Incorrect authorization in MyBB's calendar module prior to 1.8.40 allows any authenticated forum member to enumerate the titles of calendars restricted from them. Two separate code paths in calendar.php evaluate permission checks against the wrong PHP variable ($calendar['cid'] instead of $calendar_option['cid']), causing the authorization logic to resolve permissions for an unintended calendar context rather than the one being listed. A second affected path additionally omits the canmoderateevents permission check entirely. Exploitation is limited to calendar title disclosure - content, events, and user data are not exposed - and no public exploit or active exploitation has been identified.
Missing authorization in MyBB's Mod CP Report Center prior to version 1.8.40 permits any moderator holding the general `canmodcp` permission to mark reported content as resolved, regardless of whether they hold the specific `canmanagereportedcontent` or `canmanagereportedposts` capability. The bypass is triggered via the `modcp.php?action=do_reports` handler, which skips the finer-grained permission check; when the moderator's forum scope is empty, the `$flist_reports` variable is empty and the SQL UPDATE against `mybb_reportedcontent` fires without the expected permission-based WHERE clause. The vendor has released a confirmed fix in MyBB 1.8.40, and no active exploitation or public exploit code has been identified at time of analysis.
Incorrect authorization in MyBB's calendar module prior to version 1.8.40 allows authenticated users holding moderation rights on one calendar to relocate events to calendars where they possess only viewing permissions. The `do_move` action in `calendar.php` validated `canmoderateevents` for the source calendar but omitted the equivalent check for the destination, enabling unauthorized cross-calendar event manipulation. No public exploit code or active exploitation has been identified; the fix is confirmed in version 1.8.40 via a one-line permission guard added to the destination calendar lookup.
Broken access control in RomethemeForm For Elementor WordPress plugin versions 1.2.6 and earlier permits authenticated users holding the Contributor role to perform actions that exceed their authorized permission scope. Rooted in missing authorization checks (CWE-862), the flaw allows low-privilege WordPress users - who normally cannot publish content or manage plugin settings - to trigger restricted plugin functionality, resulting in unauthorized integrity impact. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis, placing this in the category of medium-severity findings warranting patching rather than emergency response.
Broken Access Control in WP Table Builder WordPress plugin versions 2.2.0 and earlier permits authenticated Contributor-level users to invoke restricted plugin functionality beyond their assigned role scope, resulting in unauthorized integrity impact against site content. The root cause is CWE-862 (Missing Authorization), where the plugin fails to validate whether the requesting user holds sufficient privileges before executing sensitive operations. No public exploit has been identified at time of analysis, and KEV status is not confirmed, placing this in a managed-patching priority tier rather than an emergency response category.
Authorization bypass in Netflix Lemur's certificate export API allows any authenticated user to export certificates they do not own by selecting an export plugin that declares `requires_key = False`. Prior to version 1.9.3, the `CertificatePermission` ownership check in `POST /api/1/certificates/<id>/export` was incorrectly nested inside the `plugin.requires_key` conditional branch, meaning non-key-requiring plugins skipped the authorization gate entirely - while the handler still passed `cert.private_key` as an argument and recorded a `key_view` audit event. With the bundled `JavaTruststoreExportPlugin` the immediate impact is limited to unauthorized access to public certificate material and falsified audit entries; however, any custom plugin that consumes the private key argument despite declaring `requires_key = False` would achieve unauthorized private key exfiltration without triggering the ownership check. No public exploit identified at time of analysis; vendor-released patch is available in version 1.9.3.
Site isolation bypass in Google Chrome prior to 151.0.7922.169 enables a renderer-compromised attacker to cross origin boundaries via a flawed CORS implementation, reading or modifying data from otherwise isolated sites. This is a chained exploitation scenario: it requires a preceding renderer compromise as a prerequisite, making it a sandbox-escape-class vulnerability rather than a standalone browser attack. No public exploit code or active exploitation has been identified at the time of analysis, and a vendor patch is available in the 151.0.7922.169 stable channel release.
Partial integrity and availability compromise in Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a remote, unauthenticated attacker over HTTP, provided high attack complexity conditions are met and a victim user interacts during the attack. Successful exploitation allows unauthorized modification or deletion of a subset of accessible data and can cause a partial denial of service. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Authentication bypass in Oracle Helidon 3.2.18's Imperative Web Server component allows low-privileged network attackers to read a subset of accessible data and perform unauthorized write, insert, or delete operations. Exploitation via HTTP requires high attack complexity and at least low-level authentication, limiting opportunistic mass exploitation. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthorized data access in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows a low-privileged attacker with HTTP network access to read a subset of accessible data and perform unauthorized insert, update, or delete operations against the Installation and Configuration component. Despite the moderate CVSS score of 4.2, the 'Authentication Bypass' tag suggests the vulnerability enables a low-privileged user to circumvent authorization controls beyond their entitlement, though high attack complexity (AC:H) significantly constrains practical exploitation. No public exploit code and no active exploitation have been identified at time of analysis.
Race condition and use-after-free memory corruption in Mozilla Firefox's Graphics component allows remote unauthenticated attackers to achieve limited confidentiality and integrity impact when a user visits a malicious web page. Affected across the standard release channel and all ESR branches, the vulnerability is fixed in Firefox 154, ESR 115.39, ESR 140.14, and ESR 153.1 per Mozilla's official advisories. No public exploit code has been identified and CISA has not listed this in KEV; the SSVC framework rates exploitation status as none and marks it not automatable.
Oracle Hyperion Financial Reporting version 11.2.25.0.000 exposes its Server component to unauthorized data manipulation and read access via a network-exploitable flaw tagged as an Authentication Bypass by Oracle's security team. A low-privileged attacker with HTTP network access can, under difficult-to-achieve conditions, read a subset of accessible financial data and perform unauthorized insert, update, or delete operations. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the financial data sensitivity of the affected platform elevates organizational risk beyond the moderate CVSS base score.
Oracle Hyperion Financial Management version 11.2.25.0.000 exposes a local privilege-assisted attack in its Security component, allowing a low-privileged authenticated user who can log on to the host infrastructure to partially compromise confidentiality, integrity, and availability. The attack demands high complexity and requires interaction from a secondary human actor, placing it firmly in the category of difficult, opportunistic local exploitation. No public exploit code or active exploitation has been identified at time of analysis; the vulnerability was disclosed by Oracle via the August 2026 Critical Security Patch Update.
Oracle Agile PLM MCAD Connector version 3.6 exposes a local, privilege-dependent attack path through its CAX Client component, enabling a low-privileged authenticated local attacker to partially compromise data confidentiality, integrity, and availability within the PLM environment. Exploitation is constrained by a mandatory human-interaction requirement and high attack complexity, making opportunistic or remote exploitation infeasible. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog; the vendor-assigned CVSS 3.1 score of 4.2 reflects the limited blast radius.
Integrity compromise in Oracle Hyperion Calculation Manager 11.2.25.0.000 enables a high-privileged local attacker to bypass security controls within the application's Security component, resulting in unauthorized creation, deletion, or modification of critical financial or planning data. Exploitation is tightly constrained by local infrastructure access, high privilege requirements, and high attack complexity, placing this vulnerability at meaningful risk only from insider threats or fully compromised privileged accounts. No public exploit or active exploitation has been identified at time of analysis.
Local authentication bypass in Oracle Hyperion Financial Management 11.2.25.0.000 exposes a subset of sensitive financial data to unauthenticated local attackers via the Security component. The vulnerability is tagged as an authentication bypass and carries a CVSS 3.1 score of 4.0, reflecting limited confidentiality impact with no integrity or availability consequences. No public exploit code or CISA KEV listing has been identified at time of analysis, though the ease-of-exploitation characterization in Oracle's advisory warrants prompt patching in environments where infrastructure access is not tightly controlled.
Local information disclosure in Oracle Hyperion Calculation Manager 11.2.25.0.000 enables an unauthenticated attacker with logon access to the underlying infrastructure to bypass application-level authentication controls and read a subset of accessible data. The attack vector is local (AV:L), meaning exploitation requires the attacker to already have operating-system-level access to the host running the product, significantly limiting the exposed population. No public exploit code or active exploitation has been identified at time of analysis; Oracle disclosed this vulnerability via its August 2026 Critical Patch Update.
Hyperion Financial Management version 11.2.25.0.000 contains an authentication bypass in its Security component that allows unauthenticated local attackers to read a subset of application-accessible financial data. The attack vector is strictly local (AV:L), meaning exploitation requires logon access to the host OS infrastructure where Hyperion executes - this is not a remotely triggerable flaw. No public exploit code has been identified at time of analysis, and the CVSS base score of 4.0 reflects limited, confidentiality-only impact with no integrity or availability consequences.
Local information disclosure in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows an unauthenticated attacker with OS-level logon access to the infrastructure host to read a subset of Hyperion application data without authenticating to the application itself. The vulnerability resides in the Installation and Configuration component and is tagged as an authentication bypass, suggesting the local access path circumvents the application's authentication layer. No public exploit code or CISA KEV listing is identified at time of analysis, and the confidentiality impact is limited in scope.
Malformed GeoJSON coordinate parsing in adaguc-server prior to 7.2.2 allows an unauthenticated WMS request to crash the backend worker process via out-of-bounds heap read or NULL pointer dereference in CConvertGeoJSON.cpp. The coordinate parser indexes into coordinate arrays without first verifying the JSON node type or minimum array length, affecting all four major geometry branches: Polygon, LineString, MultiLineString, and MultiPolygon. No active exploitation is confirmed (not in CISA KEV), but four distinct PoC GeoJSON payloads are publicly documented in the fix PR and GitHub advisory GHSA-mwgv-59vv-rp2m, making targeted denial-of-service straightforward once the conditions are met.
Path traversal via unsanitized plugin identifier in MineAdmin's app-store service enables any authenticated user to read directory existence outside the plugin root, trigger Plugin::install() and Plugin::uninstall() on arbitrary filesystem paths, and potentially execute arbitrary Composer commands. Affected versions are all releases of composer/mineadmin/mineadmin prior to v3.2.0-alpha.2. Compounded by a missing PermissionMiddleware on the plugin store controller (GM-4340), any bearer-token holder - not just administrators - can reach the vulnerable endpoints. A proof-of-concept is publicly available and the vulnerability has been reproduced in a Docker environment.
SQL-level data manipulation in Oracle Hyperion Calculation Manager version 11.2.25.0.000 enables a highly privileged, network-connected attacker to perform unauthorized read, insert, update, and delete operations against a subset of accessible application data through the Security component. Impact is constrained to partial confidentiality and integrity loss with no availability consequence, yielding a vendor-assigned CVSS 3.1 base score of 3.8. No active exploitation or public proof-of-concept has been identified at time of analysis; Oracle addressed this in its August 2026 Critical Patch Update.
Unauthorized read access in Oracle Helidon 3.2.20's Imperative Web Server component allows unauthenticated network attackers to bypass authentication controls via HTTP and retrieve a limited subset of application data. The vulnerability is tagged as an Authentication Bypass and is difficult to exploit due to high attack complexity (AC:H), materially reducing real-world risk despite the network-accessible attack vector. No active exploitation is confirmed and no public exploit code has been identified at time of analysis. The CVSS score of 3.7 accurately reflects the low-severity nature: limited data exposure with no integrity or availability impact.
Partial confidentiality exposure in Oracle Hyperion Financial Management version 11.2.25.0.000 allows unauthenticated network attackers to read a subset of application data via HTTP under high-complexity conditions. The Security component is tagged as an authentication bypass, though impact is limited to low-severity data disclosure with no integrity or availability consequences. No public exploit code or CISA KEV listing exists at time of analysis.
Unauthorized read access to data in Oracle Hyperion Calculation Manager 11.2.25.0.000 is achievable by unauthenticated network attackers via HTTP, exploiting a flaw in the Security component tagged as an Authentication Bypass. The attack carries high complexity (AC:H), substantially limiting opportunistic exploitation, and impacts only a subset of accessible data with no integrity or availability consequences. No public exploit code or active exploitation in the wild has been identified at time of analysis; Oracle disclosed this through their August 2026 Critical Security Patch Update.
Oracle Java SE's Security component across all current LTS and preview releases - versions 8u501 through 26.0.2 - along with GraalVM for JDK and GraalVM Enterprise Edition, permits unauthenticated remote attackers to read a limited subset of data via crafted API inputs delivered through web services. Despite the network-accessible, zero-authentication vector (AV:N/PR:N/UI:N), the high attack complexity (AC:H) and confined confidentiality impact (C:L) constrain real-world risk, yielding a CVSS 3.1 base score of 3.7. No public exploit code and no CISA KEV listing have been identified at time of analysis, and Oracle disclosed this finding through its standard August 2026 Critical Patch Update cycle rather than an emergency out-of-band advisory.
Unauthorized data exposure in Oracle Hyperion Financial Reporting 11.2.25.0.000 enables unauthenticated remote attackers to read a subset of accessible financial data via HTTP under high-complexity conditions. Tagged as an authentication bypass, the vulnerability is reachable without credentials and without user interaction, yet the AC:H rating signals that reliable exploitation is non-trivial. No public exploit code has been identified and no active exploitation is confirmed; however, the financial sensitivity of data processed by Hyperion EPM elevates the practical significance beyond the raw CVSS 3.7 Low score for affected organizations.
Partial authentication bypass in Oracle Hyperion Calculation Manager 11.2.25.0.000 allows an unauthenticated remote attacker to read a limited subset of application data over HTTP without valid credentials. The attack is classified as difficult to exploit (AC:H), meaning specific conditions must be met for reliable success, and impact is confined to low-level confidentiality loss with no integrity or availability consequences. No public exploit code or active exploitation has been identified at time of analysis.
Integrity compromise in Oracle Helidon 1.4.20's Imperative Web Server component enables unauthenticated remote attackers to perform limited unauthorized data modifications via HTTP under high-complexity conditions. The vulnerability, tagged as an authentication bypass, allows circumvention of access controls to execute unauthorized update, insert, or delete operations on Helidon-accessible data without requiring credentials or user interaction. No public exploit code has been identified and no active exploitation is confirmed; the CVSS 3.7 Low score combined with high attack complexity (AC:H) significantly constrain real-world risk.
Limited data exposure in Oracle Agile PLM MCAD Connector version 3.6 allows an unauthenticated attacker with access to the same physical network segment as the target host to partially read and modify application data. Exploitation is constrained by adjacent-only network access, high attack complexity, and a mandatory human-interaction requirement, resulting in a low CVSS 3.1 base score of 3.7. No public exploit code or active exploitation has been identified at time of analysis.
Local access exploitation in Oracle Hyperion Calculation Manager 11.2.25.0.000 allows an unauthenticated attacker with infrastructure logon to partially compromise data confidentiality and integrity, requiring human interaction to succeed. Tagged as an authentication bypass in the Security component, the flaw yields only limited read and write/insert/delete access to a subset of accessible data, with no availability impact. No public exploit or CISA KEV listing exists at time of analysis; the low CVSS score of 3.6 reflects the constrained impact and high exploitation complexity.
Unauthorized data modification in Oracle Hyperion Calculation Manager 11.2.25.0.000 allows a low-privileged, network-accessible attacker to perform unsanctioned insert, update, or delete operations against accessible application data via HTTP. Exploitation requires human interaction from a third party, indicating a client-side or social-engineering attack vector such as CSRF or a crafted link. No public exploit code exists and this CVE is not listed in the CISA KEV catalog; with a CVSS 3.1 score of 3.5 and integrity-only impact, this represents a low-severity, low-urgency finding in most enterprise risk frameworks.
Cross-site request forgery in MyBB's Admin CP Security Questions module (versions prior to 1.8.40) permits same-site attackers to toggle registration challenge questions on or off by tricking an authenticated administrator into visiting a specially crafted URL. The vulnerable controller in admin/modules/config/questions.php accepted GET requests for enable and disable actions and directly modified the mybb_questions.active database field without calling verify_post_check() against the my_post_key anti-CSRF token. No public exploit has been identified at time of analysis, and the vendor released a patch in MyBB 1.8.40.
Cross-site request forgery in MyBB's Admin Control Panel View Manager allows same-site attackers to silently change an administrator's default user list view by tricking the admin into visiting a specially crafted URL. All MyBB installations prior to version 1.8.40 are affected; the root cause is the set_default action in admin/inc/functions_view_manager.php accepting state-changing GET requests without CSRF token validation. No public exploit code has been identified and this vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog; the vendor-released fix is confirmed in MyBB 1.8.40.
Cross-site request forgery in MyBB's Admin CP Mass Mail module (versions prior to 1.8.40) allows same-site attackers to manipulate an authenticated administrator's session to create draft mass mail entries from archived ones. The Resend route under Users & Groups → Mass Mail → Mass Mailing Archive processed GET requests and performed state-changing database writes (setting mybb_massemails.status = 0) without any CSRF token verification, enabling forged requests via a specially crafted URL. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; the vendor-released patch is available in MyBB 1.8.40.
Local integrity and availability compromise in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows a high-privileged attacker with local system access to make unauthorized data modifications and cause partial denial of service within the Installation and Configuration component. The CVSS 3.1 base score of 3.4 (Low) reflects a tightly constrained impact scope - no confidentiality exposure and only partial integrity and availability degradation. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation at time of analysis.
Oracle VM VirtualBox 7.2.14 (Core component) exposes a low-severity local vulnerability that permits a high-privileged attacker with logon access to the host infrastructure to perform unauthorized read and limited write operations against a subset of VirtualBox-accessible data. Confidentiality and integrity are partially affected; availability is not impacted. No public exploit has been identified at time of analysis, and the combination of local-only attack vector and required high-privilege access significantly narrows the realistic attacker population.
Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 exposes a low-severity flaw in its Common Security component that permits a highly privileged, network-adjacent attacker to perform unauthorized data modifications and induce a partial denial of service via HTTP. The CVSS 3.1 base score of 3.3 reflects genuinely constrained exploitability - both high attack complexity and pre-existing high-privilege access are required before any impact is possible. No public exploit code or active exploitation has been identified at time of analysis.
Oracle Hyperion Financial Management version 11.2.25.0.000 exposes a low-severity, network-accessible vulnerability in its Security component that allows a high-privileged, authenticated attacker to read a limited subset of application data and cause a partial denial of service via HTTP. The CVSS 3.1 base score of 3.3 (Low) accurately reflects the constrained real-world risk: exploitation demands both elevated privileges and high attack complexity, substantially limiting the attacker population. No public exploit code or active exploitation has been identified at time of analysis.
Local information disclosure in Oracle Agile PLM MCAD Connector 3.6 exposes a subset of PLM-accessible data to unauthenticated local attackers exploiting an authentication bypass in the CAX Client component. Exploitation is gated by two significant constraints: the attacker must have local logon access to the infrastructure hosting the connector, and a separate legitimate user must interact with the application during the attack window. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis, consistent with the low CVSS 3.1 base score of 3.3.
Local information disclosure in Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 allows a low-privileged local attacker to read a subset of data accessible to the application. The vulnerability resides in the Installation and Configuration component and requires only local logon access with standard user privileges. No active exploitation or public exploit code has been identified at time of analysis.
Local privilege abuse in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows a low-privileged, authenticated local user to perform unauthorized insert, update, or delete operations against data accessible to the Installation and Configuration component. The vulnerability is vendor-confirmed via Oracle's Critical Security Patch Update for August 2026 and carries a low CVSS 3.1 base score of 3.3, reflecting limited impact scope restricted to partial integrity loss with no confidentiality or availability effects. No public exploit code or CISA KEV listing exists at time of analysis, consistent with the low severity and local-access requirement.
Local low-privileged access to Oracle Agile PLM MCAD Connector 3.6 enables an authenticated attacker to partially degrade availability of the CAX Client component. Oracle's August 2026 Critical Patch Update (CPU) documents this as easily exploitable by any user with a logon to the host infrastructure, resulting in partial denial of service with no confidentiality or integrity impact. No public exploit identified at time of analysis, and CISA KEV listing is absent, placing this firmly in the low-urgency category.
Memory disclosure outside the Chrome renderer sandbox is possible via uninitialized GPU resource access in Google Chrome prior to 151.0.7922.169. An attacker who has already compromised the renderer process can trigger the flaw through a crafted HTML page, allowing reads of memory belonging to processes outside the sandbox boundary. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch is confirmed available.
Partial denial of service in Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a low-privileged, authenticated attacker over HTTP, targeting the Security component under high-complexity conditions. Impact is limited exclusively to availability - no confidentiality or integrity compromise is possible - resulting in a partial service disruption rather than full outage. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, placing it at low real-world priority for most environments.
Partial information disclosure in Oracle Hyperion Calculation Manager 11.2.25.0.000 allows a low-privileged, network-authenticated attacker to read a subset of application data via HTTP under high-complexity conditions. The vulnerability resides in the Security component and is tagged as an authentication bypass, suggesting insufficient authorization enforcement rather than a full credential bypass. No public exploit code has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV.
Partial unauthorized data read in Oracle Hyperion Calculation Manager 11.2.25.0.000 is achievable by an unauthenticated remote attacker via HTTP, though exploitation is rated difficult and requires human interaction from a third party. The vulnerability is tagged as an authentication bypass in the Security component, resulting in low-severity confidentiality exposure with no integrity or availability impact (CVSS 3.1: 3.1). No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this firmly in the low-priority tier for most organizations.
Unauthorized read access to a subset of Oracle Hyperion Calculation Manager 11.2.25.0.000 data is achievable by an unauthenticated attacker who has gained proximity to the physical communication segment on which the software executes, exploiting a flaw in its Security component. The CVSS 3.1 score of 3.1 reflects a tightly constrained impact - confidentiality only, with no integrity or availability effects - combined with an adjacent-only network vector and high attack complexity. No public exploit code and no active exploitation have been identified at time of analysis.
SSRF port restriction bypass in MobSF (Mobile Security Framework) prior to 4.5.1 allows authenticated high-privilege users to cause the server to make outbound HTTP requests to attacker-selected non-standard ports by uploading a crafted APK. The `get_browsable_activities()` function in `manifest_analysis.py` validates only the `android:host` attribute via `valid_host()`, which enforces a 80/443-only port allowlist, but then appends the separately supplied `android:port` attribute to the assembled URL without re-validating the combined result - enabling port restriction bypass. When combined with DNS rebinding between the validation lookup and the `requests.get()` connection, the outbound request can reach internal services; however, the path is fixed to `/.well-known/assetlinks.json` and redirects are disabled. No public exploit has been identified at time of analysis, and the vulnerability is not in CISA KEV.
Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 contains a low-severity local vulnerability in its Installation and Configuration component that allows a highly privileged local attacker to perform limited unauthorized data manipulation and cause a partial denial of service. Exploitation requires both local system logon and high privilege level, with high attack complexity - meaning special conditions beyond the attacker's direct control must also be present. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; it was disclosed as part of Oracle's August 2026 Critical Patch Update.