Privilege escalation in The Grid WordPress plugin (versions ≤ 2.7.9.1) permits any authenticated subscriber-level user to elevate their role, effectively granting unauthorized administrative access to the WordPress installation. The vulnerability stems from incorrect privilege assignment (CWE-266), where the plugin fails to properly restrict privileged actions to appropriate roles. With a CVSS score of 8.8 and no special configuration required beyond plugin installation and a valid subscriber account, this represents a meaningful threat to WordPress sites with open user registration. No public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation via the Shell Integration component in Mozilla Firefox allows a remote unauthenticated attacker - with user interaction - to achieve full compromise of confidentiality, integrity, and availability on affected systems. Affected are all Firefox releases prior to 154 and ESR branches prior to 140.14 and 153.1, as confirmed by Mozilla advisories mfsa2026-74, mfsa2026-76, and mfsa2026-77. No public exploit or CISA KEV listing has been identified at time of analysis, and SSVC rates exploitation status as none.
Remote code execution in Halo 2.25.4 is reachable by low-privileged authenticated attackers through the backup restoration workflow, exploiting CWE-73 (External Control of File Name or Path) in MigrationServiceImpl.restoreWorkdir() combined with Spring's FileSystemUtils.copyRecursively(). An attacker with a valid low-privileged account can supply a crafted backup archive containing path-traversal entries that escape the designated work directory, writing arbitrary files to the server filesystem and achieving code execution. Publicly available exploit code exists via a proof-of-concept gist, and the EPSS score of 0.29% (21st percentile) indicates limited observed exploitation at this time despite the public POC.
Full system takeover in Oracle Agile PLM 9.3.6 is achievable by unauthenticated remote attackers via HTTP, contingent on human interaction from a victim user. Oracle's own advisory explicitly describes the outcome as 'takeover of Oracle Agile PLM,' with complete confidentiality, integrity, and availability impact (CVSS 8.8). No public exploit code or CISA KEV listing has been identified at the time of analysis, though the low attack complexity (AC:L) lowers the barrier to independent exploit development.
Full takeover of Oracle PeopleSoft Enterprise PeopleTools is achievable by an unauthenticated remote attacker targeting the nVision component via HTTP on versions 8.61 through 8.63. The attack requires that a victim user interact with attacker-controlled content - consistent with a client-side exploitation pattern such as XSS or CSRF - after which the attacker achieves complete compromise with high confidentiality, integrity, and availability impact. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the low attack complexity and absence of any authentication requirement lower the bar for targeted exploitation against internet-accessible PeopleSoft deployments.
PHP Object Injection in the Essential Real Estate WordPress plugin (≤ 5.3.3) by g5theme allows low-privileged authenticated users to pass a crafted serialized PHP object through a vulnerable unserialize() call, potentially triggering arbitrary code execution if a usable POP (Property-Oriented Programming) gadget chain exists within the WordPress installation. The CVSS 8.8 score reflects full confidentiality, integrity, and availability impact - realistic in WordPress environments where co-installed plugins routinely supply gadget chains. No public exploit code or active exploitation (CISA KEV) has been identified at the time of analysis.
Buffer overflow in the LLDP daemon of NVIDIA Cumulus Linux enables an unauthenticated attacker with Layer 2 network adjacency to achieve code execution by sending specially crafted LLDP frames. Both the GA track (all versions through 5.16) and LTS track (through 5.11.5 and 5.9.5 respectively) are confirmed affected. No active exploitation or public proof-of-concept code has been identified at time of analysis, though CISA SSVC rates the technical impact as total given that a successful exploit yields full switch compromise.
Privilege escalation via invalid pointer dereference in Mozilla Firefox's Graphics component allows a remote attacker to gain elevated privileges within the browser context. Affected versions are all Firefox releases prior to 154 and all Firefox ESR releases prior to 153.1, with patches confirmed in Mozilla advisories mfsa2026-74 and mfsa2026-77. No public exploit identified at time of analysis, and CISA's SSVC framework rates exploitation status as none with the attack not automatable, though technical impact is assessed as total.
Privilege escalation via the Application Update component in Mozilla Firefox allows a network-adjacent attacker, with user interaction, to gain elevated privileges with high impact to confidentiality, integrity, and availability. All Firefox versions prior to 154 are affected per Mozilla CPE data. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS score of 8.8 and the nature of the update mechanism - which on some platforms (e.g., Windows via the Mozilla Maintenance Service) operates with system-level privileges - make this a meaningful escalation risk.
Privilege escalation in Firefox's Request Handling component exposes all versions prior to 154 (and ESR prior to 153.1) to high-impact compromise of confidentiality, integrity, and availability. The flaw carries a CVSS 8.8 score with a network attack vector and no privilege prerequisite, meaning a remote attacker can trigger it by inducing a user to interact with attacker-controlled content. SSVC assessment confirms no active exploitation at time of analysis and rates technical impact as total, while fix versions are confirmed via two Mozilla security advisories.
Privilege escalation in Mozilla Firefox's Downloads API component exposes users on any version prior to Firefox 154 or Firefox ESR 153.1 to high-impact compromise across confidentiality, integrity, and availability. Classified under CWE-269 (Improper Privilege Management), the flaw enables an unauthenticated remote attacker to escalate privileges when a user interacts with a crafted download trigger, requiring no prior foothold on the target system. No public exploit has been identified at time of analysis, but Firefox's ubiquitous deployment and the low attack complexity make this a high-priority patch for any organization.
Denial of service in libexpat through 2.8.3 stems from quadratic CPU complexity in the storeAtts() XML attribute processing function, enabling remote unauthenticated attackers to exhaust server CPU with a compact, well-formed XML document. The flaw-closely related to CVE-2026-45186 fixed in Expat 2.8.1-requires no authentication, no external entity resolution, and no non-default parser options to trigger, and is significantly amplified when XML payloads are compression-wrapped. No public exploit code has been identified at time of analysis, but the attack algorithm is fully derivable from the public PR diff and vulnerability description, making independent weaponization low-effort.
Use-after-free memory corruption in Firefox's Layout: Text and Fonts component allows a remote unauthenticated attacker to achieve high-confidence confidentiality, integrity, and availability impact by luring a user to visit a malicious web page. The vulnerability spans the main Firefox release channel and all three active ESR branches (115.x, 140.x, 153.x), indicating broad exposure across enterprise and consumer deployments. No public exploit or active exploitation has been identified at time of analysis, but the network-accessible, low-complexity nature of this flaw and the breadth of MFSA advisories (mfsa2026-74 through mfsa2026-80) signal a high-priority patching target.
Sandbox escape in Streambert Desktop App (all versions prior to 2.6.0) allows a compromised renderer process to pass an arbitrary local file path - including executables, scripts, or OS shortcuts - to Electron's shell.openPath, causing the host OS to launch the file with the StreamBERT main process's privileges. The vulnerable IPC handler open-path-at-time in src/ipc/player.js accepted renderer-supplied filePath values with no type checking, extension filtering, or real-path validation, making the fallback to shell.openPath an unrestricted local code-execution primitive. No CISA KEV listing and no public exploit code have been identified at time of analysis; the patch and fix commit are publicly available on GitHub.
Local privilege escalation in Oracle Product Lifecycle Analytics 3.6.1 enables a low-privileged attacker with host-level logon access to fully compromise the platform, achieving complete confidentiality, integrity, and availability takeover. The vulnerable component is labeled 'Installation Issues,' indicating the flaw stems from insecure artifacts - such as file permissions, directory ownership, or credential files - left accessible by the installer. Critically, the CVSS scope change (S:C) confirms that a successful attack can significantly impact additional co-hosted Oracle or system components beyond PLA itself; no public exploit or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Oracle Payroll (E-Business Suite 12.2.3 through 12.2.15) enables a low-privileged attacker with logon access to the hosting infrastructure to fully compromise the payroll application, achieving complete confidentiality, integrity, and availability impact including full takeover. The vulnerability carries a confirmed scope change (S:C), meaning successful exploitation can cascade to affect additional products co-hosted on the same infrastructure - a significant blast-radius amplifier in shared EBS environments. No public exploit code and no CISA KEV listing have been identified at time of analysis; exploitation is assessed as a targeted insider or post-breach scenario rather than opportunistic remote attack.
Cross-site request forgery in HashBar - WordPress Notification Bar plugin through version 2.0.0 allows a remote unauthenticated attacker to perform unauthorized administrative actions by tricking a logged-in WordPress administrator into visiting a crafted webpage. Reported by Patchstack (audit@patchstack.com) and registered as EUVD-2026-62209, this flaw carries a CVSS 8.8 score reflecting high C/I/A impact ratings, though the realistic blast radius depends on which admin-facing functions the plugin exposes to forged requests. No public exploit or CISA KEV listing has been identified at time of analysis.
Path traversal in Streambert (versions prior to 2.5.0) allows a compromised Electron renderer process to abuse the run-download IPC channel to copy arbitrary files readable by the Streambert process into attacker-controlled locations, and to overwrite existing writable files on the host system. The downloadSubtitleFile utility in src/ipc/downloads.js accepts renderer-supplied file: URIs and destination paths without sanitization, passing them directly to fs.copyFileSync - crossing the Electron IPC boundary without restriction. No public exploit is identified at time of analysis, but the CWE-22 path traversal root cause is well-understood and the vendor-released patch is available in version 2.5.0.
Local privilege escalation in Oracle Agile PLM 9.3.6 enables any low-privileged user with a logon to the host infrastructure to achieve complete system takeover, including full confidentiality, integrity, and availability compromise. The CVSS scope-change indicator (S:C) confirms that successful exploitation can cascade to additional Oracle Supply Chain products co-deployed on the same infrastructure, significantly amplifying blast radius beyond the primary target. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and absence of required user interaction make this a high-priority remediation target covered under Oracle's August 2026 Critical Patch Update.
Privilege escalation in Dell Watchdog Timer Driver versions prior to 2.0.0.1 allows a local low-privileged attacker to gain full system control by abusing an improperly access-controlled IOCTL interface exposed by the kernel driver. The CVSS scope-changed score of 8.8 (AV:L/AC:L/PR:L/UI:N/S:C) reflects that exploitation crosses the kernel trust boundary, yielding complete confidentiality, integrity, and availability impact. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity makes this a meaningful local privilege escalation risk on Dell-equipped systems.
Unbounded HTTP request payload processing in OpenSearch Dashboards' capabilities route handler allows unauthenticated remote attackers to exhaust server resources and cause a denial of service. Affected products span both self-hosted OpenSearch Dashboards (all versions per CPE) and Amazon OpenSearch Service. The CVSS 4.0 score of 8.7 with AV:N/AC:L/AT:N/PR:N/UI:N reflects low attack complexity and no authentication prerequisite, making any network-exposed instance potentially reachable. No public exploit or CISA KEV listing has been identified at time of analysis, and a vendor-released patch is available.
Arbitrary shell command execution in Oh My Zsh's dotenv plugin allows any syntactically valid Zsh command embedded in a `.env` file to run with the victim user's privileges when they `cd` into a directory containing that file. The plugin unconditionally `source`d the `.env` file as a shell script rather than parsing it as a structured key-value store, meaning malicious git repositories, shared project directories, or downloaded archives could weaponize routine developer directory-navigation. Exploitation is silent when `ZSH_DOTENV_PROMPT=false` or when the user presses Enter at the default prompt without reviewing the file; no CISA KEV listing or public exploit code was identified at time of analysis.
Use-after-free in Mozilla Firefox's JavaScript garbage collector (GC) component enables remote code execution when a victim visits a malicious webpage. All Firefox versions prior to 154 and Firefox ESR versions prior to 153.1 are affected across multiple product lines, as indicated by four separate Mozilla Security Advisories (MFSA2026-74, -77, -78, -80). No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the high CVSS score of 8.8 with full C/I/A impact and low attack complexity demands prompt patching.
Denial of service in Amazon ion-java (versions 1.9.0 through 1.11.x) is caused by the GZIP auto-decompression handler failing to enforce any upper bound on decompressed output size (CWE-409), a class of flaw commonly called a decompression bomb or zip bomb. Remote unauthenticated network attackers can submit a specially crafted compressed Ion document that expands to an arbitrarily large payload in memory, exhausting heap resources and crashing or stalling any application that parses untrusted Ion input. The CVSS 4.0 score of 8.7 (AV:N/AC:L/PR:N/UI:N) reflects the low exploitation barrier; no public exploit code or CISA KEV listing has been identified at time of analysis.
Uncontrolled heap memory preallocation in Amazon ion-java's binary Ion stream cursor exposes any application parsing untrusted Ion binary data to remote denial of service. Versions 1.9.0 through 1.11.x are affected; a crafted Ion binary document with an inflated declared-length field forces the JVM to preallocate excessive heap memory before input validation occurs, exhausting available resources and crashing the host service. No public exploit code has been identified, but the CVSS 4.0 vector confirms unauthenticated remote exploitation with low complexity, and a vendor-released patch is available in version 1.12.0.
High-privileged remote exploitation of Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.6) via the Siebel Cloud Manager component enables full confidentiality and integrity compromise of Siebel data, with a documented scope change allowing cascading impact on additional Oracle products in the environment. Oracle's August 2026 Critical Security Patch Update discloses a CVSS 3.1 base score of 8.7, reflecting network-accessible exploitation requiring no interaction but demanding high-privilege credentials. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 expose a high-severity Security component flaw enabling authenticated high-privileged attackers to compromise the system via HTTP, with confirmed scope change affecting additional downstream products. Exploitation allows complete unauthorized read and write access to all OIM-accessible data, including critical identity and access management records. No public exploit has been identified at time of analysis, and this vulnerability was disclosed as part of Oracle's Critical Patch Update for August 2026.
Unbounded mutual recursion in the RabbitMQ Java client library (amqp-client <= 5.33.0) allows a malicious AMQP server or network intermediary to crash the client JVM before authentication completes. By sending approximately 580 levels of nested AMQP table structures within a single connection.start frame - well within the default 131,072-byte frame limit - an attacker triggers a StackOverflowError that kills the client's I/O processing thread, resulting in denial of service. No public exploit code has been published, but the GHSA advisory includes a precise technical breakdown and proof-of-concept payload specification, significantly lowering the bar for exploitation.
Memory exhaustion denial of service in the RabbitMQ Java client library (com.rabbitmq:amqp-client ≤ 5.33.0) allows a malicious AMQP peer to crash the client JVM by sending a LongString field with a wire-declared length near Integer.MAX_VALUE during the pre-authentication connection.start handshake. The ValueReader.readBytes() method allocates a byte array sized by the attacker-controlled wire value before validating it against actual frame data, causing a ~2 GB allocation and OutOfMemoryError that terminates the entire JVM process. No public exploit code has been identified at time of analysis, but the GHSA advisory discloses the exact vulnerable code path, the precise trigger value (0x7FFFFFFE), and the step-by-step attack scenario, making independent implementation trivial.
Cross-database authorization bypass in ArcadeDB's Gremlin wire-protocol plugin allows any authenticated server user to fully access all databases on the server, completely circumventing per-database and per-type ACLs. Versions 26.7.3 and below of com.arcadedb:arcadedb-gremlin are affected; the plugin enforces SASL PLAIN authentication but never invokes the database permission check (canAccessToDatabase) nor binds the authenticated principal into the execution engine. No public exploit code has been identified at time of analysis, but exploitation requires only a single valid server credential regardless of what database that credential was originally provisioned for.
High-privileged network exploitation of Oracle Product Lifecycle Analytics 3.6.1 enables complete unauthorized read and write access to critical data, with a confirmed scope change that can cascade into compromise of additional Oracle products sharing the same environment. The vulnerable component is tied to Installation Issues within Oracle's Supply Chain suite, reachable over Oracle Net without user interaction. No public exploit code has been identified at time of analysis, but the CVSS 8.7 rating and scope-change designation make this a serious priority for organizations running OPLA in multi-product Oracle estates.
Oracle Customer Care (Internal Operations component) in E-Business Suite versions 12.2.3 through 12.2.15 allows a high-privileged, remote attacker to achieve full confidentiality and integrity compromise via HTTP - with a confirmed scope change that can cascade to additional EBS products. Despite the PR:H requirement, the 'Authentication Bypass' tag suggests that controls within the authenticated context can be circumvented, enabling unauthorized read and write access to critical customer data. No public exploit code has been identified and CISA KEV listing is absent, but the 'easily exploitable' vendor qualifier and low attack complexity mean that any attacker who reaches this component with elevated credentials faces minimal technical barriers.
Unauthenticated information disclosure in SiYuan before v3.7.4 exposes private knowledge-base content to anonymous publish-mode readers through 17 insufficiently protected block API endpoints in kernel/api/block.go. Remote attackers without credentials can enumerate arbitrary block IDs to retrieve private text content, structural metadata, and block existence information across the entire workspace. No public exploit or active exploitation has been identified at time of analysis; a vendor-released patch is available in v3.7.4 per GitHub Security Advisory GHSA-4vpg-gwqq-w44c.
Unauthorized read and write access to critical data in Oracle WebCenter Portal's Runtime Tools component is achievable by a low-privileged, network-authenticated attacker over HTTP, contingent on victim user interaction. Successful exploitation triggers a scope change - extending compromise beyond WebCenter Portal to additional Oracle Fusion Middleware products - resulting in full confidentiality and integrity impact on critical portal data. No public exploit code has been identified at time of analysis, and this vulnerability is not currently listed in the CISA KEV catalog.
Oracle WebCenter Portal's Runtime Tools component exposes a high-severity, network-exploitable authentication bypass affecting versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged, remote-authenticated attacker who can induce a victim user to interact with a malicious HTTP request can bypass authorization controls to gain complete read access to all WebCenter Portal data and perform unauthorized creation, deletion, or modification of critical data - including scope-change impact to additional Oracle Fusion Middleware products. No public exploit code has been identified at time of analysis, and it is not listed in the CISA KEV catalog.
Oracle WebCenter Content's Content Server component, in versions 14.1.2.0.0 and 12.2.1.4.0, exposes an authentication bypass that allows a low-privileged remote attacker to achieve full confidentiality and integrity compromise of all accessible content data - and, due to a confirmed scope change, may significantly impact additional Oracle Fusion Middleware products integrated with the platform. Exploitation is network-accessible over HTTP with low complexity but requires a valid low-privileged account and human interaction from a separate victim, classifying this as a socially-engineered or CSRF-class attack surface. No public exploit code and no CISA KEV listing have been identified at time of analysis; the vulnerability was disclosed as part of Oracle's August 2026 Critical Security Patch Update.
Oracle Service Delivery Platform's Messaging Enabler component (versions 14.1.2.0.0 and 12.2.1.4.0 within Oracle Fusion Middleware) can be compromised by unauthenticated remote attackers via TCP, enabling unauthorized creation, deletion, or modification of critical data and repeated complete denial of service. The CVSS S:C scope change signals that a successful attack can cascade to additional Fusion Middleware products sharing the same deployment, amplifying organizational impact beyond the directly targeted platform. No public exploit has been identified at time of analysis, and the high attack complexity (AC:H) requirement reduces the likelihood of opportunistic mass exploitation.
Privilege escalation in Blueprint Studio (versions prior to 2.5.2) allows any authenticated Home Assistant user to access and invoke administrator-only backend API actions - including arbitrary Home Assistant service calls, configuration file reads and writes, template rendering, file uploads, and terminal helper access - because the Python backend in api.py authenticated requests for valid HA user identity but never verified admin status. The fix in 2.5.2, released 2026-05-26, introduces a consistent `_require_admin()` guard across all GET, POST, stream, upload, and WebSocket handlers. No public exploit or active exploitation has been identified at time of analysis, but the authorization bypass is structurally trivial for any non-admin HA account holder.
Unauthorized data access and manipulation in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 is achievable by a low-privileged, network-based attacker who can induce a user interaction from another party - consistent with a stored injection or cross-session exploitation pattern. Successful exploitation produces a scope change, meaning impact propagates beyond the directly vulnerable component to additional Oracle Commerce subsystems, with both confidentiality and integrity fully compromised. No public exploit code has been identified at time of analysis, and Oracle's August 2026 Critical Patch Update is the designated remediation vehicle.
Oracle Hyperion Data Relationship Management (DRM) 11.2.25.0.000 exposes a high-severity access control flaw that allows a low-privileged, network-authenticated attacker to fully compromise confidentiality and integrity of critical DRM data, with scope change extending impact to additional Oracle Hyperion products. Exploitation requires human interaction from a victim user, consistent with a cross-site or cross-context attack pattern (the 'Authentication Bypass' tag suggests privilege escalation beyond the attacker's initial access tier). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Authentication bypass in Oracle Hyperion Data Relationship Management 11.2.25.0.000 permits a low-privileged, network-adjacent attacker to achieve full confidentiality and integrity compromise of critical master data, with a confirmed scope change that can propagate impact to additional Oracle Hyperion components. Exploitation via HTTP requires a victim to take some form of interactive action, placing this in a phishing or session-hijacking attack pattern. No public exploit code or CISA KEV listing exists at time of analysis, though Oracle has published a Critical Security Patch Update advisory for August 2026 addressing this flaw.
Unauthorized data access and modification in Oracle Customer Care (E-Business Suite versions 12.2.3 through 12.2.15) is achievable by network-authenticated low-privileged attackers through the Internal Operations component via HTTP, with successful exploitation requiring victim interaction and producing a scope change that can compromise additional Oracle E-Business Suite components. The vulnerability carries a CVSS 3.1 score of 8.7, reflecting high confidentiality and integrity impacts with a cross-component blast radius. Oracle's August 2026 Critical Patch Update confirms the issue; no public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Missing authorization enforcement in the Grav API plugin before 1.0.14 allows any authenticated user holding the api.access permission to invoke privileged menubar actions - bypassing per-action authorize field evaluation in MenubarController::executeAction(). The POST /api/v1/menubar/actions/{plugin}/{action} endpoint checks only the baseline api.access gate while the parallel GET listing endpoint correctly calls userPassesAuthorize(), creating an asymmetric enforcement gap (CWE-862). On stock Grav installs the impact is currently latent because no bundled core plugin registers a privileged authorize handler, but any environment deploying third-party plugins that rely on the documented authorize contract is exposed to privilege escalation. No public exploit has been identified at time of analysis and no CISA KEV listing exists.
Unauthorized data access and tampering in Oracle WebCenter Content's Content Server component allows unauthenticated remote attackers to fully read or manipulate all managed content via HTTP. Both supported versions 12.2.1.4.0 and 14.1.2.0.0 are affected, and successful exploitation can cascade beyond the Content Server itself to impact additional Oracle Fusion Middleware products within the same deployment environment. No public exploit has been identified at time of analysis, but the unauthenticated network vector combined with a scope change rating makes this a high-priority item for any organization running this ECM platform.
Oracle WebCenter Content's Content Server component, in versions 12.2.1.4.0 and 14.1.2.0.0, contains an authentication bypass vulnerability reachable over HTTP without credentials, carrying a CVSS 3.1 base score of 8.7. Successful exploitation enables an unauthenticated remote attacker to gain both full read access and full create/delete/modify access to critical content data, with a confirmed scope change meaning downstream Oracle Fusion Middleware components may also be impacted. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the Authentication Bypass tag and high attack complexity signal a non-trivial but realistic threat to unpatched deployments.
Remote authentication bypass in Oracle WebCenter Content's Content Server component allows unauthenticated network attackers to fully compromise confidentiality and integrity of managed content - including unauthorized creation, deletion, and modification of critical data - across both affected release lines 12.2.1.4.0 and 14.1.2.0.0. The CVSS scope-change flag (S:C) indicates successful exploitation can cascade to affect additional Oracle Fusion Middleware products beyond WebCenter Content itself. Attack complexity is rated High (AC:H), meaning specific and difficult-to-reproduce conditions must be met, but no authentication or user interaction is required. No public exploit code or CISA KEV listing has been identified at time of analysis.
Oracle WebCenter Content's Content Server component harbors an authentication bypass exploitable by unauthenticated remote attackers over HTTP, affecting both actively supported versions (12.2.1.4.0 and 14.1.2.0.0) of this Oracle Fusion Middleware product. Successful exploitation grants complete unauthorized read and write access to all content managed by the system, with a confirmed scope change that can extend impact to additional Oracle Fusion Middleware products in the same deployment. No public exploit code or CISA KEV listing has been identified at the time of analysis, but the unauthenticated network vector paired with high confidentiality and integrity impacts makes this a meaningful risk for organizations running exposed affected deployments.
Unauthenticated network exploitation of Oracle WebCenter Content's Content Server component allows a remote attacker to achieve full confidentiality and integrity compromise of all accessible content data, with a scope change that can significantly impact additional Oracle Fusion Middleware products in the same environment. Affected versions are 12.2.1.4.0 and 14.1.2.0.0, addressed in Oracle's Critical Patch Update of August 2026. No public exploit code or CISA KEV listing has been identified at time of analysis, though the Authentication Bypass tag and PR:N vector confirm no credentials are required to initiate an attack. The AC:H rating indicates exploitation is non-trivial and requires meeting specific, undisclosed conditions.
Arbitrary file read in ArcadeDB before version 26.8.1 allows authenticated users holding trigger creation privileges to escape the GraalVM JavaScript sandbox and read any file accessible to the ArcadeDB server process on the underlying host. The sandbox allowlist enforces package name restrictions via unescaped regular expressions, which an attacker can craft to match unintended Java class names and instantiate ZipFile or JarFile to open arbitrary filesystem paths. No public exploit has been identified at time of analysis; however, the vendor-confirmed patch to 26.8.1 should be applied promptly given the high confidentiality impact and the sensitivity of files typically reachable by a database server process.
Stored cross-site scripting in MyBB before 1.8.40 allows any registered forum member to inject persistent JavaScript into checkbox and multiselect profile fields by submitting a scalar string value instead of the expected array shape, bypassing type-specific sanitization in UserDataHandler::verify_profile_fields(). The unsanitized payload is written to the database and rendered verbatim in member.php and inc/functions_post.php when other users view the attacker's profile or posts displaying profile fields. With a Changed scope (S:C) and high confidentiality and integrity impact, successful exploitation against an administrator enables full session hijacking and privileged action takeover; no active exploitation or public POC has been identified at time of analysis.