Full system takeover in Oracle BI Publisher's Web Service API is achievable by any low-privileged authenticated user with HTTP network access, affecting all three currently supported version lines - 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. Successful exploitation results in complete loss of confidentiality, integrity, and availability of the BI Publisher instance, per Oracle's own characterization of 'takeover' in the advisory. No public exploit code or active exploitation has been identified at time of analysis; Oracle addressed the vulnerability in its August 2026 Critical Security Patch Update.
Full takeover of Oracle Agile Engineering Data Management 6.2.1 is achievable by any low-privileged, network-based attacker via the Web Services Security component over HTTP. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms high impact across all three pillars - confidentiality, integrity, and availability - with low attack complexity and no user interaction required. No public exploit code or CISA KEV listing has been identified at time of analysis, but the ease-of-exploitation profile warrants immediate patching for any internet-facing or internally exposed deployment.
Full system takeover of Oracle Agile PLM 9.3.6 is achievable by any low-privileged authenticated attacker with network HTTP access to the Export component, resulting in complete compromise of confidentiality, integrity, and availability. Oracle confirmed this in their Critical Security Patch Update for August 2026 (EUVD-2026-61991), assigning a CVSS 3.1 base score of 8.8. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and minimal authentication barrier make this a high-priority remediation target for any organization running this PLM version.
Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows full system takeover - complete compromise of confidentiality, integrity, and availability - via low-privileged, network-accessible HTTP requests targeting the Installation and Configuration component. The attack requires no user interaction and low complexity, placing exploitation within reach of any authenticated Hyperion user with HTTP connectivity to the affected service. Oracle's August 2026 Critical Security Patch Update (CPU) addresses this vulnerability; no public exploit code or CISA KEV listing has been identified at time of analysis.
Full system takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is achievable by any low-privileged attacker with HTTP network access, affecting the Installation and Configuration component. Oracle's own CPU advisory characterizes this as 'easily exploitable,' with the CVSS 3.1 score of 8.8 reflecting complete confidentiality, integrity, and availability impact upon successful exploitation. No public exploit code or confirmed active exploitation has been identified at time of analysis, though the low attack complexity makes this a high-priority patching target.
Full system takeover is achievable in Oracle Siebel CRM End User versions 17.0 through 26.6 via the Document Management component over HTTP, exploitable by any low-privileged authenticated user without user interaction. The CVSS 8.8 score reflects complete confidentiality, integrity, and availability impact, consistent with the vendor's characterization of 'takeover' of the End User instance. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad version range make this a priority patching target for any organization running affected Siebel deployments.
Full system takeover in Oracle Hyperion Data Relationship Management 11.2.25.0.000 is achievable by low-privileged authenticated network attackers via HTTP, targeting the Access and Security component. Oracle's own advisory characterizes this as 'easily exploitable,' with successful exploitation resulting in complete compromise across confidentiality, integrity, and availability - consistent with an authorization bypass or privilege escalation flaw within the access control layer. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Full takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is achievable by any low-privileged, network-accessible attacker via HTTP, with high impact across confidentiality, integrity, and availability. The vulnerability resides in the Access and Security component and carries a vendor-assigned CVSS 3.1 base score of 8.8, reflecting low attack complexity and no required user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis.
Oracle Hyperion Financial Management 11.2.25.0.000 is vulnerable to full system takeover via a SQL-based attack against its Security component, exploitable by any low-privileged network-authenticated user. The CVSS 3.1 score of 8.8 reflects high impact across confidentiality, integrity, and availability with no user interaction required beyond holding basic credentials. Oracle disclosed this as part of its August 2026 Critical Patch Update; no public exploit code or CISA KEV listing has been identified at time of analysis.
Full system takeover of Oracle Yard Management (E-Business Suite component, versions 12.2.3 through 12.2.15) is achievable by any low-privileged authenticated user over HTTP, with the vendor-reported CVSS impact of C:H/I:H/A:H indicating complete compromise of confidentiality, integrity, and availability. The affected subcomponent is Internal Operations, and Oracle addressed this flaw in the August 2026 Critical Patch Update. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Full system takeover of Oracle Hyperion Financial Reporting 11.2.25.0.000 is achievable by any low-privileged authenticated user over HTTP, with no additional complexity required. The Server component is vulnerable to exploitation that results in complete compromise of confidentiality, integrity, and availability - Oracle's own description uses the word 'takeover'. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low bar to exploitation (PR:L, AC:L, AV:N) makes this a high-priority patching target for any organization running this Oracle Hyperion version.
Full system takeover of Oracle Sales for Handhelds (E-Business Suite versions 12.2.3-12.2.15) is achievable by any low-privileged authenticated attacker with HTTP network access, resulting in complete compromise of confidentiality, integrity, and availability. The vulnerability resides in the Internal Operations component and requires no user interaction or elevated privileges beyond a basic account. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and broad version range make this a credible lateral-movement or privilege-escalation risk within Oracle EBS environments.
Full takeover of Oracle JD Edwards EnterpriseOne Tools is achievable by a low-privileged remote attacker via HTTP, affecting all 9.2.x releases through 9.2.26.4. The vulnerability resides in the Installation Security component and requires only a low-privileged account with no user interaction, which Oracle itself classifies as 'easily exploitable.' No public exploit code or CISA KEV listing has been identified at time of analysis, but the complete C/I/A impact profile represents a critical business risk for organizations running JD Edwards ERP environments.
Full takeover of Oracle WebCenter Portal is achievable by any low-privileged authenticated user over HTTP, affecting both currently supported release lines - 12.2.1.4.0 and 14.1.2.0.0 - in the Runtime Tools component. The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects that exploitation demands minimal prerequisites: a valid portal account and network reachability, with no interaction from other users required and no special configuration needed beyond a standard supported deployment. No public exploit code and no CISA KEV listing have been identified at time of analysis, though Oracle CPU patches are routinely reverse-engineered shortly after release, narrowing the safe patching window significantly for exposed instances.
Full system takeover in Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 is achievable by any low-privileged attacker with network access over HTTP, resulting in complete compromise of confidentiality, integrity, and availability. Oracle's own advisory characterizes the vulnerability as 'easily exploitable,' materially lowering the skill threshold for attackers. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity, full-impact CVSS vector, and broad coverage across both active release branches warrant urgent remediation across Oracle Fusion Middleware deployments.
Use-after-free in Google Chrome's WebGL subsystem allows remote code execution inside the browser sandbox for all Chrome versions prior to 151.0.7922.169. An attacker can achieve arbitrary code execution within the Chrome renderer by delivering a crafted HTML page to a victim, requiring only a single page visit. No public exploit code or CISA KEV listing has been identified at time of analysis; however, CVSS 8.8 with low attack complexity reflects meaningful real-world risk for any unpatched Chrome deployment.
Privilege escalation via the Remote Settings Client component affects Mozilla Firefox across all supported mainline and ESR release tracks, with Mozilla assigning the issue CVSS 8.8 High severity. The flaw (CWE-269, Improper Privilege Management) permits a network-based attacker to escalate privileges within the browser context when a user interacts with attacker-controlled content, achieving total confidentiality, integrity, and availability impact. No public exploit code exists and CISA has not listed this in KEV, but the simultaneous patching of three ESR branches alongside mainline signals that Mozilla assessed significant breadth of exposure across its install base.
Privilege escalation in Firefox's DOM Navigation component allows a remote unauthenticated attacker to achieve full confidentiality, integrity, and availability compromise within the browser process by inducing a user to visit a malicious webpage. All Firefox releases prior to version 154 and all active ESR branches (115.x, 140.x, 153.x) are affected, with Mozilla issuing four simultaneous MFSA advisories (mfsa2026-74 through mfsa2026-77) indicating broad impact across every supported release channel. No public exploit or KEV listing has been identified at time of analysis, but the low attack complexity and zero authentication requirement make this a high-priority patch for all Firefox deployments.
Privilege escalation in Firefox's DOM Networking component allows remote attackers who can lure a user to a malicious webpage to achieve high-impact compromise of confidentiality, integrity, and availability. The flaw, rooted in improper privilege management (CWE-269), affects all Firefox releases prior to version 154 and multiple ESR branches, and has been patched across four simultaneous Mozilla advisories (mfsa2026-74 through mfsa2026-77). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Privilege escalation in Firefox's Networking: Cookies component allows a remote, unauthenticated attacker to gain elevated privileges within the browser when a user visits a malicious page, yielding full confidentiality, integrity, and availability impact. All Firefox releases prior to 154 and both ESR branches prior to 140.14 and 153.1 are affected across all platforms. SSVC rates technical impact as total, but exploitation status is confirmed as none and the attack is not automatable due to the required user interaction; no public exploit or CISA KEV listing exists at time of analysis.
Privilege escalation in The Grid WordPress plugin (versions ≤ 2.7.9.1) permits any authenticated subscriber-level user to elevate their role, effectively granting unauthorized administrative access to the WordPress installation. The vulnerability stems from incorrect privilege assignment (CWE-266), where the plugin fails to properly restrict privileged actions to appropriate roles. With a CVSS score of 8.8 and no special configuration required beyond plugin installation and a valid subscriber account, this represents a meaningful threat to WordPress sites with open user registration. No public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation via the Shell Integration component in Mozilla Firefox allows a remote unauthenticated attacker - with user interaction - to achieve full compromise of confidentiality, integrity, and availability on affected systems. Affected are all Firefox releases prior to 154 and ESR branches prior to 140.14 and 153.1, as confirmed by Mozilla advisories mfsa2026-74, mfsa2026-76, and mfsa2026-77. No public exploit or CISA KEV listing has been identified at time of analysis, and SSVC rates exploitation status as none.
Remote code execution in Halo 2.25.4 is reachable by low-privileged authenticated attackers through the backup restoration workflow, exploiting CWE-73 (External Control of File Name or Path) in MigrationServiceImpl.restoreWorkdir() combined with Spring's FileSystemUtils.copyRecursively(). An attacker with a valid low-privileged account can supply a crafted backup archive containing path-traversal entries that escape the designated work directory, writing arbitrary files to the server filesystem and achieving code execution. Publicly available exploit code exists via a proof-of-concept gist, and the EPSS score of 0.29% (21st percentile) indicates limited observed exploitation at this time despite the public POC.
Full system takeover in Oracle Agile PLM 9.3.6 is achievable by unauthenticated remote attackers via HTTP, contingent on human interaction from a victim user. Oracle's own advisory explicitly describes the outcome as 'takeover of Oracle Agile PLM,' with complete confidentiality, integrity, and availability impact (CVSS 8.8). No public exploit code or CISA KEV listing has been identified at the time of analysis, though the low attack complexity (AC:L) lowers the barrier to independent exploit development.
Full takeover of Oracle PeopleSoft Enterprise PeopleTools is achievable by an unauthenticated remote attacker targeting the nVision component via HTTP on versions 8.61 through 8.63. The attack requires that a victim user interact with attacker-controlled content - consistent with a client-side exploitation pattern such as XSS or CSRF - after which the attacker achieves complete compromise with high confidentiality, integrity, and availability impact. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the low attack complexity and absence of any authentication requirement lower the bar for targeted exploitation against internet-accessible PeopleSoft deployments.
PHP Object Injection in the Essential Real Estate WordPress plugin (≤ 5.3.3) by g5theme allows low-privileged authenticated users to pass a crafted serialized PHP object through a vulnerable unserialize() call, potentially triggering arbitrary code execution if a usable POP (Property-Oriented Programming) gadget chain exists within the WordPress installation. The CVSS 8.8 score reflects full confidentiality, integrity, and availability impact - realistic in WordPress environments where co-installed plugins routinely supply gadget chains. No public exploit code or active exploitation (CISA KEV) has been identified at the time of analysis.
Buffer overflow in the LLDP daemon of NVIDIA Cumulus Linux enables an unauthenticated attacker with Layer 2 network adjacency to achieve code execution by sending specially crafted LLDP frames. Both the GA track (all versions through 5.16) and LTS track (through 5.11.5 and 5.9.5 respectively) are confirmed affected. No active exploitation or public proof-of-concept code has been identified at time of analysis, though CISA SSVC rates the technical impact as total given that a successful exploit yields full switch compromise.
Privilege escalation via invalid pointer dereference in Mozilla Firefox's Graphics component allows a remote attacker to gain elevated privileges within the browser context. Affected versions are all Firefox releases prior to 154 and all Firefox ESR releases prior to 153.1, with patches confirmed in Mozilla advisories mfsa2026-74 and mfsa2026-77. No public exploit identified at time of analysis, and CISA's SSVC framework rates exploitation status as none with the attack not automatable, though technical impact is assessed as total.
Privilege escalation via the Application Update component in Mozilla Firefox allows a network-adjacent attacker, with user interaction, to gain elevated privileges with high impact to confidentiality, integrity, and availability. All Firefox versions prior to 154 are affected per Mozilla CPE data. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS score of 8.8 and the nature of the update mechanism - which on some platforms (e.g., Windows via the Mozilla Maintenance Service) operates with system-level privileges - make this a meaningful escalation risk.
Privilege escalation in Firefox's Request Handling component exposes all versions prior to 154 (and ESR prior to 153.1) to high-impact compromise of confidentiality, integrity, and availability. The flaw carries a CVSS 8.8 score with a network attack vector and no privilege prerequisite, meaning a remote attacker can trigger it by inducing a user to interact with attacker-controlled content. SSVC assessment confirms no active exploitation at time of analysis and rates technical impact as total, while fix versions are confirmed via two Mozilla security advisories.
Privilege escalation in Mozilla Firefox's Downloads API component exposes users on any version prior to Firefox 154 or Firefox ESR 153.1 to high-impact compromise across confidentiality, integrity, and availability. Classified under CWE-269 (Improper Privilege Management), the flaw enables an unauthenticated remote attacker to escalate privileges when a user interacts with a crafted download trigger, requiring no prior foothold on the target system. No public exploit has been identified at time of analysis, but Firefox's ubiquitous deployment and the low attack complexity make this a high-priority patch for any organization.
Denial of service in libexpat through 2.8.3 stems from quadratic CPU complexity in the storeAtts() XML attribute processing function, enabling remote unauthenticated attackers to exhaust server CPU with a compact, well-formed XML document. The flaw-closely related to CVE-2026-45186 fixed in Expat 2.8.1-requires no authentication, no external entity resolution, and no non-default parser options to trigger, and is significantly amplified when XML payloads are compression-wrapped. No public exploit code has been identified at time of analysis, but the attack algorithm is fully derivable from the public PR diff and vulnerability description, making independent weaponization low-effort.
Use-after-free memory corruption in Firefox's Layout: Text and Fonts component allows a remote unauthenticated attacker to achieve high-confidence confidentiality, integrity, and availability impact by luring a user to visit a malicious web page. The vulnerability spans the main Firefox release channel and all three active ESR branches (115.x, 140.x, 153.x), indicating broad exposure across enterprise and consumer deployments. No public exploit or active exploitation has been identified at time of analysis, but the network-accessible, low-complexity nature of this flaw and the breadth of MFSA advisories (mfsa2026-74 through mfsa2026-80) signal a high-priority patching target.
Sandbox escape in Streambert Desktop App (all versions prior to 2.6.0) allows a compromised renderer process to pass an arbitrary local file path - including executables, scripts, or OS shortcuts - to Electron's shell.openPath, causing the host OS to launch the file with the StreamBERT main process's privileges. The vulnerable IPC handler open-path-at-time in src/ipc/player.js accepted renderer-supplied filePath values with no type checking, extension filtering, or real-path validation, making the fallback to shell.openPath an unrestricted local code-execution primitive. No CISA KEV listing and no public exploit code have been identified at time of analysis; the patch and fix commit are publicly available on GitHub.
Local privilege escalation in Oracle Product Lifecycle Analytics 3.6.1 enables a low-privileged attacker with host-level logon access to fully compromise the platform, achieving complete confidentiality, integrity, and availability takeover. The vulnerable component is labeled 'Installation Issues,' indicating the flaw stems from insecure artifacts - such as file permissions, directory ownership, or credential files - left accessible by the installer. Critically, the CVSS scope change (S:C) confirms that a successful attack can significantly impact additional co-hosted Oracle or system components beyond PLA itself; no public exploit or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Oracle Payroll (E-Business Suite 12.2.3 through 12.2.15) enables a low-privileged attacker with logon access to the hosting infrastructure to fully compromise the payroll application, achieving complete confidentiality, integrity, and availability impact including full takeover. The vulnerability carries a confirmed scope change (S:C), meaning successful exploitation can cascade to affect additional products co-hosted on the same infrastructure - a significant blast-radius amplifier in shared EBS environments. No public exploit code and no CISA KEV listing have been identified at time of analysis; exploitation is assessed as a targeted insider or post-breach scenario rather than opportunistic remote attack.
Cross-site request forgery in HashBar - WordPress Notification Bar plugin through version 2.0.0 allows a remote unauthenticated attacker to perform unauthorized administrative actions by tricking a logged-in WordPress administrator into visiting a crafted webpage. Reported by Patchstack (audit@patchstack.com) and registered as EUVD-2026-62209, this flaw carries a CVSS 8.8 score reflecting high C/I/A impact ratings, though the realistic blast radius depends on which admin-facing functions the plugin exposes to forged requests. No public exploit or CISA KEV listing has been identified at time of analysis.
Path traversal in Streambert (versions prior to 2.5.0) allows a compromised Electron renderer process to abuse the run-download IPC channel to copy arbitrary files readable by the Streambert process into attacker-controlled locations, and to overwrite existing writable files on the host system. The downloadSubtitleFile utility in src/ipc/downloads.js accepts renderer-supplied file: URIs and destination paths without sanitization, passing them directly to fs.copyFileSync - crossing the Electron IPC boundary without restriction. No public exploit is identified at time of analysis, but the CWE-22 path traversal root cause is well-understood and the vendor-released patch is available in version 2.5.0.
Local privilege escalation in Oracle Agile PLM 9.3.6 enables any low-privileged user with a logon to the host infrastructure to achieve complete system takeover, including full confidentiality, integrity, and availability compromise. The CVSS scope-change indicator (S:C) confirms that successful exploitation can cascade to additional Oracle Supply Chain products co-deployed on the same infrastructure, significantly amplifying blast radius beyond the primary target. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and absence of required user interaction make this a high-priority remediation target covered under Oracle's August 2026 Critical Patch Update.
Privilege escalation in Dell Watchdog Timer Driver versions prior to 2.0.0.1 allows a local low-privileged attacker to gain full system control by abusing an improperly access-controlled IOCTL interface exposed by the kernel driver. The CVSS scope-changed score of 8.8 (AV:L/AC:L/PR:L/UI:N/S:C) reflects that exploitation crosses the kernel trust boundary, yielding complete confidentiality, integrity, and availability impact. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity makes this a meaningful local privilege escalation risk on Dell-equipped systems.
Unbounded HTTP request payload processing in OpenSearch Dashboards' capabilities route handler allows unauthenticated remote attackers to exhaust server resources and cause a denial of service. Affected products span both self-hosted OpenSearch Dashboards (all versions per CPE) and Amazon OpenSearch Service. The CVSS 4.0 score of 8.7 with AV:N/AC:L/AT:N/PR:N/UI:N reflects low attack complexity and no authentication prerequisite, making any network-exposed instance potentially reachable. No public exploit or CISA KEV listing has been identified at time of analysis, and a vendor-released patch is available.
Arbitrary shell command execution in Oh My Zsh's dotenv plugin allows any syntactically valid Zsh command embedded in a `.env` file to run with the victim user's privileges when they `cd` into a directory containing that file. The plugin unconditionally `source`d the `.env` file as a shell script rather than parsing it as a structured key-value store, meaning malicious git repositories, shared project directories, or downloaded archives could weaponize routine developer directory-navigation. Exploitation is silent when `ZSH_DOTENV_PROMPT=false` or when the user presses Enter at the default prompt without reviewing the file; no CISA KEV listing or public exploit code was identified at time of analysis.
Use-after-free in Mozilla Firefox's JavaScript garbage collector (GC) component enables remote code execution when a victim visits a malicious webpage. All Firefox versions prior to 154 and Firefox ESR versions prior to 153.1 are affected across multiple product lines, as indicated by four separate Mozilla Security Advisories (MFSA2026-74, -77, -78, -80). No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the high CVSS score of 8.8 with full C/I/A impact and low attack complexity demands prompt patching.
Denial of service in Amazon ion-java (versions 1.9.0 through 1.11.x) is caused by the GZIP auto-decompression handler failing to enforce any upper bound on decompressed output size (CWE-409), a class of flaw commonly called a decompression bomb or zip bomb. Remote unauthenticated network attackers can submit a specially crafted compressed Ion document that expands to an arbitrarily large payload in memory, exhausting heap resources and crashing or stalling any application that parses untrusted Ion input. The CVSS 4.0 score of 8.7 (AV:N/AC:L/PR:N/UI:N) reflects the low exploitation barrier; no public exploit code or CISA KEV listing has been identified at time of analysis.
Uncontrolled heap memory preallocation in Amazon ion-java's binary Ion stream cursor exposes any application parsing untrusted Ion binary data to remote denial of service. Versions 1.9.0 through 1.11.x are affected; a crafted Ion binary document with an inflated declared-length field forces the JVM to preallocate excessive heap memory before input validation occurs, exhausting available resources and crashing the host service. No public exploit code has been identified, but the CVSS 4.0 vector confirms unauthenticated remote exploitation with low complexity, and a vendor-released patch is available in version 1.12.0.
High-privileged remote exploitation of Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.6) via the Siebel Cloud Manager component enables full confidentiality and integrity compromise of Siebel data, with a documented scope change allowing cascading impact on additional Oracle products in the environment. Oracle's August 2026 Critical Security Patch Update discloses a CVSS 3.1 base score of 8.7, reflecting network-accessible exploitation requiring no interaction but demanding high-privilege credentials. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 expose a high-severity Security component flaw enabling authenticated high-privileged attackers to compromise the system via HTTP, with confirmed scope change affecting additional downstream products. Exploitation allows complete unauthorized read and write access to all OIM-accessible data, including critical identity and access management records. No public exploit has been identified at time of analysis, and this vulnerability was disclosed as part of Oracle's Critical Patch Update for August 2026.
Unbounded mutual recursion in the RabbitMQ Java client library (amqp-client <= 5.33.0) allows a malicious AMQP server or network intermediary to crash the client JVM before authentication completes. By sending approximately 580 levels of nested AMQP table structures within a single connection.start frame - well within the default 131,072-byte frame limit - an attacker triggers a StackOverflowError that kills the client's I/O processing thread, resulting in denial of service. No public exploit code has been published, but the GHSA advisory includes a precise technical breakdown and proof-of-concept payload specification, significantly lowering the bar for exploitation.
Memory exhaustion denial of service in the RabbitMQ Java client library (com.rabbitmq:amqp-client ≤ 5.33.0) allows a malicious AMQP peer to crash the client JVM by sending a LongString field with a wire-declared length near Integer.MAX_VALUE during the pre-authentication connection.start handshake. The ValueReader.readBytes() method allocates a byte array sized by the attacker-controlled wire value before validating it against actual frame data, causing a ~2 GB allocation and OutOfMemoryError that terminates the entire JVM process. No public exploit code has been identified at time of analysis, but the GHSA advisory discloses the exact vulnerable code path, the precise trigger value (0x7FFFFFFE), and the step-by-step attack scenario, making independent implementation trivial.
Cross-database authorization bypass in ArcadeDB's Gremlin wire-protocol plugin allows any authenticated server user to fully access all databases on the server, completely circumventing per-database and per-type ACLs. Versions 26.7.3 and below of com.arcadedb:arcadedb-gremlin are affected; the plugin enforces SASL PLAIN authentication but never invokes the database permission check (canAccessToDatabase) nor binds the authenticated principal into the execution engine. No public exploit code has been identified at time of analysis, but exploitation requires only a single valid server credential regardless of what database that credential was originally provisioned for.