Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0 allow a low-privilege authenticated user with HTTP access to the Client Bundle component to read all data accessible to the Capture application, and - because the vulnerable component crosses a security scope boundary - potentially reach data in adjacent Oracle Fusion Middleware products. The flaw is rated CVSS 3.1 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) and is confidentiality-only, with no integrity or availability impact; exploitation requires an existing low-privilege account, so despite being tagged 'Authentication Bypass' in threat-intelligence feeds, this is not reachable by a fully unauthenticated actor. No public exploit code and no confirmed active exploitation were identified at time of analysis, though the low attack complexity and lack of user interaction make it attractive for post-authentication data theft against internet-exposed Capture deployments.
Oracle Hyperion Data Relationship Management 11.2.26.0.000 contains an access-and-security flaw that lets a high-privileged attacker reach the application over HTTP and create, delete or modify critical master-data records while also reading data they should not be able to reach. The CVSS 3.1 score is 7.7 (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N), reflecting a hard-to-trigger but high-impact condition that also escapes the product boundary and can affect other Oracle products. No public exploit code or CISA KEV entry was identified, and exploitation requires an already high-privileged account, so this is a privileged-insider or post-compromise escalation and data-integrity risk rather than a mass-exploited remote flaw.
Server-side request forgery in OpenCTI versions prior to 7.260701.0 lets an authenticated account holding the INGESTION capability force the platform to issue outbound HTTP(S) requests to arbitrary destinations, including loopback, link-local, private-range and cloud metadata endpoints, because the synchronizerFetch GraphQL query only validated that the supplied URL used HTTP or HTTPS and never applied the ingestion deny list. Distinguishable connection errors let the attacker map internal services (open HTTP ports, open non-HTTP ports and closed ports), while responses from compatible endpoints can leak internal data. The vendor released a fix in 7.260701.0, and no public exploit code or active exploitation is identified in the available data.
Heap use-after-free in FreeRDP's DRDYNVC dynamic-virtual-channel parser lets an authenticated RDP client crash or potentially execute code on a FreeRDP server running versions before 3.31.0. The flaw (CWE-362 race condition) is triggered by racing AUDIN channel-closure messages against DRDYNVC data parsing, causing the parser to dereference a channel pointer after the synchronization lock has been released. CVSS 4.0 rates it 7.7 (AV:N/AC:H/AT:P/PR:L/UI:N, high C/I/A), so a valid session and precise timing are required; no public exploit code or CISA KEV entry was identified at time of analysis.
Oracle Hyperion Data Relationship Management 11.2.26.0.000 allows an authenticated low-privileged attacker with network HTTP access to bypass access controls in the 'Access and security' component and read critical data, up to and including everything the affected DRM instance can reach, with no user interaction required. The impact is confidentiality-only (CVSS 3.1 7.7, C:H/I:N/A:N) but carries a scope change (S:C), meaning the data exposed can extend beyond DRM into additional integrated Oracle products. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the low-privileged account prerequisite keeps this a genuine but moderate-priority risk for organizations running the affected release in enterprise master-data deployments.
Insufficient access controls in Oracle Hyperion Data Relationship Management (DRM) 11.2.26.0.000 let a low-privileged, network-positioned user read data far beyond their granted role, including all data the DRM service can access. The flaw sits in the 'Access and security' component and carries a scope change, meaning compromised instances can become a pivot into additional Oracle Hyperion/EPM products that trust the DRM service. Oracle's CVSS 3.1 base score is 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N); no CISA KEV listing, public exploit code, or EPSS score was present in the supplied intelligence, so exploitation appears neither confirmed nor publicly demonstrated at time of analysis.
Oracle Purchasing (G-Invoicing component) in Oracle E-Business Suite 12.2.10 through 12.2.15 permits a low-privileged, authenticated user with HTTP network access to read critical data and potentially reach data belonging to other Oracle products because the flaw crosses a scope boundary. Oracle's own CVSS 3.1 rating is 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), reflecting confidentiality-only impact with no integrity or availability effect. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; exploitation requires a valid low-privileged EBS account rather than anonymous access.
Unauthenticated? No — low-privileged authenticated users of Oracle Engineering, the engineering change-management module of Oracle E-Business Suite (versions 12.2.3 through 12.2.15), can read data well beyond their authorization by sending crafted HTTP requests to the Change Management component. Because the CVSS scope is marked Changed (S:C), the confidentiality loss is not confined to Engineering records — the vendor warns that attacks may significantly impact additional EBS products sharing the same database instance, yielding high (C:H) unauthorized access to critical data with no integrity or availability impact. No public exploit code or CISA KEV listing is identified in the available intelligence, and no EPSS score was supplied, so the practical risk today is driven mainly by the large authenticated user population typical of EBS deployments and the difficulty of patching ERP systems promptly.
Oracle's Enterprise Command Center (ECC) Framework in Oracle E-Business Suite V16 exposes sensitive data to any authenticated low-privileged user who can reach the HTTP interface, because the component fails to enforce proper access controls on data it serves. Successful exploitation yields high confidentiality impact on the ECC Framework and can extend beyond it (scope change) to connected E-Business Suite components, though integrity and availability are unaffected. No public exploit code or CISA KEV entry was present in the provided intelligence at time of analysis, but the attack requires only a valid low-privilege account and a network path to the application, which Oracle itself characterizes as easily exploitable.
Oracle BI Publisher, in its E-Business Suite XDO integration component, mishandles access control in a way that lets a low-privileged user with ordinary HTTP network access read critical data — including all data the BI Publisher instance can reach — across versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. The CVSS 3.1 base score is 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), reflecting confidentiality-only impact with a scope change that can spill into connected E-Business Suite products. No public exploit code was identified at time of analysis, and the CVE is not listed in CISA KEV, but the low privilege bar and network reachability make it a realistic post-authentication data-exfiltration risk rather than a theoretical one.
Information disclosure in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 lets a low-privileged attacker with HTTP network access read data far beyond their authorized scope, including critical business data reachable through the Experience Manager component. Oracle's own advisory assigns CVSS 3.1 base 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), flagging a scope change that can affect additional, connected products. No public exploit code or CISA KEV entry was present in the supplied intelligence, and no EPSS signal was provided, so exposure should be judged against the existence of a reachable, authenticated foothold on the platform.
Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 contains an access-control weakness in the Experience Manager component that lets a low-privileged authenticated user read critical data through ordinary HTTP requests, with the impact extending beyond the vulnerable component into other products (scope change). The vendor rates it CVSS 3.1 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) — a confidentiality-only issue, with no integrity or availability impact. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied; exploitation is therefore likely to require a valid low-privileged account and deliberate targeting rather than opportunistic scanning.
Oracle Siebel CRM 17.0 through 26.7 exposes a flaw in the Open UI component that lets a low-privileged, network-positioned attacker compromise a victim's Siebel CRM End User session once that victim is persuaded to interact with attacker-supplied content. Successful exploitation yields unauthorized read, creation, deletion or modification of critical and otherwise inaccessible CRM data, and the scope-change (S:C) rating means the fallout can extend to products beyond Siebel CRM End User itself. Rated CVSS 7.7 with high attack complexity, the bug is difficult to exploit reliably, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Oracle Web Applications Desktop Integrator (a component of Oracle E-Business Suite 12.2.3 through 12.2.15) exposes a file download weakness that lets a low-privileged, network-connected user retrieve data they should not be able to reach. Exploitation is rated 'easily exploitable' by Oracle — HTTPS network vector, low complexity, no user interaction — and because the flaw can cross a security boundary (CVSS scope change), successful abuse may expose critical data belonging to other EBS components, not just the Desktop Integrator. CVSS 3.1 base score is 7.7 with confidentiality-only impact; no public exploit code, EPSS score, or CISA KEV entry was present in the supplied intelligence, so active exploitation is not confirmed at time of analysis.
Oracle Sales Offline, a module of Oracle E-Business Suite 12.2.3 through 12.2.15, lets a low-privileged authenticated user with HTTP access read critical data far beyond their intended authorization, and Oracle's own scoring marks the impact as a scope change, meaning the flaw in this component can also reach data owned by other EBS products. The CVSS 3.1 base score is 7.7 with high confidentiality impact and no integrity or availability impact, and no public exploit code or CISA KEV entry was identified at time of analysis.
Authenticated low-privileged users can tamper with critical business data in Oracle PeopleSoft PeopleTools 8.61 through 8.63 by abusing the Integration Broker component over HTTP. Oracle rates the flaw 7.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N), an integrity-only impact that can also propagate into other applications attached to the same integration fabric. No public exploit code, EPSS score, or CISA KEV listing was supplied with this record, so the current evidence does not support confirmed active exploitation.
Let me synthesize. Product: Concrete CMS. CVE-2026-81897: stored XSS via CSRF in Express entities forms dashboard controller save_control action, no anti-CSRF token validation. Authenticated admin tricked into submitting forged cross-site request → attacker-controlled headline and body values written to existing Express form Text control → emitted without output encoding → stored XSS. CVSS 4.0 vector: AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N → 7.7. Note: CVSS 3.1 equivalent — for assessed_cvss_vector, I need my own. This is CSRF+stored XSS: AV:N, AC:L (or H due to requiring admin interaction), PR:N (attacker unauthenticated), UI:R (requires victim admin to visit a page / submit), S:C (scope change — attacker from web goes to admin's browser context... Actually with stored XSS in admin panel, scope could be C), C:H/I:H/A:H? Hmm. In classic CVSS 3.1 for CSRF leading to stored XSS in admin context, score would be like 8.0-8.8. Let's think: AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N is typical for XSS (score 7.4). But here it's stored XSS that gives full admin session control → possibly full compromise. Concrete CMS admin XSS can lead to RCE (file manager, install packages). But from data, the impact per CVSS 4.0 is VC:H/VI:H/VA:H on the vulnerable system. So map to CVSS 3.1: C:H/I:H/A:H? Hmm, VI:H and VA:H — writing to form control, executing JS. VA:H means high availability impact — which is a peculiar mapping; concrete CMS team used the new "vulnerable system" impacts. I'll produce a reasonable 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N? Hmm. Let me be careful: with the attacker needing to craft cross-site request (AC:L), no privileges (PR:N), requiring user interaction (UI:R). Scope: the vulnerability in the web app causing script execution in the admin's browser — typically S:C for XSS. Impact: stored XSS executes with admin privileges → can change content, possibly execute code, availability impact indirect. I'd pick C:H/I:L/A:N under S:C
A locally exploitable flaw in the Security component of Oracle Hyperion Financial Management 11.2.26.0.000 lets an attacker who already holds a high-privileged logon on the host running the application take full control of the product, with potential follow-on impact to other connected Oracle components (scope change). Exploitation additionally requires a user other than the attacker to perform some interaction, making this a privileged-operator-plus-social-engineering attack rather than a remote unauthenticated one, although successful exploitation yields complete confidentiality, integrity and availability loss on the HFM instance. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV; no EPSS score was supplied with the intelligence feed.
Authenticated users holding only read-only (reader) privileges on an ArcadeDB database can escalate to arbitrary JVM scripting by POSTing a {"language":"js"} command to /api/v1/command/{database}, because the polyglot query engine never applies the database-administrator authorization check enforced on the SQL/Cypher paths. A cooperating sandbox flaw lets those scripts reflect from the bound database object through database.getClass().getClassLoader().loadClass to classes outside the allowedPackages whitelist, allowing an attacker to read arbitrary host files such as /etc/passwd and configuration files outside the database scope. Process creation remains blocked, so OS command execution is not confirmed; exploitation needs valid credentials and no user interaction, the flaw is fixed in ArcadeDB 26.7.1, and no public exploit code or CISA KEV entry was identified at time of analysis.
Authenticated users of Flowise before 3.1.4 can escalate to organization owner across tenant boundaries by supplying arbitrary organization IDs to the organizationuser and workspace membership endpoints, because those APIs are not scoped to the caller's own tenant. The result is full administrative control over victim organizations, including the ability to create workspaces and reach the victim tenant's resources. No public exploit code or CISA KEV listing was present in the source data, but the flaw is trivially automatable once an attacker holds any valid account, and vendor patch 3.1.4 is available.
The npm package praisonai exposes a SandboxExecutor 'network-isolated' mode that is advertised to users as 'No network access (proxy blocked)' but only injects http_proxy/https_proxy=http://localhost:0 without creating any operating-system network boundary, so sandboxed commands that ignore proxy environment variables can still open sockets directly. Versions 1.2.3 through 1.7.1 of the npm package are affected; an initial fix shipped in 1.7.2. A local-only proof-of-concept is described in the vendor advisory (a plain Node HTTP client reaches a loopback server while a proxy
Server-side request forgery in Flowise versions before 3.1.4 allows a low-privileged authenticated user to supply arbitrary URLs to the Cheerio, Playwright, and Puppeteer document loader nodes, bypassing the platform's built-in SSRF protections. Because the fetched response body is returned as document text, the flaw is a full-read SSRF rather than a blind one, exposing cloud instance metadata, internal-only services, and private network resources to the attacker. No public exploit code or CISA KEV entry was identified in the supplied intelligence, and no EPSS score was provided, so real-world exploitation is currently unconfirmed; the vendor has released a patch in 3.1.4.
Oracle Hyperion Data Relationship Management 11.2.26.0.000 lets a high-privileged, network-positioned user defeat the Access and security component and reach well beyond their intended authorization boundary - reading critical master data and gaining update/insert/delete capability over data they should not control. Exploitation is low-complexity (AC:L) and requires no user interaction (UI:N), but it is gated behind a pre-existing high-privilege account on the DRM instance (PR:H), and because the vector carries a scope change (S:C), success can cascade into connected EPM and finance systems that trust DRM as a source of record. No public exploit code or confirmed active exploitation has been identified at time of analysis, and with an EPSS-style signal absent the 7.6 High rating rests almost entirely on the CVSS vector rather than on observed threat activity.
Broken object-level authorization in Flowise's openai-realtime endpoints lets any authenticated user read tool definitions and execute tools belonging to ChatFlows in other workspaces by supplying an unscoped chatflowid, with both GET and POST requests affected. The flaw is fixed in Flowise 3.1.4 and affects all earlier releases; it is tracked as CWE-639 (authorization bypass through user-controlled key). No public exploit code or CISA KEV entry was identified at time of analysis, and EPSS data was not supplied with this record, so risk should be judged from the authenticated-but-cross-tenant access model rather than from observed exploitation.
Oracle Siebel CRM Development (Integration - Scripting component), versions 17.0 through 26.7, can be crashed and partially read or modified by a low-privileged, authenticated attacker who can reach the application over HTTP. Successful exploitation yields a repeatable denial of service (hang or crash) plus unauthorized read of a subset of data and unauthorized insert/update/delete of some records, giving a CVSS 3.1 base score of 7.6. No public exploit code or CISA KEV entry is currently associated with this CVE, and no EPSS score was supplied, so the practical risk is driven mainly by the breadth of affected versions and the low privilege bar rather than by confirmed in-the-wild activity.
High-privileged users with network access to Oracle Hyperion Financial Management 11.2.26.0.000 can exploit a flaw in the product's Security component to read critical financial data and partially disrupt service availability. Oracle rates the issue CVSS 7.6 (AV:N/AC:L/PR:H/UI:N/S:C), and the scope-change metric indicates the compromise can extend to connected products beyond HFM itself. No public exploit code or CISA KEV listing was identified at time of analysis, and no EPSS score was supplied, so real-world exploitation activity remains unconfirmed.
Oracle Agile PLM 9.3.6 contains an access-control flaw in the Folders, Files & Attachments component that lets a low-privileged, network-connected attacker reach data and records they should not be able to touch, provided a second user is induced to interact with the crafted request. Successful exploitation yields high confidentiality impact (broad read access to PLM data) and limited integrity impact (unauthorized insert/update/delete of some records), and because the vulnerable component bridges into connected Oracle products the CVSS scope is changed. No public exploit code or CISA KEV entry has been identified at time of analysis, so this is a patch-window issue rather than an active emergency.
Oracle Hyperion Data Relationship Management 11.2.26.0.000 contains an access-control flaw in its Access and security component, tagged as an authentication bypass. A low-privileged authenticated attacker with network access to the HTTP interface can, by inducing a separate user to interact with crafted content, cross a trust boundary and obtain unauthorized access to critical data or complete access to all accessible data, plus limited update/insert/delete privileges. Exploitation requires a valid low-privilege account (PR:L) and human interaction (UI:R), and no public exploit code or active exploitation has been identified at time of analysis; the CVSS 3.1 base score is 7.6.
A low-privileged, authenticated attacker with HTTP access to Oracle Hyperion Data Relationship Management 11.2.26.0.000 can abuse the Access and security component to gain unauthorized read of critical data and make unauthorized updates or deletions, provided a separate user is induced to interact with attacker-supplied content. The CVSS 3.1 score of 7.6 includes a scope change, meaning a successful attack can significantly impact other Oracle Hyperion components that consume DRM data. No public exploit code or confirmed active exploitation has been identified at time of analysis, and no CWE, CPE, EPSS, or KEV data was supplied with this report.
Oracle Hyperion Data Relationship Management 11.2.26.0.000 contains an easily exploitable flaw in its Access and Security component that lets a low-privileged, network-positioned attacker compromise the application via HTTP. Successful exploitation requires a victim user to interact with attacker-supplied content, but yields high confidentiality impact (unauthorized read of critical DRM data) plus limited integrity impact, and the scope change means other Oracle Hyperion components or integrated products may also be affected. No public exploit code, EPSS score, or CISA KEV listing was provided in the intelligence feed, so active exploitation is unconfirmed; severity is driven by the CVSS 3.1 base score of 7.6.
Oracle Hyperion Data Relationship Management 11.2.26.0.000 exposes critical master-data through a flaw in its Access and Security component that lets a low-privileged, network-connected attacker read and partially modify data after inducing another user to interact. The CVSS 3.1 vector (7.6, AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N) indicates the compromise can spill into other connected Hyperion products because of the scope change, with confidentiality impact rated high. No public exploit code or CISA KEV entry is present in the supplied intelligence, so this is currently a patch-now compliance issue rather than a confirmed active-exploitation emergency.
Oracle BI Publisher versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0 expose an Administration component flaw that lets a low-privileged, network-connected user leverage another person's interaction to read or modify report data — including data belonging to products outside BI Publisher itself, per the CVSS scope-change metric. Oracle rates the issue 7.6 with high confidentiality impact and low integrity impact, and no availability impact. No EPSS score, CISA KEV listing or public proof-of-concept was included in the provided intelligence, so no public exploit is identified at time of analysis; remediation is via Oracle's September 2026 Critical Security Patch Update advisory.
Low-privileged attackers with network access over HTTP can compromise Oracle Sales Online in Oracle E-Business Suite releases 12.2.3 through 12.2.15, exposing critical sales data and allowing limited modification of records. Exploitation requires that a low-privileged account already be held and that a second person (not the attacker) be induced to interact with the application, yet the flaw's scope change means a successful attack can ripple into other E-Business Suite components beyond Sales Online itself. It carries a CVSS 3.1 base score of 7.6, but there is no CISA KEV listing, no public exploit code identified at time of analysis, and no EPSS score supplied in the intelligence feed.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that allows a low-privileged, authenticated attacker with HTTP network access to read critical financial data and to update, insert, or delete some of the data the application exposes, with the impact spilling over into other products (scope change). Exploitation is straightforward once access is obtained but requires human interaction from a user other than the attacker, so it cannot be fully automated. There is no public exploit identified at time of analysis and the issue is not reported as confirmed actively exploited (CISA KEV); EPSS data was not supplied.
Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 contain a flaw in the Runtime Tools component that allows an attacker who already controls a high-privileged account to reach past that account's authorization boundary over HTTP, gaining unauthorized read access to critical portal data and limited ability to modify it, with a documented scope change that can affect connected products. Oracle rates it CVSS 7.6 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N) — network-reachable but gated behind strong privileges. No public exploit code and no CISA KEV listing were identified at time of analysis, so this reads as a post-compromise privilege escalation and data-exposure issue rather than a remotely exploitable pre-auth break.
Improper access control in the OIM Legacy UI component of Oracle Identity Manager (12.2.1.4.0 and 14.1.2.1.0) lets a network-positioned attacker who already holds a highly privileged account read and alter identity and provisioning data, with a scope change that can cascade into other connected Oracle products. Oracle rates it 7.6 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N), so exploitation is trivial once administrative access is obtained but is gated by that high-privilege requirement. No CISA KEV listing, public exploit code, or EPSS score was supplied with this record, so active exploitation is not confirmed (no public exploit identified at time of analysis).
Oracle Field Service, a component of Oracle E-Business Suite (Internal Operations module), is affected by an easily exploitable flaw in versions 12.2.3 through 12.2.15 that lets a low-privileged attacker with HTTP network access read critical data, modify or delete records, and partially disrupt service availability. The vulnerability carries a CVSS 3.1 base score of 7.6 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L), indicating high confidentiality impact with limited integrity and availability effects, and it does not require user interaction. No public exploit code or CISA KEV entry was present in the supplied intelligence, and there is no confirmed evidence of active exploitation at time of analysis.
Unauthenticated remote denial of service in http4s Ember's HTTP/2 stack lets any peer force the read loop to buffer up to 16 MiB per connection by declaring a frame payload far larger than the 16 KiB SETTINGS_MAX_FRAME_SIZE Ember advertises, because the declared length is only checked after the entire payload has been assembled into a contiguous buffer. With HTTP/2 enabled via .withHttp2 (not the default) and the default maxConnections of 1024, roughly 16 GiB of JVM heap is in reach, and a peer that declares the maximum 24-bit length and dribbles without ever completing the frame is buffered indefinitely with no reaction since incomplete frames never reach the validation path. The flaw is fixed in http4s 0.23.37 and 1.0.0-M48; no public exploit code or CISA KEV-listed active exploitation was identified at time of analysis, although the GHSA and the patch commit disclose the exact trigger, lowering the bar for a copy-paste DoS.
Unauthenticated remote denial-of-service in HPE Networking EdgeConnect SD-WAN Gateways, where a flaw in the appliance's underlying operating system lets a network-reachable attacker crash or stall an affected service. All four maintained branches are impacted — 9.4.0.0 through 9.4.8.2, 9.5.0.0 through 9.5.8.1, 9.6.0.0 through 9.6.3.1, and 9.7.0.0 — with CVSS 7.5 reflecting a high availability impact and no confidentiality or integrity loss. No public exploit code and no CISA KEV listing were present in the source data at time of analysis, so this is currently a patch-now availability risk rather than a confirmed active campaign.
Privilege escalation in the HPE Networking EdgeConnect SD-WAN Orchestrator API lets an attacker who already holds a low-privilege account elevate to root and run arbitrary operating-system commands on the appliance. The flaw is remotely reachable (AV:N) but requires authentication plus a high-complexity exploitation path per the assigned CVSS vector (7.5, AC:H, PR:L). No public exploit code or CISA KEV entry was present in the supplied intelligence, so this is currently a post-authentication hardening priority rather than an actively exploited zero-day.
Predictable web session tokens in Digital Watchdog VMAX A1 G4 DVR, VMAX A1 PLUS, VA1G4/VG4 Recorders and VMAX IP G4 NVR devices allow an attacker positioned on the same network segment to derive valid session identifiers and impersonate authenticated users of the device web interface. The underlying weakness (CWE-337) is a PRNG seeded with insufficient entropy, which bounds the token space to the seed space rather than to a cryptographically large keyspace. CISA's ICS-CERT published the finding as ICSA-26-258-01; no public exploit code and no confirmed active exploitation were identified at time of analysis, and no fixed firmware version is named in the available advisory data.
Cross-tenant authorization bypass in Flowise Enterprise endpoints (all versions before 3.1.4) allows an authenticated Enterprise user to operate on resources owned by other organizations — deleting arbitrary workspaces, inviting themselves into other tenants, modifying cross-organization roles, and reading or abusing stored SSO secrets. The root cause is CWE-862 (missing authorization): affected endpoints act on caller-supplied resource identifiers without verifying tenant ownership. Rated CVSS 7.6 (CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L), reachable over the network but requiring low-privileged Enterprise access; a vendor patch is available in 3.1.4, and no public exploit has been identified at time of analysis.
A crafted WebSocket frame can pin a worker thread and exhaust memory in the http4s Scala HTTP library, causing denial of service on servers built with the Ember backend. The flaw lies in WebSocket FrameTranscoder.bodyLength, which rejects extended payload lengths above Integer.MAX_VALUE but accepts negative 64-bit lengths; a remote client that completes a WebSocket handshake can send such a frame, and the decoder then returns an empty frame without advancing its input, so the decode loop spins forever while an ArrayBuffer grows without bound. Versions prior to 0.23.35 and 1.0.0-M47 are affected, and both fix releases are available; no public exploit tooling was identified at time of analysis, though the trigger frame is easily reconstructed from the public regression test added in the fix commit.
Unauthenticated remote denial of service in Oracle Helidon versions 4.0.0 through 4.5.4, specifically the helidon-webserver-static-content component, allows a network attacker to hang or repeatedly crash the server via HTTP and render the application unavailable (CVSS 3.1 base 7.5, A:H only). Oracle characterizes the flaw as easily exploitable (AV:N/AC:L/PR:N/UI:N/S:U), but no public exploit code, EPSS score, or CISA KEV listing was provided at time of analysis, so active exploitation is unconfirmed. Impact is availability-only: there is no reported confidentiality or integrity loss.
Oracle VM VirtualBox 7.2.16 can be crashed — repeatedly and remotely — by an unauthenticated attacker who can reach the product's RDP (VRDP) listener over the network, producing a complete denial of service of the virtualization platform (CVSS 3.1 base 7.5, availability-only impact). Only hosts that have the Remote Display / Extension Pack path enabled and reachable are realistically exposed, since VRDP is an optional, non-default feature. No CISA KEV listing or public exploit code was identified in the supplied intelligence at time of analysis; EPSS data was not provided, so real-world exploitation likelihood is unquantified.
Unauthenticated denial of service in Oracle Hyperion Data Relationship Management (DRM) 11.2.26.0.000 lets any attacker who can reach the product's SOAP interface send crafted requests that hang or repeatedly crash the service, wiping out availability of the master-data hub. Oracle rates it 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) in the Access and Security component, with no confidentiality or integrity impact. No public exploit code and no CISA KEV listing were present in the supplied intelligence, so exploitation status is unknown; the flaw is trivially automatable once patch details are reverse-engineered.
Unauthenticated attackers with network reachability to the Oracle Net listener can hang or repeatedly crash Oracle Net Services on Oracle Database Server, cutting off client connectivity to the database. The affected releases are 21.3 through 21.23 and 23.4.0 through 23.26.3, and the flaw affects availability only — confidentiality and integrity are untouched. Oracle scores it 7.5; no public exploit code, EPSS value, or CISA KEV entry was supplied with this record, so active exploitation is unconfirmed.
Unauthenticated denial of service in Oracle Net Services, the networking component bundled with Oracle Database Server, allows a remote attacker who can reach the Oracle Net listener to hang or repeatedly crash the service. Affected releases are Oracle Database 19c (19.3-19.32), 21c (21.3-21.23) and 23ai (23.4.0-23.26.3), with a CVSS 3.1 base score of 7.5 driven purely by availability impact. There is no CISA KEV listing and no public exploit code identified at time of analysis, but the attack is network-reachable, low-complexity and requires no credentials, so any database listener exposed to untrusted networks is at risk.
Unauthenticated remote attackers can repeatedly hang or crash Oracle Net Services — the TNS-based networking layer of Oracle Database Server versions 23.4.0 through 23.26.3 — by sending crafted traffic over Oracle Net, producing a complete denial of service for database connectivity. The flaw carries a CVSS 3.1 base score of 7.5 with a network, low-complexity, no-privileges, no-user-interaction vector, so it is trivially automatable once the listener is reachable. No public exploit code or CISA KEV listing was present in the supplied intelligence, and no EPSS score was provided, so active exploitation is unconfirmed at the time of analysis.
Denial of service in Oracle Helidon versions 4.0.0 through 4.5.4 allows an unauthenticated remote attacker to hang or repeatedly crash the server by sending crafted traffic to the WebSocket component over HTTP. The flaw is rated CVSS 3.1 base 7.5 (AV:N/AC:L/PR:N/UI:N, availability impact only) and Oracle's own advisory text describes it as easily exploitable. No public exploit code and no CISA KEV listing appear in the supplied intelligence at time of analysis, but the zero-authentication, zero-complexity attack path and availability-only impact make this a low-skill, repeatable disruption vector for any internet-exposed Helidon deployment.