Authentication bypass in Oracle Helidon 1.4.19 (Imperative Web Server component of Oracle Fusion Middleware) lets a remote, unauthenticated attacker reach and manipulate protected data over HTTP, yielding full read and write access to all data the Helidon instance can reach. Oracle rates it CVSS 9.1 with High confidentiality and integrity impact and no availability impact, and describes it as easily exploitable. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated data compromise in Oracle Helidon 1.4.19 (Imperative Web Server component) lets a remote attacker send crafted HTTP requests to read, create, modify, or delete all Helidon-accessible data. Oracle rates it CVSS 3.1 9.1 (high confidentiality and integrity impact, no availability impact) and classifies it as an authentication-bypass-class flaw. No public exploit identified at time of analysis, but the low attack complexity and no-authentication requirement make it a high-priority patch item once Oracle's fix is applied.
Authentication bypass in Oracle Helidon 3.2.18 (Imperative Web Server component of Oracle Fusion Middleware) lets an unauthenticated remote attacker send crafted HTTP requests to read, create, modify, or delete any data the application can access. Rated CVSS 9.1 with high confidentiality and integrity impact but no availability impact, it is trivially exploitable over the network with no user interaction. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated data compromise in Oracle Commerce Guided Search / Experience Manager 11.4.0 lets a remote attacker read and modify all data accessible to the application over HTTP without any credentials. Tagged as an authentication bypass, the flaw yields high confidentiality and integrity impact (CVSS 9.1) but no availability impact. No public exploit identified at time of analysis, and it is not listed in CISA KEV; disclosure comes via Oracle's August 2026 Critical Patch Update.
Unauthorized data read and write against Oracle Commerce Guided Search / Experience Manager 11.4.0 is possible via its Endeca Application Controller, which a remote unauthenticated attacker can reach over HTTP. The flaw, disclosed by Oracle and tagged as an authentication bypass, yields high confidentiality and integrity impact (CVSS 9.1) but no availability impact, meaning an attacker can create, delete, or modify critical Endeca data or read all accessible data without any credentials. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and lack of authentication make it a strong patching priority.
Remote unauthenticated compromise of Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication component) is possible over the network via SOAP, letting an attacker read, create, delete, or modify all data accessible to the product. Rated CVSS 3.1 9.1 with high confidentiality and integrity impact and no availability impact, and flagged as an authentication-bypass class issue, it was addressed in Oracle's August 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authentication bypass in Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware, Security and Authentication component) lets a remote, unauthenticated attacker reach and manipulate the reporting service over HTTP, gaining read access to all data the product can reach and the ability to create, delete, or modify that data. Rated CVSS 3.1 9.1 (Critical) with high confidentiality and integrity impact but no availability impact, it was disclosed in Oracle's August 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV.
TLS/VAU man-in-the-middle in fbeta GmbH's ePA 3.x Integration (ePA3-Service-OpenSource) before 1.3.0 lets an on-path attacker impersonate the VAU server for Germany's electronic patient record (ePA). Because app/vau/VAUProtokoll.py validates the signed_vau_server_pub_keys and AUT_VAU_CertData chain against attacker-suppliable material (a circular trust relationship) and TLS certificate verification is additionally disabled, an attacker between the DiGA backend and the ePA system can negotiate the session keys and read or alter all encrypted VAU traffic, including Medical Information Objects. CVSS 9.1; no public exploit identified at time of analysis, though the upstream fix commit and PR are public.
Protection-mechanism bypass in the Storage: Cache API of Mozilla Firefox lets remote web content defeat a built-in security mitigation, exposing sensitive data and allowing unauthorized modification (CVSS 9.1, C:H/I:H). All Firefox builds prior to Firefox 154, ESR 140.14, and ESR 153.1 are affected. Reported by Mozilla with no public exploit identified at time of analysis; EPSS is low at 0.16% (6th percentile).
Cross-origin information disclosure in Mozilla Firefox's CSS Parsing and Computation component allows a malicious web page to bypass site isolation and read data it should not have access to, affecting Firefox before 154 and Firefox ESR before 153.1. The flaw is remotely reachable over the network with no privileges required per the supplied CVSS vector, though realistic exploitation hinges on a victim loading attacker-controlled web content. There is no public exploit identified at time of analysis, and EPSS is very low (0.15%, 5th percentile), indicating no observed weaponization.
Information disclosure via a side-channel in Mozilla Firefox's Web Audio component allows remote, unauthenticated attackers to infer sensitive data that should be isolated between origins by measuring observable timing or behavioral discrepancies. The flaw affects Firefox before 154 and Firefox ESR before 153.1 and is fixed in those releases; no public exploit has been identified and EPSS is low (0.14%, 4th percentile), indicating no evidence of active exploitation.
Cache poisoning in Uber Kraken, an open-source peer-to-peer Docker registry, allows malicious peers or on-path attackers to inject attacker-chosen container image layers and manifests into the content-addressable cache. Because agents validate downloaded pieces only with CRC32 checksums - which are trivially forgeable - and never confirm the reassembled blob against its requested SHA-256 digest before commit, substituted content is accepted, re-seeded to the swarm, and executed by other hosts, yielding fleet-wide integrity compromise and downstream code execution. No public exploit identified at time of analysis; the issue is tracked in vendor GitHub issue #638 and a VulnCheck advisory, with a CVSS 4.0 base score of 9.1.
Same-origin policy enforcement in Firefox's DOM Service Workers component can be bypassed, allowing a malicious web page to access resources, responses, or cached content belonging to another origin. The flaw affects Firefox before version 154 and Firefox ESR before 153.1, and carries a CVSS 3.1 base score of 9.1 (high confidentiality and integrity impact, no availability impact). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the network, no-authentication, no-interaction vector makes it attractive for drive-by attacks.
Protection-mechanism bypass in the Firefox JavaScript engine's garbage collector (JavaScript: GC) undermines a built-in exploit mitigation, weakening a defense that normally hinders memory-corruption exploitation. The flaw affects Mozilla Firefox and Firefox ESR and was addressed by the vendor in Firefox 154 and Firefox ESR 153.1. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was reported internally by Mozilla.
Full system takeover of Oracle Commerce Guided Search / Experience Manager 11.4.0 is possible by a remote, unauthenticated attacker reaching the Content Acquisition System (CAS) over HTTP, per Oracle's August 2026 Critical Patch Update. Successful exploitation yields complete loss of confidentiality, integrity, and availability and, because of a CVSS scope change, can significantly impact additional connected products beyond the vulnerable component itself. Oracle rates the flaw 9.0 but explicitly marks it difficult to exploit (AC:H); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full product takeover in Oracle WebCenter Sites (versions 12.2.1.4.0 and 14.1.2.0.0) allows a remote, unauthenticated attacker to compromise the platform over HTTP, with attacks capable of spilling beyond WebCenter Sites into other products due to a security scope change. Rated CVSS 9.0, the flaw yields complete confidentiality, integrity, and availability loss, though the high attack complexity (AC:H) means exploitation is non-trivial. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; it was disclosed via Oracle's August 2026 Critical Patch Update.
Absolute path traversal in NVIDIA Triton Inference Server for Linux (versions 0.0 through 26.05) lets remote unauthenticated attackers reference filesystem paths outside intended directories, per NVIDIA's own advisory. NVIDIA states a successful exploit may lead to information disclosure and potentially code execution. No public exploit has been identified at time of analysis, and EPSS is low at 0.41% (34th percentile).