Authentication bypass in Bastillion (bastillion-io/bastillion, all versions prior to the fix commit) lets unauthenticated remote attackers reach administrative controllers by prefixing request URIs with arbitrary path segments that the AuthFilter fails to normalize. Because the servlet-based access-management console governs SSH access to an entire managed fleet, an attacker can enumerate users, create manager accounts, and register systems, effectively seizing control of privileged SSH access. VulnCheck reported the issue and a vendor fix commit exists; no public exploit has been identified at time of analysis.
Authentication bypass in the GBIF Integrated Publishing Toolkit (IPT) before version 3.3.4 lets remote attackers gain full administrative control by reaching initial-setup functionality that is never disabled after installation completes. Because the setup workflow - meant to run once on a fresh, unconfigured instance - stays reachable on production servers, an attacker can re-drive it to seize the admin role. Reported by Mandiant (MNDT-2026-0014); no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Broken authentication in the Popup by Supsystic WordPress plugin (versions <= 1.13.0) lets remote unauthenticated attackers bypass authentication controls to tamper with plugin state, per the CVSS 3.1 vector (I:H/A:H). Reported by Patchstack with a CVSS base score of 9.1; no public exploit is identified at time of analysis and it is not listed in CISA KEV. Note the vendor tag labels it 'Information Disclosure' even though the CVSS vector sets C:N, a discrepancy defenders should verify.
Unauthenticated data compromise and denial of service in Oracle WebCenter Portal (Fusion Middleware, Portlet Services component) affects supported versions 12.2.1.4.0 and 14.1.2.0.0. A remote attacker with only HTTP network access and no credentials can read or fully access all portal-accessible data and can force a hang or repeatable crash (complete DoS) of the portal. Oracle rates it CVSS 3.1 9.1 and flags it as easily exploitable; no public exploit has been identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated remote compromise of Oracle Siebel CRM's Siebel Apps - Marketing component (versions 17.0 through 26.6) allows a network attacker over HTTP to read all Marketing-accessible data and to force a complete, repeatable denial of service. The flaw is rated CVSS 3.1 9.1 and is tagged as an authentication bypass, meaning no credentials are required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the combination of no authentication, low attack complexity, and high confidentiality/availability impact makes it a high-priority patch.
Authentication bypass in the GBIF Integrated Publishing Toolkit (IPT) before version 3.3.4 lets a remote attacker reach the initial-setup functionality, which stays unauthenticated and exposed until the server's first reboot, and abuse it to seize administrative control of the instance. The flaw was reported by Mandiant, a vendor patch (3.3.4) is available, and there is no public exploit identified at time of analysis. Rated CVSS 4.0 9.1 (Critical), exploitation is gated by a timing/deployment window rather than by raw network reach.
Unauthorized data manipulation and full denial of service in Oracle Hyperion Financial Management 11.2.25.0.000 (Security component) allow a remote, unauthenticated attacker to reach the application over HTTP and create, modify, or delete critical data as well as trigger a complete, repeatable crash. Oracle rates this CVSS 9.1 (I:H/A:H, no confidentiality impact), reflecting an easily exploitable network-facing flaw. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector makes it a high-priority patch item.
Full takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is possible when an attacker who already holds high application privileges sends crafted requests over the network via HTTPS to the Access and security component. Because the flaw carries a scope change, successful exploitation can significantly impact additional products beyond DRM itself, yielding complete loss of confidentiality, integrity, and availability (CVSS 3.1 9.1). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote tampering and denial-of-service in Oracle Database Server's Portable Clusterware component lets an unauthenticated attacker reach the service over HTTP and manipulate or destroy critical cluster data, or force a complete, repeatable crash. Affected releases span 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3, carrying a CVSS 3.1 base score of 9.1 driven purely by high Integrity and Availability impact (confidentiality is untouched). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability (network, low complexity, no privileges, no user interaction) makes it a high-priority patch item.
Unauthenticated data tampering and denial of service in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Content Acquisition System component) lets a remote attacker over HTTP create, modify, or delete all application-accessible data and force a complete, repeatable crash of the service. Oracle rates it CVSS 3.1 9.1 with High Integrity and High Availability impact and no confidentiality impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the low attack complexity (AC:L) and lack of authentication make it a high-priority patch despite no confirmed exploitation.
Unauthenticated data tampering and denial of service in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 (Content Acquisition System component) lets a remote attacker over HTTP create, delete, or modify critical data and force a complete, repeatable crash of the platform. Rated CVSS 3.1 9.1 with no authentication or user interaction required, it affects the Endeca-derived search and merchandising layer of Oracle's commerce stack. No public exploit identified at time of analysis, and it is not listed in CISA KEV; confidentiality is explicitly unaffected (C:N), so the danger is integrity and availability rather than data theft.
Data tampering and complete denial of service in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Content Acquisition System component) allow a remote, unauthenticated attacker with HTTP access to create, delete, or modify critical data and to hang or repeatedly crash the service. The CVSS 3.1 base score is 9.1 driven by high integrity and availability impact with no confidentiality loss, and the flaw is rated easily exploitable by Oracle. No public exploit was identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided.
Unauthenticated data tampering and denial-of-service in Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication component) lets a remote attacker over HTTP create, delete, or modify all Reports Developer-accessible data and trigger a complete, repeatable crash. The flaw carries a CVSS 3.1 base score of 9.1 with high integrity and availability impact but no confidentiality impact, and was disclosed in Oracle's August 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated data tampering and denial of service in Oracle Hospitality Simphony POS (versions 19.8-19.8.5, 19.9-19.9.3, 19.10-19.10.1) lets a remote attacker with only HTTP network access create, delete, or modify all Simphony-accessible data and force a repeatable crash. Oracle rates it CVSS 3.1 9.1 with high integrity and availability impact and describes it as easily exploitable, though there is no public exploit identified at time of analysis. It was reported by Oracle's own security team and fixed in the August 2026 Critical Patch Update.
Unauthorized data compromise in Oracle Web Services Manager (OWSM), part of Oracle Fusion Middleware's Web Services Security component, lets a remote unauthenticated attacker read, create, delete, or modify all OWSM-accessible data over HTTP. Tagged as an authentication bypass, it affects versions 12.2.1.4.0 and 14.1.2.0.0 and carries a CVSS 3.1 base score of 9.1 (high confidentiality and integrity impact, no availability impact). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated compromise of Oracle Helidon 4.5.0 lets a remote attacker over HTTP read, create, modify, or delete all data accessible to the Helidon application via a flaw in the Imperative Web Server component. Oracle rates it CVSS 9.1 (high confidentiality and integrity impact, no availability impact), and the vendor tag 'Authentication Bypass' indicates protected routes/resources can be reached without credentials. No public exploit identified at time of analysis; addressed in the Oracle Critical Patch Update of August 2026.
Unauthenticated remote compromise of Oracle Helidon 3.2.18 (Imperative Web Server component) allows a network attacker to read, create, modify, or delete all data accessible to the framework over HTTP. Tagged by Oracle as an authentication bypass, it carries a CVSS 3.1 base score of 9.1 with high confidentiality and integrity impact and no availability impact. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but Oracle rates it as easily exploitable, warranting prompt patching.
Unauthenticated data compromise in Oracle Helidon 4.5.0 (Imperative Web Server component of Oracle Fusion Middleware) lets a remote attacker reach and manipulate all data accessible to the framework over HTTP. Tagged as an authentication bypass, it carries a CVSS 9.1 with high confidentiality and integrity impact but no availability impact. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Authentication bypass in Oracle Commerce Guided Search / Experience Manager 11.4.0 lets a remote, unauthenticated attacker reach the Endeca Application Controller component over HTTP and read or tamper with all data accessible to the application. Rated CVSS 3.1 9.1 (C:H/I:H, no availability impact), it is trivially exploitable with no user interaction. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and unauthenticated network vector make it a high-priority patch.
Unauthorized data access and manipulation in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Endeca Application Controller component) lets a remote, unauthenticated attacker read, create, delete, or modify all data accessible to the product over HTTP. The Oracle advisory and 'Authentication Bypass' tag indicate the flaw sidesteps authentication entirely, and Oracle rates it 'easily exploitable' with CVSS 9.1 (high confidentiality and integrity impact, no availability impact). No public exploit has been identified at time of analysis, but the low attack complexity and network reachability make it a strong patching priority.
Unauthenticated data compromise in Oracle Commerce Guided Search / Experience Manager 11.4.0 (the legacy Endeca-derived Content Acquisition System) lets a remote attacker read, create, modify, or delete all data accessible to the product over HTTP. The Oracle-supplied CVSS 3.1 base score is 9.1 (C:H/I:H, no availability impact), and the intelligence tag 'Authentication Bypass' aligns with the PR:N/UI:N vector. No public exploit code has been identified and it is not on CISA KEV, but the trivial exploitability (AC:L, no auth, no user interaction) makes it a high-priority patching target.
Unauthenticated data compromise in Oracle Hyperion Data Relationship Management 11.2.25.0.000 allows a remote attacker to read, create, delete, or modify all data accessible to the application via its SOAP interface. The flaw sits in the Access and security component and is tagged as an authentication bypass, meaning an attacker needs no credentials to reach critical master-data records. No public exploit identified at time of analysis, but the CVSS 9.1 rating and unauthenticated network vector make this a high-priority patch.
Remote unauthenticated compromise of Oracle Hyperion Financial Reporting 11.2.25.0.000 (Server component) allows an attacker with network access via the Java RMI interface to read, create, modify, or delete all data accessible to the application. Carrying a CVSS 3.1 base score of 9.1 and tagged as an authentication bypass, the flaw yields full confidentiality and integrity compromise without any credentials or user interaction, though it does not affect availability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated data compromise in Oracle Hyperion Profitability and Cost Management 11.2.25.0.000 (Deployment component) lets a remote attacker over HTTP read, create, modify, or delete all data accessible to the application. Tagged as an authentication bypass and rated CVSS 3.1 9.1, it was reported by Oracle and addressed in the August 2026 Critical Patch Update; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full read/write compromise of Oracle WebCenter Sites is possible by remote, unauthenticated attackers over HTTP against versions 12.2.1.4.0 and 14.1.2.0.0. Oracle rates the flaw CVSS 9.1 and describes it as easily exploitable, granting an attacker unauthorized creation, deletion, and modification of critical data plus full read access to all WebCenter Sites accessible data, though availability is unaffected. It is tagged as an authentication bypass; no public exploit has been identified at time of analysis and it is not listed in CISA KEV.
Arbitrary file write via directory traversal in Reportico (reportico-web) through version 8.1.0 lets remote attackers create or overwrite files anywhere the web server user can write, by supplying a crafted path in the 'saveTemplate' parameter together with 'execute_mode=PREPARE' on the run.php endpoint. Because writes can land inside the web root, this is a realistic path to remote code execution (e.g., dropping a PHP web shell). No CISA KEV listing and a low EPSS score (0.37%) indicate no confirmed active exploitation yet, though a third-party vulnerability-research repository is referenced and the flaw is unauthenticated and low-complexity.
Unauthenticated data compromise and denial of service in Oracle Commerce Guided Search / Experience Manager 11.4.0 lets a remote attacker read all data accessible to the Experience Manager component and force a repeatable crash or hang. The flaw is tagged as an authentication bypass, carries a CVSS 3.1 base score of 9.1, and is reachable over HTTP with no credentials or user interaction. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated remote compromise of Oracle Commerce Guided Search / Experience Manager 11.4.0 (Endeca Application Controller) lets a network attacker read all data accessible to the product and force a complete, repeatable denial of service over HTTP. Oracle rates it CVSS 3.1 9.1 and flags it as easily exploitable with no authentication or user interaction. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the low attack complexity and unauthenticated vector make it a high-priority patch.
Full takeover of Oracle WebCenter Sites (versions 12.2.1.4.0 and 14.1.2.0.0) is possible by a high-privileged, network-based attacker over HTTP, with a scope change that lets impact spill into other Oracle Fusion Middleware components. The flaw yields complete loss of confidentiality, integrity, and availability (CVSS 3.1 9.1) and was addressed in Oracle's August 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthorized data compromise in Oracle Hyperion Data Relationship Management 11.2.25.0.000 (Access and security component) lets a remote, unauthenticated attacker read, create, delete, or modify any DRM-accessible data over HTTP. The vendor tags this as an authentication bypass, and its CVSS 3.1 score of 9.1 reflects complete confidentiality and integrity loss with no availability impact. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but the low attack complexity and no-privileges vector make it a high-priority patching target.
Unauthenticated remote compromise of Oracle Hyperion Data Relationship Management 11.2.25.0.000 (Access and security component) allows network attackers to read, create, modify, or delete all data accessible to the application over HTTP without any credentials. Oracle rates it CVSS 3.1 9.1 and tags it as an authentication bypass, meaning an attacker who can reach the web interface gains full confidentiality and integrity impact over master-data governance records. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and lack of authentication make it a high-priority patch.
Unauthenticated remote compromise of Oracle Application Testing Suite 13.3.0.1 allows a network attacker to read, create, modify, or delete all data accessible to the application over HTTP with no credentials or user interaction. Rated CVSS 3.1 9.1 with high confidentiality and integrity impact (no availability impact), and tagged as an authentication bypass, this is a pre-auth flaw fixed in Oracle's August 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Data tampering and complete denial-of-service in Oracle Commerce Guided Search / Experience Manager 11.4.0 lets a remote unauthenticated attacker reach the Content Acquisition System over HTTP to create, delete, or modify all accessible data and to force a persistent hang or repeatable crash. Rated CVSS 3.1 9.1 (Integrity and Availability high, Confidentiality none), it is easily exploitable per Oracle with no privileges or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated data tampering and denial-of-service in Oracle Commerce Guided Search / Experience Manager 11.4.0 lets a remote attacker manipulate the Content Acquisition System over HTTP to create, delete, or modify all accessible application data and to force a complete, repeatable crash or hang. The flaw carries a CVSS 3.1 base score of 9.1 driven by High Integrity and High Availability impact with no privileges or user interaction required, and was disclosed via Oracle's August 2026 Critical Patch Update. There is no public exploit identified at time of analysis.
Uncontrolled decompression in Malcolm's upload-processing pipeline allows any authenticated user with upload permissions to exhaust the shared Docker volume by submitting a single-stream compression bomb (.gz, .bz2, .xz, .lzma, .lz). The flaw in scripts/safe-extract.py is a logic gap: entry-count, nesting-depth, and total-uncompressed-byte guards exist for container formats (zip/tar/rar/7z via libarchive) but are entirely absent for single-stream formats, allowing unbounded expansion. Successful exploitation denies service to all platform users simultaneously by starving OpenSearch, Logstash, Arkime, and Zeek of shared disk. No public exploit or CISA KEV listing has been identified at time of analysis; however, the attack is conceptually trivial once the bypass is known.
Authentication bypass in Oracle Helidon 1.4.19 (Imperative Web Server component of Oracle Fusion Middleware) lets a remote, unauthenticated attacker reach and manipulate protected data over HTTP, yielding full read and write access to all data the Helidon instance can reach. Oracle rates it CVSS 9.1 with High confidentiality and integrity impact and no availability impact, and describes it as easily exploitable. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated data compromise in Oracle Helidon 1.4.19 (Imperative Web Server component) lets a remote attacker send crafted HTTP requests to read, create, modify, or delete all Helidon-accessible data. Oracle rates it CVSS 3.1 9.1 (high confidentiality and integrity impact, no availability impact) and classifies it as an authentication-bypass-class flaw. No public exploit identified at time of analysis, but the low attack complexity and no-authentication requirement make it a high-priority patch item once Oracle's fix is applied.
Authentication bypass in Oracle Helidon 3.2.18 (Imperative Web Server component of Oracle Fusion Middleware) lets an unauthenticated remote attacker send crafted HTTP requests to read, create, modify, or delete any data the application can access. Rated CVSS 9.1 with high confidentiality and integrity impact but no availability impact, it is trivially exploitable over the network with no user interaction. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated data compromise in Oracle Commerce Guided Search / Experience Manager 11.4.0 lets a remote attacker read and modify all data accessible to the application over HTTP without any credentials. Tagged as an authentication bypass, the flaw yields high confidentiality and integrity impact (CVSS 9.1) but no availability impact. No public exploit identified at time of analysis, and it is not listed in CISA KEV; disclosure comes via Oracle's August 2026 Critical Patch Update.
Unauthorized data read and write against Oracle Commerce Guided Search / Experience Manager 11.4.0 is possible via its Endeca Application Controller, which a remote unauthenticated attacker can reach over HTTP. The flaw, disclosed by Oracle and tagged as an authentication bypass, yields high confidentiality and integrity impact (CVSS 9.1) but no availability impact, meaning an attacker can create, delete, or modify critical Endeca data or read all accessible data without any credentials. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and lack of authentication make it a strong patching priority.
Remote unauthenticated compromise of Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication component) is possible over the network via SOAP, letting an attacker read, create, delete, or modify all data accessible to the product. Rated CVSS 3.1 9.1 with high confidentiality and integrity impact and no availability impact, and flagged as an authentication-bypass class issue, it was addressed in Oracle's August 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authentication bypass in Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware, Security and Authentication component) lets a remote, unauthenticated attacker reach and manipulate the reporting service over HTTP, gaining read access to all data the product can reach and the ability to create, delete, or modify that data. Rated CVSS 3.1 9.1 (Critical) with high confidentiality and integrity impact but no availability impact, it was disclosed in Oracle's August 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV.
TLS/VAU man-in-the-middle in fbeta GmbH's ePA 3.x Integration (ePA3-Service-OpenSource) before 1.3.0 lets an on-path attacker impersonate the VAU server for Germany's electronic patient record (ePA). Because app/vau/VAUProtokoll.py validates the signed_vau_server_pub_keys and AUT_VAU_CertData chain against attacker-suppliable material (a circular trust relationship) and TLS certificate verification is additionally disabled, an attacker between the DiGA backend and the ePA system can negotiate the session keys and read or alter all encrypted VAU traffic, including Medical Information Objects. CVSS 9.1; no public exploit identified at time of analysis, though the upstream fix commit and PR are public.
TLS certificate validation is completely bypassed in the RabbitMQ Java client library (`com.rabbitmq:amqp-client`) prior to version 5.33.0 when applications call `ConnectionFactory.useSslProtocol()` or `useSslProtocol(String)`, because these methods silently install `TrustEverythingTrustManager` and leave hostname verification disabled. A network-positioned attacker can present any certificate - including self-signed or null-chain - to impersonate the RabbitMQ broker and decrypt or modify all AMQP traffic, including plaintext credentials transmitted via PLAIN SASL on default port 5672. A verified proof-of-concept is publicly available in GHSA-5m9f-rphj-c435; no confirmed active exploitation (CISA KEV) has been recorded at time of analysis.
Protection-mechanism bypass in the Storage: Cache API of Mozilla Firefox lets remote web content defeat a built-in security mitigation, exposing sensitive data and allowing unauthorized modification (CVSS 9.1, C:H/I:H). All Firefox builds prior to Firefox 154, ESR 140.14, and ESR 153.1 are affected. Reported by Mozilla with no public exploit identified at time of analysis; EPSS is low at 0.16% (6th percentile).
Cross-origin information disclosure in Mozilla Firefox's CSS Parsing and Computation component allows a malicious web page to bypass site isolation and read data it should not have access to, affecting Firefox before 154 and Firefox ESR before 153.1. The flaw is remotely reachable over the network with no privileges required per the supplied CVSS vector, though realistic exploitation hinges on a victim loading attacker-controlled web content. There is no public exploit identified at time of analysis, and EPSS is very low (0.15%, 5th percentile), indicating no observed weaponization.
Information disclosure via a side-channel in Mozilla Firefox's Web Audio component allows remote, unauthenticated attackers to infer sensitive data that should be isolated between origins by measuring observable timing or behavioral discrepancies. The flaw affects Firefox before 154 and Firefox ESR before 153.1 and is fixed in those releases; no public exploit has been identified and EPSS is low (0.14%, 4th percentile), indicating no evidence of active exploitation.
Cache poisoning in Uber Kraken, an open-source peer-to-peer Docker registry, allows malicious peers or on-path attackers to inject attacker-chosen container image layers and manifests into the content-addressable cache. Because agents validate downloaded pieces only with CRC32 checksums - which are trivially forgeable - and never confirm the reassembled blob against its requested SHA-256 digest before commit, substituted content is accepted, re-seeded to the swarm, and executed by other hosts, yielding fleet-wide integrity compromise and downstream code execution. No public exploit identified at time of analysis; the issue is tracked in vendor GitHub issue #638 and a VulnCheck advisory, with a CVSS 4.0 base score of 9.1.
Same-origin policy enforcement in Firefox's DOM Service Workers component can be bypassed, allowing a malicious web page to access resources, responses, or cached content belonging to another origin. The flaw affects Firefox before version 154 and Firefox ESR before 153.1, and carries a CVSS 3.1 base score of 9.1 (high confidentiality and integrity impact, no availability impact). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the network, no-authentication, no-interaction vector makes it attractive for drive-by attacks.
Protection-mechanism bypass in the Firefox JavaScript engine's garbage collector (JavaScript: GC) undermines a built-in exploit mitigation, weakening a defense that normally hinders memory-corruption exploitation. The flaw affects Mozilla Firefox and Firefox ESR and was addressed by the vendor in Firefox 154 and Firefox ESR 153.1. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was reported internally by Mozilla.