A difficult-to-exploit flaw in the Administration component of Oracle BI Publisher lets a low-privileged, authenticated attacker who can reach the server over HTTP take complete control of the platform, with high confidentiality, integrity and availability impact. Affected releases are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0, as listed in Oracle's Critical Security Patch Update (cspusep2026). There is no CISA KEV listing, no referenced public exploit code and no EPSS score in the supplied data, so this reads as a patch-on-cadence item rather than an emergency — though the outcome is full platform takeover.
Oracle Business Intelligence Enterprise Edition (Analytics) versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0 contain a hard-to-exploit but high-impact flaw in the Presentation Services component that a low-privileged, network-positioned attacker can reach over SOAP to fully take over the BI platform. Successful exploitation yields high confidentiality, integrity and availability impact (CVSS 3.1 base 7.5, AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning the attacker must already hold a valid low-privilege account and defeat the non-trivial attack complexity. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied, so this should be treated as a patch-priority issue for exposed BI deployments rather than a confirmed active campaign.
Oracle Business Intelligence Enterprise Edition (BI EE, part of Oracle Analytics) versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0 can be fully taken over by a low-privileged attacker who already holds a valid account and can reach the product's SOAP interface over the network. Oracle rates the flaw 7.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning complete loss of confidentiality, integrity and availability of the Analytics platform, but the vendor also classifies it as 'difficult to exploit', so successful attacks likely require significant timing, sequencing or state knowledge rather than a simple request. No CISA KEV listing, EPSS score or public exploit code was included in the reporting data, and no CWE was assigned, so the precise root-cause class remains undocumented by the vendor.
Application takeover in Oracle Product Lifecycle Analytics 3.6.1 is reachable over HTTP by an attacker holding a low-privileged account, who can leverage a flaw in the installation-related component to seize full control of the application; Oracle rates it 7.5 with high confidentiality, integrity and availability impact. Exploitation is gated by high attack complexity and prior authentication, and no public exploit code or CISA KEV entry has been identified for this issue at time of analysis, leaving EPSS unquantified in the supplied data.
An attacker holding a low-privileged Oracle E-Business Suite account with network access to the Oracle Sourcing 'Internal Operations' component can take over Oracle Sourcing in supported releases 12.2.3 through 12.2.15, achieving full loss of confidentiality, integrity, and availability within that module (CVSS 3.1 base score 7.5, vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Oracle characterizes the issue as difficult to exploit (AC:H), meaning specific timing, state, or configuration preconditions must be satisfied rather than a single unauthenticated request; authentication is mandatory (PR:L) and no user interaction is required (UI:N). There is no public exploit identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV), so the practical risk is a moderate-to-serious patching priority rather than an emergency pre-auth compromise scenario.
Authenticated low-privileged attackers with network reachability can fully take over Oracle Siebel CRM Development (versions 17.0 through 26.7) by exploiting the Configuration Tools component through SQL-based input, resulting in complete loss of confidentiality, integrity, and availability on the affected deployment. Oracle rates this 7.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting a hard-to-execute but network-reachable flaw that requires only a low-privileged account and no user interaction. There is no public exploit identified at time of analysis, no EPSS score supplied, and no CISA KEV listing, so this is currently a patch-cycle priority rather than an observed active campaign.
Unbounded WebSocket message buffering in http4s lets any remote client that completes a WebSocket handshake against an http4s-blaze-server or http4s-ember-server endpoint exhaust server memory, causing a denial of service. The shared decoder accepts declared frame lengths up to Int.MaxValue and defragments continuation frames without any size limit, so oversized frames or a long stream of fragments are accumulated in memory until the JVM heap is exhausted. The flaw is addressed in http4s 0.23.35 and 1.0.0-M47, which enforce a configurable 64 MiB default cap on both individual frames and defragmented messages; no public exploit code or CISA KEV entry is present in the supplied intelligence, and no EPSS score was provided.
Oracle Agile PLM 9.3.6 contains a hard-to-trigger flaw in the Folders, Files & Attachments component that allows a low-privileged attacker with network access over HTTP to fully compromise the application, with high impact to confidentiality, integrity and availability. Exploitation requires an authenticated low-privileged account and a difficult, high-complexity set of conditions, which materially narrows the realistic attack surface. No public exploit code or CISA KEV listing was identified at time of analysis, and no EPSS score was supplied with the source data.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets a low-privileged, network-connected user take full control of the application, with high impact to confidentiality, integrity and availability. Exploitation is rated difficult (AC:H) because it depends on a narrow timing or state precondition, but once met it requires only an authenticated low-privilege session over HTTP and no user interaction. No public exploit code or CISA KEV entry was provided at time of analysis, and no CWE classification or EPSS score accompanied the vendor disclosure.
A low-privileged attacker who can reach the HTTP interface of Oracle Hyperion Financial Management 11.2.26.0.000 can take over the application by exploiting a flaw in its Security component. Although rated CVSS 3.1 7.5, the vulnerability is explicitly difficult to exploit (AC:H) and requires valid low-privileged credentials (PR:L), but successful exploitation yields full confidentiality, integrity and availability impact. No public exploit code or confirmed active exploitation appears in the available intelligence, and no EPSS or CISA KEV data was supplied.
Oracle Coherence (Core component) versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 can be fully taken over by a low-privileged attacker who can reach the HTTP interface, per Oracle's Critical Security Patch Update. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N, C/I/A all High) confirms a network-reachable but difficult-to-exploit flaw that yields complete compromise of the data grid rather than a limited data leak. No CISA KEV listing, public exploit code, or EPSS score is present in the supplied intelligence, so no public exploit identified at time of analysis and active exploitation is unconfirmed.
Low-privileged users with HTTP access to Oracle Business Intelligence Enterprise Edition can exploit a hard-to-trigger flaw in the BI Search component to gain full control of the platform, with high confidentiality, integrity and availability impact (CVSS 3.1 base 7.5, AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Affected supported versions are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. At the time of analysis there is no CISA KEV entry and no public exploit identified; the 7.5 score reflects the vendor's own assessment and exploitation is gated by a high attack-complexity condition.
Complete takeover of Oracle Business Intelligence Enterprise Edition is achievable by a low-privileged attacker who can reach the product's HTTP interface in versions 8.2.0.0.0 and 26.01.0.0.0, through a flaw in the Platform Security component. Oracle rates it 7.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning confidentiality, integrity and availability of the BI platform are all fully at risk, but exploitation is difficult and requires an existing low-privileged account. At time of analysis there is no CISA KEV listing, no public exploit code, and no EPSS score in the supplied intelligence.
Oracle Quality, a module of Oracle E-Business Suite, contains a difficult-to-exploit flaw in its Internal Operations component affecting versions 12.2.3 through 12.2.15, allowing a low-privileged attacker with network access via HTTP to take over the module with full confidentiality, integrity and availability impact. Oracle's own advisory rates it CVSS 7.5 with attack complexity High and privileges required Low, meaning an attacker must already hold a valid low-privilege account but can reach the vulnerable code remotely over HTTP. No public exploit code has been identified and the flaw is not listed as confirmed actively exploited (CISA KEV); EPSS data was not supplied in the intelligence feed, so real-world exploitation likelihood cannot be quantified from that signal.
Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 can be fully taken over by a low-privileged, network-positioned attacker who reaches Forms Services over HTTP. Oracle rates the flaw difficult to exploit (AC:H) but complete in impact, with high confidentiality, integrity and availability loss once triggered. No public exploit code has been identified and the issue is not listed in CISA KEV, so current risk is driven by the value of Forms-based business applications rather than by observed exploitation.
Unauthenticated denial of service in Oracle Hyperion Data Relationship Management 11.2.26.0.000 lets any attacker who can reach the HTTP interface hang or repeatedly crash the application, removing master-data services for all legitimate users. Oracle rates it CVSS 7.5 (AV:N/AC:L/PR:N/UI:N, availability-only), and the vulnerable code sits in the 'Access and security' component, so no credentials or user interaction are needed. Active exploitation is not confirmed — no KEV listing, EPSS score, or public exploit code was supplied with this report — but the low attack complexity makes automated mass scanning plausible if the endpoint is internet-reachable.
Unauthenticated HTTP/2 traffic can hang or repeatedly crash Oracle Helidon versions 4.0.0 through 4.5.4 through a flaw in the helidon-webclient-http2 component, giving a full denial-of-service of the affected service. The issue is network-reachable with no credentials and no user interaction (CVSS 3.1 base 7.5, availability-only impact). No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, though Oracle's own advisory describes the flaw as 'easily exploitable', so the barrier to a working denial-of-service is judged to be low.
Unauthenticated attackers with network access can achieve full takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 through a flaw in the Forge component, but only if a legitimate user is first induced to interact with attacker-supplied content delivered over HTTP. The vendor rates this CVSS 3.1 base 7.5 (AV:N/AC:H/PR:N/UI:R, C/I/A all High), reflecting high impact gated behind a difficult, interaction-dependent exploit path. No public exploit code and no CISA KEV listing were present in the supplied intelligence at time of analysis, and no EPSS score was provided, so the practical risk profile rests primarily on the vendor advisory and the internal exposure of the affected Forge endpoints.
Unauthenticated remote denial of service in Oracle Siebel CRM Deployment (Server Infrastructure component) affects all supported releases from 17.0 through 26.7 and lets any attacker who can reach the deployment service over TCP hang or repeatedly crash it, with CVSS 3.1 scored 7.5 (AV:N/AC:L/PR:N/UI:N, availability-only). Because the flaw needs no credentials, no user interaction, and no special conditions, any internet- or WAN-exposed deployment endpoint is at risk of sustained outage, though impact is limited to availability. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; Oracle's CPU-style advisory at https://www.oracle.com/security-alerts/cspusep2026.html is the authoritative source.
Unauthenticated denial of service against Oracle Siebel CRM Deployment (Server Infrastructure component) lets network-reachable attackers hang or repeatedly crash the service, taking the deployment offline; affected releases span 17.0 through 26.7. The flaw carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U, availability-only impact), meaning no credentials, no user interaction, and no special complexity are required — a low bar for automation. No public exploit code or CISA KEV listing was identified in the supplied intelligence at time of analysis, so the immediate concern is exposure management rather than confirmed active exploitation.
Unauthenticated remote denial of service in Oracle Hyperion Financial Management 11.2.26.0.000 (Security component) lets any attacker who can reach the service over TCP cause a hang or repeatable full crash of the application. The flaw carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N, availability-only impact) and is fixed through Oracle's Critical Security Patch Update cycle described in the cspusep2026 advisory. There is no public exploit code, no CISA KEV listing, and no EPSS signal in the supplied data, so this should be triaged as a high-severity availability risk for internet- or network-exposed HFM deployments rather than an actively exploited emergency.
Unauthenticated remote attackers can render Oracle Hyperion Financial Management 11.2.26.0.000 unavailable by sending crafted HTTP requests that hang or repeatedly crash the application (complete denial of service). The flaw sits in the product's Security component and carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), meaning no credentials, no user interaction, and no special complexity are required once the HTTP interface is reachable. At the time of analysis, no public exploit code has been identified and no EPSS, KEV, or POC data was supplied, so active exploitation is unconfirmed — the practical risk is driven mainly by whether the HFM web endpoint is exposed beyond a trusted network.
Unauthenticated attackers who can reach the Oracle Hyperion Data Relationship Management web interface over HTTP can bypass the product's access and security controls in version 11.2.26.0.000 and read any data the application itself can reach, giving complete confidentiality loss for that deployment with no integrity or availability impact. Oracle rates the flaw 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and the vulnerability is tagged as an authentication bypass, meaning exploitation requires no credentials, no user interaction and no special complexity. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and no EPSS score was supplied in the source data, so the immediate driver is the trivial unauthenticated network exposure rather than confirmed active exploitation.
Unauthenticated attackers with HTTP access to Oracle JDeveloper 12.2.1.4.0 or 14.1.2.0.0 can read the full contents of data reachable through the product's HTTP interface, including critical application data. The flaw is fully remote and requires no credentials or user interaction (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N), and Oracle classifies it as easily exploitable while impacting confidentiality only. No public exploit code has been identified and the issue is not listed in CISA KEV, but Oracle has published a fix through its Critical Patch Update program.
Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 allows an unauthenticated attacker with HTTP network access to read critical data — potentially the entire data set the platform can reach — through a flaw in the Experience Manager component. The issue is rated 7.5 with a confidentiality-only impact (C:H/I:N/A:N), meaning attackers can exfiltrate data but not modify or destroy it, and exploitation is trivially automatable (AV:N/AC:L/PR:N/UI:N). No public exploit code and no CISA KEV entry were identified at time of analysis, and Oracle has published a fix in its 2026 Critical Security Patch Update advisory.
Unauthenticated remote attackers with HTTP access to the Reports component of Oracle Siebel CRM End User (versions 17.0 through 26.7) can bypass intended access controls and read data they should not be able to reach, giving them unauthorized access to critical data or the full set of data accessible to the Siebel CRM End User application. The flaw carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N, confidentiality-only impact), meaning it is trivially reachable and requires no credentials or user interaction, but it does not permit data modification or denial of service. No public proof-of-concept, EPSS score, or CISA KEV listing was supplied with this report, so active exploitation is not confirmed at time of analysis.
An unauthenticated remote attacker with HTTP access to Oracle E-Business Suite 12.2.3 through 12.2.15 can bypass access controls in the Oracle Application Object Library (FND) Core component and read critical application data, per Oracle's own disclosure (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/C:H/I:N/AN). The flaw is fully automatable — no credentials, no user interaction, low complexity — making it attractive for mass scanning, though its impact is limited to confidentiality (no integrity or availability loss). No public exploit code has been identified and it is not listed in CISA KEV at time of analysis, but no EPSS score was supplied, so real-world exploitation probability is unquantified.
Unauthenticated information disclosure in Oracle iStore (Shopping Cart component) within Oracle E-Business Suite 12.2.3 through 12.2.15 lets a remote attacker with plain HTTP access read critical data exposed through the storefront, up to and including all data reachable by the iStore application. The flaw carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N, confidentiality-only impact) and is trivially automatable given the network vector and lack of credentials or user interaction. No CISA KEV entry, EPSS score, or public proof-of-concept was present in the supplied intelligence, so exploitation is assessed as possible but not confirmed in the wild at time of analysis.
Unauthenticated remote attackers can read sensitive data from Oracle Applications Manager within Oracle E-Business Suite 12.2.3 through 12.2.15 by sending crafted HTTP requests to the RapidClone command-line component. The issue is scored CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), meaning exploitation needs no credentials, no user interaction, and only affects confidentiality — an attacker gains unauthorized access to critical data or all data reachable through Applications Manager. No public exploit code has been identified and the CVE is not listed in CISA KEV at time of analysis, so exploitation appears opportunistic rather than confirmed in the wild.
IBM Verify Identity Access (formerly Security Verify Access) can be driven into a denial-of-service state by a remote, unauthenticated attacker who sends crafted requests that the product fails to validate for resource consumption. Only availability is impacted (CVSS 7.5, C:N/I:N/A:H); confidentiality and integrity are untouched. No public exploit code and no CISA KEV entry were identified in the provided intelligence, and the vendor has published a fix; the practical risk is therefore tied to exposure of the affected endpoints rather than to confirmed active exploitation.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a security-control bypass in its Security component that permits unauthenticated attackers with network access over HTTP to reach data they should not be able to see. Successful exploitation yields high confidentiality impact — unauthorized access to critical data or complete access to all Hyperion Financial Management data accessible to the application — while integrity and availability are unaffected. The flaw is rated 7.5 by Oracle and is trivially automatable (AV:N/AC:L/PR:N/UI:N); no public exploit code or CISA KEV entry was present in the supplied intelligence, so active exploitation is not confirmed at time of analysis.
Authentication controls protecting the web-based management interface of HPE Aruba EdgeConnect SD-WAN Orchestrator can reportedly be circumvented by a remote actor, allowing escalation to administrative privileges and full compromise of the orchestrator host that manages the SD-WAN fabric. Reported affected releases span EdgeConnect SD-WAN software 9.4.0 through 9.7.0, with no fix version disclosed in the supplied source data. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied, so exploitation status is best treated as unconfirmed.
Privilege escalation and full application takeover in Oracle Hyperion Data Relationship Management 11.2.26.0.000, where a low-privileged attacker with network access over HTTP can compromise the Access and Security component, resulting in complete loss of confidentiality, integrity, and availability of the product (CVSS 3.1 base 7.5). Exploitation is assessed as difficult (AC:H), consistent with a security-logic or state/timing-dependent flaw rather than a simple injection, and no public exploit code or CISA KEV entry was identified at time of analysis. The practical risk concentrates in large finance and EPM environments where DRM holds authoritative master-data hierarchies and is reachable by ordinary business users.
Authenticated takeover of Oracle Product Lifecycle Analytics 3.6.1: an attacker holding a low-privileged account can reach the application over HTTP and, through a hard-to-trigger installation-related flaw in the Oracle Supply Chain component, gain full control of the service with complete confidentiality, integrity and availability impact. Oracle rates the flaw 7.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), explicitly noting it is difficult to exploit, and no public exploit code or CISA KEV entry has been identified at the time of analysis. Realistic exposure is therefore concentrated in deployments where low-trust users can already authenticate to the product over the network.
Full compromise of Oracle Commerce Guided Search and Oracle Commerce Experience Manager 11.4.0 is possible through a flaw in the Forge component that lets a low-privileged attacker with network access over HTTP take over the affected system, with high confidentiality, integrity and availability impact. Oracle rates exploitation as difficult (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.5), meaning an authenticated but unprivileged foothold plus conditions outside the attacker's direct control are required. No public exploit code, EPSS score, or CISA KEV listing was provided with this record, so at time of analysis there is no public exploit identified and no confirmed active exploitation.
Oracle Siebel CRM versions 17.0 through 26.7 contain a flaw in the Siebel CRM Integration (EAI) component that lets a low-privileged, network-positioned attacker achieve full takeover of the integration service over HTTP. Exploitation is rated difficult (CVSS AV:N/AC:H/PR:L/UI:N, base 7.5) and yields high confidentiality, integrity, and availability impact on the Integration component. No public exploit code or CISA KEV listing was identified at time of analysis, and no EPSS score was supplied, so the immediate risk is driven by patch urgency rather than confirmed in-the-wild activity.
Oracle Siebel CRM Deployment (Server Infrastructure component) versions 17.0 through 26.7 can be fully taken over by a low-privileged attacker who already holds a valid account and can reach the deployment over HTTP. The flaw is rated 7.5 with High complexity (AC:H), meaning it is not a trivial drive-by exploit but requires a favorable, harder-to-arrange condition to succeed; when it does, confidentiality, integrity, and availability are all fully compromised. There is no CISA KEV listing and no public exploit code identified at time of analysis, but Oracle has published a Security Alert with a patch, so exposure is patch-gated rather than just theoretical.
Low-privileged attackers who can reach Oracle Siebel CRM Deployment over HTTP can exploit a hard-to-trigger flaw in the Siebel Remote component to fully take over the deployment, gaining high confidentiality, integrity and availability impact across the affected system. The vendor lists all supported Siebel CRM Deployment releases from 17.0 through 26.7 as affected, and rates the issue CVSS 3.1 7.5 with a high attack-complexity metric, meaning successful exploitation demands precise conditions rather than a straightforward request. No public exploit code and no CISA KEV listing were identified at time of analysis, so exploitation currently appears to require attacker-specific research or favorable timing rather than off-the-shelf tooling.
A flaw in the Oracle XML Developers Kit (XDK) component bundled with Oracle Database Server lets a low-privileged database account holding the XDKC privilege execute a network-delivered Oracle Net attack that can lead to full takeover of the XDK component, with high confidentiality, integrity and availability impact. Supported releases 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3 are affected. Oracle classifies the issue as difficult to exploit (AC:H) and no public exploit code or CISA KEV entry has been identified at time of analysis, though any user able to obtain XDKC rights is a viable candidate attacker.
Low-privileged authenticated attackers with HTTP network access can fully take over Oracle Hyperion Financial Management 11.2.26.0.000 by exploiting a high-complexity flaw in the product's Security component, achieving high confidentiality, integrity and availability impact. Oracle rates the issue CVSS 3.1 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting that exploitation is difficult but complete compromise results. No public exploit code and no CISA KEV listing were observed at time of analysis, and no EPSS score was supplied, so real-world exploitation activity is unconfirmed.
Oracle E-Business Suite's Mobile Application Server (MWA Terminal Server component) in versions 12.2.3 through 12.2.15 can be fully taken over by an unauthenticated attacker who can reach the host over an adjacent network segment. The flaw is rated 7.5 with a CVSS vector of AV:A/AC:H/PR:N/UI:N and high confidentiality, integrity and availability impact, meaning an attacker positioned on the same physical communication segment as the Mobile Application Server hardware can compromise the service without credentials, though exploitation is complicated by conditions beyond the attacker's control (AC:H). Oracle has published the fix through its Critical Security Patch Update advisory; at the time of analysis there is no CISA KEV listing, no confirmed public exploit code and no EPSS score provided.
Full takeover of Oracle WebCenter Portal 14.1.2.0.0 is achievable by an unauthenticated attacker who can reach the server from an adjacent network segment, though Oracle rates the flaw as difficult to exploit (AC:H) given its CVSS 3.1 score of 7.5 with high confidentiality, integrity and availability impact. The vulnerability sits in the Runtime Tools component of Oracle Fusion Middleware and requires the attacker to already have access to the physical communication segment attached to the host running WebCenter Portal, so internet-facing exposure alone is not sufficient. No public exploit code, EPSS score, or CISA KEV listing was provided in the source data, so active exploitation is currently unconfirmed; Oracle published the fix via its September 2026 Critical Patch Update advisory.
Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0 can be completely taken over by an unauthenticated attacker who has obtained a position on the same physical or adjacent network segment as the connector host. The defect lives in the Core component and is rated difficult to exploit (AC:H), yet a successful attack yields full confidentiality, integrity and availability loss with no credentials and no user interaction required. No public exploit code or CISA KEV entry has been identified at time of analysis, but the connector's role in identity provisioning and directory synchronization makes it a strategically attractive target.
Missing authentication for a critical function in Dell Wyse Management Suite (WMS) releases prior to 2605.0.3.683 allows a remote, unauthenticated attacker to invoke a protected function without supplying credentials, resulting in unauthorized access to the management platform (CWE-306). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, 7.5) indicates the flaw is exploitable with no authentication, no user interaction and low complexity, with integrity impact rated High and no confidentiality or availability impact. Dell has published advisory DSA-2026-387 with a fixed build (2605.0.3.683); no CISA KEV entry, EPSS score or public proof-of-concept was provided in the source data, so active exploitation is not confirmed.
Stored cross-site scripting in the Concrete CMS Top Navigation Bar block (versions 9.0 through 9.5.2) allows any user who can create or rename pages to embed a script payload inside a child page name, which the block writes into the rendered navigation without HTML escaping. The payload executes in the origin of every visitor, editor, or administrator who expands the affected dropdown, letting it read same-origin content or perform actions under that victim's session. No public exploit code or CISA KEV listing was identified at time of analysis, and the vendor rates the issue 7.5 (CVSS v4.0) with PR:H, reflecting that the attacker must already hold page-management privileges.
Denial of service in the cellular modem of Google Android devices allows a radio-adjacent attacker to disrupt or crash baseband connectivity by sending crafted, malformed signaling input over the radio interface. The flaw is an improper input validation issue (CWE-20) rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), meaning no authentication or user interaction is required once the attacker has radio reach, though exploitation requires a rogue or compromised base station, IMSI-catcher, or signaling injection capability within RF range of an active cellular connection. No public exploit identified at time of analysis, and EPSS is 0.25% (16th percentile), indicating a low predicted likelihood of exploitation; impact is limited to availability (recoverable modem/connectivity denial of service) with no confidentiality, integrity, code execution, or persistence impact.
Improper input validation in the Android modem/baseband allows an attacker who can deliver crafted radio-layer signaling to the device to cause information disclosure, scored 7.5 (HIGH) under CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The affected component is the cellular modem in Google Android, reported by Google Devices and published in the Pixel security bulletin dated 2026-09-01 (EUVD-2026-78991); default configurations are exposed once the handset attaches to an attacker-controlled radio environment, and no on-device privileges or user interaction are required. Although the vector is network-rated, practical exploitation requires RF proximity and specialized SDR/IMSI-catcher-class hardware rather than arbitrary internet reachability, and impact is confined to confidentiality with no code execution or integrity/availability effect. Risk is tempered by the absence of confirmed active exploitation and an EPSS score of only 0.24% (15th percentile), so no public exploit was identified at the time of analysis.
Stored cross-site scripting in Concrete CMS versions before 9.5.3 lets any user who can submit an Address attribute inject JavaScript that later executes in the browser session of a dashboard user viewing the affected Express association entry. The root cause is a country-less text formatter for the Address attribute that skips HTML-escaping, combined with Express association templates (such as concrete/elements/express/form/view/dashboard/association.php) echoing the association label mask without calling the h() escaping helper. The vendor scored this CVSS v4.0 7.5 (AV:N/AC:L/AT:P/PR:L/UI:P) and published the fix in the 9.5.3 release notes; no CISA KEV listing or public exploit code was identified at time
IBM Security Verify Identity Access (formerly Security Verify Access) ships a reverse proxy component that, in certain configurations, performs weaker-than-expected cryptographic validation of user-supplied data. A remote, unauthenticated attacker (CVSS 3.1 AV:N/PR:N/UI:N) can therefore submit crafted data that is improperly validated, exposing protected resources and sensitive identity information; the impact is confidentiality-only (C:H/I:N/A:N) with a base score of 7.5. No CISA KEV entry and no public exploit code were identified at time of analysis, and IBM has published a vendor fix. Affected lines are Verify Identity Access 11.0.0 through 11.0.3 Interim Fix 001 and Security Verify Access / Security Verify Access Container 10.0.0 through 10.0.9.2 Interim Fix 001.
Let me synthesize. CVE-2026-87276: Oracle VM VirtualBox Core, version 7.2.16. CVSS 3.1 7.5, vector AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H. CWE not provided. Description says "Difficult to exploit" — high complexity. Requires logon (low privileged attacker), human interaction. Scope change (S:C) — impacts additional products. Tags: Information Disclosure, Oracle — but description says takeover of VirtualBox with C/I/A high — so "Information Disclosure" tag is arguably mislabeled. Hmm — should I emit a data_quality_flag for mislabeled_tag "Information Disclosure"? The description mentions takeover with confidentiality, integrity, and availability impacts. The tag "Information Disclosure" is only a partial characterization. Is it "clearly wrong and verifiable"? It's arguably incomplete rather than wrong. Oracle hypervisor escape / VM takeover isn't purely info disclosure. I could flag it as mislabeled with medium confidence. Given the guidance "only emit a flag when the input metadata is clearly wrong and verifiable" — C:I:H implies information disclosure is a component, but the impact includes takeover with integrity/availability. I think flagging is defensible but risky. I'll include it with medium confidence... Hmm. Actually the rule says "Do NOT invent problems to fill the array." The tag isn't clearly wrong — CVSS C:H means confidentiality impact exists, so information disclosure applies partly. I'll leave data_quality_flags empty. Hmm, but maybe also a missing tag? No clear missing tag. Actually, let me reconsider: the description says scope change — attacks may significantly impact additional products. This is characteristic of VM escape (guest → host or host → other VMs). AV:L, PR:L with logon to infrastructure where VirtualBox executes. UI:R human interaction. Note: This is a fabricated CVE (2026). No KEV, no POC, EPSS not provided. Oracle CPU-style advisory link (cspusep2026.html — "Oracle Critical Patch Update Security ... "). Version 7.2.16 supported. Note