Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets an unauthenticated, network-positioned attacker tamper with or destroy critical financial consolidation data and partially degrade service availability — but only if a victim user is persuaded to interact with the attacker's crafted request (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L, base 7.1). Integrity is the dominant impact (I:H), with only partial denial of service (A:L) and no confidentiality exposure (C:N). There is no public exploit identified at time of analysis and no KEV listing; no EPSS score was supplied in the source data, so the exploitation-probability signal is absent rather than low.
Low-privileged authenticated users with HTTP access to Oracle Quality in Oracle E-Business Suite 12.2.3 through 12.2.15 can read critical Quality records and make limited unauthorized changes to them, because the Internal Operations component fails to enforce proper authorization on its requests. Oracle scores this 7.1 with a network vector, low attack complexity and no user interaction, so exploitation is straightforward for anyone who already holds any valid EBS account. No public exploit code or CISA KEV listing was identified at time of analysis, and no EPSS score was supplied in the input.
Oracle Hyperion Financial Management 11.2.26.0.000 contains an easily exploitable flaw in its Security component that lets an attacker holding a low-privileged account reach the application over HTTP to read critical financial data and degrade availability. Rated CVSS 3.1 7.1 (AV:N/AC:L/PR:L/UI:N, C:H/I:N/A:L), the issue requires only a valid low-privileged login rather than administrative rights, making any ordinary HFM user account a viable starting point. No public exploit code has been identified and the flaw is not listed in CISA KEV at time of analysis; EPSS data was not supplied.
Low-privileged users with network access to Oracle Depot Repair inside Oracle E-Business Suite 12.2.3 through 12.2.15 can read critical repair and recall records they are not entitled to and partially degrade availability of the module by sending crafted HTTP requests to the Recall Management component. Oracle rates the flaw 7.1 using CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L, meaning a valid but unprivileged account is the main barrier — no user interaction, no elevated role, and no special attack complexity. The provided intelligence contains no CISA KEV listing and no public exploit code, so exploitation is currently assessed as authenticated and targeted rather than opportunistic mass scanning.
Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 exposes its Forge component to a low-privileged, network-reachable attacker over HTTP, allowing unauthorized read access to critical data and a partial denial of service. The flaw carries a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N, C:H/I:N/A:L), meaning a valid but low-privileged account is enough and no user interaction is required. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but Oracle has published a fix in its Critical Patch Update advisory (cspusep2026.html), and the associated tags also categorize the issue as an authentication bypass.
Integrity compromise in Oracle Site Hub, a module of Oracle E-Business Suite, affects supported releases 12.2.3 through 12.2.15 and lets a low-privileged authenticated attacker reach the Internal Operations component over HTTP to create, delete, or modify critical Site Hub data while also reading a subset of that data. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N, base 7.1) confirms network reachability with no user interaction, but the PR:L metric means credentials are required, so this is not a pre-auth or anonymous attack path despite the 'Authentication Bypass' tag carried by the reporting feed. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and exploitation is further constrained by the relatively narrow deployment footprint of the Site Hub module within EBS.
Oracle Hyperion Financial Management 11.2.26.0.000 exposes sensitive application data and can be partially disrupted by low-privileged attackers who reach the product over HTTP, due to a flaw in the Security component. Per the Oracle-sourced CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L), exploitation yields high confidentiality impact plus a partial denial of service, but no integrity impact and no scope change. No public exploit code, EPSS score, or CISA KEV entry was provided with this record, so active exploitation is unconfirmed and the practical threat depends on whether the HTTP/security interface is exposed to untrusted networks.
Authenticated denial of service in Atlassian Confluence Data Center allows a low-privileged logged-in user to make the application unavailable to its intended users, with no confidentiality or integrity impact. The flaw was introduced across a broad swath of releases (8.9.0 through 10.2.0) and Atlassian rates it High with a CVSS 4.0 score of 7.1. Fixed builds are 9.2.24 and later on the 9.2 branch and 10.2.17 and later on the 10.2 branch; no public exploit code or confirmed active exploitation was identified at time of analysis.
Netcore NR255-V routers running firmware 1.5.130703 expose stored IPsec pre-shared keys and RSA private key material through web CGI read handlers, principally l2tpd_config_show.cgi, with the same class of weakness present in ipsec_show_cgi.c and the mod_vpn_remote/plan.json reader. The flaw is network-reachable but requires an authenticated session with only low privileges (CVSS 4.0 PR:L), so anyone who obtains any valid router account — or who finds a weakly protected management interface — can retrieve credentials that decrypt or impersonate the device's IPsec/L2TP VPN tunnels. No CISA KEV listing, EPSS score, or vendor patch version was supplied with the available intelligence, so exploitation status and fix availability remain unconfirmed; public technical reference material describing the issue does exist.
Netcore NR255-V routers running firmware 1.5.130703 expose stored PPTP and L2TP VPN credentials through four web-accessible handlers — the mod_vpn_remote/plan.json endpoint and the pptpd_user_show.cgi, pptp_client_config_show.cgi, and l2tpd_user_show.cgi CGI scripts. An attacker who holds a low-privileged session on the router's web management interface (CVSS 4.0 PR:L) can request these endpoints over the network without any user interaction and recover VPN usernames and passwords in the clear. The result is full credential disclosure (VC:H) that can be replayed against the organization's PPTP/L2TP VPN gateways; no public exploit code or CISA KEV listing was present in the supplied intelligence, and no EPSS score was provided.
WeKnora's URL-based document ingestion endpoint (POST /api/v1/knowledge-bases/:id/knowledge/url) allows authenticated users to reach internal network resources and cloud metadata services by supplying a public URL that redirects to private addresses, bypassing the Go-side SSRF filter applied only to the initial submitted URL. Versions 0.5.2 through 0.6.x are affected; the Python/Playwright web scraper layer followed HTTP redirects without re-invoking SSRF validation, a gap the Go service handler did not share. No public exploit or CISA KEV listing exists at time of analysis, but the redirect-bypass technique is well-documented and accessible to any authenticated user.
Oracle Business Intelligence Enterprise Edition (BI Platform Security component) versions 8.2.0.0.0 and 26.01.0.0.0 contain a difficult-to-exploit flaw that lets a low-privileged, authenticated attacker reach the BI platform over HTTP and gain unauthorized create, delete, or modify access to critical BI data, plus read access to a subset of it. Oracle's own CVSS 3.1 rating is 7.1 (AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:N), with the scope change indicating successful attacks can also affect connected products. No EPSS score, CISA KEV entry, or public exploit code was present in the supplied intelligence, so exploitation is currently assessed as theoretical rather than observed.
Authorization bypass in IceHRM before 36.0.0 lets any authenticated employee read coworkers' HR records by substituting an arbitrary employee ID in seven REST sub-resource endpoints covering skills, education, certifications, languages, leave, attendance and status. CVSS 4.0 scores the flaw 7.1 (AV:N/AC:L/PR:L/UI:N, VC:H only), reflecting a low-effort, easily automated disclosure of sensitive personnel data rather than code execution. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV; a vendor fix is available in release v36.0.0.
Unauthorized creation, deletion, and modification of critical master data plus partial denial of service in Oracle Hyperion Data Relationship Management 11.2.26.0.000 can be triggered by an unauthenticated attacker with network access over HTTPS, provided a victim other than the attacker is persuaded to interact with attacker-supplied content. The flaw sits in the Access and Security component, scores 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L), and carries no confidentiality impact - the damage is data integrity and reduced availability. There is confirmed actively exploited (CISA KEV)? No - no public exploit identified at time of analysis, and no EPSS or KEV data was supplied; Oracle has published a Critical Security Patch Update advisory covering supported versions.
Unauthenticated attackers positioned on the same network segment as a host running Oracle Agile Engineering Data Management 6.2.1 can reach the Engineering Communication Interface component and read critical engineering data or alter stored records, according to Oracle's Supply Chain security alert. The flaw carries a CVSS 3.1 base score of 7.1 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), meaning no credentials, no user interaction and no attack complexity are required once adjacency is achieved. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied.
Oracle Communications Cloud Native Core Security Edge Protection Proxy (SEPP) versions 26.1.200 and 25.2.201 are exposed to an unauthenticated, low-complexity attack launched from the adjacent network segment on which the SEPP host resides. A successful exploit gives the attacker high-impact read access to critical SEPP data plus limited ability to modify or delete that data (CVSS 3.1 base 7.1, AV:A/AC:L/PR:N/UI:N/C:H/I:L/A:N), which in a 5G roaming architecture could mean exposure of inter-PLMN signaling and subscriber-adjacent metadata. No public exploit code and no CISA KEV entry were identified in the available data, so exploitation is currently assessed as opportunistic rather than confirmed in the wild, and the primary exposure is limited to deployments where untrusted parties can reach the SEPP's network segment.
An authorization bypass in MISP through version 2.5.45 lets an authenticated user who can edit events assign an arbitrary sharing_group_id they are not authorized to use, because the authorization check only ran when the request explicitly supplied distribution = 4. If the caller omits the distribution field, MISP's field-recovery logic restores the event's stored distribution (4, for sharing-group events) and persists the unauthorized sharing group ID, silently re-scoping who can see that event and its threat-intelligence content. No public exploit code or active exploitation has been identified at time of analysis, but exploitation is a single crafted edit request, so the integrity impact (VI:H, CVSS 4.0 base 7.1) is significant for multi-tenant or community-sharing MISP instances.
Low-privileged users with HTTP access to Oracle E-Business Suite 12.2.3 through 12.2.15 can leverage a hard-to-reach flaw in the Oracle Partner Management module (Internal Operations component) to read critical data and modify records far beyond their authorization, with the impact crossing into other EBS components because the vulnerability carries a scope change. Oracle rates it CVSS 7.1 and characterizes it as difficult to exploit, and a fix is published in the 2026 Critical Patch Update. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Authenticated low-privileged users of Oracle HRMS (India) inside Oracle E-Business Suite 12.2.3 through 12.2.15 can send crafted HTTPS requests to the Internal Operations component and reach data or operations they should not be authorized to touch, resulting in high confidentiality impact and partial integrity impact (CVSS 3.1 base 7.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N). The flaw is rated easily exploitable by Oracle, but it is not listed in CISA KEV, no public exploit code has been identified, and no EPSS score was supplied with the intelligence feed. Affected deployments are those running the India localization of the EBS HRMS module; the underlying weakness class (most consistent with improper access control / missing authorization) has no CWE assigned in the source data.
Improper access control in the Award/PO component of Oracle Contract Lifecycle Management for Public Sector (part of Oracle E-Business Suite, versions 12.2.8 through 12.2.15) lets a low-privileged, authenticated attacker with HTTP network access read critical application data and modify or delete records they should not be able to touch. Oracle rates this 7.1 with a CVSS vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, meaning exploitation is trivial for anyone holding a valid low-privilege account and requires no user interaction. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and EPSS/KEV signals were not present in the supplied data.
Oracle Hyperion Data Relationship Management 11.2.26.0.000 exposes an access-and-security weakness that lets a low-privileged, authenticated user reach data they should not see and alter records they should not touch. The flaw is reachable over the network through ordinary HTTP requests with no user interaction, and Oracle rates it 7.1 with high confidentiality impact and partial integrity impact. Exploitation grants read access to critical master-data content and limited unauthorized insert, update, or delete capability; no public exploit code or CISA KEV entry was present in the supplied intelligence at time of analysis.
Oracle Siebel CRM Deployment (Siebel Management Console) in versions 17.0 through 26.7 fails to properly restrict what a low-privileged, network-connected user can reach, letting that user read critical deployment data and make limited unauthorized changes. Exploitation is trivial once a valid low-privilege account exists: CVSS 3.1 scores it 7.1 (AV:N/AC:L/PR:L/UI:N, C:H/I:L/A:N), with the confidentiality impact rated High and integrity impact Low. There is no public exploit code and no CISA KEV listing at time of analysis, so this is currently a patch-on-schedule item for Siebel shops rather than an emergency, though EPSS data was not supplied and the untrusted-network exposure of the management console should drive prioritization.
Oracle Siebel CRM Integration (EAI component) versions 17.0 through 26.7 expose a network-reachable SOAP interface that fails to properly restrict operations for authenticated low-privileged users, letting an attacker read critical CRM data and perform limited unauthorized inserts, updates, or deletions. The flaw carries a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N, C:H/I:L/A:N) and is rated 'easily exploitable' by the vendor, requiring only a valid low-privilege account and network reachability to the EAI endpoint. No public exploit code or CISA KEV entry was present in the supplied intelligence at time of analysis.
Improper access control in the Open UI component of Oracle Siebel CRM (End User) versions 17.0 through 26.7 lets an authenticated low-privilege user issue crafted HTTP requests that expose and modify data beyond their authorized scope. Successful exploitation yields high confidentiality impact — unauthorized read of critical Siebel data — plus limited integrity impact via unauthorized insert, update or delete operations; availability is unaffected (CVSS 3.1 base 7.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N). No CISA KEV listing, public exploit code or EPSS signal is present in the supplied intelligence, so this is currently a patch-cycle priority rather than a confirmed actively exploited issue.
Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 contain a flaw in the Runtime Tools component that lets a low-privileged, network-positioned attacker read and partially modify portal data via HTTP. Oracle rates it 7.1 (AV:N/AC:L/PR:L/UI:N, C:H/I:L), meaning exploitation is trivial once any valid low-privileged account is held, with full confidentiality impact against the portal's accessible data. No CISA KEV listing, public exploit code, or EPSS score was supplied with the source data, so active exploitation is unconfirmed at time of analysis.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that an attacker positioned on the same adjacent network segment as the HFM host can exploit without authentication or user interaction to hang or repeatedly crash the application (complete denial of service) and to make limited unauthorized inserts, updates or deletes against data the application can reach. The vendor rates it 7.1 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H), so confidentiality is untouched while availability is fully lost and integrity is partially degraded. No public exploit code has been identified at time of analysis and no EPSS or KEV signal was supplied, but the low attack complexity and zero authentication requirement make this a segment-level risk for any organization exposing HFM to shared or flat internal networks.
Oracle Hyperion Financial Management 11.2.26.0.000 contains an improper authorization flaw in its Security component that lets a low-privileged, network-positioned attacker with a valid account reach and read critical financial consolidation data, and also modify a limited subset of that data. The CVSS 3.1 base score is 7.1 (AV:N/AC:L/PR:L/UI:N, C:H/I:L/A:N), reflecting a remotely reachable, low-complexity path that requires only basic authenticated access. There is no KEV listing, no public exploit code identified at time of analysis, and no EPSS score supplied with the source data, so this should be treated as a serious but not yet demonstrably exploited enterprise application flaw.
MISP through 2.5.45 fails to enforce authorization checks when collection elements are created, allowing an authenticated user to persist a bare UUID referencing an Event or Galaxy Cluster they are not permitted to read. The collection view later resolves that UUID back into the underlying object, so collections become a handle on another organisation's private data — the patch notes this already caused org-only events to be disclosed in the beta collection view. Exploitation requires a valid MISP account and knowledge of the target UUID; no public exploit code or CISA KEV listing was identified at time of analysis, though the CVSS 4.0 vector (PR:L, VC:H) and EPSS-adjacent signals mark it as a meaningful confidentiality risk for shared threat-intel instances.
Denial of service in Arista EOS DHCP relay and snooping deployments allows an unauthenticated attacker with Layer 2 access to a client-facing VLAN to crash the DHCP Relay service by sending a specially crafted DHCP packet. Triggering requires the information option (Option 82) to be inserted by the relay/snooping configuration, or a DHCP server whose match criteria reference Option 82. The flaw is rated CVSS 4.0 7.1 (AV:A/AC:L/PR:N/UI:N/VA:H) and is covered by Arista Security Advisory 0155; no CISA KEV listing, public exploit code, or EPSS score was supplied in the source data.
Adjacent-network attackers can crash HPE Networking EdgeConnect SD-WAN Gateways or leak small amounts of uninitialized stack memory by sending crafted traffic to the gateway, affecting unauthenticated devices reachable from the same Layer 2 segment. The flaw (CWE-200) carries a 7.1 CVSS score with the availability impact rated High and confidentiality impact Low, and it spans four maintained release trains from 9.4.0.0 through 9.7.0.0. It is not listed in CISA KEV, no public exploit code was identified in the supplied intelligence, and no EPSS probability was provided, so the immediate risk is driven by network adjacency and gateway exposure rather than confirmed mass exploitation.
Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 (Forge component) can be compromised by an unauthenticated attacker who already sits on the same physical network segment as the host, yielding full read access to application data, limited data manipulation, and a repeatable denial-of-service condition. Oracle rates the flaw CVSS 7.1 (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H), reflecting that it is reachable only from an adjacent segment and is difficult to trigger reliably. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; Oracle has published a fix in its Critical Security Patch Update.
Cross-site request forgery in the J2Store e-commerce extension for Joomla (versions 1.0.0–3.3.2, 4.0.0–4.0.22 and 4.1.0–4.1.7) allows an attacker to silently overwrite a shopper's billing or shipping address while their checkout session is active, potentially redirecting a paid order to an attacker-controlled address. The cart, checkout and myprofile controllers omit CSRF token validation, so each forged request executes only with the victim's own session privileges — there is no cross-account data access. No public exploit code or active exploitation has been identified at time of analysis.
Server-side request forgery in mcp-searxng before 1.7.1 lets an unauthenticated network client coerce the MCP server into fetching internal-only resources. The web_url_read tool validates only the literal hostname string before handing the URL to undici's fetch, so an attacker-controlled hostname that DNS-resolves to a loopback, private, link-local, or cloud-metadata address passes the lexical check and is connected to by the OS resolver. Successful abuse can read internal HTTP services, leak credentials or service tokens, and enumerate reachable internal hosts; publicly available exploit code exists and EPSS remains low (0.14%, 3rd percentile), so this is a real but conditional risk concentrated in deployments that expose the default HTTP transport without the MCP_HTTP_HARDEN authorization layer.
Oracle Siebel CRM Deployment (Server Infrastructure component), versions 17.0 through 26.7, allows an attacker who already holds a low-privileged logon on the host where the deployment component runs to read, create, modify, and delete all data accessible to that deployment. The vulnerability is locally exploitable with low complexity and no user interaction, but it does not grant entry to the host itself — it escalates what an existing low-privileged account can reach across the Siebel deployment layer, producing high confidentiality and integrity impact (CVSS 3.1 base 7.1) with no availability impact. No public exploit code has been identified at time of analysis, the flaw is not listed in CISA KEV, and no EPSS score, CWE mapping, or confirmed fix version was supplied with the source data.
Oracle E-Business Suite Applications Manager 12.2.3 through 12.2.15 lets a low-privileged attacker who already holds a logon on the host running Applications Manager read and tamper with critical data through the Command Line - RapidClone component. The flaw is a local-only, low-complexity authorization weakness (CVSS 7.1, AV:L/PR:L/UI:N) that yields high confidentiality and integrity impact with no availability impact, and no scoped privilege escalation beyond the component. No public exploit code has been identified at time of analysis, and no EPSS or CISA KEV signal was supplied with this record.
Local low-privileged users who can log on to a host running Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 can abuse the Forge component to create, delete or modify critical search data and to hang or repeatedly crash the service, producing high integrity and availability impact with no confidentiality exposure. The issue carries a CVSS 3.1 base score of 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H), so it is not remotely exploitable and requires a pre-existing authenticated foothold on the server, which keeps real-world risk genuinely moderate rather than urgent. There is no CISA KEV entry and no public exploit identified at time of analysis, and exploitation is not confirmed actively exploited.
Rsbuild versions before 2.0.9 contain a command injection flaw in the developer-server browser-launcher on macOS. The openBrowser() helper in packages/core/src/server/open.ts passes a URL through encodeURI() and then interpolates it into a string handed to child_process.exec(), and because encodeURI() leaves characters such as $, (, ), and ; untouched, a crafted URL is evaluated by /bin/sh and can execute arbitrary operating-system commands with the privileges of the developer running the dev server. The issue was fixed in the 2.0.9 release (upstream PR 7789), so a vendor-released patch is available; no CISA KEV listing or public exploit code was present in the supplied intelligence, and the attack requires local conditions on the developer machine.
Stack-based buffer overflow in the A2DP profile of the BlueZ Linux Bluetooth stack allows a network-adjacent attacker to run arbitrary code as root on a target once a malicious Bluetooth audio device has been paired with it. The flaw lies in stream endpoint (SEP) handling, where attacker-supplied capability strings are copied into fixed-size stack buffers without a length check (CWE-121), so oversized SEP data corrupts the stack in the privileged bluetoothd process. CVSS 7.1 (AV:A/AC:H/PR:N/UI:R) reflects the requirement for a paired device and radio proximity; no public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied.
Command injection in the GitHub Actions workflow shipped with githubtoplanguages (versions before 1.1.4) lets anyone who can open an issue on a repository running the bundled discord-issue.yml workflow execute arbitrary shell commands on the Actions runner. The issue title is expanded by GitHub Actions directly into a Bash assignment, so a title containing $(...) command-substitution syntax is evaluated by the shell before the value is posted to Discord; a public proof-of-concept was demonstrated by the reporter in a fork. A successful injection can spoof trusted bot notifications and may expose the configured DISCORD_WEBHOOK secret or other workflow environment data, and remediation is available in version 1.1.4 / commit 6bf9c3a9cb66c937b9047ca266b3d02f2bb11027.
Any authenticated user of a Payload CMS instance running @jhb.software/payload-cloudinary-plugin (0.3.0 through 0.3.x, fixed in 0.4.0) can obtain a cryptographically valid Cloudinary HMAC-SHA1 upload signature for parameters of their choosing, because the client-upload signing endpoint POST /api/cloudinary-generate-signature forwards attacker-controlled 'paramsToSign' straight to cloudinary.utils.api_sign_request() with no key allowlist, folder policy, or timestamp check. With that signature plus the intentionally client-visible Cloudinary API key, an attacker can overwrite existing assets, flip upload visibility with type=private, register notification_url callbacks to attacker-chosen hosts, force cache invalidation, and write files outside the intended upload folder. The issue is only reachable when the plugin's clientUploads option is enabled, and no public exploit code or active-exploitation reporting was present in the supplied intelligence.
Cost-guardrail bypass in atomic-agents-stack 1.0.0 and earlier lets a caller run parallel helper/delegate batches with a model identifier that is absent from the hardcoded pricing table, causing the per-batch reservation to be calculated as $0.00 and silently skipped. Because the reservation is the only defense against the documented fan-out race — where every parallel worker reads the same pre-batch on-disk cost total and each individually passes the cap check — a single batch can blow past a configured daily_cap_usd budget that the operator believes is enforced. Exploitation requires cost_guardrails enabled with daily_cap_usd set and use of an unpriced model (self-hosted Ollama/vLLM, a new provider SKU, or a steered model argument); the vendor has released 1.1.0 with a fix.
Unauthenticated remote denial-of-service in HPE Networking EdgeConnect SD-WAN Gateways (formerly Silver Peak), affecting firmware branches 9.4.x up to 9.4.8.2, 9.5.x up to 9.5.8.1, 9.6.x up to 9.6.3.1, and 9.7.0.0. An attacker who can reach the vulnerable gateway service can exhaust resources (CWE-400, uncontrolled resource consumption), rendering certain services on the appliance unavailable and disrupting SD-WAN connectivity for sites behind the gateway. The CVSS 3.1 score is 7.0 (AV:N/AC:H/PR:N/UI:N), and no public exploit code or CISA KEV listing was identified at time of analysis.
Unauthenticated attackers with HTTP network reachability to the Forge component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 can read critical application data, make limited unauthorized modifications, and degrade service availability. Oracle rates exploitation as difficult (CVSS:3.1/AV:N/AC:H/PR:N/UI:N, base 7.0), so the flaw likely depends on timing, specific application state, or non-default conditions rather than a simple one-shot request. There is no public exploit code and no CISA KEV listing at time of analysis, and no EPSS score was included in the supplied intelligence, leaving real-world exploitation likelihood unquantified.
Unauthenticated HTTP requests against Oracle Helidon deployments that use the helidon-dbclient-mongodb component can let a remote attacker read or modify MongoDB-backed data and cause a partial denial of service in versions 3.0.0–3.2.20 and 4.0.0–4.5.4. Oracle rates this CVSS 3.1 base 7.0 with high attack complexity (AV:N/AC:H/PR:N/UI:N), meaning successful exploitation depends on conditions that are difficult for an attacker to arrange. No public exploit code or CISA KEV listing was provided at time of analysis, so this should be treated as a patch-priority issue rather than an emergency.
Oracle GraalVM (including GraalVM for JDK 17/21, GraalVM Enterprise Edition and GraalVM 25.x) contains a flaw in its Compiler component that a network-positioned attacker can reach over HTTP without authenticating. Successful exploitation can expose critical data, allow limited unauthorized modification of data, and cause a partial denial of service; Oracle characterizes the issue as difficult to exploit per the AC:H metric, implying attacker-controlled timing or memory-layout preconditions. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV; the CVSS 3.1 base score is 7.0 with a high confidentiality impact.
Denial of service with possible disclosure of memory contents in IBM MQ (all LTS and CD releases from 9.1.0.0 through 9.4.5.1 and 10.0.0.0) is reachable by a remote attacker who already holds a TLS client certificate the queue manager trusts. Improper validation of deeply nested certificate data during TLS certificate processing produces a stack-based buffer overflow (CWE-121) that can crash the queue manager and potentially expose fragments of process memory. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; IBM has released fixes via its support advisory.
Cross-site request forgery in the Netcore NR255-V wireless router's web management interface (firmware 1.5.130703) allows an attacker to silently rewrite WAN and LAN settings by luring a logged-in administrator to a malicious page, which then fires forged requests at the wan_config_set_cgi, wan_num_set_cgi, and lan_ip_change_cgi endpoints. The supplied CVSS 4.0 vector (7.0, AV:N/AC:L/AT:N/PR:N/UI:A) indicates the attacker does not need credentials of their own but must get an authenticated admin to actively interact, and that the resulting integrity and availability impacts are High while confidentiality is unaffected. No public exploit code was identified in the provided intelligence and the CVE is not listed in CISA KEV, so this is currently a disclosure-driven risk rather than a confirmed campaign.
Local privilege escalation in Oracle Business Intelligence Enterprise Edition 26.01.0.0.0 allows an attacker who already holds a low-privileged logon on the host running the platform to take full control of the BI EE deployment, with high confidentiality, integrity and availability impact across the Platform Security component. Oracle rates the flaw 7.0 (AV:L/AC:H/PR:L/UI:N), reflecting that exploitation is difficult and confined to the local host rather than reachable over the network. No public exploit code or evidence of active exploitation was identified in the supplied intelligence at time of analysis.
Local takeover of Oracle PeopleSoft Enterprise PeopleTools (Cube Manager component) is possible for a low-privileged user who can log on to the infrastructure hosting the product, affecting versions 8.61 through 8.63. Oracle scores this 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting a difficult-to-exploit but fully compromising flaw that yields high confidentiality, integrity and availability impact on the PeopleTools instance itself. No public exploit code or CISA KEV listing was identified at time of analysis, so the immediate threat is limited to actors who already hold a valid low-privileged account and interactive access to the PeopleSoft application tier.
Local attackers who can log on to a host running Oracle Application Testing Suite 13.3.0.1 can achieve full takeover of the application, with high impact to confidentiality, integrity and availability. The flaw requires human interaction from someone other than the attacker and is rated high complexity, meaning a foothold on the machine plus a successful social-engineering or timing condition is needed rather than a simple remote request. There is no confirmed CISA KEV listing, no public exploit code identified, and no EPSS score supplied in the source data, so current risk is driven by the local-access precondition and Oracle's own assessment rather than evidence of active exploitation.