Netcore NR255-V routers running firmware 1.5.130703 expose captive-portal account credentials through the l7_web_auth_user_show.cgi handler, allowing anyone who can reach the web interface with a low-privileged session to read usernames and passwords stored for web-authentication (captive-portal) users. Successful retrieval hands the attacker working credentials for authenticated network access, so the confidentiality impact is rated High while integrity and availability are unaffected. No public exploit code has been confirmed and the issue is not listed in CISA KEV, but the exposed endpoint returns credential material directly rather than requiring any cracking step.
Let me produce the JSON. Key facts: - CVE-2026-91950, FreeRDP before 3.31.0 - OOB read in rdpdr_dump_packet due to 32-bit unsigned integer wraparound in buffer bounds validation - computerNameLen = 0xFFFFFFF0 bypasses bounds check → OOB read → client crash or heap disclosure in logs - CVSS 7.1, CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CWE-125 - VulnCheck reported - CPE: freerdp:freerdp all versions (up to before 3.31.0) - Tags: Buffer Overflow, Information Disclosure, Freerdp - References: GitHub security advisory GHSA-c5gr-hmqp-pwj4, VulnCheck advisory No EPSS, no KEV, no POC mentioned. Attack requires the client to connect to a malicious RDP server — UI:P (passive user interaction: the user connects to the server). PR:N. No privileges. AV:N because the malicious server is remote. Exploitation conditions: attacker must control/operate the RDP server the client connects to; requires the RDPDR (device redirection) virtual channel to be enabled/active — in FreeRDP, rdpdr is used for drive/printer/port redirection and is typically negotiated when the client has redirection enabled. Also the dump/log path (rdpdr_dump_packet is a debug dump function) — so triggering the crash likely requires the rdpdr debug logging/dump enabled? Hmm. The function rdpdr_dump_packet is a dumping function, likely compiled when WITH_DEBUG_RDPDR or verbose logging is enabled. Actually in FreeRDP, rdpdr_dump_packet exists in rdpdr_main.c guarded by... let's be careful. I'd say the OOB read occurs during packet dump/parsing on logging, so higher log verbosity may be required. I should state this as an inference and flag uncertainty. Remediation: upgrade to FreeRDP 3.31.0 or later; advisory link. Workarounds: disable device redirection (rdpdr), avoid connecting to untrusted RDP servers, reduce log verbosity, remove /drive /printer flags. Trade-offs. Prevalence: FreeRDP is widely deployed as the RDP client in Linux distros, ThinLinc, etc. — high (widely depl
Denial of service in FreeRDP clients before 3.31.0: a rogue or compromised RD Gateway can send a WebSocket Ping frame with a crafted 64-bit extended payload length that wraps an integer inside WinPR's Stream_EnsureRemainingCapacity, producing a double free that crashes the client while the connection is being established. Exploitation requires no credentials on the attacker's side and only a victim client that routes its session through that gateway over the WebSocket transport; the primary impact is loss of availability of the client session. Vendor-released patches are available in FreeRDP 3.31.0, and there is no public exploit code or active exploitation reported in the supplied intelligence.
FreeRDP deployments running the RDPGFX server-side graphics pipeline before version 3.31.0 leak uninitialized heap memory to any authenticated RDP client, because the ResetGraphics PDU serializer leaves the padding bytes of its fixed 340-byte wire structure untouched. The leaked bytes can contain live heap pointers and GLib function addresses, which defeats heap ASLR and reveals the GLib module base address — a strong primitive for chaining into further memory-corruption exploits. No public exploit code or CISA KEV entry was identified in the supplied intelligence at time of analysis, though the fix commit is publicly visible, making the flaw trivially reverse-engineerable.
FreeRDP versions before 3.31.0 contain a heap buffer overflow in the client-side negotiation routine nego_send_negotiation_request(), which writes the server-supplied LB_LOAD_BALANCE_INFO field into a fixed 512-byte buffer without checking its length. A malicious RDP server — or an attacker positioned as a man-in-the-middle — can trigger the overflow by replying to a client's connection attempt with a Server Redirection PDU carrying an oversized LB_LOAD_BALANCE_INFO value, corrupting heap memory before authentication even completes. The confirmed impact is denial of service or heap corruption (CVSS 7.1, availability-only); no public exploit code and no CISA KEV listing were identified at time of analysis.
A security-component flaw in Oracle Hyperion Financial Management 11.2.26.0.000 lets a low-privileged attacker who already holds a valid account and network access to the HTTP interface read critical financial consolidation data and partially degrade availability of the application. The CVSS 3.1 base score is 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L), reflecting high confidentiality and low availability impact with no integrity exposure. There is no public exploit code or CISA KEV entry identified at time of analysis, so exploitation is currently assessed as targeted rather than opportunistic.
Oracle Report Manager, a component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, can be compromised by a low-privileged attacker with network access to the HTTP interface, resulting in unauthorized read access to critical report data and a partial denial of service. The flaw carries a CVSS 3.1 base score of 7.1 with high confidentiality and low availability impact, and Oracle rates it easily exploitable. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, so it is currently a patch-now vulnerability rather than a confirmed actively exploited one.
Oracle XML Gateway, a module delivered with Oracle E-Business Suite 12.2.3 through 12.2.15, exposes an install-related component that a low-privileged, network-positioned attacker can abuse over HTTP to read data the account should never reach — up to the full set of XML Gateway-accessible data — and to degrade service availability. Oracle rates it 7.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L), meaning the confidentiality hit is total for that module while the availability impact is only partial and there is no integrity impact. There is no public exploit code and no CISA KEV listing at time of analysis, and no EPSS score was supplied, so this reads as a patch-cycle obligation rather than an emergency — but the Oracle CPU reference (cspusep2026) is the authoritative fix source.
Improper access control in the Install component of Oracle XML Gateway within Oracle E-Business Suite 12.2.3 through 12.2.15 lets a low-privileged attacker with network access over HTTP read all data the XML Gateway can reach and partially degrade its availability. The flaw carries a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N, C:H/I:N/A:L), meaning exploitation is straightforward once a valid low-privilege account exists, but it is not unauthenticated. No public exploit code has been identified and the issue is not listed in CISA KEV; Oracle addresses it in its September 2026 Critical Security Patch Update.
A low-privileged authenticated attacker with HTTP network access can exploit the Install component of Oracle XML Gateway in Oracle E-Business Suite 12.2.3 through 12.2.15 to read critical data, gain complete access to all XML Gateway-accessible data, and trigger a partial denial of service. The vulnerability carries a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L), indicating easy exploitation once valid credentials are held, with confidentiality as the dominant impact. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV; the only intelligence source is Oracle's September 2026 Critical Patch Update advisory.
Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 exposes a flaw in the Forge component that lets a low-privileged, network-connected attacker read data far beyond their authorization and degrade service availability. Because exploitation requires only a valid low-privilege account and a crafted HTTP request (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L, 7.1), the confidentiality impact is severe while integrity is untouched. Exploitation status: no public exploit identified at time of analysis, and the issue is not listed in CISA KEV, though Oracle has shipped a fix in its Critical Security Patch Update.
Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 (the Endeca-based Forge component) can be exploited over HTTP by a low-privileged authenticated attacker to read critical application data and cause a partial denial of service. The flaw carries a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N, high confidentiality and low availability impact) and affects a single supported release, 11.4.0. No public exploit code or CISA KEV listing has been identified at time of analysis, and no EPSS score was supplied, so real-world exploitation is currently unconfirmed.
Oracle Siebel CRM Deployment (Server Infrastructure component) in supported releases 17.0 through 26.7 exposes critical CRM data to a low-privileged, network-positioned attacker who can reach the deployment service over HTTP, and also allows that attacker to partially degrade availability. Oracle rates it 7.1 (AV:N/AC:L/PR:L/UI:N, C:H/A:L) and describes it as easily exploitable in its cspusep2026 security alert; there is no CISA KEV listing, no public exploit code identified, and no EPSS score supplied in the source data.
Oracle One-to-One Fulfillment, a module within Oracle E-Business Suite 12.2.3 through 12.2.15, exposes unauthorized access to critical data and can be partially disrupted by an attacker holding only a low-privileged account with HTTP access to the application. Per Oracle's CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/A:L), the issue requires authentication but no user interaction, and yields high confidentiality loss plus a limited availability impact. There is no public exploit code and no CISA KEV entry at time of analysis, and no EPSS score was supplied; the vendor patch is published in the September 2026 Critical Patch Update advisory.
Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 ship a flaw in the Runtime Tools component that lets any authenticated low-privileged user read critical portal data and partially degrade portal availability over HTTP. Oracle rates it as easily exploitable (CVSS 7.1, AV:N/AC:L/PR:L/UI:N, C:H/A:L), so no user interaction and no administrative role is needed beyond a valid account. No public exploit code and no CISA KEV entry were identified at time of analysis, but the data-exposure impact on an enterprise portal makes it worth prompt patching.
Oracle XML Gateway, the E-Business Suite module that exchanges XML business documents with external trading partners, exposes critical data to any low-privileged user who can reach its HTTP endpoints in versions 12.2.3 through 12.2.15. A successful attack gives the intruder read access to data they should not see — described by Oracle as unauthorized access to critical data or complete access to all XML Gateway accessible data — and also allows a partial denial of service that degrades the module's availability. The flaw is trivially reachable (network vector, low complexity, no user interaction), and no public exploit code has been identified at the time of analysis.
Oracle Hyperion Financial Management 11.2.26.0.000 contains an easily exploitable security flaw in its Security component that lets a low-privileged, authenticated attacker reach the application over HTTP and obtain unauthorized access to critical financial consolidation data, with a secondary ability to cause a partial denial of service. The vendor rates it 7.1 with network vector, low complexity, and no user interaction, meaning an attacker only needs a valid low-privilege account rather than administrative rights. No public exploit code or CISA KEV entry was present in the supplied intelligence, and no EPSS score was provided, so current exploitation status is unconfirmed.
A security-control flaw in Oracle Hyperion Financial Management 11.2.26.0.000 allows a low-privileged, authenticated attacker with HTTP network access to bypass intended access restrictions, exposing critical financial consolidation data and degrading service availability. Successful exploitation yields high confidentiality impact (complete access to data the account should not reach) plus a partial denial of service, giving a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L). Oracle has addressed the issue in its Critical Security Patch Update; no public exploit code or CISA KEV entry was present in the intelligence provided, so exploitation status is 'no public exploit identified at time of analysis'.
Oracle Report Manager, a component of Oracle E-Business Suite (versions 12.2.3 through 12.2.15), exposes an internal-operations flaw that lets a low-privileged attacker with HTTPS network access read critical data and degrade service availability. Successful exploitation yields high confidentiality impact against all Report Manager-accessible data plus partial denial of service, giving the flaw a 7.1 CVSS base score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L). There is no public exploit code and no CISA KEV listing at time of analysis, so exploitation is not confirmed to be active; risk is concentrated in internet- or broadly-reachable EBS Report Manager deployments where ordinary authenticated users exist.
Low-privileged users with network access to Oracle E-Business Suite 12.2.3 through 12.2.15 can tamper with, create, or delete Applications Calendar data they should not control, and can partially degrade the availability of that component (CVSS 3.1 base 7.1, AV:N/AC:L/PR:L/UI:N, integrity high and availability low, no confidentiality impact). The flaw sits in the Oracle Common Applications Calendar module of EBS and is rated 'easily exploitable' by the vendor, but it is not a pre-authentication bug: an attacker must already hold a valid low-privileged account and HTTP reachability to the EBS application tier. No CISA KEV listing, EPSS score, or public exploit code was provided with the advisory data, so there is currently no public exploit identified at time of analysis.
Authenticated information disclosure in the Netcore NR255-V router (firmware 1.5.130703) allows any logged-in user to pull other users' session and browsing-history records by querying audit CGI components (l7_web_auth_log_dump_cgi.c, audit_get_cgi.c, and the mod_dispatch_auth/plan.json dispatch manifest). The flaw is rated 7.1 (CVSS 4.0) with PR:L/UI:N and a high confidentiality-only impact (CWE-359, exposure of private personal information), making it a privacy and data-protection problem rather than a code-execution risk. No public exploit code was identified in the supplied intelligence at time of analysis, and the issue is not listed in CISA KEV; a public disclosure writeup and a VulnCheck advisory are the primary references.
An authenticated user of Vikunja before 2.6.0 can exhaust the memory of migration worker processes by launching a Planka import job that points at a server they control, which advertises a large number of individually size-compliant attachments. Because the migrator enforces per-file size limits but no aggregate memory budget, the worker is consumed and the instance becomes unavailable to every user on it. The flaw is rated 7.1 (CVSS 4.0, availability-only impact), requires low privileges but no user interaction, and no public exploit code or CISA KEV entry is associated with it at time of analysis; the vendor has released a fix in 2.6.0.
Memory exhaustion in the Vikunja task-filter endpoint lets any authenticated user crash the API service by submitting a filter query containing thousands of nested parentheses, which the recursive expression parser consumes without a depth limit. All deployments before version 2.6.0 are affected (EUVD lists 2.5.0 through 2.5.x), and a single low-privileged account is enough to repeatedly take the backend offline. A vendor advisory and a VulnCheck advisory are published, a patched release exists in 2.6.0, and no public exploit code or CISA KEV entry was identified at time of analysis, though the attack is trivial to reproduce by hand with plain HTTP requests.
XML external entity (XXE) injection in the IBM MQ .NET client allows an authenticated attacker with queue-write access to read files from the host running that client and to cause a limited denial of service when the client parses the RFH2 folder of a crafted message. The flaw is client-side - the queue manager itself and the Java/C clients are not indicated as affected - and the attacker must already hold valid MQ credentials with authority to place messages on a queue the vulnerable client consumes. No public exploit has been identified at time of analysis, CISA's SSVC assessment records no exploitation activity and rates the issue not automatable with partial technical impact, and patch code is available from the vendor; the practical risk is genuine but moderate, well below what the 7.1 base score suggests at first glance.
FreeRDP clients before 3.31.0 terminate unexpectedly when connected to a malicious RDP server, because the URBDRC (USB redirection) control-transfer request path forwards an attacker-supplied OutputBufferSize of 65536 to the libusb backend without validating it, hitting a reachable assertion. The attacker must control the RDP server and convince a user to connect, so exploitation is network-facing but user-initiated. Impact is limited to availability (client process crash) rather than code execution or data exposure; no public exploit code or CISA KEV listing was identified at time of analysis.
Let me synthesize. CVE-2026-91959: FreeRDP buffer over-read in rts_read_result (RPC gateway transport parser), truncated BIND_ACK PDU result entry → OOB read → process abort (DoS). CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H — network, no privileges, passive UI (UI:P means user must perform... in CVSS 4.0, UI:P = Passive, meaning the user just needs to interact minimally, like a client connecting), high availability impact only. So no confidentiality/integrity impact despite the "Information Disclosure" tag — actually the tag "Information Disclosure" seems mislabeled since VC:N. Hmm — buffer over-read could disclose memory, but the CVSS says VC:N. The description says process abort (DoS). So the tag "Information Disclosure" is arguably mislabeled — but do I want to emit a data_quality_flag? The tags list: "Buffer Overflow, Information Disclosure, Freerdp". "Buffer Overflow" is arguably wrong too — CWE-125 is out-of-bounds read, not a buffer overflow (write). Hmm, "Buffer Overflow" tag on an over-read is a mislabel... The instructions say only emit a flag when the input metadata is clearly wrong and verifiable. Information Disclosure: an OOB read technically can leak memory, but CVSS says VC:N and description says process abort. I'd say low confidence. Buffer Overflow mislabel — CWE-125 is "Out-of-bounds Read", which is distinct from buffer overflow (CWE-787/CWE-120). Hmm, but many tag taxonomies lump them. I'll emit one flag with medium confidence for "Information Disclosure"? Actually the guidance says flags should be high-confidence and verifiable. Maybe emit a flag for "Buffer Overflow" as mislabeled_tag with suggested "out-of-bounds-read"... but 'suggested' is "the correct/canonical slug if you know it". Hmm. I think I can include one flag with medium confidence. Risk: noise. The instructions say empty array is common and correct. Given CWE-125 ≠ buffer overflow and CVSS shows VC:N (no info disclosure), I think two tags are arguably mislabeled. But
Client-side denial of service in FreeRDP before 3.31.0: the URBDRC (USB redirection) channel's func_get_ep_desc function indexes interface arrays by positional offset instead of the protocol's InterfaceNumber field, so a malicious or compromised RDP server can send a crafted SELECT_CONFIGURATION message with permuted InterfaceNumber values and trigger an out-of-bounds heap read that crashes the connecting client. The flaw only degrades availability (no confidentiality or integrity impact per the CVSS 4.0 vector), requires the victim to initiate a session against the hostile server, and no public exploit code or active exploitation has been reported at time of analysis. It is a targeted-attacker nuisance rather than a mass-exploitation risk, but patching to 3.31.0 is straightforward.
FreeRDP clients before 3.31.0 crash when a malicious RDP server sends a crafted Surface Bits command advertising the NSCodec codec ID — the GDI surface-bits handler dereferences a NULL decoder pointer instead of rejecting the unsupported codec. The victim only has to initiate an RDP session to an attacker-controlled or compromised server; the outcome is a client-side denial of service (application crash), with no memory corruption, code execution, or data exposure reported. No public exploit code and no CISA KEV listing were identified at time of analysis.
Let me write the JSON. Product: FreeRDP. CVE-2026-91952, infinite loop DoS in pool_decode_rect with AVC444 metablocks, client-side vulnerability — malicious RDP server attacks clients. AV:N, AC:L, PR:N, UI:P (UI passive), VA:H only. No KEV, no POC mentioned. CVSS 3.1 assessed: client connects to malicious RDP server. Attack vector network, AC:L? The crafted server response triggers loop — no special conditions besides connecting to malicious server (user interaction passive). PR:N. UI:P. C/I:N, A:H. S:U. So CVSS:3.1/AV:N/AC:L/PR:N/UI:P/S:U/C:N/I:N/A:H = 6.5? Let's compute: base score for AV:N/AC:L/PR:N/UI:P/S:U/C:N/I:N/A:H. Exploitability = 8.22 × 1.0 × 0.85 × 0.62 = 8.22*0.85=6.987; *0.62=4.332. Impact = 6.42 × 0.31? A:H → ISCBase = 1 - (1-0)(1-0)(1-0.56) = 0.56. Impact = 6.42 × 0.56 = 3.595. Total = roundup(min(3.595+4.332, 10)) = roundup(7.927) = 7.9. Hmm, that's odd — but that's standard: CVE with A:H and UI:P gives ~7.9? Actually wait, the numbers given in the prompt: 7.1 for CVSS 4.0. Let me just compute 3.1: 7.9? Let me double-check exploitability with UI:P (0.62). Yes 8.22*0.85*0.62 = 4.3319. And impact 3.5952. Sum 7.927 → roundup = 7.9. Hmm that seems high but it's the formula. Actually let me recheck: for A:H, ISCBase = 0.56, Impact sub score = 6.42 × 0.56 = 3.5952. Scope unchanged: Impact = 6.42 × (ISCBase - 0.029) - 3.25×(ISCBase-0.02)^15 = 6.42×0.531 - 3.25×(0.54)^15. (0.54)^15 is tiny → ~0. So 3.409? Wait no. Formula: Impact = 6.42 × ISS where ISS = 1 - [(1-C)(1-I)(1-A)]. With C:N, I:N, A:H → ISS = 1 - (1)(1)(1-0.56) = 0.56. Then for scope unchanged: Impact = 6.42 × ISS = 3.5952. Hmm, that's the scope-changed formula variant? Let me recall CVSS 3.1 spec: If Scope is Unchanged: Impact = 6.42 × ISS. If Scope Changed: Impact = 7.52 × (ISS - 0.029) - 3.25 × (ISS - 0.02)^15. Yes, so 3.5952 for unchanged. So base = min(Impact+Exploitability,10) × 1.08 = min(7.927,10)=7.927 → 7.927 × 1.08 = 8.561 → roundup = 8.6? No wait — the 1.08 multiplier is for Scope
An out-of-bounds write in FreeRDP's urbdrc (USB redirection) client channel allows a malicious or compromised RDP server to crash the connecting client. When the client loads the urbdrc channel, a crafted 28-byte USB redirection message drives urb_send_current_frame_number_result() to write 4 bytes past a 16-byte heap buffer, which trips an assertion (CWE-617) and terminates the process on builds with verbose asserts enabled. The flaw affects FreeRDP 3.14.0 through 3.30.0 and is fixed in 3.31.0; impact is availability only, and no public exploit code or CISA KEV listing has been identified at time of analysis.
Netcore NR255-V firmware 1.5.130703 exposes router account credentials through the user_pass_show.cgi endpoint, which can be reached and abused by an attacker holding only a low-privilege account on the device's web management interface. Successful exploitation hands over stored administrator/PPPoE credentials, enabling full takeover of the router and any network traffic it mediates. Rated 7.1 under CVSS 4.0 with high confidentiality impact but no integrity or availability effect; no public exploit code or CISA KEV entry was identified at time of analysis, and no patched firmware version is confirmed in the available references.
Netcore NR255-V routers running firmware 1.5.130703 expose stored DDNS account credentials in cleartext through the ddns_wan_list_show.cgi endpoint, with related handling paths in DDNSset_cgi, IGD_GetCgiHandler and IGD_CgiCall. An attacker who can reach the device's web management interface with low-level authenticated access can read the plaintext DDNS username and password, which typically grant control over the dynamic DNS provider account tied to the router's public hostname. No CISA KEV listing or confirmed public exploit code was identified at time of analysis, and no EPSS score was supplied; the CVSS 4.0 base score is 7.1 with only confidentiality impact.
Authenticated users of self-hosted Vikunja instances before 2.6.0 can crash the server by uploading a highly compressed archive through the data-import feature, which is expanded without any size or expansion-ratio limit and consumes tens of gigabytes of memory and disk. The issue is a classic decompression-bomb denial of service (CWE-400) rated 7.1 under CVSS 4.0 (AV:N/AC:L/PR:L/UI:N, availability-only impact); any account able to reach the import endpoint is sufficient, no administrative rights are needed. A vendor fix is available in 2.6.0, and no public exploit code or CISA KEV listing was identified in the supplied intelligence.
Vikunja versions before 2.6.0 omit pixel-count decode limits on avatar and project-background image upload endpoints, so an authenticated user can upload tiny files whose decoded dimensions are enormous and drive unbounded CPU and memory consumption during image processing. Repeated or concurrent uploads can exhaust server resources and deny service to all users of the instance. The flaw is rated CVSS 7.1 with high availability impact only, no public exploit code has been identified at time of analysis, and a vendor fix is available in 2.6.0.
Vikunja releases before 2.6.0 can be knocked offline by any authenticated user who uploads a deliberately oversized multipart CSV file to the POST /api/v2/migration/csv/migrate endpoint, because the importer parses rows without bounding cardinality. Each tiny record consumes heap, so a file containing millions of minimal rows drives the process to out-of-memory conditions and terminates the API service, causing a full denial of service for all tenants on that instance. The flaw is rated 7.1 (CVSS 4.0) with high availability impact and low privileges required; exploitability is high and automatable, though no public exploit code and no CISA KEV listing were provided at time of analysis. Notes in the source metadata separately cite a vendor-available patch.
Oracle Common Applications Calendar, a module within Oracle E-Business Suite 12.2.3 through 12.2.15, can be compromised by a low-privileged attacker who already holds a valid account and can reach the application over HTTP. Successful exploitation gives the attacker unauthorized read, creation, modification, and deletion access to Calendar data and can also cause a partial denial of service, though Oracle rates the flaw as difficult to exploit (CVSS 3.1 7.1, AV:N/AC:H/PR:L/UI:N). No public exploit code or CISA KEV entry was provided in the intelligence feed, and the only authoritative reference is Oracle's Critical Patch Update advisory cspusep2026.
Low-privileged attackers with network access to Oracle Field Service can read and modify critical data and cause a partial denial of service, exploiting a difficult-to-trigger flaw in the Internal Operations component of Oracle E-Business Suite. All supported Oracle Field Service releases from 12.2.3 through 12.2.15 are affected. No public exploit code was identified and there is no CISA KEV listing at time of analysis, but the CVSS 3.1 base score of 7.1 with high confidentiality and integrity impact makes this a candidate for prioritization once patch data is verified.
Improper authorization in Atlassian Jira Service Management Data Center 11.3.0 through 11.3.10 lets an authenticated, low-privileged attacker reach functionality and data they should not be able to access, with the vendor scoring it 7.1 in CVSS 4.0 (AV:N/AC:L/PR:L/UI:N/VI:H). Atlassian states the flaw was discovered through its own penetration-testing program and that the impact could extend from exposure of sensitive resources to arbitrary code execution, though the published CVSS 4.0 vector only credits a high integrity impact and rates confidentiality and availability as none. No CISA KEV listing, EPSS score, or public exploit code was provided in the source data, so at time of analysis this should be treated as a confirmed but not yet observed-in-the-wild authorization bypass; patched versions (11.3.11 and later) are already available.
An improper authorization flaw in Atlassian Confluence Data Center lets an authenticated, low-privileged user reach resources and functionality they should not be able to access, resulting in high confidentiality impact against the affected instance. The defect was introduced across a broad set of release trains — 7.4.0, 7.13.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0 and 10.2.0 — meaning most currently maintained Data Center deployments built on those lines are exposed until upgraded. Atlassian rates the issue 7.1 (CVSS 4.0, AV:N/AC:L/PR:L/UI:N/VC:H) and has shipped fixes in 9.2.24 and 10.2.17; there is no evidence of public exploit code or confirmed active exploitation at time of analysis.
Unauthorized data manipulation in Oracle E-Business Suite's US Federal Human Resources module (releases 12.2.3 through 12.2.15) lets any low-privileged user with HTTP access to the application tier create, modify or delete critical HR records and read a subset of data they should not see. The flaw
Oracle Common Applications Calendar, a module within Oracle E-Business Suite 12.2.3 through 12.2.15, exposes an application-layer access-control weakness that lets a low-privileged user with network access to the EBS HTTP interface create, delete or modify critical calendar data and read a subset of calendar records. The flaw is rated CVSS 3.1 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N), meaning no user interaction is needed but a valid low-privileged account is a prerequisite. No public exploit code or CISA KEV listing was provided in the source data, and no EPSS score was supplied, so active exploitation is currently unconfirmed.
Authenticated low-privileged users can compromise Oracle Project Intelligence within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) over HTTP, gaining unauthorized create, delete, and modify access to critical data along with read access to a subset of application data. Oracle rates the issue CVSS 3.1 base 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N), reflecting a trivial-to-execute, low-privilege attack whose dominant impact is data integrity rather than availability or broad disclosure. No EPSS score, CISA KEV listing, or public proof-of-concept was present in the supplied intelligence, so exploitation status is unconfirmed.
Oracle Order Management, a module of Oracle E-Business Suite, contains a flaw in its Enterprise Command Center component affecting the supported version V16, allowing a low-privileged attacker with network access over HTTP to read all Order Management data the attacked account can reach and to modify part of it. Oracle rates this 7.1 with confidentiality fully impacted and integrity partially impacted, and the vendor describes it as easily exploitable, though authentication with at least a low-privileged account is required per the CVSS vector (PR:L). At the time of analysis there is no public exploit code or CISA KEV listing, and no EPSS score was supplied, so risk is driven by the criticality of the ERP data rather than by evidence of active exploitation.
Improper access controls in Oracle Product Hub, a module of Oracle E-Business Suite 12.2.3 through 12.2.15, let a low-privileged authenticated user reach Internal Operations functionality over HTTP and obtain unauthorized read access to critical product data plus limited insert, update, or delete access to some records. Oracle's own advisory rates this CVSS 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), meaning a valid but unprivileged account is enough — no user interaction and no elevated role required. No public exploit code and no CISA KEV listing were identified at time of analysis, but Oracle CPU vulnerabilities in E-Business Suite are historically attractive to attackers because the targets are internet-exposed, data-rich ERP systems.
Oracle Hyperion Data Relationship Management (DRM) 11.2.26.0.000 contains an access-control weakness in its Access and Security component that lets a network-positioned attacker holding only a low-privileged account read or fully extract critical master-data records and make limited unauthorized updates to them. Oracle's own CVSS 3.1 rating is 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), reflecting complete compromise of confidentiality within the application scope but only partial integrity impact, with no availability effect. No public exploit code, EPSS score, or CISA KEV listing was supplied with the available intelligence, so active exploitation is unconfirmed; the only authoritative source is Oracle's security alert at https://www.oracle.com/security-alerts/cspusep2026.html.
Oracle E-Business Suite versions 12.2.9 through 12.2.15 ship a flaw in the Oracle Applications Framework Personalization component that lets a low-privileged authenticated user reach data and functionality they should not be able to touch, via ordinary HTTP requests. Successful exploitation yields high-impact confidentiality loss (read access to critical application data) plus limited integrity impact (unauthorized insert, update or delete of some records); availability is unaffected. Oracle rates it 7.1 on CVSS 3.1, and no public exploit code or active exploitation has been reported at time of analysis.
Out-of-bounds read in the Netcore NR255-V router (firmware 1.5.130703) is triggered when an authenticated user uploads a deliberately truncated firmware image through the put_file_cgi.c endpoint. The short buffer is passed into the pre-flash validation path (mtd_write, main.c, check_image_uuid.c, oemMD5Update.c), which reads past the end of the uploaded image, leaking adjacent memory and, per the CVSS availability impact, potentially crashing or bricking the flash-validation routine. No CISA KEV listing or confirmed public exploit code was identified at time of analysis, but a public technical write-up exists and the attack is fully automatable once credentials are held.
Takeover of Oracle Banking Corporate Lending Process Management (component: Base, versions 14.5.0.0.0 through 14.9.0.0.0) is possible for a low-privileged attacker who reaches the application over HTTP and convinces another user to interact with attacker-supplied content, resulting in full loss of confidentiality, integrity and availability of the product. The flaw is rated CVSS 3.1 7.1 (AV:N/AC:H/PR:L/UI:R) — network reachable but hard to exploit, requiring an existing low-privilege account and victim interaction. No public exploit code has been identified at time of analysis, and no EPSS score or CISA KEV entry was supplied in the source data.
Oracle Banking Branch versions 14.5.0.0.0 through 14.9.0.0.0 can be taken over by a low-privileged attacker who already holds a valid account and can reach the application over HTTP, provided a second user is lured into interacting with crafted content in the Reports component. Oracle rates this 7.1 (AV:N/AC:H/PR:L/UI:R) with high confidentiality, integrity and availability impact, meaning full compromise of the branch platform rather than mere data leakage. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied, so this should be treated as a high-severity but not yet actively exploited issue requiring patching on the Oracle Critical Security Patch Update cycle.
Authenticated low-privileged users with HTTP access to Oracle E-Business Suite 12.2.3 through 12.2.15 can exploit a difficult-to-trigger flaw in the One-to-One Fulfillment 'Documents' component to read critical data outside their authorized scope and partially degrade availability of the module. The vendor-assigned CVSS 3.1 base score is 7.1 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:L), reflecting high confidentiality impact with no integrity impact and only partial denial of service; the scope-change flag indicates that exploitation can significantly affect resources beyond the vulnerable component. There is no CISA KEV listing, no public proof-of-concept identified, and no EPSS data supplied, so exploitation is not confirmed to be active at time of analysis.