Full system takeover of Oracle Agile Engineering Data Management 6.2.1 is achievable by unauthenticated attackers who can reach the physical network segment hosting the EDM hardware, specifically via the Engineering Communication Interface (ECI) component. The CVSS vector (AV:A/AC:H/PR:N) confirms adjacency is mandatory and complexity is high, constraining realistic exposure to internal networks or co-located infrastructure. No public exploit code or active exploitation has been identified at time of analysis; this is patched under Oracle's August 2026 Critical Security Patch Update.
Full system takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is achievable by an unauthenticated attacker positioned on the same physical network segment as the affected host, exploiting a flaw in the Installation and Configuration component. The CVSS vector confirms adjacent-network vector (AV:A) with high attack complexity (AC:H), meaning exploitation requires specific conditions but no credentials. Despite the adjacent-network constraint limiting broad internet exposure, successful exploitation yields complete compromise of confidentiality, integrity, and availability. No public exploit identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
TLS certificate verification is globally disabled in fbeta-GmbH's ePA3-Service-OpenSource prior to version 1.3.0, exposing all traffic between the integration service and Germany's electronic patient record system and Konnektor devices to interception by network-positioned attackers. Both the primary TLS layer - via hardcoded `verify=False` in Python requests sessions across two independent modules - and the VAU protocol's application-layer certificate validation are broken simultaneously, eliminating all cryptographic trust anchors with no defense-in-depth fallback. On the Konnektor communication path, an impersonating attacker can additionally capture the client's mutual TLS certificate exchange and observe smartcard operations. No public exploit or CISA KEV listing exists at time of analysis.
Heap-based buffer overflow in Open5GS v.2.7.0 allows remote unauthenticated attackers to crash the NAS 5GS decoder chain by sending a NAS PDU with a mutated message type byte, resulting in denial of service to the AMF component and all connected UEs. The vulnerability is network-accessible with no authentication or user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), making it trivially reachable from any host with access to the AMF N1 interface. A public proof-of-concept exploit exists, no public exploit identified as confirmed active exploitation (no CISA KEV listing), and no vendor patch has been confirmed at time of analysis.
Memory leak in Open5GS v2.7.0's AMF component allows remote unauthenticated attackers to exhaust process memory and crash the Access and Mobility Management Function via crafted NGAP messages. The vulnerable function ngap_send_to_nas() in src/amf/ngap-path.c fails to release allocated memory (CWE-401), enabling a sustained DoS against the 5G core network's connection management plane. No public exploit confirmation as CISA KEV, but a proof-of-concept gist has been published by the reporter, and the CVSS score of 7.5 with network vector and no authentication requirement reflects meaningful real-world risk for exposed deployments.
Unauthenticated remote information disclosure in SJRC F11 SJ-GPS-PRO drone firmware (build 2019-09-17) exposes sensitive data through the tcp_actions() function over an open TCP service. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms that any network-reachable attacker, requiring no credentials or user interaction, can trigger the vulnerable function and retrieve sensitive device information. No public exploit or CISA KEV listing has been identified at time of analysis, though a researcher GitHub repository linked in references may contain disclosure details or proof-of-concept material.
Full takeover of Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 is possible by an unauthenticated attacker positioned on the same physical network segment as the connector host, resulting in complete confidentiality, integrity, and availability compromise. Disclosed in Oracle's August 2026 Critical Patch Update, the vulnerability carries a CVSS 3.1 score of 7.5 but is significantly constrained by its adjacent-only attack vector and high attack complexity. No public exploit code and no confirmed active exploitation have been identified at time of analysis.
Site isolation bypass in Firefox's Graphics: CanvasWebGL component allows a malicious web page to leak cross-origin data through the browser's graphics subsystem. All Firefox releases prior to version 154 are affected, along with ESR branches fixed in 115.39, 140.14, and 153.1. No public exploit code or active exploitation has been confirmed; EPSS places this in the 6th percentile, suggesting widespread automated exploitation is currently unlikely despite the High CVSS score.
Denial-of-service in Mozilla Firefox's Widget component allows remote attackers to crash or hang the browser via specially crafted web content, exploiting uncontrolled resource consumption (CWE-400). All Firefox versions prior to 154 and Firefox ESR versions prior to 153.1 are affected, with Mozilla issuing patches across four security advisories (mfsa2026-74, -77, -78, -80). No public exploit has been identified and EPSS sits at the 5th percentile, indicating low real-world exploitation probability despite the high CVSS base score.
Information disclosure in Firefox's Form Autofill component exposes sensitive personal data stored by the browser to unauthorized actors via a network-accessible, unauthenticated attack path scored CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/C:H). All Firefox versions prior to 154 and Firefox ESR versions prior to 153.1 are affected, with Mozilla issuing four separate security advisories (mfsa2026-74, mfsa2026-77, mfsa2026-78, mfsa2026-80) across release channels. No public exploit or CISA KEV listing has been identified at time of analysis, and the EPSS exploitation probability stands at 0.14% (4th percentile).
Full takeover of Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a high-privileged local attacker exploiting a flaw in the Security component, with confirmed scope change enabling impact on additional adjacent products. The CVSS vector (AV:L/AC:H/PR:H) reflects a difficult-to-exploit, infrastructure-local attack requiring significant access prerequisites, yet successful exploitation yields complete confidentiality, integrity, and availability compromise. No public exploit code or CISA KEV listing has been identified at time of analysis; risk is best understood as an insider or post-compromise escalation threat rather than an opportunistic remote attack.
Full hypervisor takeover in Oracle VM VirtualBox 7.2.14 is achievable by a locally authenticated, highly privileged attacker exploiting a flaw in the Core component, with successful attacks producing a scope change that may compromise systems beyond the primary VirtualBox instance. The CVSS vector confirms local-only access with high privilege and complexity prerequisites, but the S:C scope change elevates real-world impact substantially - a compromised hypervisor exposes all hosted guest VMs and their data. Disclosed in Oracle's August 2026 Critical Security Update, no public exploit code has been identified and the vulnerability does not appear in the CISA KEV catalog at time of analysis.
Local privilege escalation with scope change in Oracle Siebel CRM's Email Marketing component affects versions 17.0 through 26.6, confirmed via the Oracle August 2026 Critical Security Update advisory (EUVD-2026-61438). Low-privileged attackers with existing logon access to the Siebel infrastructure can, under difficult-to-reproduce conditions, bypass access controls to read or modify critical marketing data and cascade impacts to other integrated Siebel products. No public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis.
PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62 contain an authentication bypass in the Security component, exploitable by a low-privileged attacker with local infrastructure access to achieve full confidentiality and integrity compromise of PeopleTools data, with scope change enabling lateral impact across additional integrated Oracle products. The local attack vector (AV:L) and high complexity (AC:H) constrain exploitation to insider threats or post-compromise scenarios, but the S:C scope change and H/H confidentiality-integrity impact make successful exploitation highly consequential in large Oracle ERP environments. No public exploit code or active exploitation has been identified at time of analysis.
Local privilege abuse in PeopleSoft Enterprise FIN Lease Administration 9.2 enables a low-privileged attacker with infrastructure logon access to bypass authorization controls and achieve full confidentiality and integrity compromise of financial lease data. The vulnerability carries a scope change, meaning successful exploitation can cascade into additional PeopleSoft products beyond the directly targeted Lease Administration component, amplifying the impact across the ERP environment. No public exploit code has been identified at time of analysis; Oracle disclosed this in the August 2026 Critical Patch Update advisory.
Cross-dataset authorization bypass in GeoLens prior to 1.2.3 allows unauthenticated network callers and low-privileged authenticated users to read private dataset content - including vector tile geometries, raster pixels, backing-table rows, column schemas, and sampled values - that they have no access to. The root flaw is a consistent pattern across six distinct endpoints: the API authorizes the resource named in the URL but fails to re-authorize a second, caller-influenced dataset reached through a relationship, layer reference, VRT mosaic, or request body. No public exploit has been identified at time of analysis, but the most severe findings require zero authentication, making them trivially exploitable by any network-reachable caller.
Unvalidated Class.forName() with initialization enabled in RabbitMQ Java Client's JSON-RPC tooling allows a network-positioned attacker to trigger arbitrary static initializers in the victim JVM. Applications using com.rabbitmq:amqp-client before 5.33.0 that employ the JsonRpcClient class are exposed when an attacker can control or spoof the system.describe broker response - either as a co-tenant on a shared broker or via network interception. Successful exploitation achieves code-like effects through static initializer execution and a secondary type-confusion path via mapper.parse, with full confidentiality, integrity, and availability impact on the client process. No public exploit identified at time of analysis, and this CVE is not listed in CISA KEV.
Information disclosure via the WebRTC component in Mozilla Firefox allows network-accessible attackers to exfiltrate sensitive browser data due to improper restriction of rendered UI layers (CWE-1021). All Firefox releases prior to version 154 and all Firefox ESR releases prior to version 153.1 are affected across all platforms listed under CPE cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*. The CVSS base score is 7.5 with high confidentiality impact; SSVC confirms automatable exploitation, though no active exploitation has been confirmed in CISA KEV and no public exploit code has been identified at time of analysis.
Side-channel information disclosure in Firefox's Storage: Cache API (CWE-203) allows remote unauthenticated attackers to infer sensitive cached data through observable timing discrepancies between cache hits and misses. All Firefox versions prior to 154 and Firefox ESR versions prior to 153.1 are affected per Mozilla advisories mfsa2026-74 through mfsa2026-80. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high confidentiality impact rating and broad Firefox deployment footprint make patching a near-term priority.
Global SSL/TLS certificate verification is silently disabled across all puma web process outbound connections in Mastodon when LDAP authentication is configured with LDAP_TLS_NO_VERIFY=true, enabling man-in-the-middle interception of federation traffic, API callbacks, and media fetches. Affecting versions prior to 4.4.19 and 4.5.0 through 4.5.11, the root cause is a Ruby object mutation defect: calling .tap directly on the shared global OpenSSL::SSL::SSLContext::DEFAULT_PARAMS constant (rather than a .dup copy) permanently sets VERIFY_NONE for the entire puma process lifetime, not just the LDAP connection. No public exploit identified at time of analysis, but the exact one-line fix is visible in the public commit diff, making the vulnerability trivially reproducible.
Authentication bypass in Oracle Hyperion Financial Management 11.2.25.0.000 exposes critical financial data to unauthenticated network attackers via HTTPS. The Security component flaw - tagged explicitly as an authentication bypass by Oracle - allows complete read and write access to all data within the application, including sensitive financial consolidation records. No public exploit or CISA KEV listing is confirmed at time of analysis, and the high attack complexity (AC:H) limits opportunistic mass exploitation, but the unauthenticated network vector and dual high-severity impact on both confidentiality and integrity make this a serious priority for organizations running this version.
Oracle Service Contracts in E-Business Suite versions 12.2.3 through 12.2.15 exposes an authentication bypass in its Internal Operations component reachable over HTTP without credentials, enabling unauthorized full read and write access to critical service contract data. The CVSS 3.1 score of 7.4 reflects high confidentiality and integrity impact, moderated by high attack complexity (AC:H) that prevents trivial mass exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the authentication bypass nature of the flaw and the sensitivity of contract data make this a meaningful target for motivated adversaries with access to the EBS application layer.
Oracle iSupplier Portal versions 12.2.3 through 12.2.15 within Oracle E-Business Suite exposes an authentication bypass in the Internal Operations component that allows unauthenticated network attackers to fully compromise supplier data confidentiality and integrity via HTTP. Successful exploitation grants complete read access to all iSupplier Portal data and the ability to create, delete, or modify critical data records - high-value targets in supply chain environments. Oracle patched this in the August 2026 Critical Patch Update; no public exploit code or CISA KEV listing has been identified at time of analysis, though the AC:H rating indicates non-trivial but achievable exploitation conditions.
Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 exposes an unauthenticated authentication bypass over HTTPS in its Installation and Configuration component, enabling remote attackers to gain complete read access and full create, delete, or modify capabilities over all data accessible to the platform. The CVSS vector (AV:N/AC:H/PR:N/UI:N) confirms no credentials or user interaction are required, though the High attack complexity means exploitation demands specific technical preconditions rather than trivial scanning. No public exploit code and no CISA KEV listing have been identified at time of analysis; the issue is formally acknowledged in Oracle's August 2026 Critical Security Patch Update advisory.
Authentication bypass in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 exposes the Common Security component to unauthenticated remote attackers over HTTPS, enabling complete read and write access to all Hyperion-accessible data. The high attack complexity (AC:H) constrains opportunistic exploitation, but successful attacks result in both full confidentiality and integrity compromise with no availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis.
Critical data exposure and integrity compromise in Oracle Communications Unified Inventory Management (UIM) allows unauthenticated network attackers to read or tamper with all UIM-accessible data via a vulnerable third-party component over HTTP. Affected versions span 7.5.0 through 8.0.1, covering a wide active deployment range. The vulnerability carries an Authentication Bypass tag and is rated CVSS 7.4 with High Complexity, meaning exploitation is non-trivial but requires no credentials - no public exploit or CISA KEV listing has been identified at time of analysis.
Authentication bypass in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 enables unauthenticated remote attackers to fully compromise data confidentiality and integrity over HTTP. The 'Authentication Bypass' tag and PR:N vector confirm that no credentials are required, though AC:H indicates exploitation demands specific conditions or non-trivial technique. Successful exploitation yields unauthorized read and write access to all data accessible by the application. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Oracle Reports Developer 14.1.2.0.0 contains an authentication bypass in its Security and Authentication component that permits unauthenticated, network-based attackers to achieve both complete data disclosure and unauthorized modification of critical data over HTTP. The vulnerability requires no credentials or user interaction, though the high attack complexity (AC:H) means exploitation demands precise conditions or crafted request sequences. No public exploit code or active exploitation has been identified at time of analysis, but the unauthenticated network reach combined with dual high-impact outcomes warrants urgent remediation for any internet-exposed or untrusted-network-accessible deployments.
Unauthorized read and write access to critical enterprise content data is achievable in Oracle WebCenter Content's Content Server component via an authentication bypass exploitable over HTTP. Affecting versions 12.2.1.4.0 and 14.1.2.0.0, an unauthenticated remote attacker who overcomes the high attack complexity barrier can exfiltrate all accessible content or create, modify, and delete critical records. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Authentication bypass in Oracle Helidon 4.5.0's Imperative Web Server component allows unauthenticated network-accessible attackers to fully compromise both the confidentiality and integrity of all data accessible to the service. The vulnerability carries a CVSS 3.1 score of 7.4, tempered by high attack complexity (AC:H), meaning specific, non-trivial conditions must be satisfied for exploitation. Disclosed via Oracle's Critical Patch Update for August 2026, no public exploit code or CISA KEV listing has been identified at time of analysis.
Authentication bypass in Oracle PeopleSoft Enterprise PeopleTools (Install and Packaging component) versions 8.61 through 8.63 exposes critical HR and ERP data to unauthenticated network attackers over HTTP. Successful exploitation grants complete confidentiality and integrity compromise of all PeopleSoft-accessible data, including unauthorized creation, deletion, and modification of critical records. No public exploit has been identified at time of analysis, and CVSS AC:H rating indicates meaningful exploitation complexity, but the absence of any authentication requirement elevates organizational urgency.
Unauthenticated remote exploitation of Oracle Siebel CRM Integration's REST component across versions 17.0 through 26.6 can yield complete loss of data confidentiality and integrity. Tagged as an authentication bypass, the vulnerability permits network-accessible attackers to read all CRM data and perform unauthorized create, delete, or modify operations without credentials. No public exploit has been identified at time of analysis, and Oracle's August 2026 Critical Patch Update addresses the issue.
Unauthenticated network exploitation of the Oracle Siebel CRM Marketing component enables critical data theft and unauthorized modification across all Marketing-accessible records. Tagged explicitly as an Authentication Bypass, the flaw allows a remote attacker with no credentials to compromise the confidentiality and integrity of sensitive CRM marketing data via HTTP, affecting all supported versions from 17.0 through 26.6. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the PR:N/UI:N vector means no user interaction or account is required, making the authentication bypass self-sufficient once the high-complexity exploitation conditions are met.
Oracle Siebel CRM Integration's REST component (versions 17.0 through 26.6) contains an authentication bypass flaw enabling unauthenticated network attackers to fully compromise data confidentiality and integrity over HTTPS. The 'Authentication Bypass' tag from the Oracle reporter confirms the vulnerability class: an attacker who satisfies the high-complexity exploitation condition can read all CRM data and perform unauthorized creation, modification, or deletion of records. No public exploit code has been identified and the vulnerability is absent from the CISA KEV catalog at time of analysis.
Oracle Siebel CRM Deployment's Server Infrastructure component exposes versions 17.0 through 26.6 to an unauthenticated, network-based authentication bypass over HTTP that can result in complete compromise of CRM data confidentiality and integrity. The high complexity rating (AC:H) tempers immediate mass-exploitation risk, but the Authentication Bypass tag combined with C:H and I:H impact means a successful attacker achieves full read and write access to all CRM-accessible data - including customer records, sales pipelines, and service data - without presenting valid credentials. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle's Critical Security Patch Update for August 2026 addresses this vulnerability.
Remote authentication bypass in Oracle Siebel CRM Integration's REST component affects all supported versions from 17.0 through 26.6, enabling unauthenticated network attackers to achieve full read and write access to critical CRM data via crafted HTTPS requests. The vulnerability is tagged Authentication Bypass, indicating that REST API access controls can be circumvented without credentials despite a high attack complexity (AC:H) rating that suggests exploitation requires precise crafting or internal state knowledge. No public exploit identified at time of analysis, but the combination of unauthenticated access and high confidentiality and integrity impact warrants priority patching under Oracle's August 2026 Critical Patch Update.
Authentication bypass in Oracle Internet Procurement Connector (Oracle E-Business Suite versions 12.2.3 through 12.2.15) allows unauthenticated remote attackers to compromise the Internal Operations component via HTTP, resulting in unauthorized read access to or manipulation of critical procurement data. The CVSS 3.1 score of 7.4 reflects high confidentiality and integrity impacts moderated by high attack complexity (AC:H), meaning exploitation requires specific conditions to be met despite requiring no credentials. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
AES-GCM nonce reuse in ePA3-Service-OpenSource (all versions prior to 1.3.0) allows a network-positioned attacker to recover plaintext patient health records and forge authenticated VAU protocol messages. The frozen `request_counter` in `VAUProtokoll.py` causes every outgoing message to be encrypted under the same nonce-key pair, breaking AES-GCM's fundamental security guarantee. No public exploit code is confirmed at time of analysis, but the underlying Joux forbidden attack is well-documented in cryptographic literature, and the affected data - Germany's national electronic patient records - carries exceptional regulatory and clinical sensitivity.
Address bar spoofing in ArcSearch for iOS prior to 1.48.0 allows attacker-controlled web content to impersonate trusted browser interface elements by triggering a page-initiated scroll that keeps the address bar hidden. The Scope Change in the CVSS vector (S:C) reflects that the vulnerability crosses from web content into the browser chrome itself, enabling phishing and credential harvesting attacks. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity and lack of required privileges make this straightforward to weaponize against any user who visits a malicious page.
Unauthorized data manipulation in Oracle Telecommunications Billing Integrator versions 12.2.3 through 12.2.15 allows unauthenticated network attackers to compromise critical data integrity via crafted HTTP requests, requiring only victim interaction to trigger. The CVSS scope change (S:C) indicates successful exploitation can cascade into other Oracle E-Business Suite components beyond the directly targeted module, amplifying the overall impact. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle disclosed this vulnerability through its August 2026 Critical Patch Update.
Authentication bypass in Oracle Hyperion Data Relationship Management 11.2.25.0.000 exposes critical data assets to unauthenticated network attackers via HTTP, enabling both full read access to all application-accessible data and unauthorized creation, deletion, or modification of critical records. The vulnerability resides in the Access and security component and is tagged as an authentication bypass by Oracle. No active exploitation (KEV) or public proof-of-concept code has been identified at time of analysis, but the high confidentiality and integrity impact with no authentication prerequisite elevates its priority for affected deployments.
Unauthorized data access and modification in Oracle Payments (Oracle E-Business Suite) versions 12.2.3 through 12.2.15 is achievable by unauthenticated remote attackers via HTTPS targeting the File Transmission component. The vulnerability, tagged as an Authentication Bypass, enables full confidentiality and integrity compromise of Oracle Payments data - allowing attackers to read, create, delete, or modify all accessible payment records. Exploitation is rated 'difficult' (AC:H) and no active exploitation has been identified in CISA KEV at time of analysis, though the zero-prerequisites authentication bypass warrants urgent patching given the financial data exposure.
Arbitrary file deletion via unauthenticated CSRF in the Slider by 10Web WordPress plugin (versions up to and including 1.2.62) enables a remote attacker to delete files on the WordPress host by tricking an authenticated administrator into visiting a malicious page. Per the Patchstack advisory title, the CSRF primitive chains directly to arbitrary file deletion, which is reflected in the CVSS 3.1 score of 7.4 (High) with Scope Changed (S:C) and High Availability impact (A:H), indicating the destruction extends beyond the plugin itself to the broader WordPress installation or filesystem. No confirmed active exploitation (CISA KEV) and no public exploit code have been identified at time of analysis.
Data integrity and availability compromise in Oracle Autonomous Health Framework's Trace File Analyzer component affects versions 26 through 26.5.2, permitting high-privileged local attackers to corrupt or destroy critical data and induce a complete denial-of-service condition. Notably, the attack carries a scope change, meaning successful exploitation can cascade to affect additional co-located Oracle products beyond AHF itself. No public exploit code or active exploitation has been identified at time of analysis; Oracle has issued remediation through its August 2026 Critical Patch Update.
Full account takeover is possible in Keycloak's legacy client-initiated account-linking endpoint due to a predictable hash (CWE-341) used as a CSRF-like protection mechanism. An attacker who controls a registered OIDC client in the target realm can forge a valid linking URL that silently binds a victim's Keycloak account to the attacker's external identity, enabling subsequent login as the victim. No public exploit or CISA KEV listing is identified at time of analysis; Red Hat has released patches via RHSA-2026:56523 and RHSA-2026:56524.
Unauthenticated remote exploitation of Oracle Helidon 4.5.0's Imperative Web Server component allows network-adjacent attackers to partially compromise confidentiality, integrity, and availability via standard HTTP. The CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector confirms zero authentication or user interaction is required, and attack complexity is low - meaning successful exploitation demands minimal attacker skill or infrastructure. Disclosed through Oracle's Critical Patch Update for August 2026, no public exploit code has been identified at time of analysis, though the low-barrier network vector warrants prompt remediation for any internet-exposed Helidon deployment.
Remote unauthenticated exploitation of Oracle Helidon 4.5.0's Imperative Web Server component via HTTP allows attackers to perform unauthorized read access to a subset of data, unauthorized data modification, and partial denial of service - all without credentials or user interaction. Oracle classifies this as 'easily exploitable' in its August 2026 Critical Patch Update advisory. No public exploit identified at time of analysis, but the low attack complexity and network accessibility make this a straightforward target for opportunistic attackers.
Unauthenticated remote exploitation of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 via HTTP allows an attacker to read a subset of accessible data, perform unauthorized inserts, updates, or deletes, and cause a partial denial of service against the Installation and Configuration component. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms low attack complexity with no authentication required, making this trivially reachable for any attacker with network access to the service. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Unauthenticated remote exploitation of Oracle Helidon 4.5.3's Imperative Web Server component allows attackers with HTTP network access to perform unauthorized read, write, and partial denial-of-service operations against data accessible to the service. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms this is easily exploitable with no prerequisites, though impacts are bounded to partial CIA effects within the unchanged scope of the Helidon instance. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Unauthenticated remote exploitation of Oracle Helidon 4.5.0's Imperative Web Server component via HTTP allows attackers to read a subset of accessible data, perform unauthorized write/modify operations, and cause a partial denial of service. The CVSS vector confirms network accessibility with no authentication, no user interaction, and low attack complexity, making this easily exploitable against exposed deployments. No public exploit code or CISA KEV listing has been identified at time of analysis, but the trivial exploitation conditions warrant prompt patching.