Unauthenticated attackers with adjacent network access to the mySCADA myPRO Manager notification gateway can send arbitrary SMS messages through its connected GSM modem by submitting a phone number and message text to an exposed HTTP endpoint that performs no authorization checks. The flaw is a missing-authorization weakness (CWE-862) affecting myPRO versions 0 through 2.1, rated CVSS 4.0 base 5.3. Impact is limited to SMS abuse and messaging-service integrity — no code execution, data disclosure, or process disruption — and no public exploit code or CISA KEV entry was identified at time of analysis.
Authenticated users with access to the same physical communication segment as the server can abuse the Engineering Communication Interface in Oracle Agile Engineering Data Management 6.2.1 to bypass intended access controls and read or alter application data, producing high confidentiality and integrity impact. The vulnerability is rated CVSS 3.1 7.3 (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), meaning an attacker must already hold low-privileged credentials and be positioned on the adjacent network segment rather than reaching the service over the internet, and no user interaction is required on the victim's part. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, so this is a moderate, tightly constrained risk that becomes serious only for organizations exposing the Engineering Communication Interface to shared or untrusted local segments.
Stored cross-site scripting in Concrete CMS 9.0.0 through 9.5.2 lets an authenticated user who holds the Add Group Folder permission save a JavaScript payload as a group folder name, which the Members > Groups dashboard then renders as live markup without output encoding. When an administrator opens that dashboard page, the injected script executes in the administrator's session, enabling session and token theft plus any action the administrator can perform. The vendor assigned CVSS v4.0 7.3 (AV:N/AC:L/AT:P/PR:H/UI:P); no CISA KEV listing or public exploit code was identified in the provided data, and no EPSS score was supplied.
Oracle Common Applications, a shared framework component of Oracle E-Business Suite (CRM User Management Framework), fails to properly restrict actions for low-privileged users in versions 12.2.3 through 12.2.15, allowing them to create, delete, or modify critical CRM data and read data they should not access. Exploitation is network-based over HTTP with low complexity, but requires the attacker to already hold a valid low-privileged account and to persuade another user to interact with a crafted request (CVSS 7.3, AV:N/AC:L/PR:L/UI:R). No public exploit code has been identified at time of analysis, the flaw is not listed in CISA KEV, and no EPSS score was provided in the source data.
A buffer overflow in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways allows an attacker who already holds high-privilege API credentials to execute arbitrary commands as a privileged operating-system user on the gateway appliance. Affected releases span the 9.4.x, 9.5.x, 9.6.x and 9.7.0.0 branches, per ENISA EUVD version ranges. The CVSS 3.1 vector requires PR:H, meaning exploitation is not unauthenticated; no public exploit was identified at time of analysis, and the issue is not listed in CISA KEV.
Improper handling of chart content in the Charting component of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 lets a low-privileged, authenticated attacker read and modify critical application data after inducing another user to interact with a crafted HTTP request. Successful exploitation yields high confidentiality and integrity impact across all data the victim's session can reach, though availability is unaffected. No public exploit code has been identified at time of analysis, no CISA KEV listing is present in the supplied data, and no EPSS score was provided.
Oracle Hyperion Data Relationship Management (DRM) 11.2.26.0.000 is vulnerable to an unauthenticated, network-reachable flaw in its Access and Security component that lets an attacker read sensitive data, modify or delete records, and partially disrupt service availability via crafted HTTP requests. The CVSS 3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N) indicates trivially exploitable remote access with no credentials or user interaction, though the confidentiality, integrity and availability impacts are each rated Low rather than total compromise. No public exploit code or CISA KEV listing was present in the provided intelligence at time of analysis, so exploitation status is best characterized as no public exploit identified at time of analysis.
Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 exposes an unauthenticated, network-reachable HTTP flaw that lets an attacker read and modify a subset of application data and degrade service availability, rated CVSS 7.3. Because the vector is AV:N/AC:L/PR:N/UI:N, no credentials or user interaction are needed - only reachability to the affected Experience Manager component. No public exploit code or CISA KEV entry was identified at time of analysis, so this should be treated as a high-severity patch-now item rather than a confirmed active campaign.
Oracle Siebel CRM Deployment (Server Infrastructure component) versions 17.0 through 26.7 contains an easily exploitable flaw that lets a low-privileged attacker positioned on the physical communication segment adjacent to the Siebel Deployment host read critical data and repeatedly crash the service. Successful exploitation yields complete confidentiality loss of all data accessible to Siebel CRM Deployment plus a repeatable denial-of-service condition, per the Oracle CPU advisory. No public exploit code or CISA KEV listing was identified at time of analysis, and EPSS data was not supplied for this CVE.
Low-privileged attackers who already hold a logon to the infrastructure hosting Oracle Siebel CRM's Life Sciences module (versions 17.0 through 26.7) can achieve full takeover of that module, with high confidentiality, integrity, and availability impact. Exploitation is not remote: it requires local interactive access plus a separate human user to perform some action (CVSS:3.1/AV:L/AC:L/PR:L/UI:R, base 7.3). No public exploit code or CISA KEV listing was present in the supplied intelligence, so this is assessed as a patch-now enterprise hardening issue rather than an actively exploited threat.
Full takeover of the Siebel CRM Deployment component (Oracle Siebel CRM Server Infrastructure, supported versions 17.0 through 26.7) is possible for a low-privileged user who can log on to the host where the deployment service runs, provided a person other than the attacker can be induced to perform an interaction. Oracle rates it 7.3 under CVSS 3.1 (AV:L/AC:L/PR:L/
A local privilege-escalation and data-tampering flaw in the CAX Client component of Oracle Agile PLM MCAD Connector 3.6 lets a low-privileged user who can already log on to the host running the connector create, modify, or delete critical PLM data, while also exposing a limited subset of that data to unauthorized reads. Because the vulnerability sits in the connector but the resulting actions reach other integrated products, Oracle assigns a scope change (S:C) and a CVSS 3.1 base score of 7.3. There is no CISA KEV listing, no public exploit code, and no EPSS data in the supplied intelligence, so the issue is currently patch-driven rather than evidence of active exploitation.
Oracle Agile Engineering Data Management 6.2.1 (Engineering Communication Interface component) allows an attacker who already holds a low-privileged logon on the host to reach critical application data and modify records, with a scope change that extends impact to interconnected products. The vendor rates this 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N), so the barrier is local access plus valid credentials rather than remote unauthenticated reach. There is no public exploit code identified and the issue is not listed in CISA KEV at time of analysis; exploitation would most plausibly be an insider or post-compromise privilege escalation within a PLM deployment.
Local privilege escalation in the scan_mysql actor of leapp-repository's leapp-upgrade-el9toel10 package allows code already running as the mysql OS account to obtain root on RHEL hosts during a RHEL 9 to RHEL 10 in-place upgrade. The actor invokes 'mysqld --validate-config' directly as root instead of via the packaged User=mysql systemd unit, so attacker-written persisted state (mysqld-auto.cnf pointing plugin_dir at the mysql-writable /var/lib/mysql) causes a malicious shared object to be dlopen()'d with UID 0 and full capabilities in the unconfined_t SELinux domain. Exploitation is not confirmed in the wild and no public exploit code was identified at time of analysis, but the upstream fix is public (leapp-repository PR 1343 / commit 3e4caff) and the CVSS score is 7.3 with all three impact metrics High.
Authenticated command injection in the web-based management interface of HPE Networking EdgeConnect SD-WAN Gateways (9.4.x, 9.5.x, 9.6.x and 9.7.0.0) lets a remote user who already holds limited access privileges submit specially crafted input that is passed to the underlying operating system, resulting in arbitrary command execution with elevated privileges or a denial-of-service condition on the appliance. The vendor-assigned CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) frames this as an availability-weighted, post-authentication issue rather than a pre-auth compromise. No CISA KEV listing, EPSS score or public proof-of-concept was supplied, so exploitation status is 'no public exploit identified at time of analysis'.
Takeover of the Oracle Identity Manager Connector (component: Database Application Table) in Oracle Fusion Middleware is possible for a high-privileged attacker who can reach the affected HTTP interface, affecting versions 12.2.1.4.0 and 14.1.2.1.0. Oracle rates the flaw 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), meaning an attacker who already holds elevated privileges can fully compromise confidentiality, integrity and availability of the connector with no user interaction and low attack complexity. No public exploit code has been identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV), though it was published within Oracle's scheduled Critical Patch Update cycle.
Oracle BI Publisher 12.2.1.4.0 can be fully taken over by an attacker who already holds a high-privileged account and can reach the product's HTTP interface, with complete loss of confidentiality, integrity and availability (CVSS 3.1 base 7.2). The defect resides in the BI Platform Security component of Oracle Analytics and is rated low-complexity with no user interaction required, so a single crafted request from a privileged session is sufficient. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied with the source data.
Full takeover of Oracle Siebel CRM Deployment is achievable by attackers who already hold high-privileged accounts and can reach the deployment server's TCP interface, affecting Siebel CRM Deployment versions 17.0 through 26.7. Oracle rates the flaw CVSS 7.2 with complete loss of confidentiality, integrity and availability, but the PR:H metric means a valid privileged account is a prerequisite, keeping this out of the unauthenticated mass-exploitation class. No public exploit code or CISA KEV entry appears in the supplied intelligence, and no EPSS score was provided.
Full takeover of Oracle Depot Repair — the field-service and repair-management module of Oracle E-Business Suite — is possible in versions 12.2.3 through 12.2.15 for any attacker who already holds a high-privileged account and can reach the application over HTTP. The flaw sits in the module's Internal Operations component and permits complete loss of confidentiality, integrity and availability of Depot Repair data and functions. There is no public exploit code and no CISA KEV listing at time of analysis, so exploitation is currently limited to actors who obtain or already possess elevated EBS credentials.
Oracle Lease and Finance Management, a finance module within Oracle E-Business Suite, can be fully taken over by a high-privileged user who sends crafted HTTP requests to its Internal Operations component in versions 12.2.7 through 12.2.15. Successful exploitation yields complete loss of confidentiality, integrity and availability for the module (CVSS 3.1 base 7.2), meaning an attacker could read and alter lease, financing and contract data and disrupt related business processes. The attack is rated easy to perform once the required privileged account and network path exist, but exploitation is gated behind high privileges, and no public exploit code or CISA KEV listing was identified at the time of analysis.
Full takeover of the Oracle Marketing module inside Oracle E-Business Suite 12.2.3 through 12.2.15 is possible through its Audience component, but only for an attacker who already holds high (administrative) privileges in the application - an anonymous remote user cannot reach it. The flaw is network-reachable over HTTP with low attack complexity and no user interaction, and the assessed CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base score 7.2) reflects complete loss of confidentiality, integrity, and availability for the affected module. No public exploit code has been identified and there is no confirmed active exploitation (the CVE is not in CISA KEV) at time of analysis, so the realistic threat is a malicious privileged insider or an attacker who has already compromised a high-privilege EBS account.
Full takeover of Oracle Hyperion Financial Management 11.2.26.0.000 is possible for an authenticated attacker holding high privileges, who can send crafted HTTP requests to the Security component and gain complete control of confidentiality, integrity, and availability. The vulnerability is rated CVSS 7.2, and no public exploit code or active exploitation has been identified at time of analysis; EPSS data is unavailable. The high-privilege requirement limits exposure to already-compromised or insider accounts, but successful exploitation yields total application compromise.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that allows a high-privileged attacker with HTTP network access to fully compromise the application, yielding high confidentiality, integrity and availability impact across a single security scope. Successful exploitation means takeover of the HFM platform rather than a narrow data leak — the attacker gains the ability to read, alter and disrupt the financial consolidation environment. The vulnerability is remotely reachable and low-complexity once the required privileged position is obtained, though no public exploit code and no CISA KEV entry have been reported at time of analysis; the fixed release is delivered through Oracle's Critical Security Patch Update channel.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets an attacker who already holds a high-privileged account reach the application over HTTP and fully take over the HFM instance, with high impact to confidentiality, integrity, and availability. Exploitation is rated as easy (AC:L, no user interaction) once the privileged foothold exists, so the practical barrier is obtaining or abusing an administrative credential rather than defeating any exploit mitigation. There is no public exploit code or CISA KEV entry at time of analysis, and no EPSS score was supplied, so the real-world risk is driven by internal admin-account hygiene and network exposure of the HFM web tier.
Full compromise of Oracle Hyperion Financial Management 11.2.26.0.000 is achievable through a SQL-based attack against the product's Security component, with High confidentiality, integrity and availability impact (CVSS 3.1 base 7.2, AV:N/AC:L/PR:H/UI:N). The critical qualifier is privilege: exploitation requires an attacker who already holds a high-privileged account and network reachability to the affected component, so this is primarily an insider, credential-compromise, or laterally-moving-attacker risk rather than an unauthenticated perimeter threat. No EPSS score, CISA KEV listing, or public exploit code was supplied; the only reference is Oracle's Critical Patch Update advisory, and no exact patched build version is stated in the available data.
Oracle Product Hub, the product master-data module of Oracle E-Business Suite, fails to properly enforce authorization in its Internal Operations component across supported releases 12.2.3 through 12.2.15, allowing an attacker who already holds a high-privileged account to achieve full takeover of the module over HTTP. Successful exploitation yields complete confidentiality, integrity and availability impact (CVSS 3.1 base 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), meaning master data, configuration and administrative functions can be read and altered. Oracle did not publish a CWE identifier with this record, no public exploit code has been identified at time of analysis, and neither CISA KEV nor EPSS data was supplied, so active exploitation cannot be confirmed.
Takeover of Oracle Product Hub in Oracle E-Business Suite 12.2.3 through 12.2.15 is possible for a highly privileged authenticated attacker with network HTTP access to the Internal Operations component, yielding high confidentiality, integrity, and availability impact (CVSS 3.1 base 7.2). The flaw is rated easily exploitable (AC:L, UI:N) once the required credentials are held, and no public exploit has been identified at time of analysis. Because the CVSS vector specifies PR:H, anonymous or low-privileged internet attackers are ruled out, leaving the mandatory high-privilege account as the primary gating factor.
Authenticated high-privileged users with HTTP access to Oracle E-Business Suite 12.2.3 through 12.2.15 can fully take over the Oracle Applications Framework Personalization component, with high impact to confidentiality, integrity and availability. The flaw scores 7.2 on CVSS 3.1 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), meaning no user interaction and low attack complexity once an attacker already holds a privileged EBS account. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied, so the practical risk is dominated by the credential-privilege precondition rather than by mass exploitation.
High-privileged users of Oracle Business Intelligence Enterprise Edition (versions 8.2.0.0.0 and 26.01.0.0.0) can exploit a flaw in the Platform Security component over HTTP to take complete control of the BI platform. The vendor rates this CVSS 3.1 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), meaning the attacker must already hold a highly privileged account but needs no user interaction and faces low attack complexity, with full confidentiality, integrity and availability impact. No public exploit code or CISA KEV entry is identified in the available data, and EPSS scoring was not supplied, so real-world exploitation activity is unconfirmed at time of analysis.
Attackers who already hold an elevated account on Oracle Business Intelligence Enterprise Edition can fully take over the platform by sending crafted HTTP requests to its Platform Security component, impacting confidentiality, integrity and availability of the whole deployment. Supported versions 8.2.0.0.0 and 26.01.0.0.0 are affected, and Oracle delivered the fix through its out-of-band critical security patch update. No public exploit code or CISA KEV entry has been identified at time of analysis, so the practical risk is driven by the high-privilege prerequisite rather than by active exploitation.
Oracle Business Intelligence Enterprise Edition 26.01.0.0.0 contains a flaw in its Platform Security component that allows a high-privileged, authenticated attacker with HTTP network access to fully take over the BI platform, with high confidentiality, integrity and availability impact. Oracle rates it CVSS 7.2 (AV:N/AC:L/PR:H/UI:N) and the affected version is limited to 26.01.0.0.0. No public exploit code or CISA KEV entry was supplied with the available intelligence, so exploitation is not confirmed to be occurring in the wild.
Oracle E-Business Suite's Common Applications module (CRM User Management Framework component) in supported releases 12.2.3 through 12.2.15 can be fully taken over by an attacker who already holds a high-privileged account and can reach the application over HTTP, resulting in complete loss of confidentiality, integrity and availability of that component. Oracle rates it CVSS 3.1 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), so the network attack path is simple but the privilege bar is high. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied in the input data.
Oracle E-Business Suite 12.2.3 through 12.2.15 contains a flaw in the Applications DBA (AD Utilities) component that lets a high-privileged attacker with network access over HTTP take full control of the Applications DBA subsystem. According to Oracle's advisory language the issue is 'easily exploitable,' meaning low attack complexity once the required privileges are held, and successful exploitation delivers high confidentiality, integrity and availability impact (CVSS 3.1 base 7.2, AV:N/AC:L/PR:H/UI:N). No public exploit code or CISA KEV entry is present in the supplied intelligence, so exploitation appears limited to attackers who already hold an Applications DBA-level account rather than remote unauthenticated adversaries.
A high-privileged attacker with network access to the Oracle Contracts module of Oracle E-Business Suite 12.2.14 or 12.2.15 can fully compromise that module, affecting confidentiality, integrity, and availability. The flaw sits in the Internal Operations component and requires an already-elevated application account (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base score 7.2) - it is not reachable by unauthenticated or low-privileged users, and no user interaction is needed once the prerequisite access exists. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied; the practical risk is therefore concentrated in environments where many users or service accounts already hold broad Contracts privileges.
Oracle Contracts, a module within Oracle E-Business Suite, can be fully taken over by a high-privileged attacker who can reach the application over HTTP in versions 12.2.14 and 12.2.15. Oracle's own advisory rates this 7.2 with complete confidentiality, integrity, and availability impact, and notes it is 'easily exploitable' once the attacker holds elevated privileges. There is no CISA KEV listing and no public exploit code identified at time of analysis, so this is currently a patch-priority issue rather than an observed campaign.
Oracle Document Management and Collaboration, a module within Oracle E-Business Suite 12.2.3 through 12.2.15, can be fully taken over by an attacker who already holds a high-privileged account and can reach the application over HTTP. Successful exploitation grants complete control over the module's confidentiality, integrity, and availability (CVSS 3.1 base 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), meaning an attacker can read, alter, or destroy managed documents and related business data. There is no CISA KEV listing, no public exploit code, and no EPSS data in the provided intelligence, so this is currently a patch-priority issue for Oracle E-Business Suite shops rather than a confirmed actively exploited threat.
High-privileged attackers who already hold administrative-level LDAP credentials can fully take over the OID LDAP Server component of Oracle Internet Directory 12.2.1.4.0 and 14.1.2.1.0 by sending crafted requests over the network. Oracle rates this 7.2 on the CVSS 3.1 scale (AV:N/AC:L/PR:H/UI:N, C/I/A all High), meaning a single low-complexity action against a reachable LDAP listener yields complete loss of confidentiality, integrity, and availability for the directory service. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV; the high privilege prerequisite (PR:H) substantially narrows the realistic attacker set to insiders, compromised directory administrators, or attackers who have already escalated elsewhere in the environment.
In Oracle Siebel CRM's Marketing module (Siebel Apps - Marketing), supported versions 17.0 through 26.7 expose a network-reachable HTTP flaw that a high-privileged user can leverage to seize full control of the Marketing application, impacting confidentiality, integrity and availability alike (CVSS 3.1 base 7.2). The issue is rated easily exploitable (AC:L) but is gated behind privileged credentials (PR:H), and no user interaction is needed once such access exists. No CISA KEV entry, public exploit code, or EPSS score was supplied with the source data, so active exploitation is unconfirmed at time of analysis.
Path traversal in Flextype CMS through 1.0.0-alpha.3 allows API token holders to escape the designated entries directory and read, create, or overwrite arbitrary files accessible to the web server process. The Entries REST API accepts unsanitized id and new_id parameters and passes them directly into filesystem operations, permitting traversal sequences such as '../../' to resolve paths outside the intended content tree. No public exploit code has been identified and no CISA KEV listing exists, but the vulnerability is mechanically straightforward for any actor already possessing a valid API token.
Unauthenticated server-side request forgery in Fireshare versions prior to 1.6.16 allows any remote attacker to force the server to send an arbitrary HTTP POST to a URL of their choosing. The endpoints POST /api/test-discord-webhook and POST /api/test-webhook are missing the @login_required decorator, so no session cookie, API token, or prior access is needed. Because the attacker controls the destination, the server can be pointed at RFC1918 addresses, loopback services, or cloud instance metadata endpoints (e.g. 169.254.169.254), turning a self-hosted media-sharing instance into a pivot into the hosting network. Vendor patch: version 1.6.16. No public exploit code or active exploitation is indicated in the provided intelligence.
IBM Verify Identity Access (and its predecessor Security Verify Access) contains an improper authorization flaw that lets an administrator with limited entitlements execute additional commands beyond their granted privileges by supplying specially crafted input to the product's administrative functionality. The flaw carries a CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), reflecting high confidentiality, integrity and availability impact but requiring an existing privileged account to reach. No public exploit code or CISA KEV entry was identified at time of analysis, and IBM has published a vendor fix via its support advisory.
Incorrect authorization validation in Octopus Server permits authenticated users holding certain scoped permission sets to execute arbitrary scripts on deployment workers, including the built-in worker that runs directly within the Octopus Server process. The flaw bypasses the permission check that should gate script execution, allowing a user to operate outside their authorized scope without possessing the required authorisation. No public exploit has been identified and the CVE is not in CISA KEV, but the low authentication barrier - any user with some scoped permissions - makes this a meaningful privilege-escalation risk in CI/CD environments where Octopus Server routinely holds deployment credentials and infrastructure access.
Stored cross-site scripting in the MotoPress Hotel Booking premium Stripe gateway lets unauthenticated attackers plant persistent JavaScript in the plugin's payment log by POSTing forged Stripe webhook events, because the webhook listener only verifies the Stripe signature when an optional signing secret has been configured — and that secret is empty by default, so forged events are accepted without cryptographic verification. The attacker-controlled event object 'id' is written unescaped and later echoed unsanitized on the payment edit page, executing in an administrator's browser session. All versions up to and including 6.2.4 of the plugin (premium Stripe integration) are affected; no public exploit code has been identified at time of analysis, and no EPSS or CISA KEV data was supplied in the input.
An authenticated attacker can bypass the restore-archive prefix validation in the parame_put_file.cgi handler of Netcore NR268 firmware 1.7.121109, allowing a crafted configuration-restore archive to write files outside the intended restore path. The flaw yields a high integrity and availability impact — device configuration can be overwritten or unset, and the router can be left in an unusable state — while confidentiality is unaffected per the CVSS 4.0 vector (VC:N/VI:H/VA:H). No public exploit code or CISA KEV entry has been identified at time of analysis, and no vendor-released patch is referenced in the available advisories.
FreeRDP clients prior to 3.31.0 leak uninitialized heap memory through the urbdrc USB-redirection channel when a malicious RDP server forces USB transfers to fail, handing the attacker reliable client-side memory contents. The disclosure is a high-severity confidentiality weakness (CWE-457) that defeats ASLR and becomes remote code execution only when chained with a separate memory-corruption flaw in the client. Publicly available exploit code exists per CISA's SSVC assessment (Exploitation: poc), and SSVC rates technical impact as partial and automatable as no, meaning exploitation is feasible but requires an attacker-controlled RDP server plus a victim who initiates the connection.
Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 can be fully taken over through a flaw in its SQR component, but only by an attacker who already holds a high-privileged logon on the host where PeopleTools runs and who can persuade another user to perform an interaction. Oracle rates it 7.2 because a successful attack is difficult to execute yet delivers complete loss of confidentiality, integrity and availability, and because the compromise can spill over into connected products (scope change). No public exploit code is identified and there is no CISA KEV entry, so the issue is a defensive hardening priority rather than an observed campaign.
A difficult-to-exploit flaw in the Client Bundle component of Oracle WebCenter Enterprise Capture (12.2.1.4.0 and 14.1.2.0.0) lets an attacker who already holds a low-privileged logon on the host compromise the application, reading and altering critical capture data and potentially affecting interconnected downstream products through a scope change. Exploitation is not trivial: it requires local access, a low-privileged account, high attack complexity, and a second user to perform an interaction. No public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis; Oracle's Critical Security Patch Update advisory is the authoritative source.
The user wants a JSON analysis. Let me note the details. CVE-2026-91945: FreeRDP before 3.31.0, OOB read in smartcard response decoders failing to validate ATR length fields. Authenticated RDP clients can send oversized ATR lengths in PAKID_CORE_DEVICE_IOCOMPLETION responses. CVSS 7.1, CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N. CWE-125. Patch available from vendor, commit 9626564421df72c84f891afdbc0b20bf702f369f. Reported by VulnCheck. Note: the commit diff shown appears unrelated to the actual fix (CMakeLists.txt winpr change) — that's a data quality flag potentially. Actually the diff snippet seems to be CMake version check — not the actual security fix. Hmm. Could mention in confidence notes as suspicious/mismatched patch reference. But careful — the diff is truncated; only showing part. I could flag it. Tags: Buffer Overflow, Information Disclosure, Freerdp. "Buffer Overflow" is arguably a mislabel — CWE-125 is out-of-bounds read, not a buffer overflow (write). Hmm, "Buffer Overflow" tag could be considered mislabeled. That's a plausible data_quality_flag: mislabeled_tag target "Buffer Overflow", suggested "out-of-bounds-read". Confidence medium. Actually the instructions say only emit flag when clearly wrong and verifiable from references. CWE-125 out-of-bounds read is a memory read, not a classic buffer overflow (CWE-120/787 write). Description explicitly says "out-of-bounds read" causing process termination. So the "Buffer Overflow" tag is misleading. I'd emit a medium-confidence flag. Also "freerdp" tag present as "Freerdp" — it's lowercase normalized presumably fine. Missing tags? Possibly "smartcard"? Not a standard tag. Maybe "cwe-125"? Not necessarily. I'll skip missing tags. Prevalence: FreeRDP is a widely used open-source RDP client library — high? It's used in many Linux distributions, thin clients, etc. I'd say "high" or "medium". FreeRDP is the de facto open source RDP implementation, bundled in distros, used by ma
IBM Business Automation Workflow, in both its container and traditional (on-premises) distributions, fails to restrict XML external entity resolution when parsing XML data, allowing an authenticated remote user to read server-side files or exhaust process memory. The flaw carries a CVSS base score of 7.1 (AV:N/AC:L/PR:L/UI:N, C:H/I:N/A:L), meaning a low-privileged but valid account is required — it is not exploitable unauthenticated. IBM has published a vendor fix via support document node 7285930; there is no CISA KEV listing and no public exploit code identified at time of analysis, and no EPSS score was supplied with the intelligence feed.
Authenticated OpenCTI users holding JSON mapper creation permission can craft a catastrophically backtracking regular expression in the extractWithRegexp mapper formula, blocking the Node.js event loop and making the GraphQL API unavailable to every user on the instance. The flaw affects only availability — no data is exposed or modified — and requires the attacker to already hold a privileged mapper-management role, but scheduled ingestion can re-trigger the lockup repeatedly without further attacker action, and recovery may require disabling the mapper and restarting the process. Fixed in OpenCTI 7.260706.0, where the vulnerable JavaScript RegExp engine was replaced with RE2, a linear-time regex library; no public exploit code or CISA KEV listing was identified at time of analysis.