A denial-of-service flaw in the RDBMS component of Oracle Database Server (versions 23.4.0 through 23.26.3) lets a low-privileged, authenticated user reach the database over Oracle Net and force a hang or repeatable crash of the instance. The CVSS 3.1 base score of 7.7 reflects network reachability, low attack complexity and a Scope Change because the outage can ripple into dependent applications layered on the database. No public exploit code or CISA KEV entry has been identified at time of analysis, so current risk is driven by the ease of the attack for anyone holding a valid database account rather than by observed exploitation.
Oracle Agile PLM 9.3.6 exposes a confidentiality-only flaw in its SDK component that lets an attacker who already holds a low-privileged account read critical data through an ordinary HTTP request, with the impact spilling beyond Agile PLM into other reachable Oracle products (CVSS scope change). Oracle rates the issue 7.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), noting no integrity or availability impact. No CISA KEV listing, EPSS score, or public exploit code was present in the supplied intelligence, so active exploitation is not confirmed at time of analysis.
Authenticated, low-privileged users with network HTTP access to the Oracle Bills of Material Setup Workbench in Oracle E-Business Suite 12.2.3 through 12.2.15 can read critical Bills of Material data they are not authorized to see, including data belonging to other integrated Oracle products because the vulnerability crosses a security scope boundary (CVSS 3.1 base score 7.7, High). The weakness is confidentiality-only - there is no integrity or availability impact - and exploitation requires a valid low-privileged application account (PR:L) plus reachable HTTP access to the affected component, with no user interaction needed. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and no EPSS score was supplied; the limiting factors are the authentication prerequisite and the read-only nature of the impact.
Let me produce the JSON. Key details: Oracle iRecruitment in Oracle E-Business Suite, versions 12.2.3-12.2.15. CVSS 7.7, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. CWE N/A. Tags: Authentication Bypass, Oracle. Reference: Oracle security alert cspusep2026.html. No EPSS, no KEV, no POC info. Note: CVSS says PR:L — low privileged authenticated. But the tag says "Authentication Bypass". Slight conflict — should note in confidence_notes/risk_assessment. Actually PR:L means attacker needs low-privileged credentials (authenticated user). The tag "Authentication Bypass" is possibly mislabeled; hmm, should I flag it? The tag "Authentication Bypass" conflicts with PR:L. But data_quality_flags should only be used for concrete verifiable issues — mislabeled tags. Hmm, "Authentication Bypass" vs PR:L... The CVSS vector is authoritative from NVD. It's arguably a conflicting tag. But the guidance says don't flag severity/CVSS disagreements... it says "Do NOT flag severity/CVSS/version disagreements here". A tag mislabel is different. Still, I'd be moderately confident. I think I'll leave the array empty, or maybe flag it? Let me think: type "mislabeled_tag" for "Authentication Bypass" — target is exact wrong value as it appears in Tags. Reason: CVSS vector indicates PR:L requiring credentials, not an auth bypass. Confidence medium. Hmm, but the tag could reflect something else (e.g., unauthorized access to data via a bypass within the app). Risky. I'll emit empty array to be safe... Actually the instruction says only emit when high confidence and clearly verifiable. I'm not high confidence. Empty array. Also "Oracle" tag is correct vendor. Missing tags? Could suggest "oracle-ebs" or "e-business-suite"? Not a standard platform tag necessarily. I'll leave empty. Prevalence: Oracle E-Business Suite is enterprise ERP widely deployed in large enterprises. "high" or "medium". EBS is widely deployed in large enterprises/government. I'd say "high" — but it's not everywhere. I'd say "medium"
Oracle Product Hub, a module of Oracle E-Business Suite (Item Catalog component), versions 12.2.3 through 12.2.15, allows an authenticated low-privileged attacker with HTTP network access to retrieve data beyond their authorized scope, including critical item and catalog data, with the compromise potentially spilling into other E-Business Suite products (scope change). Oracle rates this CVSS 3.1 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) — confidentiality-only impact with no integrity or availability effect. There is no public exploit identified at time of analysis and the issue does not appear in CISA KEV, though the low attack complexity and required low privilege level keep it attractive for an insider or a compromised low-privilege ERP account.
Oracle Product Hub, the product information management component of Oracle E-Business Suite (Item Catalog module), exposes critical item data to any low-privileged authenticated user who can reach the application over HTTP in versions 12.2.3 through 12.2.15. An attacker with a valid but minimal account can send crafted requests that return data far outside their assigned responsibilities, and Oracle notes the compromise can extend into other, interconnected E-Business Suite products (scope change). Oracle rates this 7.7 with a confidentiality-only impact; no public exploit code or CISA KEV entry is available at time of analysis, so exploitation would currently require an attacker who already holds or can obtain a low-privilege account.
Oracle E-Business Suite's Product Hub module (Item Catalog component) in versions 12.2.3 through 12.2.15 exposes critical item data to any authenticated low-privileged user who can reach the application over HTTP. A successful attack grants unauthorized read access to Product Hub data and, per Oracle's scope-change assessment, can also affect other EBS products sharing the same data and session context. Only confidentiality is impacted (no integrity or availability effect), and no public exploit code or CISA KEV entry was identified in the supplied intelligence at time of analysis.
Unauthorized access to critical data in Oracle BI Publisher 12.2.1.4.0 allows a low-privileged attacker with network reachability to the SOAP-based Web Service API to read data that should be outside their authorization. Because the flaw carries a scope change (S:C), compromised BI Publisher data can extend to other Oracle Analytics components that trust the service. No public exploit code and no CISA KEV listing were identified at time of analysis; the issue is addressed only through Oracle's Critical Patch Update cycle.
Authenticated low-privileged users of Oracle BI Publisher 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0 can read sensitive report data they should not be able to access by sending crafted HTTP requests to the BI Platform Security component. The flaw is network-reachable, low complexity, and can pivot beyond BI Publisher itself (CVSS scope change), though it affects confidentiality only — no data modification or denial of service. No CISA KEV listing, EPSS score or public exploit code was supplied at time of analysis, and Oracle has published a Critical Security Patch Update advisory covering the fix.
Oracle Business Intelligence Enterprise Edition (Presentation Services component) fails to properly enforce access controls on its SOAP interface, allowing a user holding only a low-privileged account to read data they should never be able to reach — up to and including all BI data accessible through the platform, with a claimed spillover effect on additional products. Affected releases are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0; Oracle rates it CVSS 3.1 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), meaning confidentiality-only impact, no integrity or availability loss, and no user interaction. No public exploit code has been identified and the flaw is not listed in CISA KEV, but the barrier to entry is low once any valid BI account is obtained, so the exposure is meaningful for internet- or partner-reachable deployments.
Oracle E-Business Suite 12.2.3 through 12.2.15 contains a broken-authorization flaw in the Customer Interaction History module (Outcome-Result component) that allows a low-privileged user with HTTP access to read data well outside their intended privileges. Exploitation is trivial once an attacker holds any valid low-privileged EBS account, and Oracle's own CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, 7.7) marks it as an easily exploitable, confidentiality-only issue whose scope change means other EBS modules can be affected. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied, so the practical risk is driven by the enormous blast radius of an ERP holding financial, HR and customer records rather than by confirmed active exploitation.
Low-privileged users of Oracle iStore in Oracle E-Business Suite 12.2.3 through 12.2.15 can reach data they should not be able to read through the Shopping Cart component over HTTP. Successful exploitation results in unauthorized access to critical data or complete read access to everything the iStore application can reach, and because the flaw carries a scope change it can also significantly affect other E-Business Suite products. Oracle rates it CVSS 3.1 7.7 (confidentiality only, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N); no public exploit code and no CISA KEV entry were identified at time of analysis.
Oracle E-Business Suite Order Management (versions 12.2.5 through 12.2.15) exposes order data through its Product Diagnostic Tools component to any low-privileged user who can reach the HTTP interface. The flaw is easily exploitable — network vector, low complexity, no user interaction — and Oracle notes the impact can spread beyond Order Management into interconnected products, resulting in unauthorized access to critical data or complete access to all Order Management data. No public exploit code or CISA KEV listing was provided at time of analysis; no patch version is specified in the available references beyond the linked Oracle advisory.
Oracle E-Business Suite's Marketing module (Audience component) in versions 12.2.3 through 12.2.15 exposes critical data to any attacker holding a low-privileged, authenticated account, who can reach the vulnerable component over HTTP and read information well beyond their intended authorization boundary. Oracle scores it 7.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) — a scope-changing, confidentiality-only flaw with no integrity or availability impact. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied, so the immediate driver is the breadth of affected enterprise deployments rather than confirmed in-the-wild activity.
Authenticated but low-privileged users with HTTP access to Oracle WebCenter Portal can reach data well beyond their intended permissions through a flaw in the Runtime Tools component, affecting versions 12.2.1.4.0 and 14.1.2.0.0. Oracle scores it CVSS 7.7 with a scope change, meaning the portal's compromise can ripple into additional products reachable from it, with the impact limited to confidentiality. Neither CISA KEV listing nor public exploit code has been identified at time of analysis, and no EPSS probability was supplied, though the low attack complexity and absence of user interaction make weaponization plausible.
Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 allow a low-privileged, authenticated attacker with HTTP network access to read data they should not be able to reach through the Portlet Services component, scoring 7.7 on CVSS 3.1 with a scope change that can extend the impact to interconnected products. Exploitation requires only a valid low-privilege account and no user interaction, but with no CISA KEV listing, no EPSS score, and no public exploit code identified in the supplied intelligence, there is currently no public exploit identified at time of analysis. The practical priority is for organizations running the two affected WebCenter Portal releases facing untrusted or multi-tenant user populations.
An authenticated, low-privileged user with HTTP access to the Oracle Agile PLM 9.3.6 Application Server can break out of their assigned access controls and read data they should never see, including records belonging to other tenants, projects, or business units — with vendor scoring putting confidentiality impact at High and noting the attack can also affect interconnected products (scope change). No integrity or availability impact is described, so this is a pure data-exposure bug rather than a code-execution or data-destruction issue. Oracle published the fix through its Critical Security Patch Update cycle referenced at oracle.com/security-alerts/cspusep2026.html; no EPSS score, CISA KEV listing, or public proof-of-concept was supplied in the available intelligence, so exploitation status is unconfirmed.
Improper access control in Oracle Proposals, a module of Oracle E-Business Suite (component: Internal Operations), lets a low-privileged, authenticated attacker reach data outside their authorization boundary over HTTP. Supported releases 12.2.3 through 12.2.15 are affected, and successful exploitation yields unauthorized read access to critical Oracle Proposals data with a scope change that can extend impact to other EBS-backed products. Oracle rates the issue 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N); no public exploit code or CISA KEV entry is present in the supplied intelligence, so it should be treated as an unpatched-window exposure rather than a confirmed in-the-wild campaign.
Low-privileged, network-reachable users of Oracle Field Service can read data far beyond their authorized scope in Oracle E-Business Suite releases 12.2.3 through 12.2.15, potentially reaching critical data across additional products because the flaw crosses a security scope boundary (CVSS 3.1 7.7, C:H only). The vulnerability is exploitable over HTTP with no user interaction once a low-privileged session exists, and no public exploit code or active exploitation is identified at time of analysis. Oracle has published a Critical Security Patch Update advisory covering this issue; there is no CISA KEV listing and no EPSS score was supplied in the source data.
Oracle Sales, the sales module of Oracle E-Business Suite (supported versions 12.2.3 through 12.2.15), exposes critical business data to any low-privileged authenticated user who can reach its HTTP interface. A crafted request against the Internal Operations component bypasses the intended access boundary, and because the CVSS vector carries a scope change (S:C), the exposure is not limited to Oracle Sales — data reachable through additional Oracle products can be read as well. Oracle classifies it as 'easily exploitable' (AV:N/AC:L/PR:L/UI:N, CVSS 3.1 base 7.7, confidentiality-only impact); no public exploit code, EPSS score, or CISA KEV entry was provided in the source data.
Oracle PeopleSoft Enterprise PRTL Interaction Hub 9.1 (Enterprise Portal component) permits a low-privileged user with HTTP access to the portal to read data well beyond their assigned role, exposing critical enterprise data and, because the flaw crosses a trust boundary, potentially data held in other PeopleSoft products reachable through the portal. Oracle scores it 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) — confidentiality-only with a scope change — and fixed it in the 2026 Critical Patch Update. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied with the source data.
Missing authorization enforcement in the Core component of Oracle Enterprise Manager for Oracle Database 24.1 allows an authenticated, low-privileged attacker with HTTP access to read any data the management platform can reach, including data belonging to managed database targets, a confidentiality-only compromise that also changes scope (CVSS 3.1: 7.7). Oracle rates it easily exploitable because it needs only a valid low-privilege account and network reach to the console, and no public exploit identified at time of analysis. Oracle has published a fix in its Critical Security Patch Update advisory for the affected 24.1 release.
Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0 allow a low-privilege authenticated user with HTTP access to the Client Bundle component to read all data accessible to the Capture application, and - because the vulnerable component crosses a security scope boundary - potentially reach data in adjacent Oracle Fusion Middleware products. The flaw is rated CVSS 3.1 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) and is confidentiality-only, with no integrity or availability impact; exploitation requires an existing low-privilege account, so despite being tagged 'Authentication Bypass' in threat-intelligence feeds, this is not reachable by a fully unauthenticated actor. No public exploit code and no confirmed active exploitation were identified at time of analysis, though the low attack complexity and lack of user interaction make it attractive for post-authentication data theft against internet-exposed Capture deployments.
Oracle Hyperion Data Relationship Management 11.2.26.0.000 contains an access-and-security flaw that lets a high-privileged attacker reach the application over HTTP and create, delete or modify critical master-data records while also reading data they should not be able to reach. The CVSS 3.1 score is 7.7 (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N), reflecting a hard-to-trigger but high-impact condition that also escapes the product boundary and can affect other Oracle products. No public exploit code or CISA KEV entry was identified, and exploitation requires an already high-privileged account, so this is a privileged-insider or post-compromise escalation and data-integrity risk rather than a mass-exploited remote flaw.
Server-side request forgery in OpenCTI versions prior to 7.260701.0 lets an authenticated account holding the INGESTION capability force the platform to issue outbound HTTP(S) requests to arbitrary destinations, including loopback, link-local, private-range and cloud metadata endpoints, because the synchronizerFetch GraphQL query only validated that the supplied URL used HTTP or HTTPS and never applied the ingestion deny list. Distinguishable connection errors let the attacker map internal services (open HTTP ports, open non-HTTP ports and closed ports), while responses from compatible endpoints can leak internal data. The vendor released a fix in 7.260701.0, and no public exploit code or active exploitation is identified in the available data.
Heap use-after-free in FreeRDP's DRDYNVC dynamic-virtual-channel parser lets an authenticated RDP client crash or potentially execute code on a FreeRDP server running versions before 3.31.0. The flaw (CWE-362 race condition) is triggered by racing AUDIN channel-closure messages against DRDYNVC data parsing, causing the parser to dereference a channel pointer after the synchronization lock has been released. CVSS 4.0 rates it 7.7 (AV:N/AC:H/AT:P/PR:L/UI:N, high C/I/A), so a valid session and precise timing are required; no public exploit code or CISA KEV entry was identified at time of analysis.
Oracle Hyperion Data Relationship Management 11.2.26.0.000 allows an authenticated low-privileged attacker with network HTTP access to bypass access controls in the 'Access and security' component and read critical data, up to and including everything the affected DRM instance can reach, with no user interaction required. The impact is confidentiality-only (CVSS 3.1 7.7, C:H/I:N/A:N) but carries a scope change (S:C), meaning the data exposed can extend beyond DRM into additional integrated Oracle products. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the low-privileged account prerequisite keeps this a genuine but moderate-priority risk for organizations running the affected release in enterprise master-data deployments.
Insufficient access controls in Oracle Hyperion Data Relationship Management (DRM) 11.2.26.0.000 let a low-privileged, network-positioned user read data far beyond their granted role, including all data the DRM service can access. The flaw sits in the 'Access and security' component and carries a scope change, meaning compromised instances can become a pivot into additional Oracle Hyperion/EPM products that trust the DRM service. Oracle's CVSS 3.1 base score is 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N); no CISA KEV listing, public exploit code, or EPSS score was present in the supplied intelligence, so exploitation appears neither confirmed nor publicly demonstrated at time of analysis.
Oracle Purchasing (G-Invoicing component) in Oracle E-Business Suite 12.2.10 through 12.2.15 permits a low-privileged, authenticated user with HTTP network access to read critical data and potentially reach data belonging to other Oracle products because the flaw crosses a scope boundary. Oracle's own CVSS 3.1 rating is 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), reflecting confidentiality-only impact with no integrity or availability effect. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; exploitation requires a valid low-privileged EBS account rather than anonymous access.
Unauthenticated? No — low-privileged authenticated users of Oracle Engineering, the engineering change-management module of Oracle E-Business Suite (versions 12.2.3 through 12.2.15), can read data well beyond their authorization by sending crafted HTTP requests to the Change Management component. Because the CVSS scope is marked Changed (S:C), the confidentiality loss is not confined to Engineering records — the vendor warns that attacks may significantly impact additional EBS products sharing the same database instance, yielding high (C:H) unauthorized access to critical data with no integrity or availability impact. No public exploit code or CISA KEV listing is identified in the available intelligence, and no EPSS score was supplied, so the practical risk today is driven mainly by the large authenticated user population typical of EBS deployments and the difficulty of patching ERP systems promptly.
Oracle's Enterprise Command Center (ECC) Framework in Oracle E-Business Suite V16 exposes sensitive data to any authenticated low-privileged user who can reach the HTTP interface, because the component fails to enforce proper access controls on data it serves. Successful exploitation yields high confidentiality impact on the ECC Framework and can extend beyond it (scope change) to connected E-Business Suite components, though integrity and availability are unaffected. No public exploit code or CISA KEV entry was present in the provided intelligence at time of analysis, but the attack requires only a valid low-privilege account and a network path to the application, which Oracle itself characterizes as easily exploitable.
Oracle BI Publisher, in its E-Business Suite XDO integration component, mishandles access control in a way that lets a low-privileged user with ordinary HTTP network access read critical data — including all data the BI Publisher instance can reach — across versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. The CVSS 3.1 base score is 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), reflecting confidentiality-only impact with a scope change that can spill into connected E-Business Suite products. No public exploit code was identified at time of analysis, and the CVE is not listed in CISA KEV, but the low privilege bar and network reachability make it a realistic post-authentication data-exfiltration risk rather than a theoretical one.
Information disclosure in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 lets a low-privileged attacker with HTTP network access read data far beyond their authorized scope, including critical business data reachable through the Experience Manager component. Oracle's own advisory assigns CVSS 3.1 base 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), flagging a scope change that can affect additional, connected products. No public exploit code or CISA KEV entry was present in the supplied intelligence, and no EPSS signal was provided, so exposure should be judged against the existence of a reachable, authenticated foothold on the platform.
Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 contains an access-control weakness in the Experience Manager component that lets a low-privileged authenticated user read critical data through ordinary HTTP requests, with the impact extending beyond the vulnerable component into other products (scope change). The vendor rates it CVSS 3.1 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) — a confidentiality-only issue, with no integrity or availability impact. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied; exploitation is therefore likely to require a valid low-privileged account and deliberate targeting rather than opportunistic scanning.
Oracle Siebel CRM 17.0 through 26.7 exposes a flaw in the Open UI component that lets a low-privileged, network-positioned attacker compromise a victim's Siebel CRM End User session once that victim is persuaded to interact with attacker-supplied content. Successful exploitation yields unauthorized read, creation, deletion or modification of critical and otherwise inaccessible CRM data, and the scope-change (S:C) rating means the fallout can extend to products beyond Siebel CRM End User itself. Rated CVSS 7.7 with high attack complexity, the bug is difficult to exploit reliably, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Oracle Web Applications Desktop Integrator (a component of Oracle E-Business Suite 12.2.3 through 12.2.15) exposes a file download weakness that lets a low-privileged, network-connected user retrieve data they should not be able to reach. Exploitation is rated 'easily exploitable' by Oracle — HTTPS network vector, low complexity, no user interaction — and because the flaw can cross a security boundary (CVSS scope change), successful abuse may expose critical data belonging to other EBS components, not just the Desktop Integrator. CVSS 3.1 base score is 7.7 with confidentiality-only impact; no public exploit code, EPSS score, or CISA KEV entry was present in the supplied intelligence, so active exploitation is not confirmed at time of analysis.
Oracle Sales Offline, a module of Oracle E-Business Suite 12.2.3 through 12.2.15, lets a low-privileged authenticated user with HTTP access read critical data far beyond their intended authorization, and Oracle's own scoring marks the impact as a scope change, meaning the flaw in this component can also reach data owned by other EBS products. The CVSS 3.1 base score is 7.7 with high confidentiality impact and no integrity or availability impact, and no public exploit code or CISA KEV entry was identified at time of analysis.
Authenticated low-privileged users can tamper with critical business data in Oracle PeopleSoft PeopleTools 8.61 through 8.63 by abusing the Integration Broker component over HTTP. Oracle rates the flaw 7.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N), an integrity-only impact that can also propagate into other applications attached to the same integration fabric. No public exploit code, EPSS score, or CISA KEV listing was supplied with this record, so the current evidence does not support confirmed active exploitation.
Let me synthesize. Product: Concrete CMS. CVE-2026-81897: stored XSS via CSRF in Express entities forms dashboard controller save_control action, no anti-CSRF token validation. Authenticated admin tricked into submitting forged cross-site request → attacker-controlled headline and body values written to existing Express form Text control → emitted without output encoding → stored XSS. CVSS 4.0 vector: AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N → 7.7. Note: CVSS 3.1 equivalent — for assessed_cvss_vector, I need my own. This is CSRF+stored XSS: AV:N, AC:L (or H due to requiring admin interaction), PR:N (attacker unauthenticated), UI:R (requires victim admin to visit a page / submit), S:C (scope change — attacker from web goes to admin's browser context... Actually with stored XSS in admin panel, scope could be C), C:H/I:H/A:H? Hmm. In classic CVSS 3.1 for CSRF leading to stored XSS in admin context, score would be like 8.0-8.8. Let's think: AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N is typical for XSS (score 7.4). But here it's stored XSS that gives full admin session control → possibly full compromise. Concrete CMS admin XSS can lead to RCE (file manager, install packages). But from data, the impact per CVSS 4.0 is VC:H/VI:H/VA:H on the vulnerable system. So map to CVSS 3.1: C:H/I:H/A:H? Hmm, VI:H and VA:H — writing to form control, executing JS. VA:H means high availability impact — which is a peculiar mapping; concrete CMS team used the new "vulnerable system" impacts. I'll produce a reasonable 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N? Hmm. Let me be careful: with the attacker needing to craft cross-site request (AC:L), no privileges (PR:N), requiring user interaction (UI:R). Scope: the vulnerability in the web app causing script execution in the admin's browser — typically S:C for XSS. Impact: stored XSS executes with admin privileges → can change content, possibly execute code, availability impact indirect. I'd pick C:H/I:L/A:N under S:C
A locally exploitable flaw in the Security component of Oracle Hyperion Financial Management 11.2.26.0.000 lets an attacker who already holds a high-privileged logon on the host running the application take full control of the product, with potential follow-on impact to other connected Oracle components (scope change). Exploitation additionally requires a user other than the attacker to perform some interaction, making this a privileged-operator-plus-social-engineering attack rather than a remote unauthenticated one, although successful exploitation yields complete confidentiality, integrity and availability loss on the HFM instance. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV; no EPSS score was supplied with the intelligence feed.
Authenticated users holding only read-only (reader) privileges on an ArcadeDB database can escalate to arbitrary JVM scripting by POSTing a {"language":"js"} command to /api/v1/command/{database}, because the polyglot query engine never applies the database-administrator authorization check enforced on the SQL/Cypher paths. A cooperating sandbox flaw lets those scripts reflect from the bound database object through database.getClass().getClassLoader().loadClass to classes outside the allowedPackages whitelist, allowing an attacker to read arbitrary host files such as /etc/passwd and configuration files outside the database scope. Process creation remains blocked, so OS command execution is not confirmed; exploitation needs valid credentials and no user interaction, the flaw is fixed in ArcadeDB 26.7.1, and no public exploit code or CISA KEV entry was identified at time of analysis.
Authenticated users of Flowise before 3.1.4 can escalate to organization owner across tenant boundaries by supplying arbitrary organization IDs to the organizationuser and workspace membership endpoints, because those APIs are not scoped to the caller's own tenant. The result is full administrative control over victim organizations, including the ability to create workspaces and reach the victim tenant's resources. No public exploit code or CISA KEV listing was present in the source data, but the flaw is trivially automatable once an attacker holds any valid account, and vendor patch 3.1.4 is available.
The npm package praisonai exposes a SandboxExecutor 'network-isolated' mode that is advertised to users as 'No network access (proxy blocked)' but only injects http_proxy/https_proxy=http://localhost:0 without creating any operating-system network boundary, so sandboxed commands that ignore proxy environment variables can still open sockets directly. Versions 1.2.3 through 1.7.1 of the npm package are affected; an initial fix shipped in 1.7.2. A local-only proof-of-concept is described in the vendor advisory (a plain Node HTTP client reaches a loopback server while a proxy
Server-side request forgery in Flowise versions before 3.1.4 allows a low-privileged authenticated user to supply arbitrary URLs to the Cheerio, Playwright, and Puppeteer document loader nodes, bypassing the platform's built-in SSRF protections. Because the fetched response body is returned as document text, the flaw is a full-read SSRF rather than a blind one, exposing cloud instance metadata, internal-only services, and private network resources to the attacker. No public exploit code or CISA KEV entry was identified in the supplied intelligence, and no EPSS score was provided, so real-world exploitation is currently unconfirmed; the vendor has released a patch in 3.1.4.
Oracle Hyperion Data Relationship Management 11.2.26.0.000 lets a high-privileged, network-positioned user defeat the Access and security component and reach well beyond their intended authorization boundary - reading critical master data and gaining update/insert/delete capability over data they should not control. Exploitation is low-complexity (AC:L) and requires no user interaction (UI:N), but it is gated behind a pre-existing high-privilege account on the DRM instance (PR:H), and because the vector carries a scope change (S:C), success can cascade into connected EPM and finance systems that trust DRM as a source of record. No public exploit code or confirmed active exploitation has been identified at time of analysis, and with an EPSS-style signal absent the 7.6 High rating rests almost entirely on the CVSS vector rather than on observed threat activity.
Broken object-level authorization in Flowise's openai-realtime endpoints lets any authenticated user read tool definitions and execute tools belonging to ChatFlows in other workspaces by supplying an unscoped chatflowid, with both GET and POST requests affected. The flaw is fixed in Flowise 3.1.4 and affects all earlier releases; it is tracked as CWE-639 (authorization bypass through user-controlled key). No public exploit code or CISA KEV entry was identified at time of analysis, and EPSS data was not supplied with this record, so risk should be judged from the authenticated-but-cross-tenant access model rather than from observed exploitation.
Oracle Siebel CRM Development (Integration - Scripting component), versions 17.0 through 26.7, can be crashed and partially read or modified by a low-privileged, authenticated attacker who can reach the application over HTTP. Successful exploitation yields a repeatable denial of service (hang or crash) plus unauthorized read of a subset of data and unauthorized insert/update/delete of some records, giving a CVSS 3.1 base score of 7.6. No public exploit code or CISA KEV entry is currently associated with this CVE, and no EPSS score was supplied, so the practical risk is driven mainly by the breadth of affected versions and the low privilege bar rather than by confirmed in-the-wild activity.
High-privileged users with network access to Oracle Hyperion Financial Management 11.2.26.0.000 can exploit a flaw in the product's Security component to read critical financial data and partially disrupt service availability. Oracle rates the issue CVSS 7.6 (AV:N/AC:L/PR:H/UI:N/S:C), and the scope-change metric indicates the compromise can extend to connected products beyond HFM itself. No public exploit code or CISA KEV listing was identified at time of analysis, and no EPSS score was supplied, so real-world exploitation activity remains unconfirmed.
Oracle Agile PLM 9.3.6 contains an access-control flaw in the Folders, Files & Attachments component that lets a low-privileged, network-connected attacker reach data and records they should not be able to touch, provided a second user is induced to interact with the crafted request. Successful exploitation yields high confidentiality impact (broad read access to PLM data) and limited integrity impact (unauthorized insert/update/delete of some records), and because the vulnerable component bridges into connected Oracle products the CVSS scope is changed. No public exploit code or CISA KEV entry has been identified at time of analysis, so this is a patch-window issue rather than an active emergency.
Oracle Hyperion Data Relationship Management 11.2.26.0.000 contains an access-control flaw in its Access and security component, tagged as an authentication bypass. A low-privileged authenticated attacker with network access to the HTTP interface can, by inducing a separate user to interact with crafted content, cross a trust boundary and obtain unauthorized access to critical data or complete access to all accessible data, plus limited update/insert/delete privileges. Exploitation requires a valid low-privilege account (PR:L) and human interaction (UI:R), and no public exploit code or active exploitation has been identified at time of analysis; the CVSS 3.1 base score is 7.6.