Unauthorized data exfiltration and partial service disruption in Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by low-privileged network attackers via HTTP, with no user interaction required. The vulnerability resides in the Security component and, per the 'Authentication Bypass' tag, likely involves improper enforcement of access controls that permits a low-privileged user to read data far beyond their authorization level, achieving complete access to all Financial Management accessible data (C:H). No public exploit or active exploitation has been identified at time of analysis, but the low attack complexity and network accessibility make this straightforward to leverage for any authenticated user of the application.
Path traversal in Grav Plugin API versions 1.0.0-beta.10 through 1.0.14 enables an authenticated editor-level user to write attacker-controlled page content and media to arbitrary filesystem locations accessible to the web server process. The root cause is an incomplete fix for a prior related path traversal (GHSA-qjq4-jp55-4mx2) that left the 'suffix' parameter of the PagesController::batchCopy() method unvalidated against directory escape sequences. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor-released patch version 1.0.15 resolves the issue.
SQL injection in License Manager for WooCommerce (versions ≤ 3.0.18) enables authenticated customers to execute arbitrary SQL queries against the underlying WordPress database, achieving a scope change that exposes high-confidentiality data across the shared database - including license keys, customer PII, WooCommerce order records, and hashed WordPress credentials. Exploitation requires only a low-privilege customer account, making the attack surface broad on stores with open registration. No public exploit code or CISA KEV listing has been identified at time of analysis, though SQL injection in WordPress plugins is a historically well-understood attack class that lowers the barrier to POC development post-disclosure.
Oracle Loans 12.2.3 through 12.2.15, a component of Oracle E-Business Suite, exposes its Internal Operations component to network-based exploitation by low-privileged authenticated attackers over HTTP. Successful exploitation grants unauthorized ability to create, delete, or modify critical data across all Oracle Loans accessible records, and can induce a partial denial of service against the application. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the low attack complexity and broad affected version range (12.2.3-12.2.15) make this a notable priority for Oracle EBS deployments.
Oracle Work in Process (WIP) versions 12.2.3 through 12.2.15, a manufacturing module within Oracle E-Business Suite, exposes its Internal Operations component over HTTP to low-privileged authenticated attackers who can trigger a complete service hang or crash alongside unauthorized data modification. The attack requires no user interaction and is characterized as easily exploitable by Oracle's own advisory language, giving it outsized operational impact for manufacturing environments dependent on WIP for production scheduling. No public exploit has been identified at time of analysis, and this vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog.
Oracle Application Testing Suite 13.3.0.1 exposes an authentication bypass that allows an unauthenticated attacker on the same physical network segment to read critical data and perform limited data manipulation. The adjacency requirement (AV:A) constrains the attack surface to attackers who have physical or logical access to the local network segment hosting the affected system, but no credentials or user interaction are needed once that foothold exists. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and zero privilege requirement make this straightforward to exploit by any actor already on the adjacent network.
Missing authorization in ArcadeDB's DELETE FUNCTION SQL command allows any authenticated database user to permanently remove server-side functions regardless of their actual permission level. All releases up to and including 26.7.3 are affected; the issue is resolved in 26.8.1. No public exploit has been identified at time of analysis, but the low barrier - a valid database credential and a single API call - makes this easily reachable by insiders or compromised low-privilege accounts, particularly where server-side functions enforce security or business logic.
Unauthorized data access in Oracle Order Management's Product Diagnostic Tools component allows low-privileged authenticated attackers over HTTP to compromise confidentiality of critical order data and perform limited data manipulation, with a confirmed scope change that can extend impact to adjacent Oracle E-Business Suite components. Affected deployments span a wide version range, 12.2.3 through 12.2.15, and are addressed in Oracle's Critical Patch Update for August 2026. No public exploit code has been identified at time of analysis, though the Authentication Bypass tag associated with this CVE signals a potentially exploitable access control weakness in the diagnostic sub-component.
Oracle Reports Developer 12.2.1.19.0, a component of Oracle Fusion Middleware, exposes a network-exploitable authentication/security bypass in its Security and Authentication component that allows a low-privileged attacker to gain complete unauthorized read access to all data accessible by the application and limited write access to some data. The scope change (S:C) in the CVSS vector confirms that a successful attack can cascade and significantly impact additional products beyond Oracle Reports Developer itself. No public exploit code or active exploitation has been identified at time of analysis, and Oracle classifies this as difficult to exploit (AC:H).
Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 expose a high-complexity, network-accessible flaw in the Content Server component that allows low-privileged authenticated attackers to gain unauthorized read access to critical content data and perform limited data manipulation. The vulnerability carries a scope-change designation, meaning successful exploitation can extend impact beyond WebCenter Content itself to adjacent Oracle Fusion Middleware products. No public exploit code and no confirmed active exploitation (CISA KEV) have been identified at time of analysis, though the 'Authentication Bypass' tag from ENISA EUVD introduces residual uncertainty about the true privilege prerequisite.
Unauthorized data access in Oracle Flow Manufacturing 12.2.3 through 12.2.15 allows network-authenticated low-privileged users to fully compromise confidentiality of all accessible manufacturing data and perform limited unauthorized data modification via HTTP. Tagged as an authentication bypass by the reporting source, this suggests the vulnerability enables low-privileged users to circumvent authorization controls within Oracle E-Business Suite's Internal Operations component, exposing critical operational data beyond their intended access scope. No public exploit has been identified at time of analysis; Oracle addressed this in the August 2026 Critical Security Patch Update.
Unauthenticated cross-site scripting in the Subscribe2 WordPress plugin (versions <= 10.46) allows a remote unauthenticated attacker to inject arbitrary JavaScript into pages rendered by victims who follow a crafted link. The CVSS scope-change metric (S:C) indicates the injected script executes outside the vulnerable component's security boundary, enabling session hijacking, credential theft, or unauthorized administrative actions against any user - including site administrators - who can be socially engineered into triggering the payload. No public exploit code or active exploitation has been confirmed at time of analysis, though the zero-privilege attack entry point lowers the barrier for opportunistic abuse.
Cross-site scripting in the Site Reviews WordPress plugin by Gemini Labs (versions up to and including 8.2.0) allows unauthenticated attackers to inject malicious JavaScript that executes in visitors' browsers when they view affected review pages. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) reflects that no authentication is needed to plant the payload, and the changed scope means the injected script can reach browser-origin resources beyond the plugin itself, enabling session hijacking or credential theft. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated cross-site scripting in Contact Form by Supsystic WordPress plugin (all versions before 1.10.0) allows a remote, unauthenticated attacker to inject and execute arbitrary JavaScript in the browsers of site visitors. The CVSS vector confirms a scope change (S:C), meaning the injected script executes in the victim's browser context rather than the server, enabling session hijacking, credential theft, or malicious redirects. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-privilege entry point and WordPress deployment scale make this a meaningful patching priority.
Unauthenticated Cross-Site Scripting in the URL Shortify WordPress plugin (versions <= 2.5.0) allows remote attackers to inject malicious scripts into pages viewed by authenticated victims, including site administrators. With a Changed scope (S:C), successful exploitation extends the attack surface beyond the plugin itself into the victim's browser session, enabling session hijacking, credential theft, or unauthorized administrative actions within the WordPress dashboard. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthenticated cross-site scripting in Chaty Pro (WordPress plugin by Premio, versions ≤ 3.5.8) enables remote attackers without any credentials to inject malicious JavaScript into pages served to site visitors and administrators, with the CVSS scope change (S:C) indicating the payload can affect security principals beyond the plugin itself - including stealing admin session tokens or performing privileged actions on behalf of logged-in users. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) places this as a low-complexity, network-accessible attack requiring only that a victim load an affected page. No public exploit code and no CISA KEV listing have been identified at time of analysis, per Patchstack's disclosure and ENISA EUVD-2026-60784.
Unauthenticated Cross-Site Scripting in the Affiliates Manager WordPress plugin (versions ≤2.9.53) allows remote attackers without credentials to inject arbitrary JavaScript that executes in the browser context of site visitors or authenticated administrators. The CVSS scope change (S:C) indicates the injected script breaks out of the plugin's trust boundary and operates under the victim's session, enabling session hijacking or unauthorized privileged actions. Reported by Patchstack under ENISA EUVD-2026-60782, no CISA KEV entry or public exploit code has been identified at time of analysis, though the unauthenticated, low-complexity attack surface makes this class of flaw a consistent target in mass WordPress scanning campaigns.
Cross-site scripting in WP Multilang WordPress plugin (versions through 2.4.31) allows unauthenticated remote attackers to inject malicious JavaScript into victim browsers when a user interacts with a specially crafted URL, with CVSS scope change (S:C) indicating the payload can escape the plugin's execution context and affect the broader browser environment. Reported by Patchstack and catalogued as ENISA EUVD-2026-60772, the vulnerability carries a CVSS 7.1 High rating driven primarily by the changed scope and zero-privilege requirement for crafting the exploit. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Unauthenticated XSS in the Autopay WordPress plugin (versions ≤ 5.0.0) enables remote attackers to inject and execute arbitrary JavaScript in victims' browsers without any authentication, leveraging the plugin's failure to sanitize user-supplied input before rendering it in HTML output. The CVSS scope change (S:C) indicates the injected script escapes the plugin's own context, enabling session hijacking, credential theft, or malicious redirects against users of affected WordPress sites. No public exploit code or CISA KEV listing has been confirmed at time of analysis; the issue was disclosed by Patchstack.
Unauthenticated reflected Cross-Site Scripting (XSS) in the Convert Pro WordPress plugin (versions up to and including 1.0.1) allows remote, unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by tricking them into clicking a crafted link. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) confirms network-reachable exploitation with no authentication required, though victim interaction is needed. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the unauthenticated nature and WordPress ecosystem prevalence elevate practical risk.
Unauthenticated cross-site scripting (XSS) in the Kirki WordPress customizer plugin (all versions up to and including 6.2.3) allows remote, unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser when the victim is socially engineered into visiting a crafted URL or page. The CVSS scope change (S:C) indicates injected script execution escapes the plugin's own context, enabling session hijacking, credential theft, or unauthorized admin actions against authenticated WordPress users. No public exploit code or confirmed active exploitation has been identified at time of analysis, but the zero-privilege-required, low-complexity attack path makes this accessible to unsophisticated attackers targeting WordPress sites.
Unauthenticated cross-site scripting in Ultimate Dashboard WordPress plugin versions 3.11.2 and earlier allows network-accessible, privilege-free attackers to inject arbitrary JavaScript that executes in the browser context of any authenticated user who visits the affected page. The CVSS scope change (S:C) confirms the payload breaks out of the plugin's context and operates under the WordPress origin, enabling session hijacking, credential harvesting, or forced privileged actions against administrators. No active exploitation has been confirmed in CISA KEV and no public proof-of-concept exploit code has been identified at time of analysis.
Unauthenticated Cross-Site Scripting (XSS) in the BP Better Messages WordPress plugin versions up to and including 2.15.22 allows remote unauthenticated attackers to inject malicious scripts that execute in the browser of any user who views attacker-controlled content. The scope-changed CVSS vector (S:C) indicates the injected script can operate beyond the plugin's context, enabling session hijacking, credential theft, or admin account takeover when a privileged user views the payload. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated attack vector and low complexity lower the barrier significantly for opportunistic exploitation.
Remote exploitation of Oracle WebCenter Content's Content Server component allows unauthenticated network attackers to compromise confidentiality, integrity, and availability of the platform when a victim user interacts with a malicious payload delivered over HTTP. Both actively supported versions - 12.2.1.4.0 and 14.1.2.0.0 - are affected, and successful exploitation produces a scope change, meaning impacts can propagate beyond the directly targeted WebCenter Content instance to adjacent products within the Fusion Middleware stack. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-privilege requirement make this a credible threat in internet-exposed deployments.
Server-side request forgery in ArcadeDB before 26.8.1 enables authenticated attackers to bypass the IMPORT DATABASE command's hostname validator by exploiting a time-of-check/time-of-use gap: the validator resolves a hostname once, but the subsequent HTTP connection re-resolves it independently and follows redirects. This allows DNS rebinding or redirect-based bypass to reach cloud metadata endpoints such as the AWS IMDSv1 service, internal network services, or arbitrary local files on the host. No public exploit is identified at time of analysis, but the techniques involved are well-documented and the cloud credential exposure impact is severe on default cloud deployments.
Privilege escalation in NVIDIA NVOS network switch operating system occurs when PKA-only SSH mode is enabled, inadvertently activating a secondary authentication channel that can be exploited if the default device password has not been rotated per NVIDIA's hardening guidance. An adjacent-network attacker who discovers this condition can authenticate via the alternative path using default credentials, bypassing the intended PKA-only enforcement and gaining elevated access to the switch. No public exploit code exists and this vulnerability has not been added to the CISA KEV catalog at time of analysis, but the infrastructure impact of a compromised network switch is significant.
High-severity data disclosure and partial integrity compromise in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows a low-privileged network attacker to gain complete unauthorized read access to all data accessible within the platform, with additional unauthorized insert, update, and delete capability against a subset of that data. The flaw resides in the Common Security component - the centralized authentication and authorization layer of the Hyperion EPM suite - and carries a CVSS scope-change indicator (S:C) confirming that successful exploitation can affect additional Hyperion products beyond the initially targeted component. No public exploit code has been identified and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, though the cross-scope confidentiality and integrity impacts in a financial EPM context make it a meaningful business risk for affected organizations.
Tar extraction path traversal in moby/go-archive allows an attacker who controls archive contents to create or overwrite files outside the intended destination directory, undermining container-to-host filesystem boundaries. The affected functions - Unpack, UnpackLayer, Untar, UntarUncompressed, and ApplyLayer - perform lexical path validation but rely on OS-level resolution at operation time, meaning symlinks introduced inside the archive redirect writes to arbitrary paths writable by the extracting process. This flaw propagates through the full Docker ecosystem including Docker Engine, Docker Desktop, Docker CLI, Docker Compose, and Docker Sandboxes; vendor-released patches are available and no public exploit code has been identified at time of analysis.
Denial-of-service in TP-Link Tapo C200 v5 IP cameras allows adjacent-network unauthenticated attackers to crash the device's configuration service by submitting oversized encrypted ciphertext payloads that trigger unhandled exceptions. Affected firmware versions prior to V5_1.4.6 Build 260709 Rel.27675n are confirmed vulnerable per ENISA EUVD-2026-62194; successful exploitation temporarily disables HTTPS management and monitoring until the service self-recovers, with no confidentiality or integrity impact. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Unauthenticated Cross-Site Scripting in the Ultimate Maps by Supsystic WordPress plugin (all versions prior to 1.5.0) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages rendered in a victim's browser. The CVSS vector confirms a Changed scope (S:C), meaning injected scripts execute within the victim's browser security context rather than the plugin's own origin, enabling session hijacking or malicious redirection against authenticated WordPress users. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated, low-complexity attack vector significantly lowers the exploitation barrier.
Cross-Site Scripting in the WPZOOM Recipe Card Blocks for Gutenberg & Elementor WordPress plugin through version 3.4.18 allows unauthenticated remote attackers to inject malicious scripts that execute in victims' browsers when they view affected recipe content. Reported by Patchstack and registered as EUVD-2026-60785, the vulnerability carries a CVSS 7.1 (High) score with a scope change indicating the injected script breaks out of the plugin's trust boundary into the broader browser context. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Reflected XSS in the miniOrange WordPress Social Login and Register plugin (all versions through 7.8.1) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in the browser session of any user who follows a crafted link. The CVSS scope-change designation (S:C) confirms the malicious script escapes the plugin's rendering context and operates within the victim's full browser session, making admin-targeted delivery via phishing a realistic escalation path to full WordPress site compromise. No public exploit code and no CISA KEV listing have been identified at time of analysis; exploitation risk signals are limited to the CVSS vector and the Patchstack disclosure.
Cross-site scripting in WPDM - Premium Packages for WordPress allows unauthenticated remote attackers to inject arbitrary JavaScript into pages rendered for victim users, exploiting insufficient output sanitization in plugin versions 7.0.5 and earlier. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C) confirms low-complexity, network-reachable unauthenticated access with a scope change crossing from the vulnerable plugin into the victim's browser context, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Cross-site scripting in the Templately WordPress plugin (versions ≤ 3.7.1) enables unauthenticated remote attackers to inject arbitrary JavaScript that executes in victim browsers upon user interaction, with scope change indicating cross-context impact. The CVSS vector (PR:N, S:C) confirms exploitation requires no authentication and that injected scripts escape the plugin's security context into the broader browser environment, enabling session hijacking, credential theft, or malicious content injection. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated cross-site scripting in Fluent Forms Pro Add On Pack (versions below 6.2.12) allows a remote, unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by enticing them to interact with a crafted URL or form input. The vulnerability carries a CVSS 7.1 (High) rating with scope-changed impact, meaning the injected script can affect browser context beyond the plugin itself - enabling session hijacking, credential theft, or UI redirection against authenticated WordPress users. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available at version 6.2.12.
Reflected Cross-Site Scripting in the Mayosis Core WordPress plugin (versions 5.4.7 and earlier) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by tricking authenticated WordPress users into clicking a crafted URL. The CVSS Scope Change (S:C) indicator confirms the injected script escapes the plugin's context, enabling session hijacking, credential theft, or malicious redirects targeting site administrators or editors. No public exploit code or CISA KEV listing has been identified at time of analysis; the vulnerability was disclosed by Patchstack.
Reflected Cross-Site Scripting in the SSL Zen WordPress plugin (versions 4.7.43 and earlier) enables unauthenticated remote attackers to inject and execute arbitrary JavaScript in the browsers of authenticated WordPress users who interact with a crafted URL. The Scope:Changed CVSS metric confirms the injected script executes outside the plugin's own trust boundary, making admin session hijacking and site takeover realistic outcomes. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Unauthenticated cross-site scripting in Quill Forms WordPress plugin version 5.7.1 and earlier allows remote attackers without any credentials to inject malicious scripts into pages rendered by the plugin. Because the CVSS vector indicates a scope change (S:C), successful exploitation can affect the browser session of authenticated users - including site administrators - who view attacker-controlled content. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Improper access control in Oracle Hyperion Data Relationship Management 11.2.25.0.000 enables a local attacker to bypass application-level authentication and gain full read and write access to all DRM-managed data. The affected component is the Access and Security module (CWE-284), meaning the flaw sits at the authorization enforcement layer rather than in data processing logic. No public exploit or active exploitation is confirmed; SSVC rates technical impact as total, making successful compromise highly damaging despite the local attack vector requirement.
Local authentication bypass in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 allows any user with OS-level logon access to the hosting infrastructure to read all data managed by the Content Server component without Oracle application credentials. The scope change designation (S:C in the CVSS vector) indicates successful exploitation may further compromise additional Oracle Fusion Middleware products co-located on the same host. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis.
Local authentication bypass in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 enables a low-privileged OS-level attacker to gain full read and write access to all data accessible by the Hyperion platform. The flaw resides in the Installation and Configuration component, where access controls can be circumvented without requiring elevated system privileges or user interaction. No active exploitation has been confirmed (not in CISA KEV), and no public proof-of-concept code has been identified at time of analysis.
Local authentication bypass in Oracle Hyperion Financial Management 11.2.25.0.000 enables a low-privileged attacker with infrastructure logon to read and modify all application-accessible financial data. The CVSS 7.1 score reflects high confidentiality and integrity impact with no availability disruption, constrained entirely to the local attack surface. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog.
Local data compromise in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 enables a low-privileged local OS user to fully breach confidentiality and integrity of all data accessible to the Hyperion platform via a flaw in the Installation and Configuration component. Tagged as an authentication bypass, the vulnerability suggests internal Hyperion access controls fail to restrict a minimally-privileged local account from accessing or manipulating critical data beyond its authorization. No public exploit code or CISA KEV listing has been identified at time of analysis.
Code injection in Vim prior to 9.2.0845 enables arbitrary operating-system command execution by an attacker who can supply a malicious ctags-format tags file. The StructMembers() function in ccomplete.vim embeds typeref: and typename: field values from that tags file into a dynamically constructed vimgrep pattern using escaping that only covers '/' and '\', leaving regex metacharacters such as '[' active; an unclosed bracket breaks Vim's pattern parser, causing the remainder of the tag value to be interpreted as Ex commands where '|' acts as a command separator. Exploitation requires the victim to actively invoke C omni-completion (CTRL-X CTRL-O) while editing a C file referencing the malicious tags entry; no public exploit is identified at time of analysis, though the fix commit's test suite embeds a working proof-of-concept payload, substantially lowering the barrier to weaponization.
Oracle E-Business Tax versions 12.2.3 through 12.2.15 allows a low-privileged local attacker to compromise data integrity and trigger a repeatable denial-of-service condition in the Internal Operations component. Successful exploitation enables unauthorized creation, deletion, or modification of critical tax data, and can cause the application to hang or crash completely, disrupting core business tax processing workflows. No public exploit has been identified at time of analysis, though the low complexity and low privilege requirements make this an accessible target for any authenticated local user on the affected infrastructure.
Local authentication bypass in Oracle Hyperion Calculation Manager 11.2.25.0.000 allows an unauthenticated local attacker - one with OS-level logon to the host infrastructure but no Oracle application credentials - to compromise the Security component and gain complete unauthorized read access to all data accessible by Hyperion Calculation Manager. The scope change (S:C) in the CVSS vector confirms that successful exploitation can cascade to impact additional Oracle products co-hosted on the same infrastructure. No public exploit has been identified at time of analysis, and Oracle disclosed this through its August 2026 Critical Patch Update.
Unauthorized data access and integrity compromise in Oracle Hyperion Data Relationship Management 11.2.25.0.000 allows a local attacker holding low-privilege infrastructure credentials to fully circumvent application-level access controls, yielding complete read and write access to all DRM-managed master data. The vulnerability resides in the Access and security component and is tagged as an Authentication Bypass, suggesting internal authorization enforcement fails once basic OS-level access to the host is obtained. No public exploit code has been identified and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 exposes a local privilege abuse path in its Installation and Configuration component, enabling a low-privileged authenticated user with system logon to gain unauthorized read and write access to all critical Hyperion data. The CVSS 3.1 score of 7.1 (High) reflects high confidentiality and integrity impacts, though the local attack vector constrains the attacker pool to insiders or those with pre-existing system access. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Path traversal via unsanitized cluster node names in Wazuh Manager 4.0.0 through 4.14.5 enables authenticated cluster peers to delete arbitrary directory contents on the master node. An attacker holding a valid cluster Fernet key can supply a traversal-shaped node name (e.g., '../../etc') in the cluster hello handshake, then disconnect - causing the master's peer cleanup routine to recursively remove the contents of directories outside the intended cluster queue path, writable by the wazuh user. No public exploit has been identified at time of analysis, and a vendor patch is available in 4.14.6.
Path traversal in Wazuh Manager 4.0.0 through 4.14.5 allows unauthenticated remote attackers to destroy the manager's queue directory structure and halt all Wazuh services by registering an agent whose name begins with a dot (e.g., ".."). Two compounding weaknesses drive the impact: OS_IsValidName() failed to reject dot-prefixed agent names, and delete_diff() performs unsafe path concatenation that resolves the traversal sequence to the parent queue directory, wiping its subdirectories. Recovery requires manual intervention, creating a complete and sustained loss of SIEM and XDR visibility. No public exploit or CISA KEV listing has been identified at time of analysis.