths using a simple string prefix check rather than normalized directory-boundary logic, so a request for /assets-private/credentials.yaml passes validation when /assets is the configured base. No public exploit code has been identified and this vulnerability is not in the CISA KEV catalog; the CVSS 4.0 score of 8.2 reflects high confidentiality risk conditioned on a specific deployment layout (AT:P) rather than universal exploitability.
Remote unauthenticated access to the Forge component of Oracle Commerce Guided Search and Oracle Commerce Experience Manager 11.4.0 allows network-based attackers to read all data accessible to the platform and inflict partial denial of service via ordinary HTTP requests. The CVSS vector confirms no authentication, user interaction, or special configuration is required, placing this firmly in the automatable, high-priority tier. No public exploit has been identified at time of analysis, but the vulnerability is addressed in Oracle's Critical Security Patch Update for August 2026.
The Common Events component of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 exposes an unauthenticated network-accessible attack path requiring victim interaction, enabling complete unauthorized read access to all Hyperion-accessible data and limited write capability through a scope-changing exploit. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N) combined with the Authentication Bypass tag and scope change indicator is strongly consistent with a client-side injection flaw - such as reflected XSS or CSRF - in the Common Events interface that can hijack or bypass authenticated session controls. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog.
Unauthenticated remote exploitation of Oracle WebCenter Portal's Runtime Tools component (versions 12.2.1.4.0 and 14.1.2.0.0) enables a network-based authentication bypass over HTTP, contingent on a single human-interaction step by a target user. Successful exploitation yields complete confidentiality exposure of all data accessible to the portal instance and limited unauthorized write capability, with scope-change implications that can cascade into co-hosted Oracle Fusion Middleware products. Oracle confirmed the issue through its August 2026 Critical Patch Update; no public exploit code or CISA KEV listing has been identified at time of analysis.
Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 expose a network-accessible, unauthenticated vulnerability in the Content Server component that can be triggered via HTTP with user interaction, resulting in a scope change affecting additional products. Successful exploitation grants attackers complete read access to all data accessible within Oracle WebCenter Content and limited write capabilities (insert/update/delete) against some accessible data. No public exploit or CISA KEV listing has been identified at time of analysis, though the Oracle-assigned tag of 'Authentication Bypass' and the high CVSS score of 8.2 warrant prompt patching within Oracle Critical Patch Update cycles.
Remote exploitation in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 (Endeca Application Controller component) allows unauthenticated network attackers to achieve a scope change, compromising confidentiality of all data accessible to the Oracle Commerce platform and enabling limited unauthorized data modification. The attack requires victim interaction, suggesting a client-side exploitation vector such as cross-site scripting or cross-site request forgery that bypasses authentication controls per the advisory's Authentication Bypass tag. Disclosed under the Oracle August 2026 Critical Patch Update with a CVSS 8.2 High rating; no public exploit or active exploitation confirmed at time of analysis.