Oracle Business Intelligence Enterprise Edition 26.01.0.0.0 contains a flaw in its Platform Security component that allows a high-privileged, authenticated attacker with HTTP network access to fully take over the BI platform, with high confidentiality, integrity and availability impact. Oracle rates it CVSS 7.2 (AV:N/AC:L/PR:H/UI:N) and the affected version is limited to 26.01.0.0.0. No public exploit code or CISA KEV entry was supplied with the available intelligence, so exploitation is not confirmed to be occurring in the wild.
Oracle E-Business Suite's Common Applications module (CRM User Management Framework component) in supported releases 12.2.3 through 12.2.15 can be fully taken over by an attacker who already holds a high-privileged account and can reach the application over HTTP, resulting in complete loss of confidentiality, integrity and availability of that component. Oracle rates it CVSS 3.1 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), so the network attack path is simple but the privilege bar is high. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied in the input data.
Oracle E-Business Suite 12.2.3 through 12.2.15 contains a flaw in the Applications DBA (AD Utilities) component that lets a high-privileged attacker with network access over HTTP take full control of the Applications DBA subsystem. According to Oracle's advisory language the issue is 'easily exploitable,' meaning low attack complexity once the required privileges are held, and successful exploitation delivers high confidentiality, integrity and availability impact (CVSS 3.1 base 7.2, AV:N/AC:L/PR:H/UI:N). No public exploit code or CISA KEV entry is present in the supplied intelligence, so exploitation appears limited to attackers who already hold an Applications DBA-level account rather than remote unauthenticated adversaries.
A high-privileged attacker with network access to the Oracle Contracts module of Oracle E-Business Suite 12.2.14 or 12.2.15 can fully compromise that module, affecting confidentiality, integrity, and availability. The flaw sits in the Internal Operations component and requires an already-elevated application account (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base score 7.2) - it is not reachable by unauthenticated or low-privileged users, and no user interaction is needed once the prerequisite access exists. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied; the practical risk is therefore concentrated in environments where many users or service accounts already hold broad Contracts privileges.
Oracle Contracts, a module within Oracle E-Business Suite, can be fully taken over by a high-privileged attacker who can reach the application over HTTP in versions 12.2.14 and 12.2.15. Oracle's own advisory rates this 7.2 with complete confidentiality, integrity, and availability impact, and notes it is 'easily exploitable' once the attacker holds elevated privileges. There is no CISA KEV listing and no public exploit code identified at time of analysis, so this is currently a patch-priority issue rather than an observed campaign.
Oracle Document Management and Collaboration, a module within Oracle E-Business Suite 12.2.3 through 12.2.15, can be fully taken over by an attacker who already holds a high-privileged account and can reach the application over HTTP. Successful exploitation grants complete control over the module's confidentiality, integrity, and availability (CVSS 3.1 base 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), meaning an attacker can read, alter, or destroy managed documents and related business data. There is no CISA KEV listing, no public exploit code, and no EPSS data in the provided intelligence, so this is currently a patch-priority issue for Oracle E-Business Suite shops rather than a confirmed actively exploited threat.
High-privileged attackers who already hold administrative-level LDAP credentials can fully take over the OID LDAP Server component of Oracle Internet Directory 12.2.1.4.0 and 14.1.2.1.0 by sending crafted requests over the network. Oracle rates this 7.2 on the CVSS 3.1 scale (AV:N/AC:L/PR:H/UI:N, C/I/A all High), meaning a single low-complexity action against a reachable LDAP listener yields complete loss of confidentiality, integrity, and availability for the directory service. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV; the high privilege prerequisite (PR:H) substantially narrows the realistic attacker set to insiders, compromised directory administrators, or attackers who have already escalated elsewhere in the environment.
In Oracle Siebel CRM's Marketing module (Siebel Apps - Marketing), supported versions 17.0 through 26.7 expose a network-reachable HTTP flaw that a high-privileged user can leverage to seize full control of the Marketing application, impacting confidentiality, integrity and availability alike (CVSS 3.1 base 7.2). The issue is rated easily exploitable (AC:L) but is gated behind privileged credentials (PR:H), and no user interaction is needed once such access exists. No CISA KEV entry, public exploit code, or EPSS score was supplied with the source data, so active exploitation is unconfirmed at time of analysis.
Path traversal in Flextype CMS through 1.0.0-alpha.3 allows API token holders to escape the designated entries directory and read, create, or overwrite arbitrary files accessible to the web server process. The Entries REST API accepts unsanitized id and new_id parameters and passes them directly into filesystem operations, permitting traversal sequences such as '../../' to resolve paths outside the intended content tree. No public exploit code has been identified and no CISA KEV listing exists, but the vulnerability is mechanically straightforward for any actor already possessing a valid API token.
Unauthenticated server-side request forgery in Fireshare versions prior to 1.6.16 allows any remote attacker to force the server to send an arbitrary HTTP POST to a URL of their choosing. The endpoints POST /api/test-discord-webhook and POST /api/test-webhook are missing the @login_required decorator, so no session cookie, API token, or prior access is needed. Because the attacker controls the destination, the server can be pointed at RFC1918 addresses, loopback services, or cloud instance metadata endpoints (e.g. 169.254.169.254), turning a self-hosted media-sharing instance into a pivot into the hosting network. Vendor patch: version 1.6.16. No public exploit code or active exploitation is indicated in the provided intelligence.
IBM Verify Identity Access (and its predecessor Security Verify Access) contains an improper authorization flaw that lets an administrator with limited entitlements execute additional commands beyond their granted privileges by supplying specially crafted input to the product's administrative functionality. The flaw carries a CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), reflecting high confidentiality, integrity and availability impact but requiring an existing privileged account to reach. No public exploit code or CISA KEV entry was identified at time of analysis, and IBM has published a vendor fix via its support advisory.
Incorrect authorization validation in Octopus Server permits authenticated users holding certain scoped permission sets to execute arbitrary scripts on deployment workers, including the built-in worker that runs directly within the Octopus Server process. The flaw bypasses the permission check that should gate script execution, allowing a user to operate outside their authorized scope without possessing the required authorisation. No public exploit has been identified and the CVE is not in CISA KEV, but the low authentication barrier - any user with some scoped permissions - makes this a meaningful privilege-escalation risk in CI/CD environments where Octopus Server routinely holds deployment credentials and infrastructure access.
Stored cross-site scripting in the MotoPress Hotel Booking premium Stripe gateway lets unauthenticated attackers plant persistent JavaScript in the plugin's payment log by POSTing forged Stripe webhook events, because the webhook listener only verifies the Stripe signature when an optional signing secret has been configured — and that secret is empty by default, so forged events are accepted without cryptographic verification. The attacker-controlled event object 'id' is written unescaped and later echoed unsanitized on the payment edit page, executing in an administrator's browser session. All versions up to and including 6.2.4 of the plugin (premium Stripe integration) are affected; no public exploit code has been identified at time of analysis, and no EPSS or CISA KEV data was supplied in the input.
An authenticated attacker can bypass the restore-archive prefix validation in the parame_put_file.cgi handler of Netcore NR268 firmware 1.7.121109, allowing a crafted configuration-restore archive to write files outside the intended restore path. The flaw yields a high integrity and availability impact — device configuration can be overwritten or unset, and the router can be left in an unusable state — while confidentiality is unaffected per the CVSS 4.0 vector (VC:N/VI:H/VA:H). No public exploit code or CISA KEV entry has been identified at time of analysis, and no vendor-released patch is referenced in the available advisories.
FreeRDP clients prior to 3.31.0 leak uninitialized heap memory through the urbdrc USB-redirection channel when a malicious RDP server forces USB transfers to fail, handing the attacker reliable client-side memory contents. The disclosure is a high-severity confidentiality weakness (CWE-457) that defeats ASLR and becomes remote code execution only when chained with a separate memory-corruption flaw in the client. Publicly available exploit code exists per CISA's SSVC assessment (Exploitation: poc), and SSVC rates technical impact as partial and automatable as no, meaning exploitation is feasible but requires an attacker-controlled RDP server plus a victim who initiates the connection.
Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 can be fully taken over through a flaw in its SQR component, but only by an attacker who already holds a high-privileged logon on the host where PeopleTools runs and who can persuade another user to perform an interaction. Oracle rates it 7.2 because a successful attack is difficult to execute yet delivers complete loss of confidentiality, integrity and availability, and because the compromise can spill over into connected products (scope change). No public exploit code is identified and there is no CISA KEV entry, so the issue is a defensive hardening priority rather than an observed campaign.
A difficult-to-exploit flaw in the Client Bundle component of Oracle WebCenter Enterprise Capture (12.2.1.4.0 and 14.1.2.0.0) lets an attacker who already holds a low-privileged logon on the host compromise the application, reading and altering critical capture data and potentially affecting interconnected downstream products through a scope change. Exploitation is not trivial: it requires local access, a low-privileged account, high attack complexity, and a second user to perform an interaction. No public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis; Oracle's Critical Security Patch Update advisory is the authoritative source.
The user wants a JSON analysis. Let me note the details. CVE-2026-91945: FreeRDP before 3.31.0, OOB read in smartcard response decoders failing to validate ATR length fields. Authenticated RDP clients can send oversized ATR lengths in PAKID_CORE_DEVICE_IOCOMPLETION responses. CVSS 7.1, CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N. CWE-125. Patch available from vendor, commit 9626564421df72c84f891afdbc0b20bf702f369f. Reported by VulnCheck. Note: the commit diff shown appears unrelated to the actual fix (CMakeLists.txt winpr change) — that's a data quality flag potentially. Actually the diff snippet seems to be CMake version check — not the actual security fix. Hmm. Could mention in confidence notes as suspicious/mismatched patch reference. But careful — the diff is truncated; only showing part. I could flag it. Tags: Buffer Overflow, Information Disclosure, Freerdp. "Buffer Overflow" is arguably a mislabel — CWE-125 is out-of-bounds read, not a buffer overflow (write). Hmm, "Buffer Overflow" tag could be considered mislabeled. That's a plausible data_quality_flag: mislabeled_tag target "Buffer Overflow", suggested "out-of-bounds-read". Confidence medium. Actually the instructions say only emit flag when clearly wrong and verifiable from references. CWE-125 out-of-bounds read is a memory read, not a classic buffer overflow (CWE-120/787 write). Description explicitly says "out-of-bounds read" causing process termination. So the "Buffer Overflow" tag is misleading. I'd emit a medium-confidence flag. Also "freerdp" tag present as "Freerdp" — it's lowercase normalized presumably fine. Missing tags? Possibly "smartcard"? Not a standard tag. Maybe "cwe-125"? Not necessarily. I'll skip missing tags. Prevalence: FreeRDP is a widely used open-source RDP client library — high? It's used in many Linux distributions, thin clients, etc. I'd say "high" or "medium". FreeRDP is the de facto open source RDP implementation, bundled in distros, used by ma
IBM Business Automation Workflow, in both its container and traditional (on-premises) distributions, fails to restrict XML external entity resolution when parsing XML data, allowing an authenticated remote user to read server-side files or exhaust process memory. The flaw carries a CVSS base score of 7.1 (AV:N/AC:L/PR:L/UI:N, C:H/I:N/A:L), meaning a low-privileged but valid account is required — it is not exploitable unauthenticated. IBM has published a vendor fix via support document node 7285930; there is no CISA KEV listing and no public exploit code identified at time of analysis, and no EPSS score was supplied with the intelligence feed.
Authenticated OpenCTI users holding JSON mapper creation permission can craft a catastrophically backtracking regular expression in the extractWithRegexp mapper formula, blocking the Node.js event loop and making the GraphQL API unavailable to every user on the instance. The flaw affects only availability — no data is exposed or modified — and requires the attacker to already hold a privileged mapper-management role, but scheduled ingestion can re-trigger the lockup repeatedly without further attacker action, and recovery may require disabling the mapper and restarting the process. Fixed in OpenCTI 7.260706.0, where the vulnerable JavaScript RegExp engine was replaced with RE2, a linear-time regex library; no public exploit code or CISA KEV listing was identified at time of analysis.
Netcore NR255-V routers running firmware 1.5.130703 expose captive-portal account credentials through the l7_web_auth_user_show.cgi handler, allowing anyone who can reach the web interface with a low-privileged session to read usernames and passwords stored for web-authentication (captive-portal) users. Successful retrieval hands the attacker working credentials for authenticated network access, so the confidentiality impact is rated High while integrity and availability are unaffected. No public exploit code has been confirmed and the issue is not listed in CISA KEV, but the exposed endpoint returns credential material directly rather than requiring any cracking step.
Let me produce the JSON. Key facts: - CVE-2026-91950, FreeRDP before 3.31.0 - OOB read in rdpdr_dump_packet due to 32-bit unsigned integer wraparound in buffer bounds validation - computerNameLen = 0xFFFFFFF0 bypasses bounds check → OOB read → client crash or heap disclosure in logs - CVSS 7.1, CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CWE-125 - VulnCheck reported - CPE: freerdp:freerdp all versions (up to before 3.31.0) - Tags: Buffer Overflow, Information Disclosure, Freerdp - References: GitHub security advisory GHSA-c5gr-hmqp-pwj4, VulnCheck advisory No EPSS, no KEV, no POC mentioned. Attack requires the client to connect to a malicious RDP server — UI:P (passive user interaction: the user connects to the server). PR:N. No privileges. AV:N because the malicious server is remote. Exploitation conditions: attacker must control/operate the RDP server the client connects to; requires the RDPDR (device redirection) virtual channel to be enabled/active — in FreeRDP, rdpdr is used for drive/printer/port redirection and is typically negotiated when the client has redirection enabled. Also the dump/log path (rdpdr_dump_packet is a debug dump function) — so triggering the crash likely requires the rdpdr debug logging/dump enabled? Hmm. The function rdpdr_dump_packet is a dumping function, likely compiled when WITH_DEBUG_RDPDR or verbose logging is enabled. Actually in FreeRDP, rdpdr_dump_packet exists in rdpdr_main.c guarded by... let's be careful. I'd say the OOB read occurs during packet dump/parsing on logging, so higher log verbosity may be required. I should state this as an inference and flag uncertainty. Remediation: upgrade to FreeRDP 3.31.0 or later; advisory link. Workarounds: disable device redirection (rdpdr), avoid connecting to untrusted RDP servers, reduce log verbosity, remove /drive /printer flags. Trade-offs. Prevalence: FreeRDP is widely deployed as the RDP client in Linux distros, ThinLinc, etc. — high (widely depl
Denial of service in FreeRDP clients before 3.31.0: a rogue or compromised RD Gateway can send a WebSocket Ping frame with a crafted 64-bit extended payload length that wraps an integer inside WinPR's Stream_EnsureRemainingCapacity, producing a double free that crashes the client while the connection is being established. Exploitation requires no credentials on the attacker's side and only a victim client that routes its session through that gateway over the WebSocket transport; the primary impact is loss of availability of the client session. Vendor-released patches are available in FreeRDP 3.31.0, and there is no public exploit code or active exploitation reported in the supplied intelligence.
FreeRDP deployments running the RDPGFX server-side graphics pipeline before version 3.31.0 leak uninitialized heap memory to any authenticated RDP client, because the ResetGraphics PDU serializer leaves the padding bytes of its fixed 340-byte wire structure untouched. The leaked bytes can contain live heap pointers and GLib function addresses, which defeats heap ASLR and reveals the GLib module base address — a strong primitive for chaining into further memory-corruption exploits. No public exploit code or CISA KEV entry was identified in the supplied intelligence at time of analysis, though the fix commit is publicly visible, making the flaw trivially reverse-engineerable.
FreeRDP versions before 3.31.0 contain a heap buffer overflow in the client-side negotiation routine nego_send_negotiation_request(), which writes the server-supplied LB_LOAD_BALANCE_INFO field into a fixed 512-byte buffer without checking its length. A malicious RDP server — or an attacker positioned as a man-in-the-middle — can trigger the overflow by replying to a client's connection attempt with a Server Redirection PDU carrying an oversized LB_LOAD_BALANCE_INFO value, corrupting heap memory before authentication even completes. The confirmed impact is denial of service or heap corruption (CVSS 7.1, availability-only); no public exploit code and no CISA KEV listing were identified at time of analysis.
A security-component flaw in Oracle Hyperion Financial Management 11.2.26.0.000 lets a low-privileged attacker who already holds a valid account and network access to the HTTP interface read critical financial consolidation data and partially degrade availability of the application. The CVSS 3.1 base score is 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L), reflecting high confidentiality and low availability impact with no integrity exposure. There is no public exploit code or CISA KEV entry identified at time of analysis, so exploitation is currently assessed as targeted rather than opportunistic.
Oracle Report Manager, a component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, can be compromised by a low-privileged attacker with network access to the HTTP interface, resulting in unauthorized read access to critical report data and a partial denial of service. The flaw carries a CVSS 3.1 base score of 7.1 with high confidentiality and low availability impact, and Oracle rates it easily exploitable. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, so it is currently a patch-now vulnerability rather than a confirmed actively exploited one.
Oracle XML Gateway, a module delivered with Oracle E-Business Suite 12.2.3 through 12.2.15, exposes an install-related component that a low-privileged, network-positioned attacker can abuse over HTTP to read data the account should never reach — up to the full set of XML Gateway-accessible data — and to degrade service availability. Oracle rates it 7.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L), meaning the confidentiality hit is total for that module while the availability impact is only partial and there is no integrity impact. There is no public exploit code and no CISA KEV listing at time of analysis, and no EPSS score was supplied, so this reads as a patch-cycle obligation rather than an emergency — but the Oracle CPU reference (cspusep2026) is the authoritative fix source.
Improper access control in the Install component of Oracle XML Gateway within Oracle E-Business Suite 12.2.3 through 12.2.15 lets a low-privileged attacker with network access over HTTP read all data the XML Gateway can reach and partially degrade its availability. The flaw carries a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N, C:H/I:N/A:L), meaning exploitation is straightforward once a valid low-privilege account exists, but it is not unauthenticated. No public exploit code has been identified and the issue is not listed in CISA KEV; Oracle addresses it in its September 2026 Critical Security Patch Update.
A low-privileged authenticated attacker with HTTP network access can exploit the Install component of Oracle XML Gateway in Oracle E-Business Suite 12.2.3 through 12.2.15 to read critical data, gain complete access to all XML Gateway-accessible data, and trigger a partial denial of service. The vulnerability carries a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L), indicating easy exploitation once valid credentials are held, with confidentiality as the dominant impact. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV; the only intelligence source is Oracle's September 2026 Critical Patch Update advisory.
Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 exposes a flaw in the Forge component that lets a low-privileged, network-connected attacker read data far beyond their authorization and degrade service availability. Because exploitation requires only a valid low-privilege account and a crafted HTTP request (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L, 7.1), the confidentiality impact is severe while integrity is untouched. Exploitation status: no public exploit identified at time of analysis, and the issue is not listed in CISA KEV, though Oracle has shipped a fix in its Critical Security Patch Update.
Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 (the Endeca-based Forge component) can be exploited over HTTP by a low-privileged authenticated attacker to read critical application data and cause a partial denial of service. The flaw carries a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N, high confidentiality and low availability impact) and affects a single supported release, 11.4.0. No public exploit code or CISA KEV listing has been identified at time of analysis, and no EPSS score was supplied, so real-world exploitation is currently unconfirmed.
Oracle Siebel CRM Deployment (Server Infrastructure component) in supported releases 17.0 through 26.7 exposes critical CRM data to a low-privileged, network-positioned attacker who can reach the deployment service over HTTP, and also allows that attacker to partially degrade availability. Oracle rates it 7.1 (AV:N/AC:L/PR:L/UI:N, C:H/A:L) and describes it as easily exploitable in its cspusep2026 security alert; there is no CISA KEV listing, no public exploit code identified, and no EPSS score supplied in the source data.
Oracle One-to-One Fulfillment, a module within Oracle E-Business Suite 12.2.3 through 12.2.15, exposes unauthorized access to critical data and can be partially disrupted by an attacker holding only a low-privileged account with HTTP access to the application. Per Oracle's CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/A:L), the issue requires authentication but no user interaction, and yields high confidentiality loss plus a limited availability impact. There is no public exploit code and no CISA KEV entry at time of analysis, and no EPSS score was supplied; the vendor patch is published in the September 2026 Critical Patch Update advisory.
Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 ship a flaw in the Runtime Tools component that lets any authenticated low-privileged user read critical portal data and partially degrade portal availability over HTTP. Oracle rates it as easily exploitable (CVSS 7.1, AV:N/AC:L/PR:L/UI:N, C:H/A:L), so no user interaction and no administrative role is needed beyond a valid account. No public exploit code and no CISA KEV entry were identified at time of analysis, but the data-exposure impact on an enterprise portal makes it worth prompt patching.
Oracle XML Gateway, the E-Business Suite module that exchanges XML business documents with external trading partners, exposes critical data to any low-privileged user who can reach its HTTP endpoints in versions 12.2.3 through 12.2.15. A successful attack gives the intruder read access to data they should not see — described by Oracle as unauthorized access to critical data or complete access to all XML Gateway accessible data — and also allows a partial denial of service that degrades the module's availability. The flaw is trivially reachable (network vector, low complexity, no user interaction), and no public exploit code has been identified at the time of analysis.
Oracle Hyperion Financial Management 11.2.26.0.000 contains an easily exploitable security flaw in its Security component that lets a low-privileged, authenticated attacker reach the application over HTTP and obtain unauthorized access to critical financial consolidation data, with a secondary ability to cause a partial denial of service. The vendor rates it 7.1 with network vector, low complexity, and no user interaction, meaning an attacker only needs a valid low-privilege account rather than administrative rights. No public exploit code or CISA KEV entry was present in the supplied intelligence, and no EPSS score was provided, so current exploitation status is unconfirmed.
A security-control flaw in Oracle Hyperion Financial Management 11.2.26.0.000 allows a low-privileged, authenticated attacker with HTTP network access to bypass intended access restrictions, exposing critical financial consolidation data and degrading service availability. Successful exploitation yields high confidentiality impact (complete access to data the account should not reach) plus a partial denial of service, giving a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L). Oracle has addressed the issue in its Critical Security Patch Update; no public exploit code or CISA KEV entry was present in the intelligence provided, so exploitation status is 'no public exploit identified at time of analysis'.
Oracle Report Manager, a component of Oracle E-Business Suite (versions 12.2.3 through 12.2.15), exposes an internal-operations flaw that lets a low-privileged attacker with HTTPS network access read critical data and degrade service availability. Successful exploitation yields high confidentiality impact against all Report Manager-accessible data plus partial denial of service, giving the flaw a 7.1 CVSS base score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L). There is no public exploit code and no CISA KEV listing at time of analysis, so exploitation is not confirmed to be active; risk is concentrated in internet- or broadly-reachable EBS Report Manager deployments where ordinary authenticated users exist.
Low-privileged users with network access to Oracle E-Business Suite 12.2.3 through 12.2.15 can tamper with, create, or delete Applications Calendar data they should not control, and can partially degrade the availability of that component (CVSS 3.1 base 7.1, AV:N/AC:L/PR:L/UI:N, integrity high and availability low, no confidentiality impact). The flaw sits in the Oracle Common Applications Calendar module of EBS and is rated 'easily exploitable' by the vendor, but it is not a pre-authentication bug: an attacker must already hold a valid low-privileged account and HTTP reachability to the EBS application tier. No CISA KEV listing, EPSS score, or public exploit code was provided with the advisory data, so there is currently no public exploit identified at time of analysis.
Authenticated information disclosure in the Netcore NR255-V router (firmware 1.5.130703) allows any logged-in user to pull other users' session and browsing-history records by querying audit CGI components (l7_web_auth_log_dump_cgi.c, audit_get_cgi.c, and the mod_dispatch_auth/plan.json dispatch manifest). The flaw is rated 7.1 (CVSS 4.0) with PR:L/UI:N and a high confidentiality-only impact (CWE-359, exposure of private personal information), making it a privacy and data-protection problem rather than a code-execution risk. No public exploit code was identified in the supplied intelligence at time of analysis, and the issue is not listed in CISA KEV; a public disclosure writeup and a VulnCheck advisory are the primary references.
An authenticated user of Vikunja before 2.6.0 can exhaust the memory of migration worker processes by launching a Planka import job that points at a server they control, which advertises a large number of individually size-compliant attachments. Because the migrator enforces per-file size limits but no aggregate memory budget, the worker is consumed and the instance becomes unavailable to every user on it. The flaw is rated 7.1 (CVSS 4.0, availability-only impact), requires low privileges but no user interaction, and no public exploit code or CISA KEV entry is associated with it at time of analysis; the vendor has released a fix in 2.6.0.
Memory exhaustion in the Vikunja task-filter endpoint lets any authenticated user crash the API service by submitting a filter query containing thousands of nested parentheses, which the recursive expression parser consumes without a depth limit. All deployments before version 2.6.0 are affected (EUVD lists 2.5.0 through 2.5.x), and a single low-privileged account is enough to repeatedly take the backend offline. A vendor advisory and a VulnCheck advisory are published, a patched release exists in 2.6.0, and no public exploit code or CISA KEV entry was identified at time of analysis, though the attack is trivial to reproduce by hand with plain HTTP requests.
XML external entity (XXE) injection in the IBM MQ .NET client allows an authenticated attacker with queue-write access to read files from the host running that client and to cause a limited denial of service when the client parses the RFH2 folder of a crafted message. The flaw is client-side - the queue manager itself and the Java/C clients are not indicated as affected - and the attacker must already hold valid MQ credentials with authority to place messages on a queue the vulnerable client consumes. No public exploit has been identified at time of analysis, CISA's SSVC assessment records no exploitation activity and rates the issue not automatable with partial technical impact, and patch code is available from the vendor; the practical risk is genuine but moderate, well below what the 7.1 base score suggests at first glance.
FreeRDP clients before 3.31.0 terminate unexpectedly when connected to a malicious RDP server, because the URBDRC (USB redirection) control-transfer request path forwards an attacker-supplied OutputBufferSize of 65536 to the libusb backend without validating it, hitting a reachable assertion. The attacker must control the RDP server and convince a user to connect, so exploitation is network-facing but user-initiated. Impact is limited to availability (client process crash) rather than code execution or data exposure; no public exploit code or CISA KEV listing was identified at time of analysis.
Let me synthesize. CVE-2026-91959: FreeRDP buffer over-read in rts_read_result (RPC gateway transport parser), truncated BIND_ACK PDU result entry → OOB read → process abort (DoS). CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H — network, no privileges, passive UI (UI:P means user must perform... in CVSS 4.0, UI:P = Passive, meaning the user just needs to interact minimally, like a client connecting), high availability impact only. So no confidentiality/integrity impact despite the "Information Disclosure" tag — actually the tag "Information Disclosure" seems mislabeled since VC:N. Hmm — buffer over-read could disclose memory, but the CVSS says VC:N. The description says process abort (DoS). So the tag "Information Disclosure" is arguably mislabeled — but do I want to emit a data_quality_flag? The tags list: "Buffer Overflow, Information Disclosure, Freerdp". "Buffer Overflow" is arguably wrong too — CWE-125 is out-of-bounds read, not a buffer overflow (write). Hmm, "Buffer Overflow" tag on an over-read is a mislabel... The instructions say only emit a flag when the input metadata is clearly wrong and verifiable. Information Disclosure: an OOB read technically can leak memory, but CVSS says VC:N and description says process abort. I'd say low confidence. Buffer Overflow mislabel — CWE-125 is "Out-of-bounds Read", which is distinct from buffer overflow (CWE-787/CWE-120). Hmm, but many tag taxonomies lump them. I'll emit one flag with medium confidence for "Information Disclosure"? Actually the guidance says flags should be high-confidence and verifiable. Maybe emit a flag for "Buffer Overflow" as mislabeled_tag with suggested "out-of-bounds-read"... but 'suggested' is "the correct/canonical slug if you know it". Hmm. I think I can include one flag with medium confidence. Risk: noise. The instructions say empty array is common and correct. Given CWE-125 ≠ buffer overflow and CVSS shows VC:N (no info disclosure), I think two tags are arguably mislabeled. But
Client-side denial of service in FreeRDP before 3.31.0: the URBDRC (USB redirection) channel's func_get_ep_desc function indexes interface arrays by positional offset instead of the protocol's InterfaceNumber field, so a malicious or compromised RDP server can send a crafted SELECT_CONFIGURATION message with permuted InterfaceNumber values and trigger an out-of-bounds heap read that crashes the connecting client. The flaw only degrades availability (no confidentiality or integrity impact per the CVSS 4.0 vector), requires the victim to initiate a session against the hostile server, and no public exploit code or active exploitation has been reported at time of analysis. It is a targeted-attacker nuisance rather than a mass-exploitation risk, but patching to 3.31.0 is straightforward.
FreeRDP clients before 3.31.0 crash when a malicious RDP server sends a crafted Surface Bits command advertising the NSCodec codec ID — the GDI surface-bits handler dereferences a NULL decoder pointer instead of rejecting the unsupported codec. The victim only has to initiate an RDP session to an attacker-controlled or compromised server; the outcome is a client-side denial of service (application crash), with no memory corruption, code execution, or data exposure reported. No public exploit code and no CISA KEV listing were identified at time of analysis.
Let me write the JSON. Product: FreeRDP. CVE-2026-91952, infinite loop DoS in pool_decode_rect with AVC444 metablocks, client-side vulnerability — malicious RDP server attacks clients. AV:N, AC:L, PR:N, UI:P (UI passive), VA:H only. No KEV, no POC mentioned. CVSS 3.1 assessed: client connects to malicious RDP server. Attack vector network, AC:L? The crafted server response triggers loop — no special conditions besides connecting to malicious server (user interaction passive). PR:N. UI:P. C/I:N, A:H. S:U. So CVSS:3.1/AV:N/AC:L/PR:N/UI:P/S:U/C:N/I:N/A:H = 6.5? Let's compute: base score for AV:N/AC:L/PR:N/UI:P/S:U/C:N/I:N/A:H. Exploitability = 8.22 × 1.0 × 0.85 × 0.62 = 8.22*0.85=6.987; *0.62=4.332. Impact = 6.42 × 0.31? A:H → ISCBase = 1 - (1-0)(1-0)(1-0.56) = 0.56. Impact = 6.42 × 0.56 = 3.595. Total = roundup(min(3.595+4.332, 10)) = roundup(7.927) = 7.9. Hmm, that's odd — but that's standard: CVE with A:H and UI:P gives ~7.9? Actually wait, the numbers given in the prompt: 7.1 for CVSS 4.0. Let me just compute 3.1: 7.9? Let me double-check exploitability with UI:P (0.62). Yes 8.22*0.85*0.62 = 4.3319. And impact 3.5952. Sum 7.927 → roundup = 7.9. Hmm that seems high but it's the formula. Actually let me recheck: for A:H, ISCBase = 0.56, Impact sub score = 6.42 × 0.56 = 3.5952. Scope unchanged: Impact = 6.42 × (ISCBase - 0.029) - 3.25×(ISCBase-0.02)^15 = 6.42×0.531 - 3.25×(0.54)^15. (0.54)^15 is tiny → ~0. So 3.409? Wait no. Formula: Impact = 6.42 × ISS where ISS = 1 - [(1-C)(1-I)(1-A)]. With C:N, I:N, A:H → ISS = 1 - (1)(1)(1-0.56) = 0.56. Then for scope unchanged: Impact = 6.42 × ISS = 3.5952. Hmm, that's the scope-changed formula variant? Let me recall CVSS 3.1 spec: If Scope is Unchanged: Impact = 6.42 × ISS. If Scope Changed: Impact = 7.52 × (ISS - 0.029) - 3.25 × (ISS - 0.02)^15. Yes, so 3.5952 for unchanged. So base = min(Impact+Exploitability,10) × 1.08 = min(7.927,10)=7.927 → 7.927 × 1.08 = 8.561 → roundup = 8.6? No wait — the 1.08 multiplier is for Scope
An out-of-bounds write in FreeRDP's urbdrc (USB redirection) client channel allows a malicious or compromised RDP server to crash the connecting client. When the client loads the urbdrc channel, a crafted 28-byte USB redirection message drives urb_send_current_frame_number_result() to write 4 bytes past a 16-byte heap buffer, which trips an assertion (CWE-617) and terminates the process on builds with verbose asserts enabled. The flaw affects FreeRDP 3.14.0 through 3.30.0 and is fixed in 3.31.0; impact is availability only, and no public exploit code or CISA KEV listing has been identified at time of analysis.