Unauthorized data access and modification in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Experience Manager component) lets a remote, unauthenticated attacker who lures an authorized user into interacting with malicious content read, alter, or destroy all data reachable by the application and pivot into other products (scope change). Oracle rates it CVSS 9.3 with high confidentiality and integrity impact but no availability impact, and the profile (AV:N/UI:R/S:C/C:H/I:H/A:N, plus the 'Authentication Bypass' tag) is consistent with a cross-site-scripting-class flaw. There is no public exploit identified at time of analysis and it is not in CISA KEV, but Oracle assigns it a critical score.
Cross-boundary compromise in Oracle Siebel CRM's Siebel Apps - Self Service module (Helpdesk/Training component, versions 17.0 through 26.6) lets an unauthenticated remote attacker fully read and modify all data accessible to the application after luring a legitimate user into interacting with a crafted HTTP request. Because the CVSS vector carries a scope change (S:C), successful exploitation can significantly impact products beyond Siebel itself, and the vendor/analyst tagging as an 'Authentication Bypass' reinforces the high confidentiality and integrity risk. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the 9.3 base score and network-facing, unauthenticated nature make it a top-tier patch priority.
Authentication bypass in Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication component) allows a remote unauthenticated attacker to reach and compromise the reporting service over HTTP, exposing critical data and enabling partial data modification. The scope-changing flaw (CVSS 3.1 9.3) can also significantly impact adjacent products beyond Reports Developer itself. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but the low-complexity, no-privilege, no-interaction profile makes it high priority.
Vertical privilege escalation in Grav CMS before 2.0.14 lets a delegated administrator holding only the admin.users permission promote an account to super-admin by saving a group with access[admin][super]=true. The core group blueprint omits the required security@: admin.super guard on the access field, so the operator inherits full super-admin capabilities including the task scheduler and arbitrary Twig template evaluation - effectively code execution on the host. No public exploit identified at time of analysis and the issue is not in CISA KEV, but the fix is confirmed in the vendor GHSA advisory.
SQL injection in the Readabler WordPress accessibility plugin (by Merkulove) before version 2.0.18 lets unauthenticated remote attackers inject arbitrary SQL against the site database. The CVSS 3.1 score is 9.3 with a scope change, reflecting that a low-privilege network request can reach and read backend data. No public exploit has been identified at time of analysis, and it is not in CISA KEV.
Stored cross-site scripting in Grav CMS before 2.0.15 lets authenticated editors smuggle JavaScript event handlers past the detectXss() sanitizer, which fails to flag event handlers (e.g. onerror=) placed in unquoted HTML attribute values containing unpaired quotes. The malicious payload is persisted in page content and executes in the browser of any visitor who later renders that page. Reported by VulnCheck with a CVSS 4.0 base score of 9.3; no public exploit identified at time of analysis and not listed in CISA KEV.
Stored cross-site scripting in SpiderFoot (smicallef) lets attacker-controlled reconnaissance data execute JavaScript in an operator's browser. Because correlation titles are assembled from external scan inputs such as server banners and service metadata without HTML-escaping, an attacker who controls a scanned target can persist an HTML event-handler payload that fires when the operator opens the correlations view, enabling theft of stored API keys and session-context actions. No public exploit identified at time of analysis; the flaw was reported by VulnCheck and is not listed in CISA KEV.
Authentication bypass in Oracle Helidon 3.2.18 (Imperative Web Server component of Oracle Fusion Middleware) lets an unauthenticated remote attacker send crafted HTTP requests to gain unauthorized read access to critical data and limited write (insert/update/delete) access. The flaw carries a scope-changing CVSS 3.1 base score of 9.3, meaning a successful attack can significantly impact products beyond Helidon itself. Addressed in Oracle's August 2026 Critical Patch Update; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated authentication bypass in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Endeca Application Controller), version 11.4.0, lets a remote attacker reach the application over HTTP without credentials and read critical data while also tampering with a subset of it. Because the flaw carries a scope change, successful exploitation can reach beyond the vulnerable component and affect additional products in the deployment. Oracle rates it CVSS 3.1 9.3; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated remote compromise of Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware, Security and Authentication component) allows a network attacker to reach protected data and cross a trust boundary into other products. An attacker with only HTTP access can read all data accessible to Oracle Reports Developer and make limited unauthorized modifications, and because the flaw is scope-changing it can significantly impact additional products beyond Reports Developer itself. It carries a CVSS 3.1 base score of 9.3 and is addressed in Oracle's August 2026 Critical Patch Update; no public exploit identified at time of analysis.
Cross-site request forgery in Halo CMS through version 2.25.4 lets a remote attacker abuse weaknesses in the CorsConfigurer.java and CsrfConfigurer.java security-configuration components to force an authenticated victim's browser into performing unintended state-changing actions. The advisory further claims this can lead to arbitrary code execution, though the CWE-352/CSRF classification and the CVSS user-interaction requirement suggest the RCE outcome is likely a chained or victim-privilege-dependent consequence rather than a direct memory-corruption RCE. No public exploit identified at time of analysis (not in CISA KEV), and the EPSS probability is low at 0.24% (15th percentile).
Broken API-key scope enforcement in the Grav CMS API plugin (getgrav/grav-plugin-api) before 1.0.14 lets an authenticated holder of a restricted, scoped API key read authorize-gated administrative UI metadata that their scope should forbid. Because userPassesAuthorize() checks the underlying account's super-admin flag and ACL grants instead of the presenting key's declared scopes, a low-privilege key minted on a privileged account inherits the account's full authorization, exposing sidebar/menubar/widget item definitions and users-list columns, row-actions, and filter-tabs. No public exploit identified at time of analysis; impact is information disclosure only, and the published CVSS 4.0 9.3 appears materially overstated versus the described effect.
Authorization bypass in the Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0) before 1.0.15 lets a holder of a narrowly-scoped API key act outside its granted scope. Because BlueprintPathResolver::resolveUserScope() checks the underlying account's raw super-admin ACL flag (access.api.super) rather than the scope actually minted into the presented key, an attacker with a key limited to api.media.write on a super-admin account can write files into other users' account directories and enumerate their file listings without holding api.users.write. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Cross-site scripting escalating to full remote code execution in SiYuan, an Electron-based personal knowledge-management and note-taking application, affects all releases before v3.7.4. The file-upload validation flow inserts unescaped filenames into the DOM via insertAdjacentHTML, so a filename carrying a script payload runs in the privileged renderer and reaches OS command execution when a victim drags, drops, or pastes the file into the editor. Reported by VulnCheck and fixed in v3.7.4; no public exploit identified at time of analysis.
Arbitrary command execution in Hugo 0.162.0 through 0.164.x occurs when the static site generator builds a project whose Tailwind configuration is supplied by an attacker-controlled theme, module, or starter template. Because these releases added tailwindcss to the AllowChildProcess default, Hugo launches the tool with --allow-child-process, and any top-level JavaScript in tailwind.config.js (loaded via require at startup) can spawn a non-Node shell that inherits none of the Node.js permission restrictions and runs with the full privileges of the build account. This is a build-time supply-chain execution flaw with no public exploit identified at time of analysis; it was reported by VulnCheck and fixed in Hugo 0.165.0.
Authorization bypass in FUXA (a web-based SCADA/HMI/dashboard platform) versions 1.3.2 and earlier lets a remote unauthenticated attacker escalate to full runtime control when the Node-RED integration is enabled in secure mode. The allowDashboard gate in server/integrations/node-red/index.js verifies a JWT's signature but never inspects the decoded identity, so a low-privilege guest token that anyone can mint from POST /api/heartbeat is accepted for the privileged Node-RED editor and flow-deployment API. With no second adminAuth gate on Node-RED, the attacker deploys function nodes or calls fuxa.runScript to seize project data, configuration, scripts, and - where nodeRedUnsafeModules is enabled - operating-system command execution. No public exploit identified at time of analysis, but the fix (v1.3.3) and PR diff publicly reveal the flaw.
Authentication bypass in Bastillion (bastillion-io/bastillion, all versions prior to the fix commit) lets unauthenticated remote attackers reach administrative controllers by prefixing request URIs with arbitrary path segments that the AuthFilter fails to normalize. Because the servlet-based access-management console governs SSH access to an entire managed fleet, an attacker can enumerate users, create manager accounts, and register systems, effectively seizing control of privileged SSH access. VulnCheck reported the issue and a vendor fix commit exists; no public exploit has been identified at time of analysis.
Authentication bypass in the GBIF Integrated Publishing Toolkit (IPT) before version 3.3.4 lets remote attackers gain full administrative control by reaching initial-setup functionality that is never disabled after installation completes. Because the setup workflow - meant to run once on a fresh, unconfigured instance - stays reachable on production servers, an attacker can re-drive it to seize the admin role. Reported by Mandiant (MNDT-2026-0014); no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Broken authentication in the Popup by Supsystic WordPress plugin (versions <= 1.13.0) lets remote unauthenticated attackers bypass authentication controls to tamper with plugin state, per the CVSS 3.1 vector (I:H/A:H). Reported by Patchstack with a CVSS base score of 9.1; no public exploit is identified at time of analysis and it is not listed in CISA KEV. Note the vendor tag labels it 'Information Disclosure' even though the CVSS vector sets C:N, a discrepancy defenders should verify.
Unauthenticated data compromise and denial of service in Oracle WebCenter Portal (Fusion Middleware, Portlet Services component) affects supported versions 12.2.1.4.0 and 14.1.2.0.0. A remote attacker with only HTTP network access and no credentials can read or fully access all portal-accessible data and can force a hang or repeatable crash (complete DoS) of the portal. Oracle rates it CVSS 3.1 9.1 and flags it as easily exploitable; no public exploit has been identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated remote compromise of Oracle Siebel CRM's Siebel Apps - Marketing component (versions 17.0 through 26.6) allows a network attacker over HTTP to read all Marketing-accessible data and to force a complete, repeatable denial of service. The flaw is rated CVSS 3.1 9.1 and is tagged as an authentication bypass, meaning no credentials are required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the combination of no authentication, low attack complexity, and high confidentiality/availability impact makes it a high-priority patch.
Authentication bypass in the GBIF Integrated Publishing Toolkit (IPT) before version 3.3.4 lets a remote attacker reach the initial-setup functionality, which stays unauthenticated and exposed until the server's first reboot, and abuse it to seize administrative control of the instance. The flaw was reported by Mandiant, a vendor patch (3.3.4) is available, and there is no public exploit identified at time of analysis. Rated CVSS 4.0 9.1 (Critical), exploitation is gated by a timing/deployment window rather than by raw network reach.
Unauthorized data manipulation and full denial of service in Oracle Hyperion Financial Management 11.2.25.0.000 (Security component) allow a remote, unauthenticated attacker to reach the application over HTTP and create, modify, or delete critical data as well as trigger a complete, repeatable crash. Oracle rates this CVSS 9.1 (I:H/A:H, no confidentiality impact), reflecting an easily exploitable network-facing flaw. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector makes it a high-priority patch item.
Full takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is possible when an attacker who already holds high application privileges sends crafted requests over the network via HTTPS to the Access and security component. Because the flaw carries a scope change, successful exploitation can significantly impact additional products beyond DRM itself, yielding complete loss of confidentiality, integrity, and availability (CVSS 3.1 9.1). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote tampering and denial-of-service in Oracle Database Server's Portable Clusterware component lets an unauthenticated attacker reach the service over HTTP and manipulate or destroy critical cluster data, or force a complete, repeatable crash. Affected releases span 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3, carrying a CVSS 3.1 base score of 9.1 driven purely by high Integrity and Availability impact (confidentiality is untouched). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability (network, low complexity, no privileges, no user interaction) makes it a high-priority patch item.
Unauthenticated data tampering and denial of service in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Content Acquisition System component) lets a remote attacker over HTTP create, modify, or delete all application-accessible data and force a complete, repeatable crash of the service. Oracle rates it CVSS 3.1 9.1 with High Integrity and High Availability impact and no confidentiality impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the low attack complexity (AC:L) and lack of authentication make it a high-priority patch despite no confirmed exploitation.
Unauthenticated data tampering and denial of service in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 (Content Acquisition System component) lets a remote attacker over HTTP create, delete, or modify critical data and force a complete, repeatable crash of the platform. Rated CVSS 3.1 9.1 with no authentication or user interaction required, it affects the Endeca-derived search and merchandising layer of Oracle's commerce stack. No public exploit identified at time of analysis, and it is not listed in CISA KEV; confidentiality is explicitly unaffected (C:N), so the danger is integrity and availability rather than data theft.
Data tampering and complete denial of service in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Content Acquisition System component) allow a remote, unauthenticated attacker with HTTP access to create, delete, or modify critical data and to hang or repeatedly crash the service. The CVSS 3.1 base score is 9.1 driven by high integrity and availability impact with no confidentiality loss, and the flaw is rated easily exploitable by Oracle. No public exploit was identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided.
Unauthenticated data tampering and denial-of-service in Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication component) lets a remote attacker over HTTP create, delete, or modify all Reports Developer-accessible data and trigger a complete, repeatable crash. The flaw carries a CVSS 3.1 base score of 9.1 with high integrity and availability impact but no confidentiality impact, and was disclosed in Oracle's August 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated data tampering and denial of service in Oracle Hospitality Simphony POS (versions 19.8-19.8.5, 19.9-19.9.3, 19.10-19.10.1) lets a remote attacker with only HTTP network access create, delete, or modify all Simphony-accessible data and force a repeatable crash. Oracle rates it CVSS 3.1 9.1 with high integrity and availability impact and describes it as easily exploitable, though there is no public exploit identified at time of analysis. It was reported by Oracle's own security team and fixed in the August 2026 Critical Patch Update.
Unauthorized data compromise in Oracle Web Services Manager (OWSM), part of Oracle Fusion Middleware's Web Services Security component, lets a remote unauthenticated attacker read, create, delete, or modify all OWSM-accessible data over HTTP. Tagged as an authentication bypass, it affects versions 12.2.1.4.0 and 14.1.2.0.0 and carries a CVSS 3.1 base score of 9.1 (high confidentiality and integrity impact, no availability impact). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated compromise of Oracle Helidon 4.5.0 lets a remote attacker over HTTP read, create, modify, or delete all data accessible to the Helidon application via a flaw in the Imperative Web Server component. Oracle rates it CVSS 9.1 (high confidentiality and integrity impact, no availability impact), and the vendor tag 'Authentication Bypass' indicates protected routes/resources can be reached without credentials. No public exploit identified at time of analysis; addressed in the Oracle Critical Patch Update of August 2026.
Unauthenticated remote compromise of Oracle Helidon 3.2.18 (Imperative Web Server component) allows a network attacker to read, create, modify, or delete all data accessible to the framework over HTTP. Tagged by Oracle as an authentication bypass, it carries a CVSS 3.1 base score of 9.1 with high confidentiality and integrity impact and no availability impact. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but Oracle rates it as easily exploitable, warranting prompt patching.
Unauthenticated data compromise in Oracle Helidon 4.5.0 (Imperative Web Server component of Oracle Fusion Middleware) lets a remote attacker reach and manipulate all data accessible to the framework over HTTP. Tagged as an authentication bypass, it carries a CVSS 9.1 with high confidentiality and integrity impact but no availability impact. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Authentication bypass in Oracle Commerce Guided Search / Experience Manager 11.4.0 lets a remote, unauthenticated attacker reach the Endeca Application Controller component over HTTP and read or tamper with all data accessible to the application. Rated CVSS 3.1 9.1 (C:H/I:H, no availability impact), it is trivially exploitable with no user interaction. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and unauthenticated network vector make it a high-priority patch.
Unauthorized data access and manipulation in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Endeca Application Controller component) lets a remote, unauthenticated attacker read, create, delete, or modify all data accessible to the product over HTTP. The Oracle advisory and 'Authentication Bypass' tag indicate the flaw sidesteps authentication entirely, and Oracle rates it 'easily exploitable' with CVSS 9.1 (high confidentiality and integrity impact, no availability impact). No public exploit has been identified at time of analysis, but the low attack complexity and network reachability make it a strong patching priority.
Unauthenticated data compromise in Oracle Commerce Guided Search / Experience Manager 11.4.0 (the legacy Endeca-derived Content Acquisition System) lets a remote attacker read, create, modify, or delete all data accessible to the product over HTTP. The Oracle-supplied CVSS 3.1 base score is 9.1 (C:H/I:H, no availability impact), and the intelligence tag 'Authentication Bypass' aligns with the PR:N/UI:N vector. No public exploit code has been identified and it is not on CISA KEV, but the trivial exploitability (AC:L, no auth, no user interaction) makes it a high-priority patching target.
Unauthenticated data compromise in Oracle Hyperion Data Relationship Management 11.2.25.0.000 allows a remote attacker to read, create, delete, or modify all data accessible to the application via its SOAP interface. The flaw sits in the Access and security component and is tagged as an authentication bypass, meaning an attacker needs no credentials to reach critical master-data records. No public exploit identified at time of analysis, but the CVSS 9.1 rating and unauthenticated network vector make this a high-priority patch.
Remote unauthenticated compromise of Oracle Hyperion Financial Reporting 11.2.25.0.000 (Server component) allows an attacker with network access via the Java RMI interface to read, create, modify, or delete all data accessible to the application. Carrying a CVSS 3.1 base score of 9.1 and tagged as an authentication bypass, the flaw yields full confidentiality and integrity compromise without any credentials or user interaction, though it does not affect availability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated data compromise in Oracle Hyperion Profitability and Cost Management 11.2.25.0.000 (Deployment component) lets a remote attacker over HTTP read, create, modify, or delete all data accessible to the application. Tagged as an authentication bypass and rated CVSS 3.1 9.1, it was reported by Oracle and addressed in the August 2026 Critical Patch Update; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full read/write compromise of Oracle WebCenter Sites is possible by remote, unauthenticated attackers over HTTP against versions 12.2.1.4.0 and 14.1.2.0.0. Oracle rates the flaw CVSS 9.1 and describes it as easily exploitable, granting an attacker unauthorized creation, deletion, and modification of critical data plus full read access to all WebCenter Sites accessible data, though availability is unaffected. It is tagged as an authentication bypass; no public exploit has been identified at time of analysis and it is not listed in CISA KEV.
Arbitrary file write via directory traversal in Reportico (reportico-web) through version 8.1.0 lets remote attackers create or overwrite files anywhere the web server user can write, by supplying a crafted path in the 'saveTemplate' parameter together with 'execute_mode=PREPARE' on the run.php endpoint. Because writes can land inside the web root, this is a realistic path to remote code execution (e.g., dropping a PHP web shell). No CISA KEV listing and a low EPSS score (0.37%) indicate no confirmed active exploitation yet, though a third-party vulnerability-research repository is referenced and the flaw is unauthenticated and low-complexity.
Unauthenticated data compromise and denial of service in Oracle Commerce Guided Search / Experience Manager 11.4.0 lets a remote attacker read all data accessible to the Experience Manager component and force a repeatable crash or hang. The flaw is tagged as an authentication bypass, carries a CVSS 3.1 base score of 9.1, and is reachable over HTTP with no credentials or user interaction. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated remote compromise of Oracle Commerce Guided Search / Experience Manager 11.4.0 (Endeca Application Controller) lets a network attacker read all data accessible to the product and force a complete, repeatable denial of service over HTTP. Oracle rates it CVSS 3.1 9.1 and flags it as easily exploitable with no authentication or user interaction. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the low attack complexity and unauthenticated vector make it a high-priority patch.
Full takeover of Oracle WebCenter Sites (versions 12.2.1.4.0 and 14.1.2.0.0) is possible by a high-privileged, network-based attacker over HTTP, with a scope change that lets impact spill into other Oracle Fusion Middleware components. The flaw yields complete loss of confidentiality, integrity, and availability (CVSS 3.1 9.1) and was addressed in Oracle's August 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthorized data compromise in Oracle Hyperion Data Relationship Management 11.2.25.0.000 (Access and security component) lets a remote, unauthenticated attacker read, create, delete, or modify any DRM-accessible data over HTTP. The vendor tags this as an authentication bypass, and its CVSS 3.1 score of 9.1 reflects complete confidentiality and integrity loss with no availability impact. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but the low attack complexity and no-privileges vector make it a high-priority patching target.
Unauthenticated remote compromise of Oracle Hyperion Data Relationship Management 11.2.25.0.000 (Access and security component) allows network attackers to read, create, modify, or delete all data accessible to the application over HTTP without any credentials. Oracle rates it CVSS 3.1 9.1 and tags it as an authentication bypass, meaning an attacker who can reach the web interface gains full confidentiality and integrity impact over master-data governance records. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and lack of authentication make it a high-priority patch.
Unauthenticated remote compromise of Oracle Application Testing Suite 13.3.0.1 allows a network attacker to read, create, modify, or delete all data accessible to the application over HTTP with no credentials or user interaction. Rated CVSS 3.1 9.1 with high confidentiality and integrity impact (no availability impact), and tagged as an authentication bypass, this is a pre-auth flaw fixed in Oracle's August 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Data tampering and complete denial-of-service in Oracle Commerce Guided Search / Experience Manager 11.4.0 lets a remote unauthenticated attacker reach the Content Acquisition System over HTTP to create, delete, or modify all accessible data and to force a persistent hang or repeatable crash. Rated CVSS 3.1 9.1 (Integrity and Availability high, Confidentiality none), it is easily exploitable per Oracle with no privileges or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated data tampering and denial-of-service in Oracle Commerce Guided Search / Experience Manager 11.4.0 lets a remote attacker manipulate the Content Acquisition System over HTTP to create, delete, or modify all accessible application data and to force a complete, repeatable crash or hang. The flaw carries a CVSS 3.1 base score of 9.1 driven by High Integrity and High Availability impact with no privileges or user interaction required, and was disclosed via Oracle's August 2026 Critical Patch Update. There is no public exploit identified at time of analysis.