Authentication bypass in Oracle Hyperion Financial Management 11.2.25.0.000 exposes critical financial data to unauthenticated network attackers via HTTPS. The Security component flaw - tagged explicitly as an authentication bypass by Oracle - allows complete read and write access to all data within the application, including sensitive financial consolidation records. No public exploit or CISA KEV listing is confirmed at time of analysis, and the high attack complexity (AC:H) limits opportunistic mass exploitation, but the unauthenticated network vector and dual high-severity impact on both confidentiality and integrity make this a serious priority for organizations running this version.
Oracle Service Contracts in E-Business Suite versions 12.2.3 through 12.2.15 exposes an authentication bypass in its Internal Operations component reachable over HTTP without credentials, enabling unauthorized full read and write access to critical service contract data. The CVSS 3.1 score of 7.4 reflects high confidentiality and integrity impact, moderated by high attack complexity (AC:H) that prevents trivial mass exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the authentication bypass nature of the flaw and the sensitivity of contract data make this a meaningful target for motivated adversaries with access to the EBS application layer.
Oracle iSupplier Portal versions 12.2.3 through 12.2.15 within Oracle E-Business Suite exposes an authentication bypass in the Internal Operations component that allows unauthenticated network attackers to fully compromise supplier data confidentiality and integrity via HTTP. Successful exploitation grants complete read access to all iSupplier Portal data and the ability to create, delete, or modify critical data records - high-value targets in supply chain environments. Oracle patched this in the August 2026 Critical Patch Update; no public exploit code or CISA KEV listing has been identified at time of analysis, though the AC:H rating indicates non-trivial but achievable exploitation conditions.
Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 exposes an unauthenticated authentication bypass over HTTPS in its Installation and Configuration component, enabling remote attackers to gain complete read access and full create, delete, or modify capabilities over all data accessible to the platform. The CVSS vector (AV:N/AC:H/PR:N/UI:N) confirms no credentials or user interaction are required, though the High attack complexity means exploitation demands specific technical preconditions rather than trivial scanning. No public exploit code and no CISA KEV listing have been identified at time of analysis; the issue is formally acknowledged in Oracle's August 2026 Critical Security Patch Update advisory.
Authentication bypass in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 exposes the Common Security component to unauthenticated remote attackers over HTTPS, enabling complete read and write access to all Hyperion-accessible data. The high attack complexity (AC:H) constrains opportunistic exploitation, but successful attacks result in both full confidentiality and integrity compromise with no availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis.
Critical data exposure and integrity compromise in Oracle Communications Unified Inventory Management (UIM) allows unauthenticated network attackers to read or tamper with all UIM-accessible data via a vulnerable third-party component over HTTP. Affected versions span 7.5.0 through 8.0.1, covering a wide active deployment range. The vulnerability carries an Authentication Bypass tag and is rated CVSS 7.4 with High Complexity, meaning exploitation is non-trivial but requires no credentials - no public exploit or CISA KEV listing has been identified at time of analysis.
Authentication bypass in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 enables unauthenticated remote attackers to fully compromise data confidentiality and integrity over HTTP. The 'Authentication Bypass' tag and PR:N vector confirm that no credentials are required, though AC:H indicates exploitation demands specific conditions or non-trivial technique. Successful exploitation yields unauthorized read and write access to all data accessible by the application. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Oracle Reports Developer 14.1.2.0.0 contains an authentication bypass in its Security and Authentication component that permits unauthenticated, network-based attackers to achieve both complete data disclosure and unauthorized modification of critical data over HTTP. The vulnerability requires no credentials or user interaction, though the high attack complexity (AC:H) means exploitation demands precise conditions or crafted request sequences. No public exploit code or active exploitation has been identified at time of analysis, but the unauthenticated network reach combined with dual high-impact outcomes warrants urgent remediation for any internet-exposed or untrusted-network-accessible deployments.
Unauthorized read and write access to critical enterprise content data is achievable in Oracle WebCenter Content's Content Server component via an authentication bypass exploitable over HTTP. Affecting versions 12.2.1.4.0 and 14.1.2.0.0, an unauthenticated remote attacker who overcomes the high attack complexity barrier can exfiltrate all accessible content or create, modify, and delete critical records. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Authentication bypass in Oracle Helidon 4.5.0's Imperative Web Server component allows unauthenticated network-accessible attackers to fully compromise both the confidentiality and integrity of all data accessible to the service. The vulnerability carries a CVSS 3.1 score of 7.4, tempered by high attack complexity (AC:H), meaning specific, non-trivial conditions must be satisfied for exploitation. Disclosed via Oracle's Critical Patch Update for August 2026, no public exploit code or CISA KEV listing has been identified at time of analysis.
Authentication bypass in Oracle PeopleSoft Enterprise PeopleTools (Install and Packaging component) versions 8.61 through 8.63 exposes critical HR and ERP data to unauthenticated network attackers over HTTP. Successful exploitation grants complete confidentiality and integrity compromise of all PeopleSoft-accessible data, including unauthorized creation, deletion, and modification of critical records. No public exploit has been identified at time of analysis, and CVSS AC:H rating indicates meaningful exploitation complexity, but the absence of any authentication requirement elevates organizational urgency.
Unauthenticated remote exploitation of Oracle Siebel CRM Integration's REST component across versions 17.0 through 26.6 can yield complete loss of data confidentiality and integrity. Tagged as an authentication bypass, the vulnerability permits network-accessible attackers to read all CRM data and perform unauthorized create, delete, or modify operations without credentials. No public exploit has been identified at time of analysis, and Oracle's August 2026 Critical Patch Update addresses the issue.
Unauthenticated network exploitation of the Oracle Siebel CRM Marketing component enables critical data theft and unauthorized modification across all Marketing-accessible records. Tagged explicitly as an Authentication Bypass, the flaw allows a remote attacker with no credentials to compromise the confidentiality and integrity of sensitive CRM marketing data via HTTP, affecting all supported versions from 17.0 through 26.6. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the PR:N/UI:N vector means no user interaction or account is required, making the authentication bypass self-sufficient once the high-complexity exploitation conditions are met.
Oracle Siebel CRM Integration's REST component (versions 17.0 through 26.6) contains an authentication bypass flaw enabling unauthenticated network attackers to fully compromise data confidentiality and integrity over HTTPS. The 'Authentication Bypass' tag from the Oracle reporter confirms the vulnerability class: an attacker who satisfies the high-complexity exploitation condition can read all CRM data and perform unauthorized creation, modification, or deletion of records. No public exploit code has been identified and the vulnerability is absent from the CISA KEV catalog at time of analysis.
Oracle Siebel CRM Deployment's Server Infrastructure component exposes versions 17.0 through 26.6 to an unauthenticated, network-based authentication bypass over HTTP that can result in complete compromise of CRM data confidentiality and integrity. The high complexity rating (AC:H) tempers immediate mass-exploitation risk, but the Authentication Bypass tag combined with C:H and I:H impact means a successful attacker achieves full read and write access to all CRM-accessible data - including customer records, sales pipelines, and service data - without presenting valid credentials. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle's Critical Security Patch Update for August 2026 addresses this vulnerability.
Remote authentication bypass in Oracle Siebel CRM Integration's REST component affects all supported versions from 17.0 through 26.6, enabling unauthenticated network attackers to achieve full read and write access to critical CRM data via crafted HTTPS requests. The vulnerability is tagged Authentication Bypass, indicating that REST API access controls can be circumvented without credentials despite a high attack complexity (AC:H) rating that suggests exploitation requires precise crafting or internal state knowledge. No public exploit identified at time of analysis, but the combination of unauthenticated access and high confidentiality and integrity impact warrants priority patching under Oracle's August 2026 Critical Patch Update.
Authentication bypass in Oracle Internet Procurement Connector (Oracle E-Business Suite versions 12.2.3 through 12.2.15) allows unauthenticated remote attackers to compromise the Internal Operations component via HTTP, resulting in unauthorized read access to or manipulation of critical procurement data. The CVSS 3.1 score of 7.4 reflects high confidentiality and integrity impacts moderated by high attack complexity (AC:H), meaning exploitation requires specific conditions to be met despite requiring no credentials. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
AES-GCM nonce reuse in ePA3-Service-OpenSource (all versions prior to 1.3.0) allows a network-positioned attacker to recover plaintext patient health records and forge authenticated VAU protocol messages. The frozen `request_counter` in `VAUProtokoll.py` causes every outgoing message to be encrypted under the same nonce-key pair, breaking AES-GCM's fundamental security guarantee. No public exploit code is confirmed at time of analysis, but the underlying Joux forbidden attack is well-documented in cryptographic literature, and the affected data - Germany's national electronic patient records - carries exceptional regulatory and clinical sensitivity.
Address bar spoofing in ArcSearch for iOS prior to 1.48.0 allows attacker-controlled web content to impersonate trusted browser interface elements by triggering a page-initiated scroll that keeps the address bar hidden. The Scope Change in the CVSS vector (S:C) reflects that the vulnerability crosses from web content into the browser chrome itself, enabling phishing and credential harvesting attacks. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity and lack of required privileges make this straightforward to weaponize against any user who visits a malicious page.
Unauthorized data manipulation in Oracle Telecommunications Billing Integrator versions 12.2.3 through 12.2.15 allows unauthenticated network attackers to compromise critical data integrity via crafted HTTP requests, requiring only victim interaction to trigger. The CVSS scope change (S:C) indicates successful exploitation can cascade into other Oracle E-Business Suite components beyond the directly targeted module, amplifying the overall impact. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle disclosed this vulnerability through its August 2026 Critical Patch Update.
Authentication bypass in Oracle Hyperion Data Relationship Management 11.2.25.0.000 exposes critical data assets to unauthenticated network attackers via HTTP, enabling both full read access to all application-accessible data and unauthorized creation, deletion, or modification of critical records. The vulnerability resides in the Access and security component and is tagged as an authentication bypass by Oracle. No active exploitation (KEV) or public proof-of-concept code has been identified at time of analysis, but the high confidentiality and integrity impact with no authentication prerequisite elevates its priority for affected deployments.
Unauthorized data access and modification in Oracle Payments (Oracle E-Business Suite) versions 12.2.3 through 12.2.15 is achievable by unauthenticated remote attackers via HTTPS targeting the File Transmission component. The vulnerability, tagged as an Authentication Bypass, enables full confidentiality and integrity compromise of Oracle Payments data - allowing attackers to read, create, delete, or modify all accessible payment records. Exploitation is rated 'difficult' (AC:H) and no active exploitation has been identified in CISA KEV at time of analysis, though the zero-prerequisites authentication bypass warrants urgent patching given the financial data exposure.
Arbitrary file deletion via unauthenticated CSRF in the Slider by 10Web WordPress plugin (versions up to and including 1.2.62) enables a remote attacker to delete files on the WordPress host by tricking an authenticated administrator into visiting a malicious page. Per the Patchstack advisory title, the CSRF primitive chains directly to arbitrary file deletion, which is reflected in the CVSS 3.1 score of 7.4 (High) with Scope Changed (S:C) and High Availability impact (A:H), indicating the destruction extends beyond the plugin itself to the broader WordPress installation or filesystem. No confirmed active exploitation (CISA KEV) and no public exploit code have been identified at time of analysis.
Data integrity and availability compromise in Oracle Autonomous Health Framework's Trace File Analyzer component affects versions 26 through 26.5.2, permitting high-privileged local attackers to corrupt or destroy critical data and induce a complete denial-of-service condition. Notably, the attack carries a scope change, meaning successful exploitation can cascade to affect additional co-located Oracle products beyond AHF itself. No public exploit code or active exploitation has been identified at time of analysis; Oracle has issued remediation through its August 2026 Critical Patch Update.
Full account takeover is possible in Keycloak's legacy client-initiated account-linking endpoint due to a predictable hash (CWE-341) used as a CSRF-like protection mechanism. An attacker who controls a registered OIDC client in the target realm can forge a valid linking URL that silently binds a victim's Keycloak account to the attacker's external identity, enabling subsequent login as the victim. No public exploit or CISA KEV listing is identified at time of analysis; Red Hat has released patches via RHSA-2026:56523 and RHSA-2026:56524.
Unauthenticated remote exploitation of Oracle Helidon 4.5.0's Imperative Web Server component allows network-adjacent attackers to partially compromise confidentiality, integrity, and availability via standard HTTP. The CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector confirms zero authentication or user interaction is required, and attack complexity is low - meaning successful exploitation demands minimal attacker skill or infrastructure. Disclosed through Oracle's Critical Patch Update for August 2026, no public exploit code has been identified at time of analysis, though the low-barrier network vector warrants prompt remediation for any internet-exposed Helidon deployment.
Remote unauthenticated exploitation of Oracle Helidon 4.5.0's Imperative Web Server component via HTTP allows attackers to perform unauthorized read access to a subset of data, unauthorized data modification, and partial denial of service - all without credentials or user interaction. Oracle classifies this as 'easily exploitable' in its August 2026 Critical Patch Update advisory. No public exploit identified at time of analysis, but the low attack complexity and network accessibility make this a straightforward target for opportunistic attackers.
Unauthenticated remote exploitation of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 via HTTP allows an attacker to read a subset of accessible data, perform unauthorized inserts, updates, or deletes, and cause a partial denial of service against the Installation and Configuration component. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms low attack complexity with no authentication required, making this trivially reachable for any attacker with network access to the service. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Unauthenticated remote exploitation of Oracle Helidon 4.5.3's Imperative Web Server component allows attackers with HTTP network access to perform unauthorized read, write, and partial denial-of-service operations against data accessible to the service. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms this is easily exploitable with no prerequisites, though impacts are bounded to partial CIA effects within the unchanged scope of the Helidon instance. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Unauthenticated remote exploitation of Oracle Helidon 4.5.0's Imperative Web Server component via HTTP allows attackers to read a subset of accessible data, perform unauthorized write/modify operations, and cause a partial denial of service. The CVSS vector confirms network accessibility with no authentication, no user interaction, and low attack complexity, making this easily exploitable against exposed deployments. No public exploit code or CISA KEV listing has been identified at time of analysis, but the trivial exploitation conditions warrant prompt patching.
Oracle Reports Developer 14.1.2.0.0 exposes an unauthenticated authentication bypass in its Security and Authentication component, allowing an attacker on the same physical network segment to fully compromise confidentiality and integrity of all accessible data - including critical data - without any credentials or user interaction. The vulnerability carries a scope change, meaning successful exploitation may cascade to impact additional Oracle Fusion Middleware products beyond Reports Developer itself. No public exploit code has been identified at time of analysis, and EPSS places exploitation probability at 0.22% (13th percentile), suggesting low opportunistic risk despite the critical vendor-stated CVSS base score.
Improper access control in Oracle Reports Developer 12.2.1.19.0 enables unauthenticated attackers positioned on the same network segment as the host to fully compromise confidentiality and integrity of all data accessible by the product, with scope change allowing impact to additional Oracle Fusion Middleware components. The vulnerability carries tags of Authentication Bypass and is tracked under CWE-284 (Improper Access Control). No public exploit code or CISA KEV entry exists at time of analysis, and the EPSS score of 0.22% (13th percentile) reflects low observed exploitation probability despite the high theoretical severity.
Privilege escalation in Malcolm's nginx Lua RBAC layer allows authenticated low-privilege users to access administrator-only endpoints by submitting percent-encoded request URIs that bypass the access control gate. Malcolm versions up to and including 26.07.1 are affected, with restricted paths including /htadmin, /arkime/api/esadmin, NetBox, and file upload endpoints all reachable via this encoding bypass. A proof-of-concept exists per SSVC classification, though this vulnerability has not been added to CISA's Known Exploited Vulnerabilities catalog at time of analysis.
Local privilege escalation and denial-of-service in Oracle VM VirtualBox 7.2.14 allows a high-privileged attacker with local infrastructure access to crash the hypervisor, partially read or modify VM-accessible data, and - critically - extend impact beyond the vulnerable instance to additional products via a confirmed scope change. The CVSS 3.1 vector (AV:L/PR:H/S:C/A:H) indicates this is not a remote threat but a post-compromise or insider-level concern targeting the virtualization layer. No public exploit code or active exploitation has been identified at time of analysis, and Oracle disclosed this through its Critical Patch Update for August 2026.
Local privilege escalation with scope change in Oracle VM VirtualBox 7.2.14 allows a high-privileged local attacker to crash the hypervisor repeatedly, modify limited guest data, and read a subset of accessible data - with impacts that extend beyond the VirtualBox process to additional co-hosted products. No public exploit code has been identified at time of analysis, and this vulnerability is not currently listed in the CISA KEV catalog. The scope change (S:C in CVSS) is the critical differentiator, indicating that a compromised VirtualBox instance can affect the host OS or sibling VMs, raising the actual blast radius above what the per-component impact ratings suggest.
Oracle SDP Number Portability versions 12.2.3 through 12.2.15, a telecommunications management component of Oracle E-Business Suite, exposes a local privilege-abuse flaw in its Internal Operations component that enables high-privileged insiders or post-breach actors to compromise the affected system. Successful exploitation grants unauthorized creation, deletion, or modification of critical data, read access to a subset of accessible data, and the ability to cause a partial denial of service - with a scope change (S:C) extending potential impact to additional Oracle products co-hosted in the same E-Business Suite environment. No public exploit code exists and this CVE does not appear in the CISA KEV catalog at time of analysis; the CVSS 3.1 base score of 7.3 reflects the scope change rather than inherent exploitability from the perimeter.
Symlink following vulnerability across nine Dell enterprise storage and infrastructure products enables a locally authenticated, low-privileged attacker to elevate their privileges, potentially achieving full system compromise (C:H/I:H/A:H). Affected platforms span Dell AppSync 4.6.0.0, Metro Node 8.0.0, UCC Edge 3.0.1, VxRail 8.0.322, PowerMax 10.3.0, Unity 5.4, PowerFlex Manager 4.5.4, PowerFlex Intelligent Catalog 46.377.00 and 46.382.00, and PowerFlex Rack 4.5.4 and prior. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis, but the breadth of affected Dell enterprise products and the high-impact CVSS metrics make patching a priority for organizations running Dell storage infrastructure.
Local privilege abuse in Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.6) allows a low-privileged OS-level user on the hosting infrastructure to compromise the Siebel Cloud Manager component, achieving full read access to all CRM application data and limited write access, with a confirmed scope change extending impact to additional co-hosted products. The attack vector is local infrastructure access, making this primarily an insider threat or post-compromise lateral movement risk rather than an external internet-facing exposure. No public exploit has been identified, and Oracle addressed this vulnerability in the August 2026 Critical Patch Update (CPU Aug 2026).
Complete compromise of Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 is achievable through the Presentation Services component by a low-privileged attacker who already holds a local logon on the OBIEE host and can engineer interaction from a second user. Successful exploitation yields full confidentiality, integrity, and availability impact - effectively a takeover of the OBIEE instance. No public exploit code has been identified and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog as of this analysis.
Elevation of privileges in Dell Alienware Command Center (AWCC) versions prior to 6.14.20.0 allows a low-privileged local user to gain higher system access by exploiting a Least Privilege Violation (CWE-272). The application operates with or invokes components carrying excessive privileges, which a local attacker can abuse through an interaction-dependent trigger to achieve full confidentiality, integrity, and availability impact on the affected host. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the full C:H/I:H/A:H triad indicates complete system compromise potential if the privilege boundary is crossed successfully.
Full system takeover of Oracle Call Center Technology (E-Business Suite versions 12.2.3 through 12.2.15) is achievable by a high-privileged attacker with network access over HTTP targeting the Internal Operations component. The vulnerability is rated 7.2 CVSS 3.1 with complete Confidentiality, Integrity, and Availability impacts, meaning successful exploitation yields effective control of the affected instance. No public exploit code has been identified at time of analysis, and the requirement for high-privilege credentials is the primary limiting factor constraining real-world exposure.
Full system takeover of Oracle Business Intelligence Enterprise Edition 26.01.0.0.0 is achievable by a high-privileged attacker over HTTP, targeting the Analytics Web Answers component with no user interaction required. The C:H/I:H/A:H impact triad confirms complete compromise of confidentiality, integrity, and availability once exploitation succeeds. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the low attack complexity (AC:L) means that any attacker who clears the authentication barrier faces minimal technical obstacles to achieving full takeover.
Full system takeover of Oracle Hyperion Financial Management version 11.2.25.0.000 is achievable by a network-accessible, high-privileged attacker exploiting a flaw in the Security component via HTTP. The vulnerability carries a CVSS 3.1 base score of 7.2 with high confidentiality, integrity, and availability impact, amounting to effective product compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and complete CIA triad impact warrant prompt remediation attention.
Oracle Hyperion Financial Management 11.2.25.0.000 contains a flaw in its Security component that allows a high-privileged, network-authenticated attacker to achieve full system takeover via HTTP, impacting confidentiality, integrity, and availability. Disclosed via Oracle's August 2026 Critical Security Patch Update (CSPU) and corroborated by EUVD-2026-61886, the attack requires no user interaction and has low complexity once privileged credentials are available. No public exploit has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.
Full takeover of PeopleSoft Enterprise FIN Common Objects Brazil 9.1 is achievable by a high-privileged attacker with network access using Oracle's T3 or IIOP protocols. The vulnerability carries a CVSS 3.1 score of 7.2, reflecting complete confidentiality, integrity, and availability impact despite the PR:H prerequisite. No public exploit has been identified and the vulnerability is not listed in CISA KEV at time of analysis, though Oracle's August 2026 Critical Patch Update advisory addresses it.
Full takeover of Oracle Proposals (Oracle E-Business Suite component) is achievable by a high-privileged, network-adjacent attacker over HTTP, resulting in complete compromise of confidentiality, integrity, and availability. Affected deployments span versions 12.2.3 through 12.2.15 of Oracle E-Business Suite, a widely deployed enterprise ERP platform. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Oracle addressed this in the August 2026 Critical Patch Update.
Full system takeover in Oracle Hyperion Profitability and Cost Management 11.2.25.0.000 is achievable by a high-privileged, network-authenticated attacker via HTTP against the Deployment component, resulting in complete confidentiality, integrity, and availability compromise. Disclosed as part of Oracle's August 2026 Critical Security Update (CPU) and registered in ENISA EUVD (EUVD-2026-61690), with no confirmed active exploitation or public exploit code at time of analysis. The PR:H prerequisite significantly constrains the attacker population to insiders, compromised administrator accounts, or actors with prior lateral movement to admin-level access.
Full compromise of Oracle PeopleSoft Enterprise PeopleTools (versions 8.61-8.63) is achievable by a network-accessible, highly privileged attacker via a flaw in the PeopleCode component over HTTP. Successful exploitation results in complete confidentiality, integrity, and availability impact - Oracle characterizes the outcome as a full 'takeover' of the PeopleSoft environment. No public exploit code or CISA KEV listing has been identified at time of analysis, and the PR:H requirement narrows the realistic attacker population to those already holding administrative-level credentials.
PHP Object Injection in the OptionTree WordPress plugin (versions <= 2.7.3) enables authenticated administrators to submit crafted serialized PHP data through the plugin's Editor interface, triggering dangerous deserialization that can culminate in arbitrary code execution on the host server. The CVSS vector (PR:H) confirms that exploitation is gated behind WordPress administrator credentials, constraining the immediate threat surface. No public exploit code or active exploitation has been identified at time of analysis.
Full system takeover of Oracle HRMS (Netherlands) versions 12.2.3 through 12.2.15 is achievable by a high-privileged remote attacker targeting the Netherlands Payroll component over HTTP. The CVSS vector confirms network accessibility with low attack complexity, no user interaction, and complete compromise of confidentiality, integrity, and availability upon successful exploitation. No public exploit has been identified at time of analysis, and the vulnerability is not currently listed in the CISA KEV catalog.