SSH private key material in Blueprint Studio versions prior to 2.5.2 was temporarily written to disk under the Home Assistant configuration directory during terminal SSH authentication sessions, with permissions hardened only after the write and cleanup performed on a best-effort basis. Any user or co-located process with read access to the HA configuration directory could recover the residual key if cleanup was skipped due to a crash or exception. The fix in 2.5.2 eliminates the disk write entirely by switching to in-memory Paramiko sessions. No public exploit has been identified and this CVE is not listed in the CISA KEV catalog.
Local confidentiality breach in Oracle Hyperion Financial Management 11.2.25.0.000 enables a low-privileged infrastructure user to bypass Security component controls and gain unauthorized access to critical financial data, with potential spillover into additional connected Oracle products due to a confirmed scope change. The CVSS vector (AV:L/AC:H/PR:L/S:C/C:H) indicates the attack requires local system logon and high complexity, but successful exploitation yields complete read access to all data accessible by the application. No public exploit code and no CISA KEV listing have been identified at time of analysis, keeping real-world immediate risk moderate despite the authentication bypass tag.
Oracle VM VirtualBox 7.2.14 Core component allows a low-privileged local attacker to read critical data, with the impact scope extending beyond the VirtualBox instance itself - potentially exposing host system or cross-VM sensitive data. Exploitation is constrained by high attack complexity and mandatory local access, making mass exploitation impractical; targeted insider or post-compromise scenarios represent the realistic threat model. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; the official Oracle CPU advisory for August 2026 is the authoritative source.
Local privilege escalation with scope change in Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 exposes critical data to a low-privileged local attacker. The Enterprise Manager Install component can be compromised by an authenticated local user under difficult but achievable conditions, with successful exploitation yielding complete confidentiality breach of all data accessible to the platform - including data from additional managed products due to scope change. No public exploit code has been identified at time of analysis, and CISA KEV confirmation is absent.
Arbitrary root-readable file disclosure in Linuxfabrik Monitoring Plugins prior to 7.0.0 allows a local attacker controlling the monitoring account to exfiltrate sensitive files such as /etc/shadow by supplying a crafted --filename path to the logfile check plugin, which executes as root via the shipped sudoers allowlist without confining the resolved path to /var/log. The same path-traversal flaw extends to the mysql-logfile and openvpn-client-list plugins. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack is straightforward and requires only monitoring-account-level access.
Local confidentiality exposure in Oracle Hyperion Financial Management 11.2.25.0.000 allows a low-privileged attacker with local system logon to read critical or all accessible financial data within the application. The vulnerability resides in the Security component and is classified as easily exploitable given low attack complexity and no user interaction required. No public exploit code or active exploitation has been identified at time of analysis.
Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 exposes all Hyperion-accessible data to local attackers holding low operating-system privileges, through a flaw in its Installation and Configuration component. A low-privileged local user can achieve unauthorized read access to critical data - including sensitive financial planning and EPM artifacts - without requiring any user interaction. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code has been identified at time of analysis.
Local privilege escalation of read access in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows a low-privileged local attacker to gain unauthorized access to all data accessible by the Hyperion installation, including potentially sensitive configuration secrets and credentials stored during installation. The vulnerability resides in the Installation and Configuration component, tagged as an authentication bypass, suggesting an internal authorization control can be circumvented by an already-authenticated local user. No public exploit exists at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
MySQL Connector/ODBC version 26.7.0 exposes a local denial-of-service condition that allows an unauthenticated attacker with logon access to the host to cause a complete hang or repeatable crash of the connector, disrupting dependent applications. Exploitation requires human interaction from a third party (UI:R), constraining the realistic attack surface to insider threat or socially engineered scenarios on the affected host. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; availability is the sole impact dimension - confidentiality and integrity are unaffected.
Absolute path traversal in NVIDIA Triton Inference Server for Linux exposes arbitrary filesystem files to low-privileged local attackers, with the vendor flagging potential code execution as a secondary consequence. The vulnerability is classified under CWE-36 and affects all versions captured by the wildcard CPE, meaning no upper-bound patched version is confirmed from current data. No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog at time of analysis, though the discrepancy between the RCE tag and the CVSS confidentiality-only impact metrics leaves the true blast radius unresolved.
Credential exposure in Red Hat Advanced Cluster Management for Kubernetes 2.x allows any local user with access to a must-gather diagnostic archive to read proxy basic-auth credentials in plaintext. The must-gather component dumps the cluster Proxy object in raw form, bypassing the redaction logic that oc inspect would normally apply to sanitize sensitive fields before archiving. No public exploit code exists and this is not listed in CISA KEV, but the CVSS AV:L/PR:L vector confirms real-world exposure is bounded to archive access rather than remote exploitation.
Local privilege escalation in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows a low-privileged OS user on the Hyperion host to gain unauthorized access to all data accessible by the platform. The vulnerability resides in the Installation and Configuration component and carries a High confidentiality impact despite a moderate CVSS base score of 5.5, reflecting the local-only attack vector. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA's KEV catalog, but the ENISA EUVD tags it as an Authentication Bypass, suggesting application-layer authorization controls are circumvented once local OS access is obtained.
Local confidentiality compromise in Oracle Commerce Guided Search and Oracle Commerce Experience Manager 11.4.0 allows a low-privileged authenticated local attacker to gain unauthorized read access to all data accessible by the application via the Endeca Application Controller component. Oracle classifies this as easily exploitable with low attack complexity, indicating reliable exploitation without special tooling for any user holding a local logon on the affected host. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
Cleartext credential exposure in Red Hat Advanced Cluster Management for Kubernetes affects the must-gather diagnostic tool, which collects ACM wrapper Custom Resources containing embedded Secret data without scrubbing sensitive fields. Any administrator who runs must-gather to diagnose cluster issues inadvertently captures credentials and tokens in the resulting archive, which may then be stored, shared, or transmitted without awareness of the embedded secrets. No public exploit identified at time of analysis, but the information disclosure risk is compounded by the routine, trust-assumed nature of diagnostic archive handling.
Broken authentication in WPEverest's User Registration WordPress plugin (versions 5.2.6 and below) permits subscriber-level authenticated users to bypass authentication controls and perform unauthorized actions beyond their role permissions. The CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N) confirms network-exploitable with low-privilege access required, producing limited but real integrity and availability impact. No public exploit code or active CISA KEV listing has been identified at time of analysis.
Unauthorized data access and manipulation in Oracle Hyperion Calculation Manager 11.2.25.0.000 is achievable by low-privileged network attackers via HTTP, exploiting a weakness in the product's Security component tagged as an authentication bypass. Successful exploitation permits an authenticated attacker to read a subset of accessible EPM data and perform unauthorized insert, update, or delete operations against accessible data stores, with no availability impact. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; it is addressed in Oracle's Critical Patch Update for August 2026.
Unauthorized data access in Oracle Helidon 3.2.18's Imperative Web Server component allows low-privileged network attackers to read a subset of accessible data and perform unauthorized insert, update, or delete operations via HTTP. Tagged as an authentication bypass by Oracle, the flaw presents a moderate but concrete integrity and confidentiality risk for organizations running this specific microservice framework version. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the low attack complexity and no user interaction requirement lower the barrier for exploitation by any authenticated user.
Unauthorized data access in Oracle Helidon 4.5.0's Imperative Web Server component allows low-privileged network attackers to read a subset of accessible data and perform unauthorized insert, update, or delete operations via HTTP. Tagged as an Authentication Bypass by Oracle Security, the flaw is rated Medium (CVSS 5.4) with low attack complexity, meaning any attacker holding even minimal credentials can trivially exploit it without user interaction. No public exploit code or CISA KEV listing is associated at time of analysis, though the straightforward exploitation conditions make this a credible threat in multi-tenant or shared-access Helidon deployments.
Authentication bypass in Oracle Helidon 4.5.0's Imperative Web Server component allows a low-privileged, network-adjacent attacker to read unauthorized data subsets and perform unauthorized insert, update, or delete operations via HTTP. Rated CVSS 5.4 Medium with low attack complexity and no user interaction required, this flaw is tagged as an authentication bypass by multi-source intelligence, suggesting a low-privileged user can exceed their authorized scope within the Helidon web layer. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthorized data access in Oracle Helidon 3.2.18 (Imperative Web Server component) allows a low-privileged, network-adjacent attacker to read a subset of accessible data and perform unauthorized insert, update, or delete operations via HTTP. Tagged as an authentication bypass, the flaw enables privilege escalation beyond the attacker's authorized scope within the web server layer. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS data was not provided in source intelligence.
Unauthorized data access and modification in Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by unauthenticated remote attackers via HTTP, contingent on human interaction from a victim. The vulnerability resides in the Security component and is tagged as an Authentication Bypass, enabling partial confidentiality and integrity compromise without attacker credentials. No active exploitation (CISA KEV) or public exploit code has been identified at time of analysis, but the low attack complexity and zero privilege requirement make social-engineering-assisted attacks practical against exposed instances.
Unauthenticated network exploitation of Oracle Hyperion Financial Reporting version 11.2.25.0.000 allows remote attackers to partially read and manipulate application data via crafted HTTP requests, contingent on human interaction from an authenticated user. The vulnerability resides in the Server component and carries a CVSS 3.1 score of 5.4 (Medium), with confidentiality and integrity impacts but no availability effect. No public exploit identified at time of analysis and it is absent from the CISA KEV catalog, though the Oracle CPU advisory for August 2026 addresses it.
Unauthorized data access and modification in Oracle Hyperion Financial Reporting 11.2.25.0.000 is achievable by unauthenticated remote attackers over HTTP when a legitimate user is socially engineered into interacting with attacker-controlled content. Classified under the Authentication Bypass tag, the flaw enables partial confidentiality exposure and unauthorized write operations against financial reporting data without requiring any attacker credentials, exploiting the victim's active session. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle released a fix in the August 2026 Critical Patch Update.
Authentication bypass in Oracle Hyperion Calculation Manager 11.2.25.0.000 (Security component) exposes EPM calculation data to unauthenticated attackers positioned on the same physical network segment. The adjacency constraint (AV:A) limits internet-based exploitation, but an insider or attacker already present on the local segment can bypass authentication to partially read or tamper with accessible application data. No public exploit code or active exploitation has been identified at time of analysis; the CVSS 5.4 Medium score accurately reflects the constrained attack surface and limited data impact.
MyBB's calendar module prior to version 1.8.40 exposes private forum events to any authenticated user possessing calendar viewing or moderation permissions, due to seven missing authorization checks across calendar.php action handlers. Authenticated forum members can read and modify private calendar events created by other users - data the event creator intended to restrict exclusively to themselves. No public exploit code has been identified at time of analysis and the flaw is absent from CISA KEV, but exploitation requires only a standard low-privilege forum account, keeping the practical barrier for abuse low.
Broken access control in Gravity Booster - Styles & Layouts for Gravity Forms (WordPress plugin by WPMonks) through version 6.0 permits any authenticated subscriber to invoke functionality restricted to higher-privileged roles, yielding limited but real confidentiality and integrity impact. Reported by Patchstack and catalogued as EUVD-2026-60813, the flaw stems from missing authorization checks (CWE-862) on plugin operations, enabling subscriber-level users to read or modify form style and layout configurations beyond their intended permissions. No public exploit code and no active exploitation have been identified at time of analysis.
Unauthorized data access and manipulation in Oracle Helidon 4.5.0's Imperative Web Server allows low-privileged network attackers to read restricted data and perform unauthorized insert, update, or delete operations via HTTP. Tagged as an authentication bypass, the flaw enables authenticated users to exceed their intended authorization scope within the Helidon application. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog at time of analysis, though Oracle's August 2026 Critical Patch Update confirms the issue.
Unauthorized data access in Oracle Helidon 4.5.0's Imperative Web Server component allows a low-privileged, network-authenticated attacker to read a subset of accessible data and perform unauthorized insert, update, or delete operations via HTTP. The vulnerability is tagged as an authentication bypass, suggesting that existing access controls within the Imperative Web Server can be circumvented by an attacker who holds any valid low-privilege credential. No public exploit code and no CISA KEV listing have been identified at time of analysis.
UI spoofing in the Downloads component of Firefox for Android allows network-accessible attackers to misrepresent critical information to users, potentially deceiving them about the nature or origin of downloaded content. Affected versions are those prior to Firefox 154 on Android, as confirmed by Mozilla's security advisory MFSA2026-74. No public exploit code exists and CISA has not added this to the KEV catalog; SSVC signals exploitation status as none with partial technical impact.
Site isolation bypass in Firefox's Graphics component allows a remote attacker who can induce user interaction to read cross-origin data or tamper with content across site boundaries. Affected versions are all Firefox releases prior to 154 and all Firefox ESR releases prior to 153.1. No public exploit has been identified and CISA SSVC rates exploitation as none at time of analysis, but the network-accessible attack surface and broad deployment footprint make this a meaningful patching priority.
Stored cross-site scripting in FileOrbis before version 16.5 allows authenticated low-privileged users to inject persistent malicious scripts into pages subsequently rendered for other users. When a victim browses to affected content while authenticated, the injected script executes in their browser context, enabling session hijacking, credential theft, or unauthorized actions on behalf of the victim. Reported by TR-CERT; no public exploit identified at time of analysis, and the product does not appear in the CISA KEV catalog, indicating no confirmed active exploitation.
Same-origin policy bypass in Firefox's ImageLib image rendering component allows remote attackers to read cross-origin data or perform unauthorized cross-origin writes against victims using unpatched browser versions. Affected releases span the main Firefox channel (prior to 154) and three ESR branches (prior to ESR 115.39, ESR 140.14, and ESR 153.1), placing a large share of the global Firefox install base at risk until patched. The CVSS 5.4 score reflects limited confidentiality and integrity impact with no authentication requirement on the attacker side, though no public exploit has been identified and this CVE is not listed in the CISA KEV catalog at the time of analysis.
Same-origin policy bypass in Firefox's Audio/Video Playback component exposes users to cross-origin data reads and limited content manipulation when visiting a malicious webpage. All Firefox stable releases prior to 154 and both ESR tracks prior to 140.14 and 153.1 are affected, with Mozilla issuing a coordinated advisory series (mfsa2026-74 through mfsa2026-80) covering the full release matrix. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation requires user interaction but no credentials or special configuration.
Missing authorization in the B2BKing WordPress/WooCommerce plugin (versions through 5.2.30) allows authenticated low-privilege users to exploit incorrectly configured access control security levels, potentially accessing B2B wholesale pricing tiers, customer group data, or restricted functionality reserved for higher-privilege roles. Reported by Patchstack's audit team under ENISA EUVD-2026-62211, this broken access control flaw (CWE-862) carries a CVSS 5.4 Medium score. No public exploit code or CISA KEV listing is identified at time of analysis, limiting immediate threat urgency.
Site isolation bypass in Firefox's Graphics: WebRender component allows a remote attacker to achieve limited cross-origin information disclosure and content manipulation by delivering a crafted webpage to a user (CWE-346, origin validation error). All Firefox releases prior to 154 and Firefox ESR releases prior to 153.1 are affected across all platforms. No public exploit code or active exploitation has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
DLL sideloading in the Zabbix Agent Windows installer allows a local attacker with write access to a custom installation directory to plant a malicious DLL that the agent process subsequently loads. The installer previously failed to validate whether a user-selected directory had appropriately restrictive access controls, leaving deployments in permissive directories silently exposed. No public exploit has been identified at time of analysis, and the vendor has already shipped a hardened installer that warns users before proceeding with potentially unsafe target directories.
Cleartext storage of the IPsec pre-shared key (PSK) in the Submariner Custom Resource exposes the cryptographic secret used to secure all inter-cluster communication in Red Hat Advanced Cluster Management for Kubernetes 2 deployments. Any principal with low-privilege read access to the Submariner CR object within the Kubernetes cluster can retrieve the PSK and use it to passively decrypt IPsec-encrypted traffic flowing between every cluster in the connected mesh - not just the cluster where access was obtained (CVSS scope change S:C). No public exploit code exists and the vulnerability is not listed in CISA KEV, but the architectural impact is severe: a single stolen key compromises the confidentiality of all inter-cluster traffic simultaneously.
Same-origin policy bypass in Firefox's Networking: Cookies component exposes users to cross-origin cookie theft and manipulation when visiting attacker-controlled pages. All Firefox versions prior to 154 and both ESR branches prior to ESR 140.14 and ESR 153.1 are affected, with Mozilla publishing at least six separate security advisories (mfsa2026-74 through mfsa2026-80) indicating broad coverage across release tracks. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis; the CVSS 5.4 Medium score reflects real but bounded confidentiality and integrity risk, gated by a mandatory user-interaction requirement.
Insecure Direct Object Reference (IDOR) in Kurrier's API layer exposes webhook and identity resource metadata to any authenticated API user prior to version 1.2.4. Any holder of a valid Kurrier API key can read and enumerate webhook configurations and identity records belonging to other accounts by supplying a victim's resource identifier to four unprotected GET and list endpoints. Confidentiality impact is limited to resource metadata - cross-user write and delete operations were already blocked - but the flaw enables reconnaissance of account configurations within a shared Kurrier instance. No public exploit code has been identified at time of analysis.
CAPTCHA replay exploitation in MyBB prior to 1.8.40 allows unauthenticated remote attackers to bypass anti-automation controls by reusing a previously validated CAPTCHA challenge token across five distinct action endpoints. The root cause is missing calls to captcha::invalidate_captcha() after successful validation in contact.php, member.php (do_resendactivation, do_lostpw, do_emailuser), and sendthread.php (do_sendtofriend) when the built-in captchaimage setting is active. No public exploit has been identified at time of analysis, and the flaw enables form-abuse automation rather than code execution or data exfiltration.
Helidon 3.2.18's Imperative Web Server component exposes an unauthenticated, network-accessible denial-of-service condition via HTTP that allows remote attackers to partially degrade service availability without any credentials or user interaction. Only the Availability dimension is affected - Confidentiality and Integrity remain intact - classifying this as a medium-severity partial DoS. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this in a lower operational priority tier despite its trivial exploitation conditions.
Blueprint Studio, a VS Code-like configuration file editor for Home Assistant (versions prior to 2.5.2), exposed internal filesystem paths and implementation details through raw Python exception strings returned directly in HTTP API responses. Any authenticated Home Assistant user - not only administrators - could trigger these disclosures by sending unexpected input to the backend API. The 2.5.2 patch sanitizes error responses to generic messages and simultaneously closes a broader privilege boundary gap by restricting API access to admin-only users. No public exploit code exists and the vulnerability is not listed in CISA KEV.
CAPTCHA bypass in MyBB's registration workflow allows unauthenticated remote attackers to create accounts without solving the Security Question challenge. The `member.php?action=do_register` endpoint accepts a hidden `question_id` field but fails open when that identifier is blank, forged, or expired - the validation logic has no fail-closed fallback, so the request proceeds without challenge verification. The issue is resolved in MyBB 1.8.40; no public exploit is identified at time of analysis.
The Imperative Web Server in Oracle Helidon 4.5.0 exposes an authentication bypass that permits remote unauthenticated HTTP attackers to read a subset of application-accessible data. Tagged by Oracle CSIRT as an authentication bypass and disclosed in the August 2026 Critical Patch Update, the flaw carries a CVSS 5.3 Medium score with network-accessible, zero-complexity exploitation conditions - conditions that may understate practical risk given the complete absence of authentication prerequisites. No active exploitation has been confirmed via CISA KEV, and no public exploit code was identified at time of analysis.
Unauthorized data read in Oracle Helidon 3.2.19's Imperative Web Server component allows unauthenticated remote attackers to access a subset of protected application data via HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial network-level exploitation with no credentials or user interaction required, consistent with the intelligence tag of Authentication Bypass. Impact is bounded to confidentiality only (C:L, I:N, A:N), suggesting an access control bypass that exposes a partial data view rather than full system compromise. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthorized data exposure in Oracle Helidon 3.2.18's Imperative Web Server component allows unauthenticated network attackers to read a subset of application-accessible data via HTTP. Tagged as an authentication bypass, the vulnerability is trivially exploitable with no complexity barriers - any attacker with HTTP access to the service can trigger it. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and impact is constrained to partial confidentiality loss with no integrity or availability consequences.
Unauthorized data exposure in Oracle Helidon 4.5.0's Imperative Web Server component allows unauthenticated remote attackers to read a subset of application-accessible data via HTTP. The vulnerability is tagged as an authentication bypass, meaning protections that should gate read access can be circumvented without credentials. No public exploit code has been identified at time of analysis, and it has not been listed in the CISA KEV catalog, though Oracle disclosed this via their August 2026 Critical Patch Update (CPU).
Unauthorized data exposure in Oracle Helidon 4.5.0's Imperative Web Server enables unauthenticated remote attackers to read a subset of application-accessible data via HTTP, confirmed by Oracle's August 2026 Critical Patch Update. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivially exploitable, zero-complexity network access requiring no authentication or user interaction. No public exploit has been identified at time of analysis, though the 'Authentication Bypass' tag from multi-source intelligence indicates a structural access control failure in the HTTP request handling pipeline.
Authentication bypass in Helidon 3.2.18's Imperative Web Server component allows unauthenticated remote attackers to read a subset of data accessible within the Helidon service over HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is trivially exploitable from any network location against default deployments without credentials. Impact is limited to partial confidentiality loss (C:L) with no integrity or availability consequence, though the 'Authentication Bypass' tag suggests access-control logic failures that may expose protected endpoints. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthorized data read in Oracle Helidon 4.5.0's Imperative Web Server component exposes a subset of server-accessible data to unauthenticated remote attackers over HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is trivially exploitable without credentials, and the 'Authentication Bypass' tag from intelligence sources suggests access controls within the Imperative Web Server are being circumvented rather than simply an information leak. No active exploitation is confirmed in CISA KEV and no public exploit code has been identified at time of analysis.