Unauthorized data modification, partial denial of service, and limited data exposure in Oracle Hyperion Calculation Manager 11.2.25.0.000 are achievable by unauthenticated remote attackers over HTTP targeting the Security component. The CVSS 3.1 score of 7.0 reflects high integrity impact - attackers can create, delete, or modify critical EPM data - tempered by high attack complexity (AC:H) that prevents trivial automated exploitation. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
HTML injection in MailerUp's public subscription form (all versions before 1.1.3) allows unauthenticated remote attackers to embed arbitrary HTML into the double opt-in verification email the application sends, using the form owner's configured sending identity and an attacker-specified recipient address. The root cause is unescaped interpolation of the subscriber-supplied first_name field directly into the HTML email body, confirmed by the patch commit which adds Django's escape() call. No active exploitation is confirmed in CISA KEV, but the Secur0 CNA advisory fully documents the injection point and patch version 1.1.3 is available.
Oracle Hyperion Financial Management 11.2.25.0.000 exposes a local-access vulnerability in its Security component that allows an unauthenticated local attacker to achieve full system takeover - compromising confidentiality, integrity, and availability - when combined with required interaction from a separate legitimate user. The attack is constrained to actors with logon access to the infrastructure hosting HFM and requires high complexity to execute, limiting the realistic threat population to insiders or those who have already established a foothold on the target server. No public exploit code has been identified at time of analysis, and the vulnerability is not currently listed in the CISA KEV catalog.
Full takeover of Oracle Work in Process (WIP), a manufacturing execution module in Oracle E-Business Suite, is achievable by a low-privileged local attacker exploiting a flaw in the Internal Operations component across versions 12.2.3 through 12.2.15. The CVSS vector (AV:L/AC:H/PR:L) constrains exploitation to authenticated infrastructure-level access with high attack complexity, significantly limiting opportunistic or remote attack paths. No public exploit code or CISA KEV listing has been identified at time of analysis; however, successful exploitation yields complete compromise of confidentiality, integrity, and availability of the WIP instance.
Local privilege escalation in Oracle PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 enables a low-privileged attacker with infrastructure logon access to achieve full system takeover via the Tuxedo middleware component. The CVSS vector (AV:L/AC:H/PR:L) confirms this requires physical or session-level access to the host and involves high attack complexity, materially limiting opportunistic exploitation despite the complete CIA impact. No public exploit code or active exploitation has been identified at time of analysis; Oracle disclosed this via its August 2026 Critical Security Patch Update.
Local privilege escalation in Oracle Agile PLM 9.3.6 via the Gantt Chart component allows a low-privileged attacker with existing logon access to the host infrastructure to fully compromise the application. Successful exploitation results in complete confidentiality, integrity, and availability impact - effectively a full system takeover of the PLM instance. No public exploit code and no CISA KEV listing have been identified at time of analysis; exploitation is constrained by both a local attack vector and high attack complexity (CVSS AV:L/AC:H/PR:L).
Full system takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 is achievable by a low-privileged local attacker through the Content Acquisition System component. Exploitation requires physical or logical access to the host infrastructure combined with high attack complexity, constraining the realistic threat to insider actors or adversaries who have already established a foothold on the target server. No public exploit code has been identified and this vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog at time of analysis.
Local privilege escalation in Oracle Business Intelligence Enterprise Edition 26.01.0.0.0 allows a low-privileged attacker with local logon access to the host infrastructure to fully compromise the application, achieving confidentiality, integrity, and availability takeover. The attack complexity is rated high, indicating non-trivial exploitation conditions must be met. No public exploit or active exploitation has been identified at time of analysis, but full system takeover is the confirmed impact per Oracle's advisory.
Local privilege escalation in Oracle Agile Engineering Data Management 6.2.1 allows a low-privileged attacker with logon access to the hosting infrastructure to fully compromise the system via the Engineering Communication Interface component. Exploitation requires high-complexity conditions and local access, but successful attacks result in complete takeover - full loss of confidentiality, integrity, and availability. Disclosed through Oracle's Critical Security Patch Update for August 2026; no public exploit identified at time of analysis.
Unlimited authentication attempts against the karakeep login endpoint (apps/web/server/auth.ts) in versions up to 0.32.0 enable remote credential brute-forcing due to a missing rate-limiting guard on the NextAuth authorize function (CWE-307). The CVSS 4.0 score of 2.9 with AC:H reflects that successful exploitation depends on the target account holding a guessable password - a condition outside the attacker's direct control. A proof-of-concept has been publicly disclosed via GitHub issue #2919, though no active exploitation is confirmed by CISA KEV.
Denial of service in Carbone, a Node.js document generation library, allows remote attackers to crash application servers by supplying a maliciously crafted zip bomb embedded in a .docx template file. The library processed .docx archives (which are ZIP containers) using yazl without enforcing any limit on decompressed entry sizes, enabling an attacker-controlled file to trigger runaway memory allocation that terminates the Node.js process. Fixed in versions 3.8.2, 4.26.3, and 5.4.4 across all distribution types; no public exploit or CISA KEV listing identified at time of analysis.
Missing authorization on four Socket.IO event handlers in FUXA 1.3.2 and earlier exposes SCADA/HMI system-discovery metadata - device topology, node attributes, host network interfaces, and device tags - to any remote unauthenticated or guest user when the platform's security mode (secureEnabled=true) is active. The DEVICE_BROWSE, DEVICE_NODE_ATTRIBUTE, HOST_INTERFACES, and DEVICE_TAGS_REQUEST handlers in server/runtime/index.js omit the isSocketAdminAuthorized check that governs other protected events, creating an authorization gap specifically in hardened deployments. No public exploit or CISA KEV listing has been identified at time of analysis, but the network-accessible nature and zero-privilege requirement make passive reconnaissance trivial against exposed instances. A vendor-released patch is available in FUXA v1.3.3.
OAuth Sign-In bypass in Karakeep up to version 0.32.0 allows unauthenticated remote attackers to subvert the authentication process via manipulation of logic in apps/web/server/auth.ts, achieving a low-integrity impact on the vulnerable system without requiring credentials or user interaction. High attack complexity (AC:H) means exploitation demands engineered conditions in the OAuth callback flow rather than trivial exploitation. No vendor patch has been issued at time of analysis; a public proof-of-concept has been disclosed via GitHub issue #2920 and indexed by VulDB, no public exploit identified at time of analysis for widespread automated campaigns but the PoC reduces the barrier for targeted attacks.
Absolute path traversal in NVIDIA Triton Inference Server for Linux (versions 0.0 through 26.05) lets remote unauthenticated attackers reference filesystem paths outside intended directories, per NVIDIA's own advisory. NVIDIA states a successful exploit may lead to information disclosure and potentially code execution. No public exploit has been identified at time of analysis, and EPSS is low at 0.41% (34th percentile).
Blueprint Studio versions prior to 2.5.2 exposed Git usernames and personal access tokens in plaintext on the filesystem by misconfiguring Git's credential.helper store when an admin saved Git credentials through the interface. The resulting .git-credentials file persists beyond Blueprint Studio's intended storage scope and can be read by any user or process sharing the same filesystem context as the Home Assistant instance. No public exploit code has been identified at time of analysis; vendor-released patch v2.5.2 is available and confirmed.
Improper CORS origin validation in Joomla! CMS versions 4.0.0-5.4.7 and 6.0.0-6.1.2 allows remote attackers to bypass the configured origin allowlist and make unauthorized cross-origin requests. The CWE-93 (CRLF Injection) classification indicates the bypass mechanism likely involves injecting carriage-return/line-feed characters into the Origin header to confuse the server's string-comparison logic, rather than a simple misconfiguration of the allowlist itself. No public exploit code or CISA KEV listing exists at time of analysis, but the network-accessible, zero-privilege, low-complexity nature of the flaw makes it exploitable at scale against Joomla sites where CORS is configured.
Full-read SSRF in SiYuan before v3.7.4 allows authenticated attackers to bypass the SafeMode SSRF guard by supplying URLs whose hostnames resolve to IPv6 transition addresses - NAT64 (64:ff9b::/96), 6to4 (2002::/16), or Teredo (2001::/32) - which encode private IPv4 destinations that the isPrivateIP function in kernel/util/net.go fails to classify as internal. Because the affected forward proxy, WebSocket proxy, and SSE proxy endpoints return the full response body, a successful bypass enables exfiltration of cloud instance metadata credentials (e.g., from 169.254.169.254), enumeration of internal services, and port-scanning of internal infrastructure. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVE description provides sufficient technical specificity to serve as an exploit development roadmap.
Memory exhaustion in Wazuh Manager 4.4.0 through 4.14.6 allows authenticated cluster peers to crash the wazuh-clusterd daemon on the master node by submitting a specially crafted zip bomb archive during cluster synchronization. The fdecompress_files() function in cluster.py invoked zlib.decompress() without any decompressed-size limit, enabling an attacker holding a valid cluster Fernet key to force unbounded memory allocation from a tiny compressed payload. No public exploit has been identified and the vulnerability is absent from CISA KEV; Wazuh has released a fix in version 4.14.7 via GitHub pull request #37119.
Missing rate limiting on the POST /v1/sessions login endpoint in Plainpad through 1.1.1 allows unauthenticated remote attackers to submit unlimited credential attempts with no lockout, enabling both credential stuffing and a CPU exhaustion denial-of-service via repeated bcrypt comparisons. The flaw originates from a Laravel framework version mismatch: the throttle middleware was defined in App\Http\Kernel.php, which is dead code never instantiated by the Laravel 11+ bootstrap model, leaving the API route group entirely unthrottled. No public exploit has been identified at time of analysis, though SSVC classifies this as automatable with partial technical impact.
Cross-site scripting via deliberate CSP header removal in Streambert's Electron API key redemption window affects versions 2.5.0 through 2.5.x, allowing attacker-controlled script content on sub.wyzie.io or any navigated resource to execute without Content-Security-Policy constraints and interact with other windows and persistent session storage. The wyzie-open-redeem IPC handler in index.js unconditionally strips all CSP response headers from a dedicated Electron session partition, and the redemption BrowserWindow omits a setWindowOpenHandler, compounding the attack surface. No public exploit has been identified at time of analysis; the vulnerability is fixed in version 2.6.0 by complete removal of the vulnerable feature.
Login lockout bypass in Zabbix API and Frontend enables brute-force attacks beyond intended limits by exploiting a race condition in the block counter. Simultaneous login requests are not properly synchronized against the lockout mechanism, allowing unauthenticated remote attackers to submit more credential guesses than the lockout policy permits. No public exploit code or CISA KEV listing has been identified at time of analysis, but the network-accessible, no-authentication-required attack surface lowers the barrier for credential-stuffing campaigns against Zabbix deployments.
Unauthorized critical data disclosure in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 allows a high-privileged, network-based attacker to read all data accessible to the Experience Manager component, with scope change extending impact to additional Oracle Commerce products. The vulnerability is exploitable over HTTP with no user interaction required. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, though the 'Authentication Bypass' tag warrants attention - it may indicate a privilege escalation pathway that reduces the effective authentication bar. EPSS data was not provided.
Unauthorized confidential data access in Oracle Service Delivery Platform (Fusion Middleware, Messaging Enabler component) is achievable by network-adjacent high-privileged attackers over HTTP, with a scope change that can impact additional Fusion Middleware products beyond the primary target. Affected versions are 14.1.2.0.0 and 12.2.1.4.0. Classified as 'easily exploitable' by Oracle, the flaw carries a CVSS 3.1 score of 6.8 with scope change flagged - though no public exploit code or CISA KEV listing has been identified at time of analysis.
Full system takeover of Oracle Reports Developer 14.1.2.0.0 is achievable by an unauthenticated attacker present on the same physical network segment as the host running the software. The vulnerability resides in the Security and Authentication component of this Oracle Fusion Middleware product, meaning the mechanism meant to enforce access control can be bypassed without credentials. With a CVSS 3.1 score of 8.8, the impact spans complete confidentiality, integrity, and availability compromise; no public exploit or CISA KEV listing has been identified at time of analysis.
Unauthorized access to critical commerce data is achievable against Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 via a network-accessible authentication bypass in the Content Acquisition System component. The vulnerability carries a CVSS scope change, meaning successful exploitation can spill over to compromise data accessible by additional integrated Oracle Commerce components beyond the directly attacked service. No public exploit has been identified at time of analysis, but the Authentication Bypass tag and unauthenticated network vector make this a meaningful data-exposure risk for any organization running the affected version.
Unauthenticated network exploitation of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 via the Content Acquisition System component enables complete unauthorized read access to all data accessible by the platform, with scope change indicating downstream impact on adjacent Oracle systems. The attack vector is HTTP with high complexity, meaning specific preconditions must be met, but no credentials are required. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog. The tag 'Authentication Bypass' suggests the root cause is a failure in the Content Acquisition System to enforce identity controls on inbound HTTP requests.
Unauthorized data disclosure in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 exposes all data accessible to the Content Acquisition System component via a network-based authentication bypass over HTTP. Successful exploitation requires no credentials and no user interaction, though high attack complexity limits opportunistic mass exploitation. No public exploit code has been identified and this CVE is absent from the CISA KEV catalog at time of analysis.
Unauthorized data exposure in Oracle Java SE's Networking component allows unauthenticated remote attackers via HTTP to access critical or all data accessible to the affected Java process, with a confirmed scope change that can impact systems and products beyond the JDK's own security boundary. Affected versions span a wide range across Oracle Java SE (8u501 through 26.0.2), Oracle GraalVM for JDK (17.0.20 and 21.0.12), and Oracle GraalVM Enterprise Edition (21.3.19), covering both server-side Java API consumers and client-side Java Web Start or sandboxed applet deployments. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog; however, the breadth of affected LTS versions and the ubiquity of Java in enterprise environments make patch prioritization appropriate.
CRLF injection in ePA 3.x Integration's VAU inner HTTP request builder allows an authenticated attacker to inject arbitrary headers into encrypted tunnel requests destined for Germany's electronic patient record (ePA) backend, potentially exposing other patients' medical records or bypassing authorization controls. The flaw exists in the build_inner_header function of app/vau/VAUProtokoll.py, which interpolates user-controlled values - including insurant_id and USER_AGENT - directly into raw HTTP header strings without stripping carriage-return or line-feed characters. No public exploit code has been identified at time of analysis, and the issue is fixed in release 1.3.0.
Unauthorized read and write access to critical financial data in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is possible via an authentication bypass in the Installation and Configuration component, reachable over HTTP by low-privileged network attackers. Successful exploitation grants complete confidentiality and integrity compromise of all Hyperion-accessible data, though no availability impact is described. No public exploit code has been identified and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at time of analysis.
Oracle Unified Directory versions 12.2.1.4.0 and 14.1.2.1.0 expose a network-exploitable authentication bypass over LDAP that grants low-privileged attackers full read and write control over directory data. Despite a moderate CVSS base score of 6.8 driven down by high attack complexity (AC:H), successful exploitation yields complete confidentiality and integrity compromise of all OUD-accessible data - a severe outcome for identity and directory infrastructure. No public exploit code or active exploitation has been identified at time of analysis; Oracle disclosed the issue as part of the Critical Patch Update for August 2026.
Confidential data exposure in Oracle Commerce Guided Search / Experience Manager 11.4.0 enables high-privileged network attackers to read critical platform data over HTTP, with a confirmed scope change extending potential impact to adjacent Oracle Commerce components beyond the primary application. The attack requires no user interaction and is characterized as easily exploitable at low complexity, though the high privilege prerequisite narrows the attacker pool. Oracle has addressed this vulnerability in the Critical Security Patch Update for August 2026; no public exploit code has been identified at time of analysis.
Oracle Hyperion Financial Reporting 11.2.25.0.000 exposes an authentication bypass in its Server component, reachable over HTTP without credentials, that allows full read and write access to sensitive financial data. The attack is tagged as an Authentication Bypass by the reporting source (secalert_us@oracle.com) and yields both C:H and I:H impact, meaning an attacker can exfiltrate all accessible financial data and tamper with or delete critical records. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis, though the high-impact outcome against an enterprise financial platform warrants priority patching.
Full takeover of Oracle Autonomous Health Framework is achievable by an unauthenticated attacker positioned on the same physical or logical network segment as the affected host, exploiting a flaw in the Trace File Analyzer (TFA) component. Affected releases span multiple 26.x branches - 26 through 26.1.0, 26.2.0, 26.3.1, 26.5.0, and 26.5.2 - with successful exploitation yielding complete confidentiality, integrity, and availability compromise. No public exploit code has been identified and no CISA KEV listing is present at time of analysis, though the low attack complexity and absence of authentication requirements make exploitation straightforward for any attacker with adjacent network access.
Full compromise of Oracle Reports Developer 12.2.1.19.0 is achievable by an unauthenticated attacker who has access to the same physical or logical network segment as the host running the software. The flaw resides in the Security and Authentication component of this Oracle Fusion Middleware product, and successful exploitation yields complete confidentiality, integrity, and availability impact - effectively a full system takeover. No public exploit or CISA KEV listing exists at time of analysis, but the combination of no required privileges, no user interaction, and a low-complexity attack makes this a credible threat within the adjacent network boundary.
Unauthorized data disclosure in Oracle Helidon 3.2.18's Imperative Web Server allows unauthenticated network attackers to bypass authentication over HTTP and gain complete read access to critical data, including data accessible across additional connected products due to a confirmed scope change. The vulnerability is rated CVSS 6.8 with high attack complexity, meaning exploitation requires specific conditions to be met, which limits opportunistic mass exploitation. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the Authentication Bypass tag and scope-change impact make this a material risk for Oracle Fusion Middleware deployments running the affected version.
Authentication bypass in Oracle Hyperion Financial Management 11.2.25.0.000 enables an unauthenticated attacker positioned on the same physical network segment to fully compromise confidentiality and integrity of financial data. The vulnerability is tagged as an authentication bypass in the Security component, meaning an adversary can bypass credential checks and gain unauthorized read and write access to all financial data accessible by the application. No public exploit code has been identified at time of analysis, and the adjacent-network vector combined with high attack complexity limits the realistic attacker population to internal network adversaries or those with network proximity to the deployment.
Full system takeover of Oracle Reports Developer 14.1.2.0.0 is achievable by an unauthenticated attacker physically co-located on the same network segment as the affected host. The Security and Authentication component contains an easily exploitable flaw - CVSS AC:L and PR:N confirm no elevated privileges or complexity are required once adjacent network access is established. Successful exploitation yields complete confidentiality, integrity, and availability compromise of the Oracle Reports Developer instance. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Authentication bypass in Oracle Hyperion Financial Reporting 11.2.25.0.000 exposes critical financial data to unauthenticated attackers who can reach the physical network segment hosting the server. The CVSS vector (AV:A/AC:H/PR:N) indicates that while no credentials are required and no user interaction is needed, exploitation is constrained to adjacent-network attackers and involves high attack complexity. Successful compromise yields full read and write access to all financial reporting data - including unauthorized creation, deletion, and modification of critical records. No public exploit or CISA KEV listing has been identified at time of analysis.
Out-of-bounds memory read in Zabbix's script item and preprocessing JavaScript HttpRequest logic allows an authenticated administrator, operating from an adjacent network position, to read process memory beyond allocated buffer boundaries. Exploitation results in confidentiality loss - sensitive data resident in process memory may be exposed to the attacker. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Local exploitation of MySQL Connector/ODBC 26.7.0 on Oracle MySQL allows any user with OS-level logon to the affected infrastructure to crash or hang the connector process and read a subset of accessible data. The attack requires no authentication to MySQL Connectors itself and no user interaction, making it trivially executable by any local user or process on the host. No public exploit code has been identified at time of analysis, and exploitation is bounded by the requirement for local system access.
Arbitrary file write in Trivy's plugin manager prior to version 0.72.0 allows a malicious plugin author to escape the confines of ~/.trivy/plugins and write files to any user-writable filesystem path. The flaw exists in pkg/plugin/manager.go, where plugin manifest metadata is used to construct file paths without enforcing directory confinement, enabling a path traversal (CWE-22) attack. No public exploit has been identified and no CISA KEV listing exists, but the attack is mechanically simple and the impact extends to overwriting sensitive user files such as shell profiles or SSH authorized_keys, creating realistic subsequent privilege escalation paths.
Race condition in Firefox's JavaScript Engine (CVE-2026-74984) exposes users on all Firefox versions prior to 154 and ESR versions prior to 153.1 to potential confidentiality and integrity compromise. The CWE-362 flaw creates a timing window during concurrent JavaScript execution in which an attacker-controlled script can race against the engine's internal state management, enabling memory read or write access. No public exploit code has been identified and EPSS sits at the 5th percentile, indicating no widespread exploitation at time of analysis.
Certificate chain validation bypass in the openHiTLS cryptographic library (0.2.0 through 0.3.2) lets attackers use a non-CA certificate as an intermediate CA, because basicConstraints/cA-flag checks are applied only to X.509 v3 certificates while v1/v2 intermediate certificates are silently accepted. An attacker able to obtain any leaf/end-entity certificate (or craft a v1/v2 certificate) can forge a trusted chain and impersonate arbitrary servers, enabling man-in-the-middle interception. No public exploit identified at time of analysis; EPSS is low (0.11%), and the fix landed in openHiTLS 0.3.3.
Persistent cross-site scripting in Otalio Ship Property Management System (all versions before 2.22.0) enables authenticated high-privileged attackers to escalate privileges by injecting unescaped malicious scripts into the application security page. The stored payload executes in the browser context of other authenticated users who subsequently view the affected page, enabling session hijacking or unauthorized actions under victim credentials. Reported by Mandiant; no public exploit code or CISA KEV listing identified at time of analysis.
Unauthorized data access and modification in Oracle Autonomous Health Framework's Cluster Health Analyzer component allows a low-privileged attacker with adjacency to the physical communication segment to fully compromise confidentiality and integrity of AHF data, with scope change enabling lateral impact on additional Oracle products. Affected versions span the 26.x release line through 26.5.2, disclosed in Oracle's August 2026 Critical Patch Update. No public exploit code has been identified at time of analysis, and the High attack complexity combined with the adjacent-only attack vector materially constrains real-world exploitability despite the 7.7 base score.
Full takeover of Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a high-privileged local attacker targeting the Security component, resulting in complete compromise of confidentiality, integrity, and availability. The attack requires logon access to the infrastructure host where the application runs, limiting exposure to insider threats or attackers who have already established a foothold with elevated privileges. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and the local-only attack vector substantially constrains real-world risk despite the full CIA impact.
Full system takeover of Oracle Agile Engineering Data Management 6.2.1 is achievable through a vulnerability in its Install component, exploitable by a high-privileged attacker with local logon access to the host infrastructure. The CVSS 3.1 base score of 6.7 reflects the constrained attack prerequisites - local access and high privileges - yet successful exploitation yields complete compromise of confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog.
High-privileged local exploitation of Oracle Hyperion Calculation Manager 11.2.25.0.000 allows an attacker with existing infrastructure logon to bypass Security component controls, gaining full read access to critical Hyperion data and limited write access to accessible records, with a scope change indicating spillover risk to additional Oracle Hyperion products. The attack is confined to insiders or adversaries who have already achieved a high-privilege foothold on the Hyperion infrastructure, making this most relevant to insider threat models and post-compromise lateral movement scenarios. No public exploit code has been identified at time of analysis; Oracle addressed this vulnerability in the August 2026 Critical Patch Update.
Local privilege escalation in mise (jdx/mise), the polyglot dev tool version manager, allows a local user with UID and GID 1001 to gain ownership of a root-installed system binary. Prior to version 2026.7.1, release tar archives embedded non-root UID/GID 1001 metadata from the build environment, and the standalone install script failed to normalize ownership before placing the binary in shared paths such as /usr/local/bin, leaving the installed executable writable by any user matching that UID/GID pair. No public exploit has been identified at time of analysis, and no CISA KEV listing exists, but the attack path is mechanically straightforward in multi-user environments where a local account happens to share UID/GID 1001 with the build system.