Netcore NR255-V firmware 1.5.130703 exposes router account credentials through the user_pass_show.cgi endpoint, which can be reached and abused by an attacker holding only a low-privilege account on the device's web management interface. Successful exploitation hands over stored administrator/PPPoE credentials, enabling full takeover of the router and any network traffic it mediates. Rated 7.1 under CVSS 4.0 with high confidentiality impact but no integrity or availability effect; no public exploit code or CISA KEV entry was identified at time of analysis, and no patched firmware version is confirmed in the available references.
Netcore NR255-V routers running firmware 1.5.130703 expose stored DDNS account credentials in cleartext through the ddns_wan_list_show.cgi endpoint, with related handling paths in DDNSset_cgi, IGD_GetCgiHandler and IGD_CgiCall. An attacker who can reach the device's web management interface with low-level authenticated access can read the plaintext DDNS username and password, which typically grant control over the dynamic DNS provider account tied to the router's public hostname. No CISA KEV listing or confirmed public exploit code was identified at time of analysis, and no EPSS score was supplied; the CVSS 4.0 base score is 7.1 with only confidentiality impact.
Authenticated users of self-hosted Vikunja instances before 2.6.0 can crash the server by uploading a highly compressed archive through the data-import feature, which is expanded without any size or expansion-ratio limit and consumes tens of gigabytes of memory and disk. The issue is a classic decompression-bomb denial of service (CWE-400) rated 7.1 under CVSS 4.0 (AV:N/AC:L/PR:L/UI:N, availability-only impact); any account able to reach the import endpoint is sufficient, no administrative rights are needed. A vendor fix is available in 2.6.0, and no public exploit code or CISA KEV listing was identified in the supplied intelligence.
Vikunja versions before 2.6.0 omit pixel-count decode limits on avatar and project-background image upload endpoints, so an authenticated user can upload tiny files whose decoded dimensions are enormous and drive unbounded CPU and memory consumption during image processing. Repeated or concurrent uploads can exhaust server resources and deny service to all users of the instance. The flaw is rated CVSS 7.1 with high availability impact only, no public exploit code has been identified at time of analysis, and a vendor fix is available in 2.6.0.
Vikunja releases before 2.6.0 can be knocked offline by any authenticated user who uploads a deliberately oversized multipart CSV file to the POST /api/v2/migration/csv/migrate endpoint, because the importer parses rows without bounding cardinality. Each tiny record consumes heap, so a file containing millions of minimal rows drives the process to out-of-memory conditions and terminates the API service, causing a full denial of service for all tenants on that instance. The flaw is rated 7.1 (CVSS 4.0) with high availability impact and low privileges required; exploitability is high and automatable, though no public exploit code and no CISA KEV listing were provided at time of analysis. Notes in the source metadata separately cite a vendor-available patch.
Oracle Common Applications Calendar, a module within Oracle E-Business Suite 12.2.3 through 12.2.15, can be compromised by a low-privileged attacker who already holds a valid account and can reach the application over HTTP. Successful exploitation gives the attacker unauthorized read, creation, modification, and deletion access to Calendar data and can also cause a partial denial of service, though Oracle rates the flaw as difficult to exploit (CVSS 3.1 7.1, AV:N/AC:H/PR:L/UI:N). No public exploit code or CISA KEV entry was provided in the intelligence feed, and the only authoritative reference is Oracle's Critical Patch Update advisory cspusep2026.
Low-privileged attackers with network access to Oracle Field Service can read and modify critical data and cause a partial denial of service, exploiting a difficult-to-trigger flaw in the Internal Operations component of Oracle E-Business Suite. All supported Oracle Field Service releases from 12.2.3 through 12.2.15 are affected. No public exploit code was identified and there is no CISA KEV listing at time of analysis, but the CVSS 3.1 base score of 7.1 with high confidentiality and integrity impact makes this a candidate for prioritization once patch data is verified.
Improper authorization in Atlassian Jira Service Management Data Center 11.3.0 through 11.3.10 lets an authenticated, low-privileged attacker reach functionality and data they should not be able to access, with the vendor scoring it 7.1 in CVSS 4.0 (AV:N/AC:L/PR:L/UI:N/VI:H). Atlassian states the flaw was discovered through its own penetration-testing program and that the impact could extend from exposure of sensitive resources to arbitrary code execution, though the published CVSS 4.0 vector only credits a high integrity impact and rates confidentiality and availability as none. No CISA KEV listing, EPSS score, or public exploit code was provided in the source data, so at time of analysis this should be treated as a confirmed but not yet observed-in-the-wild authorization bypass; patched versions (11.3.11 and later) are already available.
An improper authorization flaw in Atlassian Confluence Data Center lets an authenticated, low-privileged user reach resources and functionality they should not be able to access, resulting in high confidentiality impact against the affected instance. The defect was introduced across a broad set of release trains — 7.4.0, 7.13.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0 and 10.2.0 — meaning most currently maintained Data Center deployments built on those lines are exposed until upgraded. Atlassian rates the issue 7.1 (CVSS 4.0, AV:N/AC:L/PR:L/UI:N/VC:H) and has shipped fixes in 9.2.24 and 10.2.17; there is no evidence of public exploit code or confirmed active exploitation at time of analysis.
Unauthorized data manipulation in Oracle E-Business Suite's US Federal Human Resources module (releases 12.2.3 through 12.2.15) lets any low-privileged user with HTTP access to the application tier create, modify or delete critical HR records and read a subset of data they should not see. The flaw
Oracle Common Applications Calendar, a module within Oracle E-Business Suite 12.2.3 through 12.2.15, exposes an application-layer access-control weakness that lets a low-privileged user with network access to the EBS HTTP interface create, delete or modify critical calendar data and read a subset of calendar records. The flaw is rated CVSS 3.1 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N), meaning no user interaction is needed but a valid low-privileged account is a prerequisite. No public exploit code or CISA KEV listing was provided in the source data, and no EPSS score was supplied, so active exploitation is currently unconfirmed.
Authenticated low-privileged users can compromise Oracle Project Intelligence within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) over HTTP, gaining unauthorized create, delete, and modify access to critical data along with read access to a subset of application data. Oracle rates the issue CVSS 3.1 base 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N), reflecting a trivial-to-execute, low-privilege attack whose dominant impact is data integrity rather than availability or broad disclosure. No EPSS score, CISA KEV listing, or public proof-of-concept was present in the supplied intelligence, so exploitation status is unconfirmed.
Oracle Order Management, a module of Oracle E-Business Suite, contains a flaw in its Enterprise Command Center component affecting the supported version V16, allowing a low-privileged attacker with network access over HTTP to read all Order Management data the attacked account can reach and to modify part of it. Oracle rates this 7.1 with confidentiality fully impacted and integrity partially impacted, and the vendor describes it as easily exploitable, though authentication with at least a low-privileged account is required per the CVSS vector (PR:L). At the time of analysis there is no public exploit code or CISA KEV listing, and no EPSS score was supplied, so risk is driven by the criticality of the ERP data rather than by evidence of active exploitation.
Improper access controls in Oracle Product Hub, a module of Oracle E-Business Suite 12.2.3 through 12.2.15, let a low-privileged authenticated user reach Internal Operations functionality over HTTP and obtain unauthorized read access to critical product data plus limited insert, update, or delete access to some records. Oracle's own advisory rates this CVSS 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), meaning a valid but unprivileged account is enough — no user interaction and no elevated role required. No public exploit code and no CISA KEV listing were identified at time of analysis, but Oracle CPU vulnerabilities in E-Business Suite are historically attractive to attackers because the targets are internet-exposed, data-rich ERP systems.
Oracle Hyperion Data Relationship Management (DRM) 11.2.26.0.000 contains an access-control weakness in its Access and Security component that lets a network-positioned attacker holding only a low-privileged account read or fully extract critical master-data records and make limited unauthorized updates to them. Oracle's own CVSS 3.1 rating is 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), reflecting complete compromise of confidentiality within the application scope but only partial integrity impact, with no availability effect. No public exploit code, EPSS score, or CISA KEV listing was supplied with the available intelligence, so active exploitation is unconfirmed; the only authoritative source is Oracle's security alert at https://www.oracle.com/security-alerts/cspusep2026.html.
Oracle E-Business Suite versions 12.2.9 through 12.2.15 ship a flaw in the Oracle Applications Framework Personalization component that lets a low-privileged authenticated user reach data and functionality they should not be able to touch, via ordinary HTTP requests. Successful exploitation yields high-impact confidentiality loss (read access to critical application data) plus limited integrity impact (unauthorized insert, update or delete of some records); availability is unaffected. Oracle rates it 7.1 on CVSS 3.1, and no public exploit code or active exploitation has been reported at time of analysis.
Out-of-bounds read in the Netcore NR255-V router (firmware 1.5.130703) is triggered when an authenticated user uploads a deliberately truncated firmware image through the put_file_cgi.c endpoint. The short buffer is passed into the pre-flash validation path (mtd_write, main.c, check_image_uuid.c, oemMD5Update.c), which reads past the end of the uploaded image, leaking adjacent memory and, per the CVSS availability impact, potentially crashing or bricking the flash-validation routine. No CISA KEV listing or confirmed public exploit code was identified at time of analysis, but a public technical write-up exists and the attack is fully automatable once credentials are held.
Takeover of Oracle Banking Corporate Lending Process Management (component: Base, versions 14.5.0.0.0 through 14.9.0.0.0) is possible for a low-privileged attacker who reaches the application over HTTP and convinces another user to interact with attacker-supplied content, resulting in full loss of confidentiality, integrity and availability of the product. The flaw is rated CVSS 3.1 7.1 (AV:N/AC:H/PR:L/UI:R) — network reachable but hard to exploit, requiring an existing low-privilege account and victim interaction. No public exploit code has been identified at time of analysis, and no EPSS score or CISA KEV entry was supplied in the source data.
Oracle Banking Branch versions 14.5.0.0.0 through 14.9.0.0.0 can be taken over by a low-privileged attacker who already holds a valid account and can reach the application over HTTP, provided a second user is lured into interacting with crafted content in the Reports component. Oracle rates this 7.1 (AV:N/AC:H/PR:L/UI:R) with high confidentiality, integrity and availability impact, meaning full compromise of the branch platform rather than mere data leakage. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied, so this should be treated as a high-severity but not yet actively exploited issue requiring patching on the Oracle Critical Security Patch Update cycle.
Authenticated low-privileged users with HTTP access to Oracle E-Business Suite 12.2.3 through 12.2.15 can exploit a difficult-to-trigger flaw in the One-to-One Fulfillment 'Documents' component to read critical data outside their authorized scope and partially degrade availability of the module. The vendor-assigned CVSS 3.1 base score is 7.1 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:L), reflecting high confidentiality impact with no integrity impact and only partial denial of service; the scope-change flag indicates that exploitation can significantly affect resources beyond the vulnerable component. There is no CISA KEV listing, no public proof-of-concept identified, and no EPSS data supplied, so exploitation is not confirmed to be active at time of analysis.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets an unauthenticated, network-positioned attacker tamper with or destroy critical financial consolidation data and partially degrade service availability — but only if a victim user is persuaded to interact with the attacker's crafted request (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L, base 7.1). Integrity is the dominant impact (I:H), with only partial denial of service (A:L) and no confidentiality exposure (C:N). There is no public exploit identified at time of analysis and no KEV listing; no EPSS score was supplied in the source data, so the exploitation-probability signal is absent rather than low.
Low-privileged authenticated users with HTTP access to Oracle Quality in Oracle E-Business Suite 12.2.3 through 12.2.15 can read critical Quality records and make limited unauthorized changes to them, because the Internal Operations component fails to enforce proper authorization on its requests. Oracle scores this 7.1 with a network vector, low attack complexity and no user interaction, so exploitation is straightforward for anyone who already holds any valid EBS account. No public exploit code or CISA KEV listing was identified at time of analysis, and no EPSS score was supplied in the input.
Oracle Hyperion Financial Management 11.2.26.0.000 contains an easily exploitable flaw in its Security component that lets an attacker holding a low-privileged account reach the application over HTTP to read critical financial data and degrade availability. Rated CVSS 3.1 7.1 (AV:N/AC:L/PR:L/UI:N, C:H/I:N/A:L), the issue requires only a valid low-privileged login rather than administrative rights, making any ordinary HFM user account a viable starting point. No public exploit code has been identified and the flaw is not listed in CISA KEV at time of analysis; EPSS data was not supplied.
Low-privileged users with network access to Oracle Depot Repair inside Oracle E-Business Suite 12.2.3 through 12.2.15 can read critical repair and recall records they are not entitled to and partially degrade availability of the module by sending crafted HTTP requests to the Recall Management component. Oracle rates the flaw 7.1 using CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L, meaning a valid but unprivileged account is the main barrier — no user interaction, no elevated role, and no special attack complexity. The provided intelligence contains no CISA KEV listing and no public exploit code, so exploitation is currently assessed as authenticated and targeted rather than opportunistic mass scanning.
Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 exposes its Forge component to a low-privileged, network-reachable attacker over HTTP, allowing unauthorized read access to critical data and a partial denial of service. The flaw carries a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N, C:H/I:N/A:L), meaning a valid but low-privileged account is enough and no user interaction is required. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but Oracle has published a fix in its Critical Patch Update advisory (cspusep2026.html), and the associated tags also categorize the issue as an authentication bypass.
Integrity compromise in Oracle Site Hub, a module of Oracle E-Business Suite, affects supported releases 12.2.3 through 12.2.15 and lets a low-privileged authenticated attacker reach the Internal Operations component over HTTP to create, delete, or modify critical Site Hub data while also reading a subset of that data. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N, base 7.1) confirms network reachability with no user interaction, but the PR:L metric means credentials are required, so this is not a pre-auth or anonymous attack path despite the 'Authentication Bypass' tag carried by the reporting feed. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and exploitation is further constrained by the relatively narrow deployment footprint of the Site Hub module within EBS.
Oracle Hyperion Financial Management 11.2.26.0.000 exposes sensitive application data and can be partially disrupted by low-privileged attackers who reach the product over HTTP, due to a flaw in the Security component. Per the Oracle-sourced CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L), exploitation yields high confidentiality impact plus a partial denial of service, but no integrity impact and no scope change. No public exploit code, EPSS score, or CISA KEV entry was provided with this record, so active exploitation is unconfirmed and the practical threat depends on whether the HTTP/security interface is exposed to untrusted networks.
Authenticated denial of service in Atlassian Confluence Data Center allows a low-privileged logged-in user to make the application unavailable to its intended users, with no confidentiality or integrity impact. The flaw was introduced across a broad swath of releases (8.9.0 through 10.2.0) and Atlassian rates it High with a CVSS 4.0 score of 7.1. Fixed builds are 9.2.24 and later on the 9.2 branch and 10.2.17 and later on the 10.2 branch; no public exploit code or confirmed active exploitation was identified at time of analysis.
Netcore NR255-V routers running firmware 1.5.130703 expose stored IPsec pre-shared keys and RSA private key material through web CGI read handlers, principally l2tpd_config_show.cgi, with the same class of weakness present in ipsec_show_cgi.c and the mod_vpn_remote/plan.json reader. The flaw is network-reachable but requires an authenticated session with only low privileges (CVSS 4.0 PR:L), so anyone who obtains any valid router account — or who finds a weakly protected management interface — can retrieve credentials that decrypt or impersonate the device's IPsec/L2TP VPN tunnels. No CISA KEV listing, EPSS score, or vendor patch version was supplied with the available intelligence, so exploitation status and fix availability remain unconfirmed; public technical reference material describing the issue does exist.
Netcore NR255-V routers running firmware 1.5.130703 expose stored PPTP and L2TP VPN credentials through four web-accessible handlers — the mod_vpn_remote/plan.json endpoint and the pptpd_user_show.cgi, pptp_client_config_show.cgi, and l2tpd_user_show.cgi CGI scripts. An attacker who holds a low-privileged session on the router's web management interface (CVSS 4.0 PR:L) can request these endpoints over the network without any user interaction and recover VPN usernames and passwords in the clear. The result is full credential disclosure (VC:H) that can be replayed against the organization's PPTP/L2TP VPN gateways; no public exploit code or CISA KEV listing was present in the supplied intelligence, and no EPSS score was provided.
WeKnora's URL-based document ingestion endpoint (POST /api/v1/knowledge-bases/:id/knowledge/url) allows authenticated users to reach internal network resources and cloud metadata services by supplying a public URL that redirects to private addresses, bypassing the Go-side SSRF filter applied only to the initial submitted URL. Versions 0.5.2 through 0.6.x are affected; the Python/Playwright web scraper layer followed HTTP redirects without re-invoking SSRF validation, a gap the Go service handler did not share. No public exploit or CISA KEV listing exists at time of analysis, but the redirect-bypass technique is well-documented and accessible to any authenticated user.
Oracle Business Intelligence Enterprise Edition (BI Platform Security component) versions 8.2.0.0.0 and 26.01.0.0.0 contain a difficult-to-exploit flaw that lets a low-privileged, authenticated attacker reach the BI platform over HTTP and gain unauthorized create, delete, or modify access to critical BI data, plus read access to a subset of it. Oracle's own CVSS 3.1 rating is 7.1 (AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:N), with the scope change indicating successful attacks can also affect connected products. No EPSS score, CISA KEV entry, or public exploit code was present in the supplied intelligence, so exploitation is currently assessed as theoretical rather than observed.
Authorization bypass in IceHRM before 36.0.0 lets any authenticated employee read coworkers' HR records by substituting an arbitrary employee ID in seven REST sub-resource endpoints covering skills, education, certifications, languages, leave, attendance and status. CVSS 4.0 scores the flaw 7.1 (AV:N/AC:L/PR:L/UI:N, VC:H only), reflecting a low-effort, easily automated disclosure of sensitive personnel data rather than code execution. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV; a vendor fix is available in release v36.0.0.
Unauthorized creation, deletion, and modification of critical master data plus partial denial of service in Oracle Hyperion Data Relationship Management 11.2.26.0.000 can be triggered by an unauthenticated attacker with network access over HTTPS, provided a victim other than the attacker is persuaded to interact with attacker-supplied content. The flaw sits in the Access and Security component, scores 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L), and carries no confidentiality impact - the damage is data integrity and reduced availability. There is confirmed actively exploited (CISA KEV)? No - no public exploit identified at time of analysis, and no EPSS or KEV data was supplied; Oracle has published a Critical Security Patch Update advisory covering supported versions.
Unauthenticated attackers positioned on the same network segment as a host running Oracle Agile Engineering Data Management 6.2.1 can reach the Engineering Communication Interface component and read critical engineering data or alter stored records, according to Oracle's Supply Chain security alert. The flaw carries a CVSS 3.1 base score of 7.1 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), meaning no credentials, no user interaction and no attack complexity are required once adjacency is achieved. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied.
Oracle Communications Cloud Native Core Security Edge Protection Proxy (SEPP) versions 26.1.200 and 25.2.201 are exposed to an unauthenticated, low-complexity attack launched from the adjacent network segment on which the SEPP host resides. A successful exploit gives the attacker high-impact read access to critical SEPP data plus limited ability to modify or delete that data (CVSS 3.1 base 7.1, AV:A/AC:L/PR:N/UI:N/C:H/I:L/A:N), which in a 5G roaming architecture could mean exposure of inter-PLMN signaling and subscriber-adjacent metadata. No public exploit code and no CISA KEV entry were identified in the available data, so exploitation is currently assessed as opportunistic rather than confirmed in the wild, and the primary exposure is limited to deployments where untrusted parties can reach the SEPP's network segment.
An authorization bypass in MISP through version 2.5.45 lets an authenticated user who can edit events assign an arbitrary sharing_group_id they are not authorized to use, because the authorization check only ran when the request explicitly supplied distribution = 4. If the caller omits the distribution field, MISP's field-recovery logic restores the event's stored distribution (4, for sharing-group events) and persists the unauthorized sharing group ID, silently re-scoping who can see that event and its threat-intelligence content. No public exploit code or active exploitation has been identified at time of analysis, but exploitation is a single crafted edit request, so the integrity impact (VI:H, CVSS 4.0 base 7.1) is significant for multi-tenant or community-sharing MISP instances.
Low-privileged users with HTTP access to Oracle E-Business Suite 12.2.3 through 12.2.15 can leverage a hard-to-reach flaw in the Oracle Partner Management module (Internal Operations component) to read critical data and modify records far beyond their authorization, with the impact crossing into other EBS components because the vulnerability carries a scope change. Oracle rates it CVSS 7.1 and characterizes it as difficult to exploit, and a fix is published in the 2026 Critical Patch Update. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Authenticated low-privileged users of Oracle HRMS (India) inside Oracle E-Business Suite 12.2.3 through 12.2.15 can send crafted HTTPS requests to the Internal Operations component and reach data or operations they should not be authorized to touch, resulting in high confidentiality impact and partial integrity impact (CVSS 3.1 base 7.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N). The flaw is rated easily exploitable by Oracle, but it is not listed in CISA KEV, no public exploit code has been identified, and no EPSS score was supplied with the intelligence feed. Affected deployments are those running the India localization of the EBS HRMS module; the underlying weakness class (most consistent with improper access control / missing authorization) has no CWE assigned in the source data.
Improper access control in the Award/PO component of Oracle Contract Lifecycle Management for Public Sector (part of Oracle E-Business Suite, versions 12.2.8 through 12.2.15) lets a low-privileged, authenticated attacker with HTTP network access read critical application data and modify or delete records they should not be able to touch. Oracle rates this 7.1 with a CVSS vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, meaning exploitation is trivial for anyone holding a valid low-privilege account and requires no user interaction. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and EPSS/KEV signals were not present in the supplied data.
Oracle Hyperion Data Relationship Management 11.2.26.0.000 exposes an access-and-security weakness that lets a low-privileged, authenticated user reach data they should not see and alter records they should not touch. The flaw is reachable over the network through ordinary HTTP requests with no user interaction, and Oracle rates it 7.1 with high confidentiality impact and partial integrity impact. Exploitation grants read access to critical master-data content and limited unauthorized insert, update, or delete capability; no public exploit code or CISA KEV entry was present in the supplied intelligence at time of analysis.
Oracle Siebel CRM Deployment (Siebel Management Console) in versions 17.0 through 26.7 fails to properly restrict what a low-privileged, network-connected user can reach, letting that user read critical deployment data and make limited unauthorized changes. Exploitation is trivial once a valid low-privilege account exists: CVSS 3.1 scores it 7.1 (AV:N/AC:L/PR:L/UI:N, C:H/I:L/A:N), with the confidentiality impact rated High and integrity impact Low. There is no public exploit code and no CISA KEV listing at time of analysis, so this is currently a patch-on-schedule item for Siebel shops rather than an emergency, though EPSS data was not supplied and the untrusted-network exposure of the management console should drive prioritization.
Oracle Siebel CRM Integration (EAI component) versions 17.0 through 26.7 expose a network-reachable SOAP interface that fails to properly restrict operations for authenticated low-privileged users, letting an attacker read critical CRM data and perform limited unauthorized inserts, updates, or deletions. The flaw carries a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N, C:H/I:L/A:N) and is rated 'easily exploitable' by the vendor, requiring only a valid low-privilege account and network reachability to the EAI endpoint. No public exploit code or CISA KEV entry was present in the supplied intelligence at time of analysis.
Improper access control in the Open UI component of Oracle Siebel CRM (End User) versions 17.0 through 26.7 lets an authenticated low-privilege user issue crafted HTTP requests that expose and modify data beyond their authorized scope. Successful exploitation yields high confidentiality impact — unauthorized read of critical Siebel data — plus limited integrity impact via unauthorized insert, update or delete operations; availability is unaffected (CVSS 3.1 base 7.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N). No CISA KEV listing, public exploit code or EPSS signal is present in the supplied intelligence, so this is currently a patch-cycle priority rather than a confirmed actively exploited issue.
Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 contain a flaw in the Runtime Tools component that lets a low-privileged, network-positioned attacker read and partially modify portal data via HTTP. Oracle rates it 7.1 (AV:N/AC:L/PR:L/UI:N, C:H/I:L), meaning exploitation is trivial once any valid low-privileged account is held, with full confidentiality impact against the portal's accessible data. No CISA KEV listing, public exploit code, or EPSS score was supplied with the source data, so active exploitation is unconfirmed at time of analysis.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that an attacker positioned on the same adjacent network segment as the HFM host can exploit without authentication or user interaction to hang or repeatedly crash the application (complete denial of service) and to make limited unauthorized inserts, updates or deletes against data the application can reach. The vendor rates it 7.1 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H), so confidentiality is untouched while availability is fully lost and integrity is partially degraded. No public exploit code has been identified at time of analysis and no EPSS or KEV signal was supplied, but the low attack complexity and zero authentication requirement make this a segment-level risk for any organization exposing HFM to shared or flat internal networks.
Oracle Hyperion Financial Management 11.2.26.0.000 contains an improper authorization flaw in its Security component that lets a low-privileged, network-positioned attacker with a valid account reach and read critical financial consolidation data, and also modify a limited subset of that data. The CVSS 3.1 base score is 7.1 (AV:N/AC:L/PR:L/UI:N, C:H/I:L/A:N), reflecting a remotely reachable, low-complexity path that requires only basic authenticated access. There is no KEV listing, no public exploit code identified at time of analysis, and no EPSS score supplied with the source data, so this should be treated as a serious but not yet demonstrably exploited enterprise application flaw.
MISP through 2.5.45 fails to enforce authorization checks when collection elements are created, allowing an authenticated user to persist a bare UUID referencing an Event or Galaxy Cluster they are not permitted to read. The collection view later resolves that UUID back into the underlying object, so collections become a handle on another organisation's private data — the patch notes this already caused org-only events to be disclosed in the beta collection view. Exploitation requires a valid MISP account and knowledge of the target UUID; no public exploit code or CISA KEV listing was identified at time of analysis, though the CVSS 4.0 vector (PR:L, VC:H) and EPSS-adjacent signals mark it as a meaningful confidentiality risk for shared threat-intel instances.
Denial of service in Arista EOS DHCP relay and snooping deployments allows an unauthenticated attacker with Layer 2 access to a client-facing VLAN to crash the DHCP Relay service by sending a specially crafted DHCP packet. Triggering requires the information option (Option 82) to be inserted by the relay/snooping configuration, or a DHCP server whose match criteria reference Option 82. The flaw is rated CVSS 4.0 7.1 (AV:A/AC:L/PR:N/UI:N/VA:H) and is covered by Arista Security Advisory 0155; no CISA KEV listing, public exploit code, or EPSS score was supplied in the source data.
Adjacent-network attackers can crash HPE Networking EdgeConnect SD-WAN Gateways or leak small amounts of uninitialized stack memory by sending crafted traffic to the gateway, affecting unauthenticated devices reachable from the same Layer 2 segment. The flaw (CWE-200) carries a 7.1 CVSS score with the availability impact rated High and confidentiality impact Low, and it spans four maintained release trains from 9.4.0.0 through 9.7.0.0. It is not listed in CISA KEV, no public exploit code was identified in the supplied intelligence, and no EPSS probability was provided, so the immediate risk is driven by network adjacency and gateway exposure rather than confirmed mass exploitation.