Complete takeover of Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware) is possible by a remote, unauthenticated attacker over TCP, per Oracle's August 2026 Critical Patch Update. The flaw resides in the Security and Authentication component and yields full confidentiality, integrity, and availability compromise (CVSS 9.8). No public exploit identified at time of analysis, but the trivial exploitability and complete-takeover outcome make this a high-priority patch.
Full compromise of Oracle Siebel CRM Integration (Open Integration component) is possible by an unauthenticated remote attacker over HTTP, per Oracle's August 2026 Critical Patch Update. Affected releases span Siebel CRM Integration 25.12 through 26.6, and successful exploitation yields complete takeover of the Integration component with full confidentiality, integrity, and availability impact (CVSS 9.8). No public exploit has been identified at time of analysis and the flaw is not listed in CISA KEV, but the unauthenticated, low-complexity network profile makes it a high-priority patch item.
Full system takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is possible by a remote, unauthenticated attacker over HTTP against the Installation and Configuration component. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact, and was disclosed in Oracle's August 2026 Critical Patch Update. No public exploit or CISA KEV listing has been identified at the time of analysis, so this is a pre-exploitation, patch-now situation rather than confirmed active exploitation.
Full product takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 (Common Events component) is possible by an unauthenticated remote attacker sending crafted HTTP requests. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms network-reachable exploitation with no privileges or user interaction, yielding high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the 9.8 base score and unauthenticated nature make it a high-priority patch target.
Full-system takeover of Oracle WebCenter Enterprise Capture (Oracle Fusion Middleware, Client Bundle component) is achievable by a remote, unauthenticated attacker reaching the server over the T3 or IIOP protocols. Oracle rates this CVSS 9.8 with complete confidentiality, integrity, and availability loss, and describes it as 'easily exploitable,' meaning a single crafted protocol interaction can yield complete compromise of the Capture instance. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the T3/IIOP attack surface has a long history of reliable Java-deserialization exploitation in the WebLogic/Fusion Middleware stack.
Full remote takeover of Oracle WebCenter Enterprise Capture (Fusion Middleware, Client Bundle component) affects supported versions 12.2.1.4.0 and 14.1.2.0.0, allowing an unauthenticated attacker with only HTTP network access to fully compromise the product. Oracle rates this CVSS 3.1 9.8 with high confidentiality, integrity, and availability impact and describes it as 'easily exploitable,' meaning no credentials or user interaction are needed. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network-takeover profile makes it a top-priority patch in Oracle's August 2026 Critical Patch Update.
Complete takeover of Oracle WebCenter Enterprise Capture is possible via the Client Bundle component, where an unauthenticated network attacker leveraging the RMI protocol can fully compromise the affected server. Oracle's August 2026 Critical Patch Update rates this at CVSS 9.8 with full confidentiality, integrity, and availability impact against supported versions 12.2.1.4.0 and 14.1.2.0.0. No public exploit identified at time of analysis, though the trivial exploitability (AC:L, PR:N) and RMI attack surface make it a high-priority patch item.
Full remote takeover of Oracle WebCenter Enterprise Capture (Fusion Middleware, Client Bundle component) is possible by an unauthenticated attacker reaching the product over Java RMI, per Oracle's August 2026 Critical Patch Update. The flaw is rated CVSS 9.8 with high confidentiality, integrity, and availability impact and is described by Oracle as 'easily exploitable,' affecting versions 12.2.1.4.0 and 14.1.2.0.0. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the combination of network reach, no authentication, and complete compromise makes it a top-priority patch.
Remote takeover of Oracle WebCenter Enterprise Capture (versions 12.2.1.4.0 and 14.1.2.0.0) allows an unauthenticated network attacker to fully compromise the product via the WebLogic T3 and IIOP protocols exposed by the Client Bundle component. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N, full C/I/A impact), reflecting easy, no-privilege exploitation. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but the T3/IIOP attack class is historically a high-value target in Oracle Fusion Middleware.
Full compromise of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 is possible via the Business Interlink component, where a remote unauthenticated attacker sending crafted HTTP requests can take over the product. Oracle rates this at CVSS 9.8 with high confidentiality, integrity, and availability impact, describing it as 'easily exploitable.' No public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability and unauthenticated network vector make it a high-priority patch in the August 2026 Critical Patch Update.
Full takeover of Oracle Payments (Oracle E-Business Suite, File Transmission component) is possible by remote unauthenticated attackers over HTTP, affecting supported releases 12.2.3 through 12.2.15. The flaw carries a CVSS 3.1 base score of 9.8 with complete confidentiality, integrity, and availability impact, and Oracle rates it 'easily exploitable.' There is no public exploit identified at time of analysis and it is not on CISA KEV, but the unauthenticated network-facing profile makes it a top-tier patch priority.
Remote takeover of Oracle Identity Manager (Oracle Fusion Middleware) affects the OIM Legacy UI component in versions 12.2.1.4.0 and 14.1.2.1.0, allowing an unauthenticated attacker with only HTTP network access to fully compromise the identity-management platform. The maximum CVSS 3.1 base score of 9.8 reflects complete loss of confidentiality, integrity, and availability, and because OIM governs enterprise identity and access, compromise cascades to every system it provisions. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitation profile makes it a high priority for immediate patching.
Full product takeover in Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 (Legacy UI component) allows a remote, unauthenticated attacker to compromise the identity-governance platform over HTTP. Rated CVSS 9.8 with high confidentiality, integrity, and availability impact, this issue is trivially exploitable and requires no user interaction; at time of analysis there is no public exploit identified and it is not listed in CISA KEV. Because OIM brokers provisioning and access to downstream enterprise systems, a takeover here has cascading blast radius across connected accounts and applications.
Remote code execution and denial of service in Dell PowerStore T-series arrays (SDNAS software) stem from an out-of-bounds write in the SMB/CIFS file-sharing service, reachable by an unauthenticated remote attacker (CVSS 9.8, AV:N/PR:N). A single specially crafted SMB packet can crash the storage node, and because affected models are configured to auto-restart, the crash becomes a persistent, repeatable DoS; a more capable attacker can leverage the same memory-corruption primitive for arbitrary code execution. No public exploit has been identified at time of analysis, but this is a network-facing storage controller flaw and Dell has already shipped a fix.
Path traversal in NVIDIA Triton Inference Server for Linux (CWE-22) lets remote attackers manipulate file paths to reach locations outside intended directories, with the vendor citing denial of service as the primary outcome. NVIDIA assigned a critical 9.8 CVSS score claiming full confidentiality, integrity, and availability impact, though the published description only asserts DoS. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Insecure deserialization in the Youzify WordPress plugin (versions 1.3.7 and earlier) allows remote unauthenticated attackers to submit crafted serialized PHP objects that the plugin deserializes without validation, per a Patchstack advisory. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity, and availability impact, successful exploitation can lead to object injection and potentially full site compromise. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated PHP Object Injection in the Ultimate Maps by Supsystic WordPress plugin (all versions before 1.5.0) lets remote attackers pass attacker-controlled serialized data into a PHP unserialize() call, instantiating arbitrary PHP objects. If a usable POP (property-oriented programming) gadget chain is present in the plugin, WordPress core, or any other active plugin, this can escalate to remote code execution, file operations, or database compromise. Reported by Patchstack and assigned CVSS 9.8; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated PHP Object Injection in the RegistrationMagic WordPress plugin (versions <= 6.0.9.7) allows remote attackers to inject crafted serialized PHP objects that are deserialized by the application without validation. Depending on the POP gadget chains available in the plugin, WordPress core, or other installed plugins, this can escalate to arbitrary file operations, SQL injection, or remote code execution. Reported by Patchstack with a CVSS 9.8; no public exploit identified at time of analysis and no CISA KEV listing, so exploitation is not confirmed in the wild.
Unauthenticated PHP Object Injection in the FundEngine WordPress fundraising/donation plugin (slug wp-fundraising-donation) affects all versions up to and including 1.7.9, letting a remote attacker with no authentication inject a crafted serialized PHP object into an application deserialization sink. Given the CWE-502 root cause and the PR:N/UI:N vector, a successful attack can pivot to remote code execution, data theft, or full site takeover when a suitable POP gadget chain is reachable. Reported by Patchstack and rated CVSS 9.8, with no public exploit identified at time of analysis and no CISA KEV listing.
Complete takeover of Oracle Reports Developer 14.1.2.0.0 is possible when an unauthenticated remote attacker sends crafted HTTP requests to the Security and Authentication component of this Oracle Fusion Middleware reporting tool. The flaw carries a CVSS 9.8 base score with full confidentiality, integrity, and availability impact, and requires no privileges or user interaction. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV; it was disclosed via Oracle's August 2026 Critical Patch Update.
Full compromise of Oracle Internet Directory (OID) LDAP Server is possible in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0, where a remote unauthenticated attacker reaching the LDAP service over the network can take over the directory instance. The flaw scores CVSS 9.8 with high confidentiality, integrity, and availability impact and is addressed in Oracle's August 2026 Critical Patch Update. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Full product takeover in Oracle WebCenter Sites (versions 12.2.1.4.0 and 14.1.2.0.0) allows a remote, unauthenticated attacker to compromise the application over HTTP with low attack complexity. Rated CVSS 3.1 9.8 with complete confidentiality, integrity, and availability impact, this flaw was disclosed by Oracle in the August 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not currently listed in CISA KEV.
Remote takeover in Oracle Helidon 1.4.20 (Imperative Web Server component of Oracle Fusion Middleware) allows an unauthenticated attacker with network access over HTTP to fully compromise the affected instance. The flaw carries a critical CVSS 3.1 base score of 9.8 with high impact to confidentiality, integrity and availability, and is described by Oracle as easily exploitable. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, so exploitation is not yet confirmed in the wild.
Remote takeover of Oracle Helidon 4.5.0 is possible when an unauthenticated attacker reaches the Imperative Web Server component over HTTP, per Oracle's August 2026 Critical Patch Update. The flaw yields full compromise of confidentiality, integrity, and availability (CVSS 9.8) without credentials or user interaction. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network-facing profile makes it a high-priority patch.
Complete takeover of Oracle Helidon 4.5.0 is achievable by remote, unauthenticated attackers over HTTP through the Imperative Web Server component, per Oracle's August 2026 Critical Patch Update. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N, full C/I/A impact) reflects easy exploitation with no privileges or user interaction. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Complete takeover of Oracle Commerce Guided Search / Experience Manager 11.4.0 is possible via the Endeca Application Controller, which is reachable over HTTP by unauthenticated network attackers. Oracle rates this 9.8 with full confidentiality, integrity, and availability impact, meaning a single crafted request can yield full control of the search/merchandising tier. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the low-complexity, no-authentication profile makes it a high-priority patch item disclosed in Oracle's August 2026 Critical Patch Update.
Remote takeover of Oracle Commerce Platform 11.4.0 (Dynamo Application Framework component) allows an unauthenticated attacker with only HTTP network access to fully compromise the platform, per Oracle's August 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact, and Oracle characterizes it as 'easily exploitable' requiring no authentication or user interaction. No public exploit identified at time of analysis, and it is not currently listed in CISA KEV.
Remote takeover in Oracle Commerce Platform 11.4.0 (Dynamo Application Framework component) allows an unauthenticated attacker with only TCP network access to fully compromise the platform. Rated CVSS 9.8 with complete confidentiality, integrity and availability loss, the flaw requires no authentication or user interaction, making it a top-tier remediation priority. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability and total-compromise impact warrant immediate patching via Oracle's August 2026 Critical Patch Update.
Full product takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is achievable by a remote, unauthenticated attacker over TCP, per Oracle's Critical Patch Update advisory (CSPU August 2026). The flaw resides in the Access and security component and yields complete confidentiality, integrity, and availability compromise (CVSS 3.1 base 9.8). No public exploit identified at time of analysis, and it is not currently listed in CISA KEV, but the trivial exploitability and unauthenticated network vector make it a high-priority patch item.
Remote takeover of Oracle Siebel CRM Administration is possible via its Data Archival component, where an unauthenticated attacker with only HTTP network access can fully compromise the module. Oracle rates this CVSS 9.8 with high confidentiality, integrity, and availability impact, and it was disclosed in the August 2026 Oracle Critical Patch Update. At time of analysis there is no public exploit identified and no CISA KEV listing, but the trivial exploitability (AV:N/AC:L/PR:N/UI:N) makes it a high-priority patch for Siebel operators.
Full product takeover in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 (Installation and Configuration component) allows a remote, unauthenticated attacker to compromise the platform over HTTP, per Oracle's August 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact and requires no user interaction. No public exploit is identified at time of analysis, but the trivially exploitable, network-facing nature makes it a top-tier patching priority for affected Oracle EPM deployments.
Complete takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is possible via HTTP by an unauthenticated remote attacker, per Oracle's Critical Patch Update of August 2026. The flaw resides in the Installation and Configuration component and carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-authentication, low-complexity profile makes it a high-priority patch.
Complete takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is possible for a remote, unauthenticated attacker sending crafted HTTP requests to the Installation and Configuration component. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact, and was disclosed in Oracle's August 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network attack profile makes it a high-priority patch item.
Full compromise of Oracle JD Edwards EnterpriseOne Tools (versions 9.2.0.0 through 9.2.26.4) is possible via the Web Runtime SEC component, where an unauthenticated attacker with only HTTP network access can achieve complete takeover of the product. Oracle rates this CVSS 3.1 9.8 with full confidentiality, integrity, and availability loss and describes it as 'easily exploitable,' meaning no special skill or preconditions are needed. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the unauthenticated network-facing nature makes it a high-priority patch item.
Complete takeover of Oracle WebCenter Enterprise Capture (versions 12.2.1.4.0 and 14.1.2.0.0) is achievable by an unauthenticated remote attacker over the T3 and IIOP protocols in the Client Bundle component. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N) reflects easy, network-based exploitation yielding full confidentiality, integrity, and availability compromise. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; EPSS data was not provided.
Unauthenticated arbitrary file upload in the Masteriyo LMS WordPress plugin (versions <= 2.3.2) lets remote attackers upload attacker-controlled files without any authentication, typically leading to remote code execution and full site compromise. The flaw is reported by Patchstack and carries a CVSS 9.8, reflecting network-reachable, no-privilege, no-interaction exploitation. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV, so exploitation is a strong theoretical risk rather than a confirmed campaign.
Access-control mitigation bypass in the Firefox Add-ons Manager component allows attackers to circumvent a security protection that Mozilla had previously put in place around add-on handling, affecting Firefox before 154 and Firefox ESR before 153.1. Mozilla assigned this a 9.8 CVSS score with a fully remote, unauthenticated, no-user-interaction vector, though the terse advisory text does not detail the exact protection defeated. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided.
Remote code execution in Reportico (reportico-web) versions 8.1.0 and earlier lets an unauthenticated attacker inject arbitrary PHP into the PreExecuteCode attribute of any report and have it executed by the server, bypassing the application's safe_mode restriction entirely. The flaw stems from missing access control on report attribute handling, so no authentication or user interaction is required. CVSS is 9.8 and a public vulnerability-research writeup exists, though EPSS remains low (0.27%, 19th percentile) and it is not on CISA KEV.
Memory corruption via a use-after-free in Firefox's Graphics: ImageLib component allows a remote attacker to potentially execute code or disclose memory contents when a victim renders attacker-controlled image data. All Firefox channels are affected up to the fixed builds (Firefox 154 and ESR 115.39, 140.14, 153.1). No public exploit identified at time of analysis, and EPSS is low (0.20%, 10th percentile), indicating no observed weaponization despite the high CVSS score.
Memory corruption in Mozilla Firefox 153, Firefox ESR 153.0, and Firefox ESR 140.13 allows remote attackers to potentially execute arbitrary code within the browser process when a victim renders attacker-controlled web content. Mozilla internally discovered a batch of memory-safety defects (tracked across advisories MFSA2026-74 through MFSA2026-80) and states that some showed evidence of memory corruption presumed exploitable with sufficient effort. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it is fixed in Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1.
Memory corruption in Mozilla Firefox's Graphics: Text component (CWE-416 use-after-free) can be triggered by malicious web content, potentially leading to remote code execution or information disclosure in the browser process. All Firefox users on pre-fix builds are affected until updated to Firefox 154 or the corresponding ESR releases (115.39, 140.14, 153.1). There is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.16%, 6th percentile).
Memory corruption in Mozilla Firefox's Graphics component stems from an integer overflow (CWE-190) that can be triggered when the browser processes malicious web content, potentially leading to remote code execution within the content process. The flaw affects Firefox before 154 and the ESR 140.x and 153.x branches, and Mozilla has shipped fixes across advisories MFSA2026-74 through MFSA2026-80. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Memory corruption via a use-after-free in Firefox's DOM: Core & HTML component allows a remote attacker to trigger dangling-pointer reuse in the browser engine, potentially leading to arbitrary code execution within the content process. All Firefox and Firefox ESR users on versions prior to Firefox 154, ESR 140.14, and ESR 153.1 are affected. No public exploit identified at time of analysis, and EPSS is low (0.16%, 5th percentile), consistent with a freshly patched browser bug with no observed weaponization.
Memory-corruption via a use-after-free in Firefox's JavaScript WebAssembly engine allows a remote attacker to corrupt heap memory and potentially achieve arbitrary code execution or information disclosure when a victim loads attacker-controlled content. All Firefox versions prior to Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1 are affected. There is no public exploit identified at time of analysis, KEV does not list it as actively exploited, and EPSS is low (0.16%), so this is a high-severity but not yet demonstrably-exploited flaw.
Memory-corruption defects in Mozilla Firefox 153 and Firefox ESR 153.0, disclosed by Mozilla in advisories MFSA2026-74/77/78/80, could allow a remote attacker to corrupt memory and potentially achieve arbitrary code execution within the browser process. The issues were found internally by Mozilla developers and fixed in Firefox 154 and Firefox ESR 153.1. There is no public exploit identified at time of analysis, and EPSS is low (0.15%, 5th percentile), consistent with a proactively-patched roll-up of memory-safety bugs rather than an actively exploited flaw.
Memory-safety defects in Mozilla Firefox 153 could allow remote attackers to corrupt memory and potentially achieve arbitrary code execution when a victim renders malicious web content, and were resolved in Firefox 154. These bugs were discovered internally by Mozilla with no public exploit identified at time of analysis, and the EPSS exploitation probability is low (0.15%, 5th percentile). The issues are classified as buffer/memory-corruption defects (CWE-119) that Mozilla presumes could have been exploited with sufficient effort.
Privilege escalation in Mozilla Firefox's Enterprise Policies component allows an attacker to gain elevated privileges by subverting administrator-defined policy enforcement, affecting Firefox before 154 and Firefox ESR before 153.1. Mozilla (the reporter) assigned CWE-269 (Improper Privilege Management) and the record carries a CVSS 9.8 rating, though the low EPSS score (0.15%, 5th percentile) signals minimal predicted exploitation. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Out-of-bounds read with unbounded memory allocation in the surfio Python/C++ library affects all versions prior to 0.0.19, where the Irap ASCII and binary surface-file parsers trust attacker-controllable ncol/nrow size fields in the header without validating them against the actual input length. A remote attacker who can supply a crafted .irap file to an application that parses it - the vendor explicitly rates severity assuming surfio runs in a networked service - can trigger a memory over-read and force allocation of tens of megabytes from a single tiny value, causing information disclosure or denial of service. No public exploit identified at time of analysis; the issue is fixed in 0.0.19.
Memory-corruption in Equinor's resdata library before 6.2.9 lets a crafted GRDECL reservoir-model file trigger a classic buffer overflow, out-of-bounds read, improper array indexing, and NULL-pointer dereference during parsing. Any application that feeds untrusted GRDECL input to resdata - the maintainer explicitly rates the 9.8 severity for a networked webservice that parses attacker-supplied files - is exposed to memory corruption that can lead to crashes, information disclosure, or potentially code execution. No public exploit identified at time of analysis, and the flaw is not on CISA KEV.
Remote code execution in Google Chrome for Android before 151.0.7922.169 stems from a heap buffer overflow in Dawn, Chromium's WebGPU implementation, and is notable because Google explicitly states it allows code execution OUTSIDE the renderer sandbox. A remote attacker who lures a victim to a crafted HTML page can achieve full compromise of the browser process context on the device. Rated Critical by Chromium with CVSS 9.6; a vendor patch is available, and no public exploit has been identified at time of analysis.