Unlimited authentication attempts against the karakeep login endpoint (apps/web/server/auth.ts) in versions up to 0.32.0 enable remote credential brute-forcing due to a missing rate-limiting guard on the NextAuth authorize function (CWE-307). The CVSS 4.0 score of 2.9 with AC:H reflects that successful exploitation depends on the target account holding a guessable password - a condition outside the attacker's direct control. A proof-of-concept has been publicly disclosed via GitHub issue #2919, though no active exploitation is confirmed by CISA KEV.
OAuth Sign-In bypass in Karakeep up to version 0.32.0 allows unauthenticated remote attackers to subvert the authentication process via manipulation of logic in apps/web/server/auth.ts, achieving a low-integrity impact on the vulnerable system without requiring credentials or user interaction. High attack complexity (AC:H) means exploitation demands engineered conditions in the OAuth callback flow rather than trivial exploitation. No vendor patch has been issued at time of analysis; a public proof-of-concept has been disclosed via GitHub issue #2920 and indexed by VulDB, no public exploit identified at time of analysis for widespread automated campaigns but the PoC reduces the barrier for targeted attacks.
Socket.IO namespace access control bypass in MagicMirror² prior to v2.37.0 allows unauthenticated adjacent-network clients to interact directly with module helpers, bypassing the configured ipWhitelist that protects only the Express HTTP layer. Affected deployments binding to non-loopback interfaces can be exploited for server-side request forgery via the default newsfeed and calendar helpers, and conditionally for command execution via child_process.exec through the updatenotification helper when a third-party module update is pending. No public exploit code has been identified at time of analysis and this vulnerability is not in CISA KEV.
Out-of-bounds read in mistral.rs versions 0.8.0 through 0.8.22 allows a remote attacker to crash the GGUF tokenizer by supplying a malformed model file containing out-of-range special token ID values. The `convert_gguf_to_hf_tokenizer` function in `mistralrs-core/src/gguf/gguf_tokenizer.rs` uses eos_token_id, bos_token_id, and unknown_token_id values from untrusted GGUF file metadata as direct array indices without validating they fall within vocabulary bounds. Publicly available exploit code exists, vendor-released patch version 0.8.23 is confirmed, and no CISA KEV listing is present at time of analysis.
Incorrect buffer size validation in Sonos Tract's ONNX Initializer Loader allows a crafted ONNX model file to crash the inference process. The Tensor::from_raw_dt_align function in data/src/tensor.rs accepts a raw byte slice and declared tensor shape without confirming the slice length matches the expected size, causing a Rust panic in copy_from_slice when dimensions mismatch. Applications using Tract 0.23.0-0.23.4 to load untrusted or third-party ONNX models are at risk; a public proof-of-concept (GitHub issue #2390) confirms reproducibility, though no CISA KEV listing means confirmed threat-actor exploitation has not been observed.
Cross-site scripting in Webkul Bagisto up to version 2.4.4 allows remote unauthenticated attackers to inject script-related HTML tags via the first_name or last_name parameters submitted to the /customer/register endpoint, with impact routed through the Customer-Registration Notification Email component. The CVSS 4.0 score of 2.1 reflects constrained real-world impact - user interaction is required and integrity impact is low - but a publicly available proof-of-concept on GitHub documents and lowers the bar for this attack. The vendor acknowledged the findings, confirming some issues have been addressed internally, though no specific patched release version has been publicly identified.
Business logic bypass in Bagisto's RMA (Return Merchandise Authorization) module allows authenticated remote customers to manipulate workflow-critical parameters - rma_qty, resolution_type, and rma_reason_id - at the /customer/account/rma/store endpoint in versions up to 2.4.4. The integrity impact is limited to the RMA subsystem, but exploitation could enable unauthorized refund claims, fraudulent return approvals, or workflow state corruption. A public proof-of-concept is available; the vulnerability is not confirmed actively exploited (not in CISA KEV). The vendor has acknowledged the issue and states partial remediation is in progress through their internal security lifecycle.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the /viewbilling.php endpoint to database manipulation via the unsanitized delid parameter, exploitable by any low-privileged authenticated user over the network. A publicly available proof-of-concept has been disclosed on GitHub, lowering the barrier to exploitation significantly. Impact is bounded to partial confidentiality, integrity, and availability loss against the application database, with no confirmed scope change to adjacent systems.
SQL injection in itsourcecode Hospital Management System 1.0 allows low-privileged remote attackers to manipulate the `delid` parameter in `/viewdepartment.php`, enabling arbitrary SQL query execution against the backend database. The CVSS 4.0 score of 5.3 reflects limited but confirmed confidentiality, integrity, and availability impact. A proof-of-concept exploit is publicly available on GitHub, materially lowering the barrier to exploitation; however, no active exploitation has been confirmed via CISA KEV.
SQL injection in itsourcecode Hospital Management System 1.0 exposes patient and operational database contents to remote authenticated attackers via the `delid` parameter in `/viewroom.php`. The vulnerability carries a CVSS 4.0 score of 5.3 with a network attack vector and low complexity, and a public proof-of-concept exploit has been disclosed on GitHub. No CISA KEV listing exists, but the combination of a live exploit and sensitive healthcare data context elevates practical urgency beyond what the moderate score alone suggests.
SQL-level data manipulation in Oracle Hyperion Calculation Manager version 11.2.25.0.000 enables a highly privileged, network-connected attacker to perform unauthorized read, insert, update, and delete operations against a subset of accessible application data through the Security component. Impact is constrained to partial confidentiality and integrity loss with no availability consequence, yielding a vendor-assigned CVSS 3.1 base score of 3.8. No active exploitation or public proof-of-concept has been identified at time of analysis; Oracle addressed this in its August 2026 Critical Patch Update.
Unauthorized read access in Oracle Helidon 3.2.20's Imperative Web Server component allows unauthenticated network attackers to bypass authentication controls via HTTP and retrieve a limited subset of application data. The vulnerability is tagged as an Authentication Bypass and is difficult to exploit due to high attack complexity (AC:H), materially reducing real-world risk despite the network-accessible attack vector. No active exploitation is confirmed and no public exploit code has been identified at time of analysis. The CVSS score of 3.7 accurately reflects the low-severity nature: limited data exposure with no integrity or availability impact.
Partial confidentiality exposure in Oracle Hyperion Financial Management version 11.2.25.0.000 allows unauthenticated network attackers to read a subset of application data via HTTP under high-complexity conditions. The Security component is tagged as an authentication bypass, though impact is limited to low-severity data disclosure with no integrity or availability consequences. No public exploit code or CISA KEV listing exists at time of analysis.
Unauthorized read access to data in Oracle Hyperion Calculation Manager 11.2.25.0.000 is achievable by unauthenticated network attackers via HTTP, exploiting a flaw in the Security component tagged as an Authentication Bypass. The attack carries high complexity (AC:H), substantially limiting opportunistic exploitation, and impacts only a subset of accessible data with no integrity or availability consequences. No public exploit code or active exploitation in the wild has been identified at time of analysis; Oracle disclosed this through their August 2026 Critical Security Patch Update.
Oracle Java SE's Security component across all current LTS and preview releases - versions 8u501 through 26.0.2 - along with GraalVM for JDK and GraalVM Enterprise Edition, permits unauthenticated remote attackers to read a limited subset of data via crafted API inputs delivered through web services. Despite the network-accessible, zero-authentication vector (AV:N/PR:N/UI:N), the high attack complexity (AC:H) and confined confidentiality impact (C:L) constrain real-world risk, yielding a CVSS 3.1 base score of 3.7. No public exploit code and no CISA KEV listing have been identified at time of analysis, and Oracle disclosed this finding through its standard August 2026 Critical Patch Update cycle rather than an emergency out-of-band advisory.
Unauthorized data exposure in Oracle Hyperion Financial Reporting 11.2.25.0.000 enables unauthenticated remote attackers to read a subset of accessible financial data via HTTP under high-complexity conditions. Tagged as an authentication bypass, the vulnerability is reachable without credentials and without user interaction, yet the AC:H rating signals that reliable exploitation is non-trivial. No public exploit code has been identified and no active exploitation is confirmed; however, the financial sensitivity of data processed by Hyperion EPM elevates the practical significance beyond the raw CVSS 3.7 Low score for affected organizations.
Partial authentication bypass in Oracle Hyperion Calculation Manager 11.2.25.0.000 allows an unauthenticated remote attacker to read a limited subset of application data over HTTP without valid credentials. The attack is classified as difficult to exploit (AC:H), meaning specific conditions must be met for reliable success, and impact is confined to low-level confidentiality loss with no integrity or availability consequences. No public exploit code or active exploitation has been identified at time of analysis.
Integrity compromise in Oracle Helidon 1.4.20's Imperative Web Server component enables unauthenticated remote attackers to perform limited unauthorized data modifications via HTTP under high-complexity conditions. The vulnerability, tagged as an authentication bypass, allows circumvention of access controls to execute unauthorized update, insert, or delete operations on Helidon-accessible data without requiring credentials or user interaction. No public exploit code has been identified and no active exploitation is confirmed; the CVSS 3.7 Low score combined with high attack complexity (AC:H) significantly constrain real-world risk.
Limited data exposure in Oracle Agile PLM MCAD Connector version 3.6 allows an unauthenticated attacker with access to the same physical network segment as the target host to partially read and modify application data. Exploitation is constrained by adjacent-only network access, high attack complexity, and a mandatory human-interaction requirement, resulting in a low CVSS 3.1 base score of 3.7. No public exploit code or active exploitation has been identified at time of analysis.
Local access exploitation in Oracle Hyperion Calculation Manager 11.2.25.0.000 allows an unauthenticated attacker with infrastructure logon to partially compromise data confidentiality and integrity, requiring human interaction to succeed. Tagged as an authentication bypass in the Security component, the flaw yields only limited read and write/insert/delete access to a subset of accessible data, with no availability impact. No public exploit or CISA KEV listing exists at time of analysis; the low CVSS score of 3.6 reflects the constrained impact and high exploitation complexity.
Unauthorized data modification in Oracle Hyperion Calculation Manager 11.2.25.0.000 allows a low-privileged, network-accessible attacker to perform unsanctioned insert, update, or delete operations against accessible application data via HTTP. Exploitation requires human interaction from a third party, indicating a client-side or social-engineering attack vector such as CSRF or a crafted link. No public exploit code exists and this CVE is not listed in the CISA KEV catalog; with a CVSS 3.1 score of 3.5 and integrity-only impact, this represents a low-severity, low-urgency finding in most enterprise risk frameworks.
Cross-site request forgery in MyBB's Admin CP Security Questions module (versions prior to 1.8.40) permits same-site attackers to toggle registration challenge questions on or off by tricking an authenticated administrator into visiting a specially crafted URL. The vulnerable controller in admin/modules/config/questions.php accepted GET requests for enable and disable actions and directly modified the mybb_questions.active database field without calling verify_post_check() against the my_post_key anti-CSRF token. No public exploit has been identified at time of analysis, and the vendor released a patch in MyBB 1.8.40.
Cross-site request forgery in MyBB's Admin Control Panel View Manager allows same-site attackers to silently change an administrator's default user list view by tricking the admin into visiting a specially crafted URL. All MyBB installations prior to version 1.8.40 are affected; the root cause is the set_default action in admin/inc/functions_view_manager.php accepting state-changing GET requests without CSRF token validation. No public exploit code has been identified and this vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog; the vendor-released fix is confirmed in MyBB 1.8.40.
Cross-site request forgery in MyBB's Admin CP Mass Mail module (versions prior to 1.8.40) allows same-site attackers to manipulate an authenticated administrator's session to create draft mass mail entries from archived ones. The Resend route under Users & Groups → Mass Mail → Mass Mailing Archive processed GET requests and performed state-changing database writes (setting mybb_massemails.status = 0) without any CSRF token verification, enabling forged requests via a specially crafted URL. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; the vendor-released patch is available in MyBB 1.8.40.
Local integrity and availability compromise in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows a high-privileged attacker with local system access to make unauthorized data modifications and cause partial denial of service within the Installation and Configuration component. The CVSS 3.1 base score of 3.4 (Low) reflects a tightly constrained impact scope - no confidentiality exposure and only partial integrity and availability degradation. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation at time of analysis.
Oracle VM VirtualBox 7.2.14 (Core component) exposes a low-severity local vulnerability that permits a high-privileged attacker with logon access to the host infrastructure to perform unauthorized read and limited write operations against a subset of VirtualBox-accessible data. Confidentiality and integrity are partially affected; availability is not impacted. No public exploit has been identified at time of analysis, and the combination of local-only attack vector and required high-privilege access significantly narrows the realistic attacker population.
Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 exposes a low-severity flaw in its Common Security component that permits a highly privileged, network-adjacent attacker to perform unauthorized data modifications and induce a partial denial of service via HTTP. The CVSS 3.1 base score of 3.3 reflects genuinely constrained exploitability - both high attack complexity and pre-existing high-privilege access are required before any impact is possible. No public exploit code or active exploitation has been identified at time of analysis.
Oracle Hyperion Financial Management version 11.2.25.0.000 exposes a low-severity, network-accessible vulnerability in its Security component that allows a high-privileged, authenticated attacker to read a limited subset of application data and cause a partial denial of service via HTTP. The CVSS 3.1 base score of 3.3 (Low) accurately reflects the constrained real-world risk: exploitation demands both elevated privileges and high attack complexity, substantially limiting the attacker population. No public exploit code or active exploitation has been identified at time of analysis.
Local information disclosure in Oracle Agile PLM MCAD Connector 3.6 exposes a subset of PLM-accessible data to unauthenticated local attackers exploiting an authentication bypass in the CAX Client component. Exploitation is gated by two significant constraints: the attacker must have local logon access to the infrastructure hosting the connector, and a separate legitimate user must interact with the application during the attack window. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis, consistent with the low CVSS 3.1 base score of 3.3.
Local information disclosure in Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 allows a low-privileged local attacker to read a subset of data accessible to the application. The vulnerability resides in the Installation and Configuration component and requires only local logon access with standard user privileges. No active exploitation or public exploit code has been identified at time of analysis.
Local privilege abuse in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows a low-privileged, authenticated local user to perform unauthorized insert, update, or delete operations against data accessible to the Installation and Configuration component. The vulnerability is vendor-confirmed via Oracle's Critical Security Patch Update for August 2026 and carries a low CVSS 3.1 base score of 3.3, reflecting limited impact scope restricted to partial integrity loss with no confidentiality or availability effects. No public exploit code or CISA KEV listing exists at time of analysis, consistent with the low severity and local-access requirement.
Local low-privileged access to Oracle Agile PLM MCAD Connector 3.6 enables an authenticated attacker to partially degrade availability of the CAX Client component. Oracle's August 2026 Critical Patch Update (CPU) documents this as easily exploitable by any user with a logon to the host infrastructure, resulting in partial denial of service with no confidentiality or integrity impact. No public exploit identified at time of analysis, and CISA KEV listing is absent, placing this firmly in the low-urgency category.
Memory disclosure outside the Chrome renderer sandbox is possible via uninitialized GPU resource access in Google Chrome prior to 151.0.7922.169. An attacker who has already compromised the renderer process can trigger the flaw through a crafted HTML page, allowing reads of memory belonging to processes outside the sandbox boundary. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch is confirmed available.
Partial denial of service in Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a low-privileged, authenticated attacker over HTTP, targeting the Security component under high-complexity conditions. Impact is limited exclusively to availability - no confidentiality or integrity compromise is possible - resulting in a partial service disruption rather than full outage. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, placing it at low real-world priority for most environments.
Partial information disclosure in Oracle Hyperion Calculation Manager 11.2.25.0.000 allows a low-privileged, network-authenticated attacker to read a subset of application data via HTTP under high-complexity conditions. The vulnerability resides in the Security component and is tagged as an authentication bypass, suggesting insufficient authorization enforcement rather than a full credential bypass. No public exploit code has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV.
Partial unauthorized data read in Oracle Hyperion Calculation Manager 11.2.25.0.000 is achievable by an unauthenticated remote attacker via HTTP, though exploitation is rated difficult and requires human interaction from a third party. The vulnerability is tagged as an authentication bypass in the Security component, resulting in low-severity confidentiality exposure with no integrity or availability impact (CVSS 3.1: 3.1). No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this firmly in the low-priority tier for most organizations.
Unauthorized read access to a subset of Oracle Hyperion Calculation Manager 11.2.25.0.000 data is achievable by an unauthenticated attacker who has gained proximity to the physical communication segment on which the software executes, exploiting a flaw in its Security component. The CVSS 3.1 score of 3.1 reflects a tightly constrained impact - confidentiality only, with no integrity or availability effects - combined with an adjacent-only network vector and high attack complexity. No public exploit code and no active exploitation have been identified at time of analysis.
Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 contains a low-severity local vulnerability in its Installation and Configuration component that allows a highly privileged local attacker to perform limited unauthorized data manipulation and cause a partial denial of service. Exploitation requires both local system logon and high privilege level, with high attack complexity - meaning special conditions beyond the attacker's direct control must also be present. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; it was disclosed as part of Oracle's August 2026 Critical Patch Update.
Local privilege-abuse in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows a high-privileged local attacker to partially corrupt data integrity and cause a partial denial of service against the Installation and Configuration component. The vulnerability requires physical or logical logon access to the host infrastructure where Hyperion executes, and exploitation is rated High Complexity, significantly constraining real-world risk. No public exploit code and no CISA KEV listing are associated with this vulnerability at time of analysis.
Local privilege abuse in Oracle Hyperion Financial Management 11.2.25.0.000 allows a high-privileged attacker with logon access to the host infrastructure to read a subset of accessible data and perform unauthorized insert, update, or delete operations against that data. The vulnerability resides in the Security component and carries a CVSS 3.1 base score of 3.0, reflecting its constrained local attack vector, high complexity, and high privilege prerequisites. No public exploit code has been identified and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at time of analysis.
Oracle Hyperion Financial Management version 11.2.25.0.000 exposes a low-severity local vulnerability in its Security component, enabling a high-privileged attacker with local infrastructure logon to perform unauthorized data modification and cause partial denial of service. The CVSS vector (AV:L/AC:H/PR:H) confirms that exploitation requires both physical or logical local access and a high-privilege account, with complex attack conditions that must be met. No public exploit code has been identified and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog, consistent with its low base score and restricted attack surface.
Limited-impact local privilege abuse in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows an already-privileged local attacker to gain unauthorized read and write access to a restricted subset of Hyperion data. Exploitation requires both local logon access to the infrastructure host and high-level existing privileges, making this extremely constrained in scope. No public exploit code and no active exploitation (CISA KEV) have been identified; the overall risk is low and consistent with the CVSS 3.1 score of 3.0.
SSRF port restriction bypass in MobSF (Mobile Security Framework) prior to 4.5.1 allows authenticated high-privilege users to cause the server to make outbound HTTP requests to attacker-selected non-standard ports by uploading a crafted APK. The `get_browsable_activities()` function in `manifest_analysis.py` validates only the `android:host` attribute via `valid_host()`, which enforces a 80/443-only port allowlist, but then appends the separately supplied `android:port` attribute to the assembled URL without re-validating the combined result - enabling port restriction bypass. When combined with DNS rebinding between the validation lookup and the `requests.get()` connection, the outbound request can reach internal services; however, the path is fixed to `/.well-known/assetlinks.json` and redirects are disabled. No public exploit has been identified at time of analysis, and the vulnerability is not in CISA KEV.
Unauthorized data modification is possible in Oracle Hyperion Financial Reporting 11.2.25.0.000 (Server component), exploitable by low-privileged authenticated attackers over HTTP under conditions of high attack complexity and required third-party user interaction. The impact is confined exclusively to limited integrity - partial unauthorized write access to financial reporting data - with no confidentiality or availability exposure. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; the vendor-assigned CVSS score of 2.6 reflects the multiple prerequisite conditions that substantially limit real-world exploitability.
Integrity compromise in Oracle Hyperion Calculation Manager 11.2.25.0.000 is achievable by a low-privileged attacker physically co-located on the same network segment as the affected host. Exploitation requires high attack complexity and yields only partial data modification - unauthorized insert, update, or delete of a subset of accessible data with no confidentiality or availability impact. No public exploit code and no CISA KEV listing exist at time of analysis, making real-world exploitation unlikely outside of highly targeted scenarios.
Oracle Hyperion Financial Management 11.2.25.0.000 exposes a low-severity integrity flaw in its Security component that permits a local, unauthenticated attacker - one with OS-level logon to the host infrastructure - to perform unauthorized insert, update, or delete operations against a subset of accessible application data. Exploitation is rated difficult (AC:H) and additionally requires human interaction from a party other than the attacker, substantially constraining real-world opportunity. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog, consistent with its 2.5 CVSS base score.
Local information disclosure in Oracle Agile PLM MCAD Connector version 3.6 allows a low-privileged, locally authenticated attacker to read a subset of data accessible to the CAX Client component under high-complexity exploitation conditions. Reported by Oracle Security (secalert_us@oracle.com) as part of the August 2026 Critical Patch Update and tracked under ENISA EUVD-2026-62027, this vulnerability carries a CVSS 3.1 base score of 2.5, reflecting strictly limited confidentiality impact with no integrity or availability consequences. No public exploit code has been identified at time of analysis, and active exploitation has not been confirmed.
Batch and time-series HTTP handlers in ArcadeDB before 26.8.1 omit the setCurrentUser call when dispatching work to worker threads, causing the fine-grained per-type ACL layer to silently skip authorization checks for those endpoints. Authenticated users with restricted per-type permissions can read from and write to data types they are not authorized to access by routing requests through the affected handlers. No public exploit has been identified and the CVSS 4.0 score of 2.3 reflects the narrow exploitation prerequisites - only deployments actively using per-type or per-group ACLs are vulnerable.
Denial of service in Zabbix server and proxy can be triggered by an authenticated administrator who crafts malicious JavaScript scripts within preprocessing or script item configurations, causing the server or proxy process to crash. All Zabbix versions are listed as affected per the wildcard CPE entry. Exploitation requires high-privilege administrative access, and no public exploit code or CISA KEV listing exists at time of analysis.
OAuth client secret exposure in Zabbix email media configuration allows a Super Admin to exfiltrate the stored client secret by pointing the Token endpoint to an attacker-controlled server. Because the secret is masked in the UI after saving but still transmitted when OAuth token requests are made, changing the endpoint URL effectively redirects the credential to an external host. No public exploit or active exploitation has been identified; the vendor has addressed the issue by resetting the client secret whenever the token endpoint is changed.