Full takeover of Oracle iSetup 12.2.3 through 12.2.15 is achievable by a low-privileged, network-adjacent attacker via HTTP, targeting the General Ledger Update Transform and Reports component within Oracle E-Business Suite. Successful exploitation results in complete compromise of confidentiality, integrity, and availability of the affected instance. No public exploit code and no CISA KEV listing have been identified at time of analysis; however, the full-takeover impact (C:H/I:H/A:H) and network accessibility elevate the urgency of patching relative to other Oracle CPU entries in this cycle.
Full takeover of JD Edwards EnterpriseOne US Payroll version 9.2 is achievable by a low-privileged, network-adjacent attacker via the JDENET protocol, with successful exploitation yielding complete confidentiality, integrity, and availability compromise of the payroll system. Oracle rates this High severity (CVSS 7.5) under the August 2026 Critical Patch Update; the high attack complexity (AC:H) is the primary barrier to mass exploitation. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Full takeover of Oracle Siebel CRM's Marketing component is achievable by a low-privileged, network-accessible attacker exploiting a difficult-to-trigger condition via HTTP, affecting all supported versions from 17.0 through 26.6. Successful exploitation results in complete confidentiality, integrity, and availability compromise of the Marketing module - effectively a full component takeover. No public exploit code has been identified and the vulnerability is not listed in CISA's KEV catalog; however, Oracle's August 2026 Critical Patch Update confirms the flaw and releases a remediation.
Denial of service in NVIDIA Triton Inference Server for Linux exposes AI inference infrastructure to remote disruption through improper input validation. Unauthenticated network attackers can crash or render unresponsive the inference server by submitting malformed inputs, with CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) confirming no authentication or user interaction is required. No public exploit code has been identified at time of analysis, and CISA KEV listing is absent, but the low attack complexity and zero-authentication requirement make this a meaningful availability risk for any Triton deployment reachable from untrusted networks.
Unbounded resource allocation in NVIDIA Triton Inference Server for Linux allows remote, unauthenticated attackers to exhaust server-side resources and cause denial of service against all tracked versions (CPE wildcard). The CVSS 7.5 High rating reflects a fully network-accessible attack path with no privileges or user interaction required, making the exposure surface broad for any Triton deployment reachable from untrusted networks. No public exploit code has been identified at time of analysis, and exploitation has not been confirmed by CISA KEV.
Full instance takeover of Oracle Helidon 3.2.18 (Imperative Web Server component) is achievable by a low-privileged remote attacker over HTTP, though exploitation demands high attack complexity. The CVSS 3.1 score of 7.5 reflects complete confidentiality, integrity, and availability compromise - consistent with the vendor description of 'takeover' - affecting Oracle Fusion Middleware deployments running this specific release. No public exploit code or CISA KEV listing exists at time of analysis; Oracle addressed this in the August 2026 Critical Security Patch Update (CSPU).
Full system takeover in Oracle Agile PLM MCAD Connector 3.6 is achievable by a low-privileged network attacker via HTTP, resulting in complete compromise of confidentiality, integrity, and availability of the connector. The vulnerability resides in the CAX Client component and carries a CVSS 3.1 score of 7.5, moderated by high attack complexity. No public exploit code and no CISA KEV listing have been identified at time of analysis, suggesting this is not currently under active widespread exploitation.
Full system takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is achievable by a low-privileged remote attacker over HTTP under difficult exploitation conditions. The vulnerability resides in the Installation and Configuration component and results in complete compromise of confidentiality, integrity, and availability. No public exploit or active exploitation has been identified at time of analysis; the August 2026 Oracle Critical Security Patch Update (CSPU) addresses this flaw.
Full system takeover of Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a low-privileged, network-authenticated attacker exploiting a flaw in its Security component via HTTP. The vulnerability demands high attack complexity - indicating specific conditions must align - but successful exploitation yields complete compromise of confidentiality, integrity, and availability, consistent with a privilege escalation or security bypass in the access-control subsystem. No public exploit code or active exploitation has been identified at time of analysis; Oracle addressed this through the August 2026 Critical Patch Update.
Oracle Order Management's Product Diagnostic Tools component in Oracle E-Business Suite versions 12.2.3 through 12.2.15 can be fully compromised by a low-privileged attacker over HTTP, resulting in complete system takeover with high confidentiality, integrity, and availability impact. The attack requires low privileges and high complexity to execute, reducing the immediacy of the threat but not its severity if conditions are met. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Full takeover of Oracle Application Testing Suite 13.3.0.1 is achievable by a network-adjacent, low-privileged attacker holding the 'Load Testing for Web Apps' privilege over HTTPS. The CVSS 3.1 score of 7.5 (High) reflects total compromise of confidentiality, integrity, and availability, though Oracle classifies this as 'difficult to exploit' (AC:H), implying specific conditions must align for successful attack. No public exploit code and no CISA KEV listing have been identified at time of analysis, and EPSS data was not available in the provided intelligence.
Oracle Operations Intelligence, the Daily Business Intelligence component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, contains a network-exploitable vulnerability that allows a low-privileged authenticated attacker to achieve full takeover - encompassing complete loss of confidentiality, integrity, and availability - via crafted HTTP requests. The vendor-assigned CVSS 3.1 score of 7.5 reflects high attack complexity (AC:H), tempering immediacy despite the severe impact ceiling. No public exploit code and no CISA KEV listing have been identified at time of analysis, indicating this is not currently subject to widespread opportunistic exploitation.
Full compromise of Oracle Sales (E-Business Suite component: Internal Operations) is achievable by a low-privileged network attacker via HTTP across versions 12.2.3 through 12.2.15, with successful exploitation resulting in complete takeover - high confidentiality, integrity, and availability impact. The attack is constrained by high complexity (AC:H), meaning reliable exploitation requires meeting specific, non-trivial conditions rather than simple request crafting. Disclosed through Oracle's August 2026 Critical Security Patch Update, no public exploit or active exploitation has been identified at time of analysis.
Full takeover of Oracle General Ledger (versions 12.2.3 through 12.2.15) is achievable by a low-privileged, network-authenticated attacker via HTTP, exploiting an undisclosed flaw in the Internal Operations component of Oracle E-Business Suite. The CVSS vector confirms complete confidentiality, integrity, and availability impact (C:H/I:H/A:H), consistent with application-level takeover. Notably, the intelligence tags classify this as 'Information Disclosure,' which conflicts with the described takeover impact - this discrepancy warrants verification against the Oracle August 2026 CSPU advisory. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Full server takeover of Oracle WebLogic Server is achievable by a low-privileged network attacker exploiting a flaw in the Core component via the T3 or IIOP protocols. All four currently supported versions - 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 - are confirmed affected per Oracle's Critical Patch Update for August 2026. Although High Attack Complexity (AC:H) limits opportunistic mass exploitation, successful attacks yield complete confidentiality, integrity, and availability compromise; no public exploit identified at time of analysis.
Unauthenticated broken authentication (CWE-288) in the Ezoic WordPress plugin versions 2.22.11 and earlier allows remote attackers to bypass authentication via an alternate path or channel, resulting in high confidentiality impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N) confirms network-based exploitation requiring no credentials, no user interaction, and low attack complexity, consistent with the 'Information Disclosure' tag applied by Patchstack. No public exploit or CISA KEV listing has been identified at time of analysis.
Authentication bypass in Oracle Helidon 4.5.1 (Imperative Web Server component) exposes applications to unauthenticated remote attackers who can create, modify, or delete critical data accessible to the service via standard HTTP requests. Oracle classifies this as 'easily exploitable' with a CVSS 3.1 score of 7.5, reflecting a network-accessible, zero-complexity attack requiring no credentials or user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle addressed the issue in the August 2026 Critical Patch Update.
Unauthenticated remote attackers can create, delete, or modify critical data in Oracle Helidon 4.5.1 by bypassing authentication controls in the Imperative Web Server component over HTTP. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires only network reachability with no credentials, no user interaction, and no elevated access - placing this firmly in the easily exploitable category per Oracle's own classification. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity warrants prompt patching for any internet-exposed Helidon deployments.
Full system takeover of Oracle Siebel CRM Deployment (versions 17.0 through 26.6) is achievable by unauthenticated remote attackers via HTTP, targeting the Migration component. The attack requires human interaction from a victim - a social engineering or luring condition that constrains opportunistic exploitation - but successful exploitation results in complete compromise of confidentiality, integrity, and availability of the Siebel CRM Deployment instance. No public exploit code has been identified at time of analysis, and this vulnerability has not been added to CISA's Known Exploited Vulnerabilities catalog.
Integer overflow in Firefox's Graphics component crashes the browser for any user who loads attacker-controlled graphical content, resulting in a denial-of-service condition. All Firefox versions prior to 154 and all Firefox ESR versions prior to 153.1 are affected, covering effectively the entire unpatched Firefox install base globally. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the AV:N/AC:L/PR:N CVSS vector indicates a low-complexity, unauthenticated remote path, making this a high-priority patch target given Firefox's ubiquitous deployment footprint.
Denial-of-service in Oracle Helidon 4.5.1's Imperative Web Server component allows unauthenticated remote attackers to crash or indefinitely hang the service via crafted HTTP/2 traffic. Disclosed as part of Oracle's Critical Security Patch Update (CPU) for August 2026, the vulnerability is rated CVSS 7.5 with low attack complexity and no privileges required, making automated exploitation straightforward against any exposed instance. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Denial of service in Oracle Helidon 3.2.19's Imperative Web Server allows unauthenticated network attackers to hang or crash the server entirely via HTTP/2 traffic. The CVSS 3.1 score of 7.5 reflects the low attack complexity and complete availability impact, with no authentication or user interaction required. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Remote denial-of-service in Oracle Helidon 4.5.0 Imperative Web Server allows unauthenticated network attackers to cause a persistent hang or repeated crash of the service via HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial remote exploitation with no authentication or user interaction required, making this reliably triggerable against any exposed instance. No public exploit code or CISA KEV listing has been identified at time of analysis, but low attack complexity means operational risk for teams running Helidon 4.5.0 in production microservice environments is meaningful.
Unauthenticated remote denial-of-service in Oracle Helidon 3.2.19 allows a network attacker to hang or crash the Imperative Web Server component via crafted HTTP requests, causing complete loss of service availability. The vulnerability requires no privileges, no user interaction, and is reachable over standard HTTP, making it trivially exploitable against any exposed Helidon 3.2.19 instance. No public exploit code has been identified at time of analysis, and the flaw is not listed in the CISA KEV catalog.
Remote denial-of-service in Oracle Helidon 4.5.0's Imperative Web Server component allows unauthenticated network attackers to crash or indefinitely hang the server by sending crafted HTTP/2 traffic. The vulnerability carries a CVSS 7.5 rating with low attack complexity and no credential or interaction requirement, making it trivially scriptable from any network-accessible position. No active exploitation has been confirmed and no public proof-of-concept is known at time of analysis.
Denial-of-service in Oracle Helidon 3.2.19's Imperative Web Server component allows remote unauthenticated attackers to cause a complete hang or repeatable crash via HTTP, fully disrupting service availability. The vulnerability requires no authentication, no user interaction, and no special configuration, making it trivially exploitable against any network-accessible Helidon 3.2.19 instance. No public exploit code has been identified and it does not appear in CISA KEV at time of analysis, though the low attack complexity elevates operational risk for any exposed deployment.
Broken access control in the Charitable WordPress donation plugin (versions 1.8.11.3 and earlier) allows unauthenticated remote attackers to perform unauthorized write operations against protected plugin functionality. Classified under CWE-862 (Missing Authorization), the flaw reflects absent or bypassed capability and nonce checks on one or more plugin endpoints, enabling integrity-impacting actions without any credentials. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis, but the unauthenticated, low-complexity attack surface warrants prompt patching on any internet-exposed WordPress installation running this plugin.
Broken access control in the Ultimate Maps by Supsystic WordPress plugin (all versions prior to 1.5.0) allows unauthenticated remote attackers to perform privileged administrative actions without any credentials. The flaw stems from missing authorization checks (CWE-862), meaning the plugin executes sensitive operations without validating the requester's identity or permission level. With a CVSS 3.1 score of 7.5 and an attack vector of network/no-privileges-required, exploitation is trivially achievable against any WordPress site running the affected plugin; no public exploit or CISA KEV listing has been identified at time of analysis.
Unauthorized data disclosure in Oracle Hyperion Data Relationship Management 11.2.25.0.000 exposes all application-accessible financial hierarchy and metadata to unauthenticated remote attackers over HTTP, with no user interaction required. The flaw resides in the Access and Security component and is classified as an authentication bypass, enabling complete confidentiality compromise of the DRM platform's data assets without any credential requirement. No public exploit has been identified at time of analysis, but the absence of authentication barriers and low attack complexity make this a credible remote threat against any network-exposed deployment.
Unauthenticated remote attackers can access all data within Oracle iSupplier Portal 12.2.3 through 12.2.15 via a trivially exploitable HTTP flaw in the Internal Operations component, with no credentials, no user interaction, and no special configuration required. The 'Authentication Bypass' tag indicates that access controls protecting internal operations endpoints can be circumvented entirely over the network. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the low attack complexity makes opportunistic exploitation realistic if portal instances are internet-facing.
Unauthenticated remote information disclosure in Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 exposes critical financial planning and performance management data over HTTP. The authentication bypass flaw in the Installation and Configuration component allows a network-adjacent attacker with no credentials to gain complete read access to all data accessible within the Hyperion environment. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low-complexity, zero-authentication attack vector makes this a high-priority patching target for any enterprise running the affected version.
Full takeover of Oracle MySQL Cluster is achievable by an unauthenticated remote attacker over HTTP across three active release trains: 8.0.0-8.0.48, 8.4.0-8.4.11, and 9.7.0-9.7.2. The attack carries high complexity and requires human interaction from a victim user, but successful exploitation yields complete confidentiality, integrity, and availability compromise of the cluster. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthorized data exposure in Oracle Helidon 4.5.0's Imperative Web Server component allows unauthenticated, network-adjacent attackers to read critical application data via HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial exploitability with no authentication or user interaction required. Classified under the Authentication Bypass tag by Oracle, this vulnerability is covered in the Oracle Critical Patch Update for August 2026, with no public exploit code or CISA KEV listing identified at time of analysis.
Unauthenticated remote access to sensitive data affects Oracle Helidon 4.5.0's Imperative Web Server component via HTTP/2, allowing an attacker with network access to read critical or all data accessible to the Helidon application. The vulnerability is tagged as an authentication bypass, consistent with the CVSS vector showing no privileges or user interaction required. No public exploit identified at time of analysis, and the flaw is disclosed through Oracle's Critical Patch Update for August 2026.
Unauthenticated remote access to critical data in Oracle Business Intelligence Enterprise Edition (BIEE) is possible via a BI Platform Security authentication bypass reachable over HTTP. Affected versions 8.2.0.0.0 and 26.01.0.0.0 allow a network attacker with no credentials to read all data accessible through the BIEE platform, including potentially sensitive business reports, dashboards, and underlying data source content. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and zero authentication requirement make this a high-priority patching target.
Unauthenticated remote access to all Oracle Agile PLM 9.3.6 data is achievable via a flaw in the product's Security component, exploitable over HTTP with no credentials or user interaction. Tagged as an Authentication Bypass by the Oracle Security Alerts team, this vulnerability allows complete unauthorized read access to PLM-managed data - including product designs, intellectual property, and supply chain records - making it a significant data exfiltration risk for affected deployments. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low-complexity, unauthenticated attack profile makes this a high-priority patch target for any internet-exposed instance.
Unauthenticated remote access to sensitive data is possible in Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 via a network-accessible HTTP attack requiring no user interaction and no prior privileges, consistent with an authentication bypass flaw. The CVSS 7.5 High rating reflects the complete confidentiality impact - full read access to all data accessible by the component - with no integrity or availability consequence. No public exploit code or CISA KEV listing has been identified at the time of analysis, but the low-complexity, zero-authentication attack profile makes this straightforward to exploit if targeted.
Unauthenticated data exposure in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 allows remote attackers to access all data managed by the Content Acquisition System component over HTTP with no credentials required. Tagged as an authentication bypass, the flaw carries a CVSS 3.1 score of 7.5 (High) with a fully unauthenticated, low-complexity network attack vector, enabling complete confidentiality compromise of indexed and managed content. No public exploit code or active exploitation has been identified at the time of analysis, and the vulnerability is not listed in CISA KEV.
Unauthenticated HTTP access to Oracle Purchasing (a component of Oracle E-Business Suite versions 12.2.3-12.2.15) enables remote attackers to read critical or complete procurement data with no credentials, user interaction, or elevated attack complexity. Tagged as an authentication bypass by EUVD (EUVD-2026-61894) and disclosed through Oracle's August 2026 Critical Patch Update, the flaw carries a CVSS 3.1 base score of 7.5, reflecting a fully network-exposed, zero-prerequisite attack path. No public exploit code or active CISA KEV listing has been identified at time of analysis.
Unauthenticated network exposure in Oracle Payments (E-Business Suite versions 12.2.3 through 12.2.15) allows remote attackers to access all data handled by the File Transmission component without credentials. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial network reachability with no authentication or user interaction required. Tagged as an authentication bypass, this flaw yields complete confidentiality loss over Oracle Payments data; no public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity makes exploitation straightforward once a target instance is reachable.
Sensitive data exposure in the Duitku Payment Gateway WordPress plugin (versions up to and including 2.11.14) allows unauthenticated remote attackers to retrieve sensitive information without any credentials or user interaction. The vulnerability, classified under CWE-497, stems from the plugin failing to restrict access to system or operational data that should be shielded from public consumers. Reported by Patchstack, this flaw carries a CVSS 7.5 High rating driven entirely by confidentiality impact, with no public exploit or CISA KEV listing identified at time of analysis.
Full system takeover is achievable in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 via a network-accessible SQL attack vector targeting the Common Events component. A low-privileged authenticated attacker who can meet the high-complexity exploitation conditions may fully compromise confidentiality, integrity, and availability of the affected system. No public exploit code or CISA KEV listing has been identified at time of analysis, but the vendor-confirmed total impact - described explicitly as 'takeover' - warrants priority patching in any environment running the affected version.
Unauthenticated broken access control in the FormyChat WordPress plugin (versions 2.15.7 and earlier) allows remote, unauthenticated attackers to access restricted plugin functionality or data due to missing authorization checks. The CVSS vector (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N) confirms this is exploitable from the network without credentials, with high confidentiality impact but no integrity or availability compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, zero-authentication requirements make this straightforwardly exploitable on any exposed WordPress installation running the affected plugin.
WP Sort Order WordPress plugin versions 1.3.5 and below expose an unauthenticated broken access control flaw (CWE-862: Missing Authorization) that allows remote attackers without any credentials to invoke restricted plugin functionality. The CVSS vector confirms network-accessible, zero-complexity, unauthenticated exploitation with high confidentiality impact, meaning protected data can be read by any external party. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
Full system takeover of Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a low-privileged network attacker targeting the Security component over HTTP, resulting in complete confidentiality, integrity, and availability compromise. The CVSS 3.1 score of 7.5 (High) reflects this total impact, though high attack complexity (AC:H) constrains opportunistic exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, and no EPSS data was supplied in the source intelligence.
Full system takeover is possible in Oracle Hyperion Data Relationship Management version 11.2.25.0.000 via a network-exploitable flaw in the Access and Security component. A low-privileged authenticated attacker with HTTP access can, under high-complexity conditions, achieve complete compromise of confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and the product is not listed in the CISA KEV catalog; the high attack complexity (AC:H) meaningfully reduces the realistic exploitation probability despite the severe potential impact.
Unauthenticated remote data manipulation in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 exposes the Endeca Application Controller to attackers who can create, delete, or modify critical commerce data over HTTP with no credentials required. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) and Oracle's own characterization of the flaw as 'easily exploitable' confirm a low-barrier attack path with high integrity impact. No public exploit and no CISA KEV listing are identified at time of analysis, though the authentication bypass tag signals a fundamental access control failure in the controller interface.
Unauthenticated SQL injection in the Depicter Slider WordPress plugin (versions <= 4.8.0) allows remote attackers to query the underlying WordPress database without any credentials. The scope-changed CVSS vector (S:C, C:H) indicates the attack reaches beyond the WordPress application layer into the database tier, enabling high-confidentiality data extraction including user credentials and sensitive site content. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the unauthenticated nature of the flaw substantially lowers the bar for exploitation.
Full takeover of Oracle Applications DBA within Oracle E-Business Suite versions 12.2.3 through 12.2.15 is possible via an unauthenticated, network-based HTTP attack targeting the JRI and associated Java utility components. Exploitation is rated difficult (CVSS AC:H) and requires human interaction from a legitimate user, but successful compromise yields complete loss of confidentiality, integrity, and availability of the affected component. No public exploit code and no CISA KEV listing have been identified at time of analysis, though Oracle's August 2026 Critical Patch Update addresses this issue.
Full platform takeover is possible in Oracle Commerce Platform 11.4.0 via the Dynamo Application Framework component, exploitable by an unauthenticated attacker who can reach the adjacent network segment hosting the server. The CVSS vector (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms that successful exploitation yields complete compromise of confidentiality, integrity, and availability - consistent with Oracle's characterization of 'takeover.' No public exploit code has been identified at time of analysis, and this CVE does not appear on the CISA KEV catalog.