Arbitrary file upload in GP Premium (the premium companion plugin for the GeneratePress WordPress theme) through version 2.5.5 allows attackers holding a low-privileged Contributor account to upload arbitrary files, enabling web shell deployment and full site compromise. Rated CVSS 9.9 with a scope-changing vector, it is reported by Patchstack and tracked as EUVD-2026-60916; no public exploit code has been identified at time of analysis and it is not listed in CISA KEV. The low privilege barrier (any Contributor) combined with high confidentiality, integrity and availability impact makes this a severe multi-tenant and membership-site risk.
Arbitrary file upload in the Templatiq WordPress plugin (versions ≤ 0.2.5) lets authenticated users holding only Contributor-level privileges upload files without adequate type or content validation (CWE-434), enabling upload of executable PHP and full site compromise. The flaw was reported by Patchstack and carries a vendor CVSS of 9.9 driven by a scope change and low privilege barrier. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Remote code execution in the Cwicly WordPress page-builder plugin (versions 1.4.4 and earlier) allows a low-privileged Contributor-level account to inject and execute arbitrary PHP code on the server, per a Patchstack advisory. Because a Contributor is a low-trust role often granted for guest posting, this collapses the boundary between content authoring and full server compromise. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the 9.9 CVSS score and CWE-94 code-injection class make it a high-priority patching target.
Scope-changing compromise of Oracle Helidon 4.5.3 (Imperative Web Server component) lets a remote, unauthenticated attacker send HTTP requests that grant high-integrity write access to Helidon-accessible data, partial read disclosure, and a partial denial of service - with impact that can extend beyond Helidon into adjacent products. Rated CVSS 3.1 9.9 due to the scope change combined with easy, no-privilege network exploitation. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated remote compromise of Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.6) is possible through the Siebel Cloud Manager component via crafted HTTP requests, requiring no privileges or user interaction. An attacker can gain full read access to all Siebel CRM Cloud data, perform limited unauthorized writes, and cause a partial denial of service, and because the flaw carries a scope change, exploitation can significantly impact additional connected products beyond Siebel itself. Rated CVSS 9.9; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full takeover of Oracle Identity Manager is possible when a low-privileged attacker reaches the OIM Legacy UI component over the network via RMI, per Oracle's August 2026 Critical Patch Update (CVE-2026-61066). The flaw carries a CVSS 3.1 base score of 9.9 with a scope change, meaning successful exploitation can compromise the identity platform itself and cascade into other products that trust it. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and identity-provider blast radius make it a top-priority patch.
Remote unauthenticated compromise of Oracle WebCenter Enterprise Capture (Fusion Middleware, Client Bundle component) allows an attacker with only network/HTTP reach to create, delete, or modify critical data, read a subset of accessible data, and cause partial denial of service. Versions 12.2.1.4.0 and 14.1.2.0.0 are affected, and Oracle explicitly flags a scope change meaning successful attacks may significantly impact other products beyond Capture itself. Rated CVSS 3.1 9.9; disclosed in the Oracle Critical Patch Update of August 2026 with no public exploit identified at time of analysis.
Privilege escalation to full takeover in Oracle Internet Directory (OID) 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged attacker with network access over LDAP to fully compromise the directory server, with a scope change that can significantly impact other products relying on it. Rated CVSS 9.9 with high confidentiality, integrity, and availability impact, it was reported by Oracle and addressed in the August 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege escalation and full takeover of the Oracle Identity Manager Connector (Core component of Oracle Fusion Middleware) is possible for a low-privileged attacker with network access over TLS, affecting versions 12.2.1.4.0 and 14.1.2.1.0. Because the flaw carries a scope change, a successful attack can pivot beyond the connector to significantly impact additional products, driving the CVSS 3.1 base score to 9.9. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, so exploitation is currently theoretical but the low attack complexity makes it a high patching priority.
Privilege escalation to full takeover in Oracle Identity Manager Connector (Oracle Fusion Middleware, Core component) lets a low-privileged, network-adjacent attacker fully compromise the Connector over TLS, with a scope change that can significantly impact other integrated products. Affected releases are 12.2.1.4.0 and 14.1.2.1.0, carrying a CVSS 3.1 base score of 9.9 (C:H/I:H/A:H). No public exploit is identified at time of analysis, and the issue is addressed in Oracle's August 2026 Critical Patch Update.
Full product takeover in Oracle WebCenter Sites (versions 12.2.1.4.0 and 14.1.2.0.0), a component of Oracle Fusion Middleware, allows a low-privileged attacker with HTTP network access to fully compromise the server and, due to a scope change, significantly impact additional connected products. Oracle rates this CVSS 3.1 9.9 with high confidentiality, integrity, and availability impact and describes it as easily exploitable. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the fix ships in Oracle's August 2026 Critical Patch Update.
Full takeover of Oracle BI Publisher is possible when a low-privileged attacker sends crafted SOAP requests to the Web Service API component of this enterprise reporting and document-generation platform. Oracle rates the flaw CVSS 9.9 because the compromise crosses a trust boundary (scope change), meaning exploitation can significantly impact products beyond BI Publisher itself. No public exploit has been identified at time of analysis; the issue was self-reported by Oracle in the August 2026 Critical Patch Update.
Remote code execution in MyBB 1.8.13 through 1.8.39 lets an attacker inject arbitrary PHP into the generated database configuration file when the web-based installer (install/index.php) remains accessible. The installer sanitizes database configuration values with addcslashes() but omits the backslash from its escaped-character set, so crafted input can break out of the single-quoted PHP string and execute attacker-controlled code. Rated CVSS 9.8; no public exploit identified at time of analysis, though the fixing commit publicly reveals the exact one-character root cause, lowering the barrier to weaponization.
Arbitrary file upload in the WordPress plugin Sync Post With Other Site (versions 1.9.3 and earlier) lets a user holding only Contributor-level privileges upload files of any type, including PHP webshells, bypassing WordPress's normal media-type restrictions. Because the flaw carries a scope-changed CVSS 3.1 score of 9.9, a successful upload typically escalates to remote code execution and full site compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low authentication barrier and high impact make it a strong patch priority.
Memory-corruption defects in Mozilla Firefox and its ESR channels allow potential arbitrary code execution when a user renders attacker-controlled web content, per Mozilla advisories MFSA2026-74 through MFSA2026-80. The flaws were found internally by Mozilla across Firefox 153 and ESR 115.38/140.13/153.0, and Mozilla states some showed evidence of memory corruption that could plausibly be exploited. No public exploit identified at time of analysis; the issues are already fixed in Firefox 154, ESR 115.39, 140.14, and 153.1.
Unauthenticated PHP Object Injection in the WordPress plugin Popup by Supsystic (versions 1.13.0 and earlier) lets remote attackers submit crafted serialized data that the plugin deserializes without validation. Reported by Patchstack and rated CVSS 9.8, the flaw is exploitable without authentication or user interaction; if a suitable POP gadget chain is present in the WordPress core, another plugin, or theme, it can escalate to arbitrary file operations, SQL injection, or remote code execution. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated PHP object injection affects the Easy Google Maps WordPress plugin (vendor Supsystic) in all versions up to and including 1.13.0, letting remote attackers submit arbitrary serialized PHP objects that the application deserializes. Reported by Patchstack and rated CVSS 9.8, the flaw can escalate to remote code execution, data theft, or full site takeover when a suitable property-oriented programming (POP) gadget chain is present in the plugin, WordPress core, or another active extension. No public exploit is identified at time of analysis, and the issue is not listed in CISA KEV.
Full compromise of Oracle Workflow (Workflow Notification Mailer component) in Oracle E-Business Suite 12.2.3 through 12.2.15 is possible by an unauthenticated attacker who can reach the product over SMTP, per Oracle's August 2026 Critical Patch Update. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, 9.8) reflects an easily exploitable network flaw resulting in complete takeover of Oracle Workflow. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV; EPSS data was not provided.
Remote takeover of Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication component) allows an unauthenticated attacker with only HTTP network access to fully compromise the product, per Oracle's Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact and no user interaction required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and unauthenticated network vector make it a high-priority patch target.
Full takeover of Oracle Reports Developer 14.1.2.0.0 (a component of Oracle Fusion Middleware) is possible for a remote, unauthenticated attacker over HTTP, carrying a CVSS 3.1 base score of 9.8 with complete confidentiality, integrity, and availability impact. Disclosed in Oracle's August 2026 Critical Patch Update (cross-referenced as ENISA EUVD-2026-61615), the flaw sits in the Security and Authentication component and permits complete compromise of the product without credentials or user interaction. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Full compromise of Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware) is possible by a remote, unauthenticated attacker over HTTP against the Security and Authentication component, per Oracle's August 2026 Critical Patch Update. Oracle rates it CVSS 9.8 with high confidentiality, integrity, and availability impact, describing 'takeover' of the product. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Complete takeover of Oracle Reports Developer 12.2.1.19.0 is achievable by a remote, unauthenticated attacker over HTTP, per Oracle's August 2026 Critical Patch Update. The flaw sits in the product's Security and Authentication component and yields full confidentiality, integrity, and availability compromise (CVSS 9.8). No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the trivial exploitability and unauthenticated network vector make it a high-priority patch.
Full application takeover in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component), versions 22.3 through 26.6, lets a remote unauthenticated attacker fully compromise the system over HTTP. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) with a 9.8 base score and full high impact on confidentiality, integrity, and availability marks this as a pre-authentication, network-reachable critical flaw disclosed in Oracle's August 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivially-exploitable, unauthenticated profile makes it a high-priority patch target.
Remote unauthenticated compromise of Oracle WebLogic Server (Fusion Middleware, WLS Core Components) allows a network attacker to fully take over the server via the RMI protocol. Affected supported versions are 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0, with a CVSS 3.1 base score of 9.8 reflecting full confidentiality, integrity, and availability loss. No public exploit was identified at time of analysis, but the 'easily exploitable' rating and unauthenticated RMI attack surface make this a top-priority patch.
Full remote takeover of Oracle Hyperion Calculation Manager 11.2.25.0.000 is possible by an unauthenticated attacker over HTTP, per Oracle's Critical Patch Update advisory (CSPUAUG2026). The flaw sits in the product's Security component and yields complete compromise of confidentiality, integrity, and availability (CVSS 3.1 9.8). No public exploit code or CISA KEV listing is identified at time of analysis, but the trivial exploitability and network reach make it a high-priority patch item.
Remote takeover of Oracle WebLogic Server is possible when an unauthenticated attacker reaches the server's IIOP interface over the network, letting them fully compromise the Core component with high confidentiality, integrity, and availability impact. The flaw affects supported releases 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, and is rated CVSS 9.8 by Oracle. No public exploit identified at time of analysis, but the pattern matches prior high-impact WebLogic IIOP deserialization flaws that were rapidly weaponized.
Unauthenticated remote takeover in Oracle WebLogic Server (Fusion Middleware Core) lets a network attacker fully compromise the server via the T3 and IIOP protocols with no credentials and no user interaction. Affected supported releases are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, and Oracle rates it CVSS 9.8 with full confidentiality, integrity, and availability loss. No public exploit identified at time of analysis, but the class of flaw and the low attack complexity make it a top-priority patch.
Full server takeover in Oracle WebLogic Server (Fusion Middleware Core component) allows a remote, unauthenticated attacker with network access via the T3 or IIOP protocols to completely compromise affected instances (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0). The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity and availability impact and requires no privileges or user interaction. There is no public exploit identified at time of analysis, but WebLogic T3/IIOP deserialization flaws are historically rapid targets for weaponization.
Full remote takeover in Oracle Helidon 3.2.18 (Fusion Middleware, Imperative Web Server component) allows an unauthenticated attacker with only HTTP network access to fully compromise the affected instance. Oracle rates the flaw CVSS 3.1 9.8 with high confidentiality, integrity, and availability impact and describes it as "easily exploitable," fixed in the August 2026 Critical Patch Update. There is no public exploit identified at time of analysis and the CVE is not on CISA KEV, but the unauthenticated network-facing profile makes it a high-priority patch.
Remote takeover in Oracle Helidon 4.5.0 lets an unauthenticated attacker fully compromise the framework's Imperative Web Server component over HTTP. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact and no authentication or user interaction required, per Oracle's August 2026 Critical Patch Update. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the trivial exploitability rating warrants urgent patching.
Remote takeover of Oracle Helidon 3.2.18 (Imperative Web Server component, part of Oracle Fusion Middleware) allows an unauthenticated attacker to fully compromise the framework over HTTP. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity and availability impact, and requires no privileges or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivially exploitable, network-facing nature makes it a high-priority patch item.
Full compromise of Oracle Agile PLM 9.3.6 is achievable by a remote, unauthenticated attacker sending crafted HTTP requests to the product's Security component, resulting in complete takeover with high confidentiality, integrity, and availability impact. The flaw carries a CVSS 3.1 base score of 9.8 and requires no user interaction or privileges. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability and unauthenticated network reach make it a high-priority patch.
Complete takeover of Oracle WebCenter Portal is possible by a remote, unauthenticated attacker sending crafted HTTP requests to the Runtime Tools component, affecting versions 12.2.1.4.0 and 14.1.2.0.0 of this Oracle Fusion Middleware product. The flaw yields full high-impact compromise of confidentiality, integrity, and availability (CVSS 9.8) with no user interaction or credentials required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the 'easily exploitable' language from Oracle and the pre-auth network vector make it a high-priority patch.
SAML-based authentication bypass and full product takeover affects Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 within Oracle Fusion Middleware's Agent infrastructure component. A remote attacker with no credentials can reach the SAML processing surface over the network and, per Oracle's own rating, easily compromise the identity broker outright - CVSS 9.8 with full confidentiality, integrity, and availability impact. Because Oracle Access Manager is a single-sign-on and access-enforcement gatekeeper, its takeover cascades to every downstream application it protects. No public exploit identified at time of analysis; not listed in CISA KEV.
Full remote takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is possible by an unauthenticated attacker who can reach the service over the network via TCP, per Oracle's August 2026 Critical Patch Update. The flaw sits in the Access and security component and yields complete compromise of confidentiality, integrity, and availability (CVSS 3.1 base 9.8). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability (AV:N/AC:L/PR:N/UI:N) makes it a high-priority patch.
Remote takeover of Oracle Hyperion Financial Management 11.2.25.0.000 (Security component) allows an unauthenticated attacker with HTTP network access to fully compromise the application. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact, and per the CVSS vector requires no privileges or user interaction, making it a prime candidate for opportunistic exploitation. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; despite the Oracle-supplied 'Information Disclosure' tag, the CVSS I:H/A:H metrics and 'takeover' language indicate impact well beyond disclosure.
Remote takeover of Oracle Hyperion Financial Reporting 11.2.25.0.000 allows an unauthenticated attacker with HTTP network access to fully compromise the Server component, yielding complete confidentiality, integrity, and availability loss. Rated CVSS 9.8 and flagged as 'easily exploitable' by Oracle, though tagged as Information Disclosure in EUVD; no public exploit identified at time of analysis and it is not listed in CISA KEV. This is part of Oracle's August 2026 Critical Patch Update and should be treated as high-priority given the unauthenticated network vector.
Remote takeover of Oracle Hyperion Financial Reporting 11.2.25.0.000 (Server component) allows an unauthenticated attacker with only HTTP network reach to fully compromise the application, per Oracle's August 2026 Critical Patch Update. The CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact reflects complete product compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-authentication profile makes it a high-priority patch.
Remote takeover of Oracle Hyperion Financial Reporting 11.2.25.0.000 (Server component) allows an unauthenticated attacker with only HTTP network access to fully compromise the application, per Oracle's August 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact and is described by Oracle as 'easily exploitable.' At time of analysis there is no public exploit identified and no CISA KEV listing, but the trivial exploitability and complete-compromise outcome make it a high patch priority.
Complete takeover of Oracle Essbase 21.8.1.0.0 is possible by an unauthenticated remote attacker over HTTP, per Oracle's August 2026 Critical Patch Update. Oracle rates it CVSS 9.8 with full confidentiality, integrity, and availability impact and flags it as 'easily exploitable,' meaning no authentication, no user interaction, and low attack complexity are required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the combination of network reach and unauthenticated takeover makes it a high-priority patch candidate.
Remote takeover of Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication component) is possible for an unauthenticated attacker who can reach the service over IIOP. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) the flaw is network-reachable, low-complexity, and requires no credentials or user interaction, yielding full confidentiality, integrity, and availability compromise (CVSS 9.8). No public exploit identified at time of analysis, and it is not listed in CISA KEV; it was reported by Oracle and fixed in the August 2026 Critical Patch Update.
Complete takeover of Oracle Reports Developer 14.1.2.0.0 is possible for a remote, unauthenticated attacker who can reach the product's CORBA interface over the network, per the Oracle Critical Patch Update of August 2026. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact and is rated by Oracle as easily exploitable. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Full system takeover of Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication component) is possible when a remote, unauthenticated attacker reaches the product over CORBA. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact, and Oracle rates it 'easily exploitable.' No public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network-facing nature makes it a top-priority patch item.
Complete takeover of Oracle Reports Developer 14.1.2.0.0 is possible by a remote, unauthenticated attacker over TCP, per Oracle's August 2026 Critical Patch Update. The flaw sits in the Security and Authentication component and yields full confidentiality, integrity, and availability compromise (CVSS 9.8). No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability and unauthenticated network vector make it a high-priority patch.
Full compromise of Oracle Reports Developer 12.2.1.19.0 is possible when an unauthenticated attacker reaches the product over the network via the IIOP protocol, per Oracle's August 2026 Critical Patch Update. The flaw sits in the Security and Authentication component and yields complete takeover with high confidentiality, integrity, and availability impact (CVSS 9.8). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and lack of authentication make it a high-priority patch.
Remote takeover of Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware, Security and Authentication component) allows an unauthenticated attacker with network access over the IIOP protocol to fully compromise the product, per Oracle's August 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact, and Oracle rates it easily exploitable. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Full compromise of Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware) is possible via a Security and Authentication component flaw that lets a remote attacker take over the product over TCP without credentials or user interaction. Oracle rates it CVSS 9.8 with complete confidentiality, integrity, and availability loss, and describes it as 'easily exploitable.' No public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector makes it a high-priority patch in the August 2026 Critical Patch Update.
Remote takeover in Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware, Security and Authentication component) lets an unauthenticated network attacker fully compromise the product via UDP. Oracle rates the flaw CVSS 9.8 with high confidentiality, integrity, and availability impact and describes it as easily exploitable. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Full compromise of Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware) is possible for a remote, unauthenticated attacker over HTTP via the Security and Authentication component. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact, and Oracle describes successful attacks as resulting in complete takeover of the product. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network-reachable takeover profile makes it a high patch priority.
Remote unauthenticated takeover in Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware, Security and Authentication component) allows an attacker with network access via the IIOP protocol to fully compromise the product without credentials or user interaction. Rated CVSS 3.1 9.8 with high confidentiality, integrity, and availability impact, this was disclosed in Oracle's August 2026 Critical Patch Update (CPUAUG2026). No public exploit identified at time of analysis, and it is not listed in CISA KEV.