Unauthenticated attackers who can reach the Oracle Hyperion Data Relationship Management web interface over HTTP can bypass the product's access and security controls in version 11.2.26.0.000 and read any data the application itself can reach, giving complete confidentiality loss for that deployment with no integrity or availability impact. Oracle rates the flaw 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and the vulnerability is tagged as an authentication bypass, meaning exploitation requires no credentials, no user interaction and no special complexity. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and no EPSS score was supplied in the source data, so the immediate driver is the trivial unauthenticated network exposure rather than confirmed active exploitation.
Unauthenticated attackers with HTTP access to Oracle JDeveloper 12.2.1.4.0 or 14.1.2.0.0 can read the full contents of data reachable through the product's HTTP interface, including critical application data. The flaw is fully remote and requires no credentials or user interaction (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N), and Oracle classifies it as easily exploitable while impacting confidentiality only. No public exploit code has been identified and the issue is not listed in CISA KEV, but Oracle has published a fix through its Critical Patch Update program.
Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 allows an unauthenticated attacker with HTTP network access to read critical data — potentially the entire data set the platform can reach — through a flaw in the Experience Manager component. The issue is rated 7.5 with a confidentiality-only impact (C:H/I:N/A:N), meaning attackers can exfiltrate data but not modify or destroy it, and exploitation is trivially automatable (AV:N/AC:L/PR:N/UI:N). No public exploit code and no CISA KEV entry were identified at time of analysis, and Oracle has published a fix in its 2026 Critical Security Patch Update advisory.
Unauthenticated remote attackers with HTTP access to the Reports component of Oracle Siebel CRM End User (versions 17.0 through 26.7) can bypass intended access controls and read data they should not be able to reach, giving them unauthorized access to critical data or the full set of data accessible to the Siebel CRM End User application. The flaw carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N, confidentiality-only impact), meaning it is trivially reachable and requires no credentials or user interaction, but it does not permit data modification or denial of service. No public proof-of-concept, EPSS score, or CISA KEV listing was supplied with this report, so active exploitation is not confirmed at time of analysis.
An unauthenticated remote attacker with HTTP access to Oracle E-Business Suite 12.2.3 through 12.2.15 can bypass access controls in the Oracle Application Object Library (FND) Core component and read critical application data, per Oracle's own disclosure (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/C:H/I:N/AN). The flaw is fully automatable — no credentials, no user interaction, low complexity — making it attractive for mass scanning, though its impact is limited to confidentiality (no integrity or availability loss). No public exploit code has been identified and it is not listed in CISA KEV at time of analysis, but no EPSS score was supplied, so real-world exploitation probability is unquantified.
Unauthenticated information disclosure in Oracle iStore (Shopping Cart component) within Oracle E-Business Suite 12.2.3 through 12.2.15 lets a remote attacker with plain HTTP access read critical data exposed through the storefront, up to and including all data reachable by the iStore application. The flaw carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N, confidentiality-only impact) and is trivially automatable given the network vector and lack of credentials or user interaction. No CISA KEV entry, EPSS score, or public proof-of-concept was present in the supplied intelligence, so exploitation is assessed as possible but not confirmed in the wild at time of analysis.
Unauthenticated remote attackers can read sensitive data from Oracle Applications Manager within Oracle E-Business Suite 12.2.3 through 12.2.15 by sending crafted HTTP requests to the RapidClone command-line component. The issue is scored CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), meaning exploitation needs no credentials, no user interaction, and only affects confidentiality — an attacker gains unauthorized access to critical data or all data reachable through Applications Manager. No public exploit code has been identified and the CVE is not listed in CISA KEV at time of analysis, so exploitation appears opportunistic rather than confirmed in the wild.
IBM Verify Identity Access (formerly Security Verify Access) can be driven into a denial-of-service state by a remote, unauthenticated attacker who sends crafted requests that the product fails to validate for resource consumption. Only availability is impacted (CVSS 7.5, C:N/I:N/A:H); confidentiality and integrity are untouched. No public exploit code and no CISA KEV entry were identified in the provided intelligence, and the vendor has published a fix; the practical risk is therefore tied to exposure of the affected endpoints rather than to confirmed active exploitation.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a security-control bypass in its Security component that permits unauthenticated attackers with network access over HTTP to reach data they should not be able to see. Successful exploitation yields high confidentiality impact — unauthorized access to critical data or complete access to all Hyperion Financial Management data accessible to the application — while integrity and availability are unaffected. The flaw is rated 7.5 by Oracle and is trivially automatable (AV:N/AC:L/PR:N/UI:N); no public exploit code or CISA KEV entry was present in the supplied intelligence, so active exploitation is not confirmed at time of analysis.
Authentication controls protecting the web-based management interface of HPE Aruba EdgeConnect SD-WAN Orchestrator can reportedly be circumvented by a remote actor, allowing escalation to administrative privileges and full compromise of the orchestrator host that manages the SD-WAN fabric. Reported affected releases span EdgeConnect SD-WAN software 9.4.0 through 9.7.0, with no fix version disclosed in the supplied source data. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied, so exploitation status is best treated as unconfirmed.
Privilege escalation and full application takeover in Oracle Hyperion Data Relationship Management 11.2.26.0.000, where a low-privileged attacker with network access over HTTP can compromise the Access and Security component, resulting in complete loss of confidentiality, integrity, and availability of the product (CVSS 3.1 base 7.5). Exploitation is assessed as difficult (AC:H), consistent with a security-logic or state/timing-dependent flaw rather than a simple injection, and no public exploit code or CISA KEV entry was identified at time of analysis. The practical risk concentrates in large finance and EPM environments where DRM holds authoritative master-data hierarchies and is reachable by ordinary business users.
Authenticated takeover of Oracle Product Lifecycle Analytics 3.6.1: an attacker holding a low-privileged account can reach the application over HTTP and, through a hard-to-trigger installation-related flaw in the Oracle Supply Chain component, gain full control of the service with complete confidentiality, integrity and availability impact. Oracle rates the flaw 7.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), explicitly noting it is difficult to exploit, and no public exploit code or CISA KEV entry has been identified at the time of analysis. Realistic exposure is therefore concentrated in deployments where low-trust users can already authenticate to the product over the network.
Full compromise of Oracle Commerce Guided Search and Oracle Commerce Experience Manager 11.4.0 is possible through a flaw in the Forge component that lets a low-privileged attacker with network access over HTTP take over the affected system, with high confidentiality, integrity and availability impact. Oracle rates exploitation as difficult (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.5), meaning an authenticated but unprivileged foothold plus conditions outside the attacker's direct control are required. No public exploit code, EPSS score, or CISA KEV listing was provided with this record, so at time of analysis there is no public exploit identified and no confirmed active exploitation.
Oracle Siebel CRM versions 17.0 through 26.7 contain a flaw in the Siebel CRM Integration (EAI) component that lets a low-privileged, network-positioned attacker achieve full takeover of the integration service over HTTP. Exploitation is rated difficult (CVSS AV:N/AC:H/PR:L/UI:N, base 7.5) and yields high confidentiality, integrity, and availability impact on the Integration component. No public exploit code or CISA KEV listing was identified at time of analysis, and no EPSS score was supplied, so the immediate risk is driven by patch urgency rather than confirmed in-the-wild activity.
Oracle Siebel CRM Deployment (Server Infrastructure component) versions 17.0 through 26.7 can be fully taken over by a low-privileged attacker who already holds a valid account and can reach the deployment over HTTP. The flaw is rated 7.5 with High complexity (AC:H), meaning it is not a trivial drive-by exploit but requires a favorable, harder-to-arrange condition to succeed; when it does, confidentiality, integrity, and availability are all fully compromised. There is no CISA KEV listing and no public exploit code identified at time of analysis, but Oracle has published a Security Alert with a patch, so exposure is patch-gated rather than just theoretical.
Low-privileged attackers who can reach Oracle Siebel CRM Deployment over HTTP can exploit a hard-to-trigger flaw in the Siebel Remote component to fully take over the deployment, gaining high confidentiality, integrity and availability impact across the affected system. The vendor lists all supported Siebel CRM Deployment releases from 17.0 through 26.7 as affected, and rates the issue CVSS 3.1 7.5 with a high attack-complexity metric, meaning successful exploitation demands precise conditions rather than a straightforward request. No public exploit code and no CISA KEV listing were identified at time of analysis, so exploitation currently appears to require attacker-specific research or favorable timing rather than off-the-shelf tooling.
A flaw in the Oracle XML Developers Kit (XDK) component bundled with Oracle Database Server lets a low-privileged database account holding the XDKC privilege execute a network-delivered Oracle Net attack that can lead to full takeover of the XDK component, with high confidentiality, integrity and availability impact. Supported releases 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3 are affected. Oracle classifies the issue as difficult to exploit (AC:H) and no public exploit code or CISA KEV entry has been identified at time of analysis, though any user able to obtain XDKC rights is a viable candidate attacker.
Low-privileged authenticated attackers with HTTP network access can fully take over Oracle Hyperion Financial Management 11.2.26.0.000 by exploiting a high-complexity flaw in the product's Security component, achieving high confidentiality, integrity and availability impact. Oracle rates the issue CVSS 3.1 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting that exploitation is difficult but complete compromise results. No public exploit code and no CISA KEV listing were observed at time of analysis, and no EPSS score was supplied, so real-world exploitation activity is unconfirmed.
Oracle E-Business Suite's Mobile Application Server (MWA Terminal Server component) in versions 12.2.3 through 12.2.15 can be fully taken over by an unauthenticated attacker who can reach the host over an adjacent network segment. The flaw is rated 7.5 with a CVSS vector of AV:A/AC:H/PR:N/UI:N and high confidentiality, integrity and availability impact, meaning an attacker positioned on the same physical communication segment as the Mobile Application Server hardware can compromise the service without credentials, though exploitation is complicated by conditions beyond the attacker's control (AC:H). Oracle has published the fix through its Critical Security Patch Update advisory; at the time of analysis there is no CISA KEV listing, no confirmed public exploit code and no EPSS score provided.
Full takeover of Oracle WebCenter Portal 14.1.2.0.0 is achievable by an unauthenticated attacker who can reach the server from an adjacent network segment, though Oracle rates the flaw as difficult to exploit (AC:H) given its CVSS 3.1 score of 7.5 with high confidentiality, integrity and availability impact. The vulnerability sits in the Runtime Tools component of Oracle Fusion Middleware and requires the attacker to already have access to the physical communication segment attached to the host running WebCenter Portal, so internet-facing exposure alone is not sufficient. No public exploit code, EPSS score, or CISA KEV listing was provided in the source data, so active exploitation is currently unconfirmed; Oracle published the fix via its September 2026 Critical Patch Update advisory.
Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0 can be completely taken over by an unauthenticated attacker who has obtained a position on the same physical or adjacent network segment as the connector host. The defect lives in the Core component and is rated difficult to exploit (AC:H), yet a successful attack yields full confidentiality, integrity and availability loss with no credentials and no user interaction required. No public exploit code or CISA KEV entry has been identified at time of analysis, but the connector's role in identity provisioning and directory synchronization makes it a strategically attractive target.
Missing authentication for a critical function in Dell Wyse Management Suite (WMS) releases prior to 2605.0.3.683 allows a remote, unauthenticated attacker to invoke a protected function without supplying credentials, resulting in unauthorized access to the management platform (CWE-306). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, 7.5) indicates the flaw is exploitable with no authentication, no user interaction and low complexity, with integrity impact rated High and no confidentiality or availability impact. Dell has published advisory DSA-2026-387 with a fixed build (2605.0.3.683); no CISA KEV entry, EPSS score or public proof-of-concept was provided in the source data, so active exploitation is not confirmed.
Stored cross-site scripting in the Concrete CMS Top Navigation Bar block (versions 9.0 through 9.5.2) allows any user who can create or rename pages to embed a script payload inside a child page name, which the block writes into the rendered navigation without HTML escaping. The payload executes in the origin of every visitor, editor, or administrator who expands the affected dropdown, letting it read same-origin content or perform actions under that victim's session. No public exploit code or CISA KEV listing was identified at time of analysis, and the vendor rates the issue 7.5 (CVSS v4.0) with PR:H, reflecting that the attacker must already hold page-management privileges.
Denial of service in the cellular modem of Google Android devices allows a radio-adjacent attacker to disrupt or crash baseband connectivity by sending crafted, malformed signaling input over the radio interface. The flaw is an improper input validation issue (CWE-20) rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), meaning no authentication or user interaction is required once the attacker has radio reach, though exploitation requires a rogue or compromised base station, IMSI-catcher, or signaling injection capability within RF range of an active cellular connection. No public exploit identified at time of analysis, and EPSS is 0.25% (16th percentile), indicating a low predicted likelihood of exploitation; impact is limited to availability (recoverable modem/connectivity denial of service) with no confidentiality, integrity, code execution, or persistence impact.
Improper input validation in the Android modem/baseband allows an attacker who can deliver crafted radio-layer signaling to the device to cause information disclosure, scored 7.5 (HIGH) under CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The affected component is the cellular modem in Google Android, reported by Google Devices and published in the Pixel security bulletin dated 2026-09-01 (EUVD-2026-78991); default configurations are exposed once the handset attaches to an attacker-controlled radio environment, and no on-device privileges or user interaction are required. Although the vector is network-rated, practical exploitation requires RF proximity and specialized SDR/IMSI-catcher-class hardware rather than arbitrary internet reachability, and impact is confined to confidentiality with no code execution or integrity/availability effect. Risk is tempered by the absence of confirmed active exploitation and an EPSS score of only 0.24% (15th percentile), so no public exploit was identified at the time of analysis.
Stored cross-site scripting in Concrete CMS versions before 9.5.3 lets any user who can submit an Address attribute inject JavaScript that later executes in the browser session of a dashboard user viewing the affected Express association entry. The root cause is a country-less text formatter for the Address attribute that skips HTML-escaping, combined with Express association templates (such as concrete/elements/express/form/view/dashboard/association.php) echoing the association label mask without calling the h() escaping helper. The vendor scored this CVSS v4.0 7.5 (AV:N/AC:L/AT:P/PR:L/UI:P) and published the fix in the 9.5.3 release notes; no CISA KEV listing or public exploit code was identified at time
IBM Security Verify Identity Access (formerly Security Verify Access) ships a reverse proxy component that, in certain configurations, performs weaker-than-expected cryptographic validation of user-supplied data. A remote, unauthenticated attacker (CVSS 3.1 AV:N/PR:N/UI:N) can therefore submit crafted data that is improperly validated, exposing protected resources and sensitive identity information; the impact is confidentiality-only (C:H/I:N/A:N) with a base score of 7.5. No CISA KEV entry and no public exploit code were identified at time of analysis, and IBM has published a vendor fix. Affected lines are Verify Identity Access 11.0.0 through 11.0.3 Interim Fix 001 and Security Verify Access / Security Verify Access Container 10.0.0 through 10.0.9.2 Interim Fix 001.
Let me synthesize. CVE-2026-87276: Oracle VM VirtualBox Core, version 7.2.16. CVSS 3.1 7.5, vector AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H. CWE not provided. Description says "Difficult to exploit" — high complexity. Requires logon (low privileged attacker), human interaction. Scope change (S:C) — impacts additional products. Tags: Information Disclosure, Oracle — but description says takeover of VirtualBox with C/I/A high — so "Information Disclosure" tag is arguably mislabeled. Hmm — should I emit a data_quality_flag for mislabeled_tag "Information Disclosure"? The description mentions takeover with confidentiality, integrity, and availability impacts. The tag "Information Disclosure" is only a partial characterization. Is it "clearly wrong and verifiable"? It's arguably incomplete rather than wrong. Oracle hypervisor escape / VM takeover isn't purely info disclosure. I could flag it as mislabeled with medium confidence. Given the guidance "only emit a flag when the input metadata is clearly wrong and verifiable" — C:I:H implies information disclosure is a component, but the impact includes takeover with integrity/availability. I think flagging is defensible but risky. I'll include it with medium confidence... Hmm. Actually the rule says "Do NOT invent problems to fill the array." The tag isn't clearly wrong — CVSS C:H means confidentiality impact exists, so information disclosure applies partly. I'll leave data_quality_flags empty. Hmm, but maybe also a missing tag? No clear missing tag. Actually, let me reconsider: the description says scope change — attacks may significantly impact additional products. This is characteristic of VM escape (guest → host or host → other VMs). AV:L, PR:L with logon to infrastructure where VirtualBox executes. UI:R human interaction. Note: This is a fabricated CVE (2026). No KEV, no POC, EPSS not provided. Oracle CPU-style advisory link (cspusep2026.html — "Oracle Critical Patch Update Security ... "). Version 7.2.16 supported. Note
A hard-to-exploit local vulnerability in Oracle Business Intelligence Enterprise Edition 26.01.0.0.0 (Oracle Analytics, Platform Security component) lets a low-privileged user who can already log on to the host running the platform take full control of the BI service, with knock-on impact to connected products because the vulnerable component operates with changed scope. The attacker must additionally induce a separate legitimate user to perform an action (UI:R) and clear a high attack-complexity bar (AC:H), so exploitation is neither trivial nor remote. No public exploit code has been identified and the flaw is not listed in CISA KEV at time of analysis; Oracle shipped the fix in its Critical Security Patch Update advisory (cspusep2026).
Broken access control in the tts-be timetable backend (all versions prior to 2.1.0) lets unauthenticated remote attackers chain several public API endpoints - including /api/student/{id}/photo and /api/course_unit/{id}/exchange/metadata - and abuse the server as an open proxy against upstream university systems. The result is enumeration and extraction of student PII such as full names, student IDs, class schedules and photographs, with no authentication or user interaction required. The flaw is rated CVSS 7.5 with high confidentiality impact only; the vendor advisory confirms a fix in 2.1.0, and no public exploit code or CISA KEV listing was identified at time of analysis.
Unbounded memory consumption in the web_url_read tool of mcp-searxng before 1.7.1 lets a remote unauthenticated client exhaust the MCP server process by pointing it at an HTTP endpoint that omits (or understates) the Content-Length header. The 5 MiB URL_READ_MAX_CONTENT_LENGTH_BYTES guard is implemented as a HEAD preflight only, so when the header is absent the check short-circuits to false and the full response body is loaded via response.text() and then converted to Markdown, driving both memory and CPU usage toward exhaustion. Exploit code and a Docker-based proof of concept are published in the vendor's GHSA advisory, and the flaw is fixed in 1.7.1; CISA KEV listing and EPSS scoring are not present in the supplied data.
Prolink's 13A Smart Plug (model DS-3202M-UKv3) paired with the mEzee 2.6.7 mobile app mishandles packets received during the Wi-Fi provisioning phase, letting an attacker within radio range crash the plug or redirect it to connect to an attacker-controlled device instead of the legitimate access point. The flaw carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N, availability-only per the published vector), while the practical attack surface is narrower because it exists only while the plug is actively being set up. Exploitation status at time of analysis: no public exploit identified at time of analysis, though a public GitHub repository ('crossprobe') is linked in the CVE record and appears to be proof-of-concept research tooling; the CVE is not listed in CISA KEV and no EPSS score was supplied.
Oracle Hyperion Data Relationship Management (DRM) version 11.2.26.0.000 contains a hard-to-exploit flaw in the product's Access and Security component that lets an unauthenticated attacker reachable over TCP create, delete or modify critical master data and read the full contents of the application. CVSS 3.1 scores it 7.4 with Confidentiality and Integrity both High, but only because no public exploit code and no CISA KEV entry exist does this remain an integrity-focused patching priority rather than an emergency. There is no public exploit identified at time of analysis and no EPSS score was supplied.
Oracle E-Business Suite 12.2.3 through 12.2.15 contains a flaw in the Core component of the Application Object Library that allows a remote, unauthenticated attacker with HTTP access to bypass authentication and gain unauthorized read and write access to critical application data. Oracle rates the issue 7.4 with a high attack complexity, reflecting that exploitation is possible over the network without credentials but requires conditions an attacker must engineer or discover. No public exploit code has been identified and the issue is not listed in CISA KEV, so at time of analysis this is a patch-now, high-impact confidentiality and integrity risk rather than a confirmed active campaign.
Unauthenticated network attackers can reach Oracle Forms Services (including the C/S and Charmode components) over HTTP and achieve unauthorized access to, or modification and deletion of, critical data held in the application, in Oracle Forms 12.2.1.19.0 and 14.1.2.0.0. Oracle rates the issue 7.4 with high confidentiality and integrity impact but explicitly characterizes it as difficult to exploit (AC:H), meaning a favorable timing or state condition is required rather than simple request replay. At the time of analysis there is no confirmed CISA KEV listing and no public exploit code identified; exploitability details remain largely undisclosed by the vendor.
Hyperion Financial Management 11.2.26.0.000 can be compromised by an unauthenticated attacker who can reach the product's SSH service, resulting in unauthorized reading, creation, deletion, or modification of the financial data the application manages. Oracle scores this CVSS 7.4 (AV:N/AC:H/PR:N/UI:N, C:H/I:H/A:N), pairing high confidentiality and integrity impact with a stated difficulty of exploitation. No public exploit code, EPSS score, or CISA KEV entry was present in the supplied intelligence, so exposure should be judged from network reachability of SSH rather than from confirmed in-the-wild activity.
Unauthenticated attackers who can reach the Oracle Hyperion Financial Management 11.2.26.0.000 web interface over HTTP can bypass the product's security controls and gain unauthorized read and write access to financial consolidation data, although Oracle rates the attack as difficult to execute (AC:H). The vendor addressed the flaw in its Critical Security Patch Update advisory, and no public exploit code or CISA KEV entry was identified at time of analysis. EPSS data was not supplied in the available intelligence, so real-world exploitation likelihood cannot be quantified from these sources.
Oracle Hyperion Financial Management 11.2.26.0.000 (component: Security) can be compromised by an unauthenticated attacker who reaches the product over the network via TLS, resulting in unauthorized read, creation, modification and deletion of critical consolidation data. The vendor rates this 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), with the high attack-complexity metric reflecting a flaw that is difficult to trigger reliably rather than a trivial path. Security tagging points to an authentication-bypass condition in the Security component; no public exploit code or CISA KEV entry was available at time of analysis, and no EPSS data was supplied.
Unauthenticated network attackers can exploit a hard-to-trigger flaw in the Web Services Security component of Oracle Web Services Manager 12.2.1.4.0 and 14.1.2.0.0 to read all data the service can access and to repeatedly hang or crash it. Oracle rates the issue 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H), reflecting high confidentiality and availability impact offset by high attack complexity and no integrity impact. No public exploit code and no CISA KEV entry were identified at time of analysis, and no CWE classification was supplied.
Oracle Hyperion Data Relationship Management 11.2.26.0.000 contains an authentication bypass in the Access and Security component that can be reached over the network through SMTP, allowing an unauthenticated attacker to create, delete, or modify critical data and to read the entirety of the application's accessible data. Oracle's security alert rates it 7.4 with high confidentiality and integrity impact but high attack complexity, indicating the exploit path is non-trivial even though no credentials or user interaction are required. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV, but the vendor-published advisory and the absence of any availability impact make this a targeted-tampering risk for finance and master-data teams rather than a broad worm-style threat.
Oracle Siebel CRM Deployment (Server Infrastructure component) versions 17.0 through 26.7 contain an authentication-related flaw that lets a remote, unauthenticated attacker over HTTP read, create, delete, or modify critical deployment data - CVSS 3.1 base 7.4 with high confidentiality and integrity impact. Exploitation is rated difficult (AC:H), presumably because the attacker must meet a hard-to-satisfy protocol or timing condition, but no privileges or user interaction are required if that condition is met. Oracle has published a fix via its Critical Security Patch Update advisory; active exploitation is not confirmed and no public exploit code was identified in the supplied intelligence.
Unauthenticated attackers able to reach the HTTPS interface of Oracle E-Business Suite 12.2.3 through 12.2.15 can exploit a difficult-to-trigger flaw in the Oracle Application Object Library (Core component) to create, delete, or modify critical data and to read data they should never see. The CVSS 3.1 base score is 7.4 (AV:N/AC:H/PR:N/UI:N, high confidentiality and integrity impact, no availability impact), meaning no credentials or user interaction are needed but successful exploitation depends on conditions the attacker must satisfy. No public exploit code has been identified and the flaw is not listed in CISA KEV, so it should be treated as a high-severity patch obligation rather than an actively exploited emergency.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a hard-to-trigger but unauthenticated network flaw in its Security component that lets an attacker reaching the TLS-exposed service read, create, modify or delete any financial consolidation data the application can access. CVSS 3.1 scores it 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), reflecting complete confidentiality and integrity loss with no availability impact, and Oracle explicitly characterises exploitation as difficult. No public exploit code, EPSS score, or CISA KEV entry was provided at time of analysis, so this should be treated as a patch-now integrity risk to financial reporting data rather than an actively exploited incident.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a hard-to-exploit but unauthenticated security flaw reachable over HTTP through the product's Security component, allowing an attacker to read and tamper with financial consolidation data. The CVSS 3.1 score is 7.4 (AV:N/AC:H/PR:N/UI:N, high confidentiality and integrity impact, no availability impact), and Oracle's tag for the issue points to an authentication bypass. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV, so it is a patching priority rather than a confirmed active threat.
Oracle Hyperion Financial Management 11.2.26.0.000 exposes a Security-component flaw that lets an unauthenticated remote attacker with network access create, delete, or modify critical financial consolidation data and read the full contents of the application's accessible data set. Exploitation is rated difficult (CVSS 3.1 7.4, AV:N/AC:H/PR:N/UI:N), implying a timing-, state-, or query-construction dependency rather than a one-shot request. No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV, but the confidentiality and integrity impact is total for exposed deployments, so the Oracle Critical Security Patch Update referenced by the vendor should be treated as mandatory.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a security flaw in its Security component that lets an unauthenticated attacker reachable over HTTP bypass access controls and gain both read and write access to the application's critical financial data. Oracle rates it 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), with the high attack-complexity metric indicating that some non-trivial precondition must be met before the bypass succeeds. There is no public exploit code or CISA KEV listing in the supplied intelligence, and no EPSS score was provided, so active exploitation is unconfirmed at time of analysis.
Account takeover of non-superuser accounts is possible in Concrete CMS 9.2.0 through 9.5.2 because the REST API user write endpoints (PUT /ccm/api/1.0/users/{uID} and POST /ccm/api/1.0/users/{uID}/change_password) fail to enforce per-field edit_user_properties permissions. An attacker holding an OAuth token scoped for updates and permission to edit only one non-sensitive field on another user can rewrite that user's password, username, email, and attributes, fully seizing the account; superuser accounts are explicitly out of reach. There is no public exploit identified and no CISA KEV listing at time of analysis, so this currently represents a targeted, credential-gated authorization defect rather than a mass-exploitation event. Concrete CMS rated it CVSS v4.0 7.4 (CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N).
Incorrect authorization in Chrome's Core component on Windows (versions prior to 153.0.8010.47) lets a local attacker who can run a program on the machine break out of the browser sandbox and execute arbitrary code at the user's privilege level outside it. The flaw is rated High by the Chromium security team and carries CVSS 7.4 (AV:L/AC:H/PR:N/UI:N, C/I/A all High), reflecting a local-only but complete confidentiality, integrity and availability impact once the sandbox boundary is crossed. No public exploit code or CISA KEV listing was provided in the input, and Google has released a fixed stable-channel build, so this is best treated as a high-value chaining primitive rather than a currently mass-exploited issue.
Authenticated attackers holding administrative access to the management plane of HPE Networking EdgeConnect SD-WAN Gateways can supply crafted input to an affected component and achieve arbitrary command execution as root. The flaw affects multiple released trains — 9.4.x up to 9.4.8.2, 9.5.x up to 9.5.8.1, 9.6.x up to 9.6.3.1, and 9.7.0.0 — with a CVSS base score of 7.2 reflecting the high privilege prerequisite against total loss of confidentiality, integrity, and availability. There is no CISA KEV entry, no EPSS score, and no public exploit code identified at time of analysis, so this is currently a high-impact but credential-gated risk rather than an actively exploited one.
Authenticated attackers who already hold administrative privileges on HPE Aruba EdgeConnect SD-WAN Gateways can supply specially crafted configuration data that overflows a stack buffer in the configuration processing logic, potentially yielding remote code execution as root or crashing the gateway into a denial of service. The flaw affects gateway releases in the 9.4.x (≤9.4.8.2), 9.5.x (≤9.5.8.1), 9.6.x (≤9.6.3.1) and 9.7.0.0 branches per the ENISA EUVD affected-version list, and carries a CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). No public exploit code, CISA KEV listing or EPSS score was included in the supplied intelligence, so the observed exploitation status is unconfirmed at time of analysis.