High-privileged network exploitation of Oracle Product Lifecycle Analytics 3.6.1 enables complete unauthorized read and write access to critical data, with a confirmed scope change that can cascade into compromise of additional Oracle products sharing the same environment. The vulnerable component is tied to Installation Issues within Oracle's Supply Chain suite, reachable over Oracle Net without user interaction. No public exploit code has been identified at time of analysis, but the CVSS 8.7 rating and scope-change designation make this a serious priority for organizations running OPLA in multi-product Oracle estates.
Oracle Customer Care (Internal Operations component) in E-Business Suite versions 12.2.3 through 12.2.15 allows a high-privileged, remote attacker to achieve full confidentiality and integrity compromise via HTTP - with a confirmed scope change that can cascade to additional EBS products. Despite the PR:H requirement, the 'Authentication Bypass' tag suggests that controls within the authenticated context can be circumvented, enabling unauthorized read and write access to critical customer data. No public exploit code has been identified and CISA KEV listing is absent, but the 'easily exploitable' vendor qualifier and low attack complexity mean that any attacker who reaches this component with elevated credentials faces minimal technical barriers.
Unauthenticated information disclosure in SiYuan before v3.7.4 exposes private knowledge-base content to anonymous publish-mode readers through 17 insufficiently protected block API endpoints in kernel/api/block.go. Remote attackers without credentials can enumerate arbitrary block IDs to retrieve private text content, structural metadata, and block existence information across the entire workspace. No public exploit or active exploitation has been identified at time of analysis; a vendor-released patch is available in v3.7.4 per GitHub Security Advisory GHSA-4vpg-gwqq-w44c.
Unauthorized read and write access to critical data in Oracle WebCenter Portal's Runtime Tools component is achievable by a low-privileged, network-authenticated attacker over HTTP, contingent on victim user interaction. Successful exploitation triggers a scope change - extending compromise beyond WebCenter Portal to additional Oracle Fusion Middleware products - resulting in full confidentiality and integrity impact on critical portal data. No public exploit code has been identified at time of analysis, and this vulnerability is not currently listed in the CISA KEV catalog.
Oracle WebCenter Portal's Runtime Tools component exposes a high-severity, network-exploitable authentication bypass affecting versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged, remote-authenticated attacker who can induce a victim user to interact with a malicious HTTP request can bypass authorization controls to gain complete read access to all WebCenter Portal data and perform unauthorized creation, deletion, or modification of critical data - including scope-change impact to additional Oracle Fusion Middleware products. No public exploit code has been identified at time of analysis, and it is not listed in the CISA KEV catalog.
Oracle WebCenter Content's Content Server component, in versions 14.1.2.0.0 and 12.2.1.4.0, exposes an authentication bypass that allows a low-privileged remote attacker to achieve full confidentiality and integrity compromise of all accessible content data - and, due to a confirmed scope change, may significantly impact additional Oracle Fusion Middleware products integrated with the platform. Exploitation is network-accessible over HTTP with low complexity but requires a valid low-privileged account and human interaction from a separate victim, classifying this as a socially-engineered or CSRF-class attack surface. No public exploit code and no CISA KEV listing have been identified at time of analysis; the vulnerability was disclosed as part of Oracle's August 2026 Critical Security Patch Update.
Oracle Service Delivery Platform's Messaging Enabler component (versions 14.1.2.0.0 and 12.2.1.4.0 within Oracle Fusion Middleware) can be compromised by unauthenticated remote attackers via TCP, enabling unauthorized creation, deletion, or modification of critical data and repeated complete denial of service. The CVSS S:C scope change signals that a successful attack can cascade to additional Fusion Middleware products sharing the same deployment, amplifying organizational impact beyond the directly targeted platform. No public exploit has been identified at time of analysis, and the high attack complexity (AC:H) requirement reduces the likelihood of opportunistic mass exploitation.
Privilege escalation in Blueprint Studio (versions prior to 2.5.2) allows any authenticated Home Assistant user to access and invoke administrator-only backend API actions - including arbitrary Home Assistant service calls, configuration file reads and writes, template rendering, file uploads, and terminal helper access - because the Python backend in api.py authenticated requests for valid HA user identity but never verified admin status. The fix in 2.5.2, released 2026-05-26, introduces a consistent `_require_admin()` guard across all GET, POST, stream, upload, and WebSocket handlers. No public exploit or active exploitation has been identified at time of analysis, but the authorization bypass is structurally trivial for any non-admin HA account holder.
Unauthorized data access and manipulation in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 is achievable by a low-privileged, network-based attacker who can induce a user interaction from another party - consistent with a stored injection or cross-session exploitation pattern. Successful exploitation produces a scope change, meaning impact propagates beyond the directly vulnerable component to additional Oracle Commerce subsystems, with both confidentiality and integrity fully compromised. No public exploit code has been identified at time of analysis, and Oracle's August 2026 Critical Patch Update is the designated remediation vehicle.
Oracle Hyperion Data Relationship Management (DRM) 11.2.25.0.000 exposes a high-severity access control flaw that allows a low-privileged, network-authenticated attacker to fully compromise confidentiality and integrity of critical DRM data, with scope change extending impact to additional Oracle Hyperion products. Exploitation requires human interaction from a victim user, consistent with a cross-site or cross-context attack pattern (the 'Authentication Bypass' tag suggests privilege escalation beyond the attacker's initial access tier). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Authentication bypass in Oracle Hyperion Data Relationship Management 11.2.25.0.000 permits a low-privileged, network-adjacent attacker to achieve full confidentiality and integrity compromise of critical master data, with a confirmed scope change that can propagate impact to additional Oracle Hyperion components. Exploitation via HTTP requires a victim to take some form of interactive action, placing this in a phishing or session-hijacking attack pattern. No public exploit code or CISA KEV listing exists at time of analysis, though Oracle has published a Critical Security Patch Update advisory for August 2026 addressing this flaw.
Unauthorized data access and modification in Oracle Customer Care (E-Business Suite versions 12.2.3 through 12.2.15) is achievable by network-authenticated low-privileged attackers through the Internal Operations component via HTTP, with successful exploitation requiring victim interaction and producing a scope change that can compromise additional Oracle E-Business Suite components. The vulnerability carries a CVSS 3.1 score of 8.7, reflecting high confidentiality and integrity impacts with a cross-component blast radius. Oracle's August 2026 Critical Patch Update confirms the issue; no public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Missing authorization enforcement in the Grav API plugin before 1.0.14 allows any authenticated user holding the api.access permission to invoke privileged menubar actions - bypassing per-action authorize field evaluation in MenubarController::executeAction(). The POST /api/v1/menubar/actions/{plugin}/{action} endpoint checks only the baseline api.access gate while the parallel GET listing endpoint correctly calls userPassesAuthorize(), creating an asymmetric enforcement gap (CWE-862). On stock Grav installs the impact is currently latent because no bundled core plugin registers a privileged authorize handler, but any environment deploying third-party plugins that rely on the documented authorize contract is exposed to privilege escalation. No public exploit has been identified at time of analysis and no CISA KEV listing exists.
Unauthorized data access and tampering in Oracle WebCenter Content's Content Server component allows unauthenticated remote attackers to fully read or manipulate all managed content via HTTP. Both supported versions 12.2.1.4.0 and 14.1.2.0.0 are affected, and successful exploitation can cascade beyond the Content Server itself to impact additional Oracle Fusion Middleware products within the same deployment environment. No public exploit has been identified at time of analysis, but the unauthenticated network vector combined with a scope change rating makes this a high-priority item for any organization running this ECM platform.
Oracle WebCenter Content's Content Server component, in versions 12.2.1.4.0 and 14.1.2.0.0, contains an authentication bypass vulnerability reachable over HTTP without credentials, carrying a CVSS 3.1 base score of 8.7. Successful exploitation enables an unauthenticated remote attacker to gain both full read access and full create/delete/modify access to critical content data, with a confirmed scope change meaning downstream Oracle Fusion Middleware components may also be impacted. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the Authentication Bypass tag and high attack complexity signal a non-trivial but realistic threat to unpatched deployments.
Remote authentication bypass in Oracle WebCenter Content's Content Server component allows unauthenticated network attackers to fully compromise confidentiality and integrity of managed content - including unauthorized creation, deletion, and modification of critical data - across both affected release lines 12.2.1.4.0 and 14.1.2.0.0. The CVSS scope-change flag (S:C) indicates successful exploitation can cascade to affect additional Oracle Fusion Middleware products beyond WebCenter Content itself. Attack complexity is rated High (AC:H), meaning specific and difficult-to-reproduce conditions must be met, but no authentication or user interaction is required. No public exploit code or CISA KEV listing has been identified at time of analysis.
Oracle WebCenter Content's Content Server component harbors an authentication bypass exploitable by unauthenticated remote attackers over HTTP, affecting both actively supported versions (12.2.1.4.0 and 14.1.2.0.0) of this Oracle Fusion Middleware product. Successful exploitation grants complete unauthorized read and write access to all content managed by the system, with a confirmed scope change that can extend impact to additional Oracle Fusion Middleware products in the same deployment. No public exploit code or CISA KEV listing has been identified at the time of analysis, but the unauthenticated network vector paired with high confidentiality and integrity impacts makes this a meaningful risk for organizations running exposed affected deployments.
Unauthenticated network exploitation of Oracle WebCenter Content's Content Server component allows a remote attacker to achieve full confidentiality and integrity compromise of all accessible content data, with a scope change that can significantly impact additional Oracle Fusion Middleware products in the same environment. Affected versions are 12.2.1.4.0 and 14.1.2.0.0, addressed in Oracle's Critical Patch Update of August 2026. No public exploit code or CISA KEV listing has been identified at time of analysis, though the Authentication Bypass tag and PR:N vector confirm no credentials are required to initiate an attack. The AC:H rating indicates exploitation is non-trivial and requires meeting specific, undisclosed conditions.
Arbitrary file read in ArcadeDB before version 26.8.1 allows authenticated users holding trigger creation privileges to escape the GraalVM JavaScript sandbox and read any file accessible to the ArcadeDB server process on the underlying host. The sandbox allowlist enforces package name restrictions via unescaped regular expressions, which an attacker can craft to match unintended Java class names and instantiate ZipFile or JarFile to open arbitrary filesystem paths. No public exploit has been identified at time of analysis; however, the vendor-confirmed patch to 26.8.1 should be applied promptly given the high confidentiality impact and the sensitivity of files typically reachable by a database server process.
Stored cross-site scripting in MyBB before 1.8.40 allows any registered forum member to inject persistent JavaScript into checkbox and multiselect profile fields by submitting a scalar string value instead of the expected array shape, bypassing type-specific sanitization in UserDataHandler::verify_profile_fields(). The unsanitized payload is written to the database and rendered verbatim in member.php and inc/functions_post.php when other users view the attacker's profile or posts displaying profile fields. With a Changed scope (S:C) and high confidentiality and integrity impact, successful exploitation against an administrator enables full session hijacking and privileged action takeover; no active exploitation or public POC has been identified at time of analysis.
Publish-mode endpoint misconfiguration in SiYuan before v3.7.4 exposes operator-forbidden documents to anonymous remote visitors. Eight reader-facing API endpoints - covering search, backlinks, asset content, saved criteria, recent documents, graph, and tags - incorrectly apply the visibility access-control list rather than the disabled list, bypassing the intended publication restriction. Unauthenticated attackers can enumerate and read content that the SiYuan operator has explicitly marked as forbidden from publishing; no public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Stored cross-site scripting in MyBB's Buddy/Ignore component prior to version 1.8.40 allows authenticated attackers to inject arbitrary JavaScript by registering usernames that survive the `htmlspecialchars_uni()` sanitization pass with unescaped single quotes intact. The payload fires in the victim's browser during two specific user interactions: clicking 'Yes' in the removal confirmation dialog within usercp.php, or selecting the crafted username via the onclick handler in the xmlhttp.php Private Messages Select Buddies popup. With a CVSS 8.7 rating reflecting a scope change (C:H, I:H), successful exploitation can yield full session hijacking or unauthorized actions on behalf of the victim. No public exploit has been identified at time of analysis.
High-severity data compromise in Oracle Identity Manager Connector (versions 12.2.1.4.0 and 14.1.2.1.0) allows a network-authenticated, high-privileged attacker to fully read and modify critical identity connector data, with confirmed scope change enabling impact on additional downstream products. The vulnerability is tagged 'Authentication Bypass', suggesting the flaw undermines access control enforcement within the Connector Server component despite requiring elevated initial credentials, resulting in a CVSS 3.1 base score of 8.7. No public exploit code or CISA KEV listing has been identified at time of analysis.
Authentication bypass in Oracle Siebel CRM Integration (Open Integration component, versions 25.12-26.6) allows a remote unauthenticated attacker reachable over HTTP to gain unauthorized read and write access to critical CRM data, with a confirmed scope change meaning successful exploitation can cascade to impact additional integrated systems beyond Siebel itself. The AC:H rating indicates exploitation is difficult and likely requires meeting specific environmental or timing conditions, tempering the urgency implied by the 8.7 CVSS score. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Authentication bypass in Oracle Hyperion Data Relationship Management 11.2.25.0.000 exposes the Access and Security component to unauthenticated remote attackers over HTTP, enabling full read and write access to critical master data hierarchies. The CVSS 3.1 score of 8.7 reflects a scope change (S:C), meaning successful exploitation can cascade to additional Oracle Hyperion EPM products beyond the initial target system. No public exploit code or CISA KEV listing has been identified at time of analysis, but the combination of zero authentication requirement and cross-component impact warrants prompt remediation.
Authentication bypass in Oracle WebCenter Portal's Runtime Tools component allows unauthenticated remote attackers to compromise confidentiality and integrity of critical portal data across affected versions 12.2.1.4.0 and 14.1.2.0.0. The vulnerability carries a CVSS 3.1 score of 8.7 with scope change (S:C), meaning successful exploitation can cascade beyond WebCenter Portal to impact additional products within the Oracle Fusion Middleware stack. No public exploit code has been identified at time of analysis, and high attack complexity (AC:H) limits opportunistic exploitation, though the authentication bypass nature and scope change elevate priority for Oracle-heavy environments.
Authentication bypass in TP-Link Tapo C200 v5 IP cameras running firmware below V5_1.4.6 Build 260709 Rel.27675n allows unauthenticated adjacent-network attackers to manipulate challenge parameters during the login handshake, circumventing the authentication verification module and obtaining valid administrative session tokens. With those tokens, an attacker can execute privileged management operations - including reconfiguring the camera, accessing live or recorded footage, and deliberately disrupting device services to cause a denial-of-service condition. No public exploit identified at time of analysis, and the adjacent-network requirement (AV:A) constrains exposure to attackers already present on the same LAN or Wi-Fi segment.
Excessive ClusterRole permissions on the managed-serviceaccount addon-manager pod in Red Hat Advanced Cluster Management for Kubernetes 2 allow a compromised addon-manager to read secrets across every namespace and approve arbitrary Certificate Signing Requests, resulting in cluster-wide information disclosure and privilege escalation. The CVSS scope-change (S:C) reflects that a single compromised pod can affect the entire Kubernetes cluster, not just the addon namespace. No public exploit code or active exploitation via CISA KEV has been confirmed at time of analysis.
Stored cross-site scripting in Kestra's custom Markdown renderer (versions before 1.3.24) allows any authenticated user with Flow create or edit permissions to inject arbitrary JavaScript event-handler attributes via the platform's own [[link]] syntax, executing attacker-controlled code in the browser of any user who views the affected Flow description. The CVSS scope change (S:C) reflects that the payload crosses from the attacker's permission context into the victim's browser session, enabling session hijacking or privilege escalation against higher-privileged reviewers. A working proof-of-concept is publicly confirmed in GHSA-34pm-923j-7wf8; no active exploitation via CISA KEV is listed at time of analysis.
Path traversal on Windows-hosted DataEase instances allows unauthenticated remote attackers to read arbitrary files from the server filesystem by exploiting a filter bypass unique to the Windows backslash path separator. All DataEase versions prior to 2.10.23 on Windows are affected; the root cause is that string truncation logic blocks only the forward-slash but not the backslash, which Windows treats as an equivalent directory separator. No public exploit has been identified at time of analysis, but the vendor-confirmed CVSS 4.0 score of 8.7 with a network-accessible, no-privileges vector warrants immediate patching on any Windows deployment.
Unauthenticated network exploitation of the Data Archival component in Oracle Siebel CRM Administration exposes complete CRM data to unauthorized access over HTTP. Affecting versions 25.12 through 26.6, the vulnerability carries a CVSS 3.1 score of 8.6 with a confirmed scope change, meaning successful exploitation can cascade to impact additional Oracle or integrated enterprise products beyond the Siebel CRM Administration interface itself. No public exploit or CISA KEV listing has been identified at time of analysis, but the zero-authentication, low-complexity attack surface makes this a high-priority patching target for any organization with internet-exposed Siebel administrative interfaces.
Unauthenticated remote data disclosure in Oracle WebLogic Server Core allows network-accessible attackers to exfiltrate all data reachable by the server via the T3 or IIOP protocols, with confirmed scope change impact on additional downstream systems. Tagged as an Authentication Bypass by Oracle, this affects four active release lines - 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 - making it a broad exposure across the WebLogic installed base. No public exploit identified at time of analysis, and remediation is available through Oracle's Critical Patch Update (CPU) August 2026.
Unauthenticated remote exploitation of Oracle Hyperion Profitability and Cost Management 11.2.25.0.000 allows network attackers to gain complete read access to all application-managed financial data via HTTP, with no credentials or user interaction required. The vulnerability resides in the Deployment component and carries a CVSS scope change, meaning successful exploitation may expose data from additional interconnected Oracle Hyperion products sharing the same infrastructure. No public exploit code or active exploitation has been confirmed, but the CVSS:3.1 AV:N/AC:L/PR:N/UI:N profile makes this trivially repeatable once an attacker identifies the vulnerable endpoint.
Authentication bypass in Oracle Reports Developer 12.2.1.19.0 exposes critical data to unauthenticated remote attackers over TCP, with a scope change confirmed by the vendor meaning downstream Oracle Fusion Middleware components can also be compromised. The CVSS 3.1 score of 8.6 reflects a network-accessible, zero-interaction attack path yielding high confidentiality impact across system boundaries. No public exploit code has been identified at time of analysis, though the vendor's own 'easily exploitable' classification substantially lowers the operational barrier for threat actors.
Unauthenticated remote data exposure in Oracle Trading Community (Oracle E-Business Suite) versions 12.2.3 through 12.2.15 allows a network attacker to bypass authentication in the Third Party Data Integration component via HTTP, gaining complete read access to all data accessible by Oracle Trading Community. The scope change (S:C) means a successful attack can cascade into other EBS modules or integrated downstream systems. Oracle's own advisory classifies this as 'easily exploitable,' and no public exploit or CISA KEV listing has been identified at time of analysis, though the low attack complexity and zero-authentication requirement make it a high-priority patching target.
OS command injection in Blueprint Studio before 2.5.2 allows authenticated Home Assistant users to execute arbitrary shell commands with Home Assistant's OS-level privileges by embedding newline characters or shell metacharacters into configured Git credential values. The vulnerable code in git_manager.py interpolated raw username and token values directly into generated shell credential helper scripts without any sanitization or validation. The fix, released in version 2.5.2 on 2026-05-26, adds input validation rejecting credentials containing newlines or null bytes and simultaneously restricts the entire Blueprint Studio backend API to admin-only users - no public exploit has been identified at time of analysis.
Device trust bypass in authentik enterprise Google Chrome stages allows an authenticated attacker to skip Google Verified Access API attestation and complete authentication from an unverified device. Enterprise deployments using either the Google Chrome Endpoint stage with mode=REQUIRED or the deprecated Google Chrome Device Trust Connector (GDTC) stage are affected in all supported versions prior to 2026.2.6 and 2026.5.5. No public exploit is identified at time of analysis, but the bypass requires only that the attacker submit the stage form without triggering the verification iframe - a trivially reproducible action for any credential holder.
Unauthenticated remote exploitation of Oracle Reports Developer 14.1.2.0.0 via the SOAP interface allows attackers to read all data accessible to the application, perform partial data modification, and cause partial service disruption without credentials or user interaction. The vulnerability resides in the Security and Authentication component of Oracle Fusion Middleware, meaning authentication enforcement over the SOAP protocol can be bypassed entirely. No active exploitation has been confirmed at time of analysis, but the network-accessible, zero-authentication attack vector makes this a high-priority patching target for any organization with this product exposed beyond strictly controlled network segments.
Unauthenticated remote compromise of Oracle Reports Developer 12.2.1.19.0 is achievable via crafted SOAP requests targeting the Security and Authentication component, confirming an authentication bypass condition. The CVSS 3.1 vector (PR:N, AV:N, AC:L) indicates no credentials or user interaction are required, and the high confidentiality impact reflects full data exposure across all data accessible to the Reports Developer service. Additionally, limited integrity and availability degradation are possible, making this a high-priority patch candidate for any Oracle Fusion Middleware deployment running this version. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated remote exploitation of Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 allows network-accessible attackers to achieve complete read access to all application-accessible data, perform limited unauthorized data modification, and cause partial denial of service - all via HTTP with no credentials or user interaction required. The 'Authentication Bypass' tag in multi-source intelligence corroborates the PR:N CVSS metric, indicating the flaw circumvents access controls prior to any authentication gate. No CISA KEV listing or public proof-of-concept has been identified at time of analysis, though the low attack complexity (AC:L) makes opportunistic exploitation feasible once technical details circulate.
Unauthenticated remote exploitation of Oracle Helidon 3.2.20's Imperative Web Server component enables attackers to perform unauthorized creation, deletion, or modification of critical data via HTTP with no prerequisites. The vulnerability carries a scope change (S:C in CVSS), meaning successful exploitation can cascade to impact additional products or systems beyond Helidon itself. Tagged as an authentication bypass, this is classified by Oracle as easily exploitable with no public exploit identified at time of analysis.
Unauthenticated remote data exposure in Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 allows network-based attackers to access critical or all portal-accessible data via HTTP with no privileges or user interaction required. Tagged as an Authentication Bypass in the Oracle CPUAUG2026 advisory, the vulnerability carries a changed scope, meaning successful exploitation can cascade to impact additional Oracle Fusion Middleware products integrated with the portal. No public exploit has been identified at time of analysis, and remediation is available through Oracle's Critical Security Patch Update for August 2026.
Unauthenticated remote information disclosure in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 allows network attackers to retrieve critical data or gain complete read access to all data accessible through the Endeca Application Controller via HTTP. The CVSS vector confirms a zero-complexity, no-privilege, no-interaction attack path with scope change, meaning successful exploitation cascades beyond the directly targeted component to affect additional Oracle Commerce products. No public exploit code or CISA KEV listing exists at time of analysis, though the authentication bypass classification and high-severity confidentiality impact make this a material risk for any internet-exposed deployment.
Unauthenticated remote exploitation of Oracle Reports Developer 12.2.1.19.0 exposes all data accessible to the application via HTTP, with confirmed scope change that can impact additional downstream products within the Oracle Fusion Middleware environment. The vulnerability resides in the Security and Authentication component and is tagged as an authentication bypass, meaning attackers require no credentials to exploit it. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-privilege requirement make this straightforward to exploit once a target instance is reachable.
Unauthenticated network exploitation of Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 allows remote attackers to obtain complete unauthorized access to critical data, with confirmed scope change affecting additional Oracle Hyperion products beyond the directly targeted component. The vulnerability resides in the Installation and Configuration component, is tagged as an Authentication Bypass, and is accessible via multiple network protocols with no complexity barrier. No public exploit or CISA KEV listing has been identified at time of analysis, though the CVSS 3.1 base score of 8.6 reflects the elevated risk from scope change and high confidentiality impact. The Oracle August 2026 CSPU advisory (EUVD-2026-61533) is the primary disclosure source.
Unauthenticated remote compromise of Oracle WebCenter Portal's Runtime Tools component exposes critical data through an authentication bypass vulnerability patched in Oracle's August 2026 Critical Patch Update. Affected versions 12.2.1.4.0 and 14.1.2.0.0 allow any network-accessible attacker to gain complete read access to all data handled by the portal - and, due to a confirmed scope change, potentially reach data in additional connected Oracle Fusion Middleware products. No public exploit or KEV listing is confirmed at time of analysis, but the absence of authentication requirements and low attack complexity make this a high-priority remediation target.
Unauthenticated remote exploitation of Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 via HTTP allows an attacker to create, delete, or modify critical platform-managed data through the Event Management component, with secondary impacts on confidentiality and service availability. The Oracle-published CVSS 8.6 score reflects a low-complexity, no-privilege-required attack path, making this accessible to non-sophisticated threat actors with network access. No public exploit code has been identified at time of analysis, and this vulnerability has not been added to the CISA KEV catalog.
Server-side template injection in grav-plugin-api before 1.0.15 enables remote code execution for any attacker holding api.pages.write permission. The translate() endpoint accepts unsanitized Twig template syntax in header and content parameters, which can be persisted to a page with process.twig enabled and evaluated by the Twig engine at render time. No public exploit or CISA KEV listing has been identified at time of analysis, but the combination of network-reachable exploitation path and high confidentiality and integrity impact from full server-side template evaluation makes this a serious risk for any Grav installation exposing the plugin API to lower-trust users.
Unauthenticated network exploitation of Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 allows remote attackers to compromise confidentiality, integrity, and availability via HTTP without requiring any credentials or user interaction. Oracle's own advisory characterizes this as 'easily exploitable,' and the Authentication Bypass tag corroborates the PR:N CVSS metric, indicating the flaw circumvents access controls entirely. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-prerequisite nature make this a high-priority patching target for any organization running the affected Fusion Middleware component.
Open redirect in the Grav API plugin (grav-plugin-api) before 1.0.14, bundled with Grav 2.0's admin-next/API stack, allows post-login phishing via a backslash normalization bypass in SsoController::sanitizeReturnTo(). An attacker who can send a crafted OAuth login URL to an authenticated admin victim can supply a returnTo value such as '/\evil.com' that passes the guard rejecting '//' prefixes but is silently normalized by the browser into the protocol-relative URL '//evil.com', redirecting the victim to an attacker-controlled site immediately after a legitimate login. No public exploit has been identified at time of analysis, though the backslash-normalization technique is a well-documented browser behavior; the vendor advisory references a fix in version 1.0.14.