Tencent Mass Service Engine in Cluster (MSEC) allows a remote, unauthenticated attacker to send a crafted POST request including ../ and gain root access on the target device. An attacker who uploads a webshell can execute arbitrary code as root.
Unauthenticated attackers on the same adjacent network segment can compromise the Oracle Identity Manager Connector (versions 12.2.1.4.0 and 14.1.2.1.0), bypassing authentication to gain unauthorized read/write access to critical data, with scope change potentially affecting other Oracle products. This high-severity vulnerability (CVSS 9.3) requires local network adjacency but no credentials or user interaction. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated network attackers can obtain complete confidentiality and integrity compromise of Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 through the Portlet Services component, but only after a legitimate portal user is induced to interact with attacker-influenced content - exploitation is gated by the UI:R prerequisite, which requires human interaction from a person other than the attacker. With a CVSS 3.1 base score of 9.3 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N), the flaw allows unauthorized creation, deletion or modification of, and complete read access to, data accessible through the portal, and because scope changes (S:C) the impact can extend to additional integrated products. There is no KEV listing and no public exploit identified at time of analysis, so this is a high-severity issue whose real-world risk is bounded by the need to socially engineer a valid portal user and by the narrow set of affected releases.
Bambuddy, a self-hosted print archive and management system for Bambu Lab 3D printers, fails open when its database is unavailable: versions from 0.1.6 up to (but not including) 0.2.4.4 catch every exception in the authentication probe and treat the failure as 'auth disabled', granting unauthenticated access to every protected endpoint. A remote attacker with no credentials can force the condition by flooding the public /api/v1/auth/login endpoint until the process exhausts its file-descriptor budget so the next SQLite connect() raises, then timing requests into that transient window to create a persistent admin account or API key, download the database backup (hashed passwords, encryption keys, printer access codes, MFA secrets), alter settings, or control printers. Vendor/CISA scoring is critical (CVSS 4.0 9.3; vendor advisory states 9.8), while independent assessment rates it high with high attack complexity because the bypass exists only during the resource-exhaustion window; no public exploit code identified at time of analysis, no KEV listing, and CWE-636 (Failing Open) is the root class.
Unauthenticated remote command execution in Issabel Framework (the web framework bundled with Issabel PBX) lets any attacker who can reach the pbxapi endpoint forge valid HS256 JSON Web Tokens, because the signing key was a fixed string identical on every installation prior to commit b97dbaf0b71c1c36f841e672b664afbeb02773bd. With a forged bearer token the attacker calls the Asterisk manager originate endpoint using the System application parameter, causing Asterisk to execute arbitrary operating-system commands as the unprivileged Asterisk service user. Rated 9.3 (CVSS 4.0) / assessed 9.8 (CVSS 3.1, AV:N/AC:L/PR:N/UI:N) with no authentication or user interaction required, and the Shadowserver Foundation observed exploitation evidence beginning 2026-09-09; there is no CISA KEV entry and no public exploit-code reference in the supplied data, but the hard-coded key is trivially recoverable from the public source, so treat exposure as urgent.
Heap-based buffer overflow in Ghostscript's JPEG 2000 (JPX) stream decoder (base/sjpx_openjpeg.c) allows unauthenticated remote attackers to corrupt memory, and potentially achieve code execution, by supplying a crafted PDF containing a JPEG 2000 image whose components declare mismatched subsampling factors. All Ghostscript/GhostPDL releases before 10.08.0 are affected; exploitation requires only that the target render the malicious file, which is effectively automatic in server-side pipelines such as CUPS/print spoolers, ImageMagick/GhostPDL conversion services and web PDF renderers, while desktop use requires a victim to open the document. Vendor-released patch: Ghostscript 10.08.0; no public exploit code identified at time of analysis and no confirmed active exploitation (not listed in CISA KEV), though the CVSS 4.0 base score of 9.3 reflects the trivial attack complexity and the high confidentiality, integrity and availability impact of a heap allocator corruption primitive.
Crafted Bidirectional Forwarding Detection (BFD) control packets can force authenticated BFD sessions on Arista EOS to drop, which in turn triggers reconvergence in the routing protocols that monitor those sessions (BGP, OSPF, IS-IS, or static-route failover) and can disrupt or blackhole traffic. The root cause is CWE-303, an incorrect implementation of the authentication algorithm: a packet that should fail BFD authentication is mishandled and can terminate the session, and the published CVSS 4.0 vector scores this 9.2 with unauthenticated network access (PR:N, UI:N) and high subsequent-system availability impact. Exposure is limited to devices running EOS 4.33.0-4.33.8M, 4.34.0-4.34.7M, 4.35.0-4.35.5M, or 4.36.0-4.36.1F that have authenticated BFD sessions explicitly configured; there is no public exploit identified at time of analysis and no CISA KEV listing.
Request smuggling in the http4s Ember HTTP/1.1 parser lets an unauthenticated, remote attacker bypass front-end access controls, splice a victim request onto an attacker-controlled prefix, or poison a caching layer, but only where ember-server runs as an origin behind a keep-alive intermediary that forwards both Transfer-Encoding and Content-Length headers and frames the body by Content-Length while Ember frames by chunked (a CL.TE mismatch); a standalone Ember server with no fronting proxy is not exploitable, and the client path only desyncs when a malicious or compromised upstream sends both headers over a pooled ember-client connection. The flaw affects http4s-ember-core 0.23.34 and earlier in the 0.23.x line, plus 1.0.0-M1 through 1.0.0-M46, with a parser that fails to treat dual-framed messages as the framing error RFC 9112 §6.1 requires; the vendor-assessed CVSS 4.0 score is 9.2, with the topology dependency captured by the AT:P metric. Fixed in 0.23.35 and 1.0.0-M47 (vendor-released patch); no public exploit identified at time of analysis, and CISA SSVC records exploitation as none.
Code execution on the agent host is achievable in atomic-agents-stack through version 1.0.0 because the HTTP MCP server-registry backend factory accepts cleartext http:// catalog URLs alongside https://, letting a network man-in-the-middle rewrite catalog responses and inject arbitrary command/args values that MCPClientPool subsequently spawns as local subprocesses. The flaw is genuine but conditional and its real-world risk is materially lower than the 9.2 CVSS 4.0 headline suggests: exploitation requires an operator to have configured a cleartext http catalog URL (a deployment choice, not a default-reachable condition), an active man-in-the-middle position on the path to that catalog server, and no operator-authored allowlist (mcp_allow_fn defaults to None); the https:// path is not vulnerable because httpx verifies certificates and does not follow redirects. No authentication or user interaction is required and no LLM involvement is needed, no public exploit code has been identified at time of analysis (SSVC exploitation: none, automatable: no), and the vendor-released fix in 1.1.0 requires https by default and gates http:// behind an explicit opt-in.
Unauthenticated remote attackers can bypass the RDSTLS-disabling policy on FreeRDP servers 3.0.0 through 3.30.0 by sending incompatible protocol requests that produce a negotiation failure, then completing a TLS handshake and entering RDSTLS anyway, defeating the intended pre-authentication transport restriction. The vendor CVSS 4.0 base score is 9.2, but our independent CVSS 3.1 assessment is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, reflecting a policy bypass with limited confidentiality and integrity impact rather than direct code execution; no public exploit was identified at time of analysis. Only network-reachable FreeRDP server-mode deployments with RDSTLS administratively disabled are affected, while client-side FreeRDP deployments are not impacted.
Trust-boundary spoofing in the proxy-addr Node.js module (versions 1.1.0 through 2.0.7), the library that backs Express req.ip and req.ips, lets unauthenticated clients forge their apparent source address. When an operator declares a trusted-proxy subnet in IPv4-mapped IPv6 notation with an IPv4-sized prefix (e.g. ::ffff:10.0.0.0/8 rather than the correct /104), proxy-addr silently accepts it but trusts every IPv4 address on the internet, so the direct socket peer becomes trusted at hop 0 and any client can set an arbitrary X-Forwarded-For header. This is a fail-open regression introduced in 1.1.0, fixed in 2.0.8; no public exploit identified at time of analysis, and it is not in CISA KEV.
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Financial Management accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 9.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H).
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Financial Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. While the vulnerability is in Oracle Hyperion Financial Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows high privileged attacker with network access via Oracle Net to compromise Oracle Hyperion Financial Management. While the vulnerability is in Oracle Hyperion Financial Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Financial Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Financial Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Financial Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Financial Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Data Relationship Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Data Relationship Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Data Relationship Management accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Data Relationship Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Data Relationship Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Data Relationship Management accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
High-privileged takeover of Oracle BI Publisher is possible through the BI Platform Security component in versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0, where an attacker who already holds administrative access on the instance can exploit the flaw over HTTP with a Critical CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), taking over the application with full confidentiality, integrity and availability impact. Because the CVSS scope metric is changed (S:C), a successful compromise can extend beyond BI Publisher into additional integrated products rather than being contained by the BI Publisher trust boundary. Exploitation is authenticated and privilege-gated (PR:H) with no user interaction required, so realistic risk is concentrated in deployments where administrative accounts are shared, over-provisioned or reachable from untrusted networks; no public exploit identified at time of analysis.
Takeover of Oracle Agile PLM 9.3.6 is achievable through the Event Java PX component, where an attacker with high privileges and network reachability over T3 or IIOP can fully compromise confidentiality, integrity, and availability while the scope change (S:C) allows significant impact on additional products. The CVSS 3.1 base score is 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), and the dominant real-world limiter is the PR:H requirement - the attacker must already hold an elevated, authenticated role, so realistic exploitation is confined to insiders or adversaries who have already compromised a privileged account. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (the CVE is not in CISA KEV).
Takeover of Siebel CRM Deployment 17.0 through 26.7 is possible for high-privileged attackers via HTTP requests to the Siebel Management Console. Oracle rates this 9.1 Critical with low attack complexity and no user interaction, and a scope change means compromise can affect additional products beyond the vulnerable component. No public exploit or CISA KEV listing was identified in the provided data.
Authentication bypass in the Server Infrastructure component of Oracle Siebel CRM Deployment (supported versions 17.0 through 26.7) lets an unauthenticated remote attacker reach the HTTP interface and take full read/write control of deployment data. The assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (score 9.1) confirms no credentials, no user interaction, and no non-default configuration are required; impact is confined to confidentiality and integrity, so data can be stolen or tampered with but the service cannot be disrupted (A:N). No public exploit code has been identified at time of analysis and CISA SSVC rates exploitation as 'none', though the flaw is rated automatable with total technical impact - making exposure reduction the key control while patching.
Authentication bypass in the Server Infrastructure component of Oracle Siebel CRM Deployment (versions 17.0 through 26.7) lets an unauthenticated remote attacker reach critical CRM data over HTTP and read, create, delete, or modify it at will. Rated CVSS 3.1 base 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) and classified CWE-287, the flaw requires no credentials and no user interaction - the only meaningful barrier is network reachability of the Siebel HTTP interface. No public exploit code exists and there is no confirmed active exploitation (CISA SSVC exploitation: none), but the issue is assessed as automatable with total technical impact, so exposure should be treated as urgent for internet-facing deployments; EPSS data was not provided for this CVE.
Oracle Siebel CRM's Financial Services module (Financial Accounts component) can be compromised by an unauthenticated attacker with network access over HTTP, exposing critical Financial Accounts data and enabling a hang or repeatable crash of the affected service. Supported versions 17.0 through 26.7 are impacted, and the assessed vector (AV:N/AC:L/PR:N/UI:N) indicates exploitation is possible without credentials, user interaction, or non-default configuration, with impact limited to confidentiality and availability (no data modification). No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV); practical exposure is governed mainly by whether the Siebel HTTP endpoint is reachable from untrusted networks, since many deployments are intranet-facing.
Privileged compromise of the Server Infrastructure component in Oracle Siebel CRM Deployment (versions 17.0 through 26.7) allows an attacker who already holds administrative-level access to escalate into a full takeover of the Deployment environment over HTTP. Oracle scores it CVSS 3.1 9.1 with a scope change (S:C), meaning a successful attack can significantly impact additional products reachable from the affected deployment, with high confidentiality, integrity and availability impact. Because the vector requires high privileges (PR:H), this is a post-authentication escalation and lateral-movement risk rather than an anonymous remote compromise; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
Unauthenticated attackers with network reachability to the Siebel CRM Open UI SOAP interface can bypass authentication in Oracle Siebel CRM End User versions 17.0 through 26.7 and obtain full read, create, modify, and delete access to all data reachable through the affected component. Rated CVSS 3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), the flaw requires no credentials, no user interaction, and has low attack complexity, though it carries no availability impact (A:N). No public exploit code and no confirmed active exploitation were identified at time of analysis, so the primary real-world risk driver is whether the SOAP endpoint of a given deployment is exposed beyond trusted networks.
Oracle Application Testing Suite 13.3.0.1 allows an authenticated attacker holding only the low-privilege 'Test Manager for Web Apps' role to obtain unauthorized access to critical data, perform unauthorized inserts, updates, or deletes, and cause a partial denial of service, with a scope change (S:C) indicating that a successful attack can significantly affect other products beyond the tested application. The CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L) reflects low attack complexity and no user interaction over HTTP, but the low-privileged account requirement is the primary limiter - an anonymous or externally unauthenticated attacker cannot exploit this, and exposure is confined to deployments running 13.3.0.1 with the Web Apps test component deployed and network-reachable. No public exploit code or confirmed active exploitation was identified at time of analysis.
High-privileged attackers who already hold administrative access within Oracle Fusion Middleware and can reach Oracle Forms over HTTP can achieve full takeover of the Forms service, with impact extending into other connected products. The flaw affects the Forms Services / Client-Server (C/S) Charmode component in Oracle Forms 12.2.1.19.0 and 14.1.2.0.0, and carries a CVSS 3.1 base score of 9.1 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) with high confidentiality, integrity and availability impact and a scope change - but the PR:H metric is decisive: this is not an unauthenticated remote exploit, no user interaction is needed, and the attacker must already be highly privileged before the attack begins. No public exploit code and no CISA KEV entry were identified from the available intelligence sources at the time of analysis, and no EPSS score was supplied in the source data.
Improper authentication in the Oracle Forms Client/Server (C/S) Charmode runtime allows an unauthenticated, network-reachable attacker to bypass authentication and operate with the data privileges granted to the Oracle Forms application, yielding high confidentiality and integrity impact (CVSS 3.1 base 9.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). Oracle Forms 12.2.1.19.0 and 14.1.2.0.0, as shipped in Oracle Fusion Middleware (Forms Services, C/S, Charmode), are affected; the vector requires no credentials and no user interaction, and there is no availability impact. No public exploit code and no confirmed active exploitation were identified at the time of analysis, and exposure is limited to deployments whose C/S Charmode listener is network-reachable over TCP from an untrusted network.
Full takeover of Oracle Forms is possible in the Forms Services component of Oracle Fusion Middleware for versions 12.2.1.19.0 and 14.1.2.0.0, where an attacker who already holds high privileges on the target and has HTTP network access to the Forms Services listener (including C/S and Charmode deployments) can achieve complete confidentiality, integrity, and availability impact and, because of a scope change, extend that impact to other products in the same deployment. The 9.1 CVSS base score reflects low attack complexity and no user interaction, but the PR:H prerequisite is the dominant limiter - this is not exploitable by an unauthenticated remote actor, so the realistic threat is a privileged insider or an attacker who has already obtained elevated credentials. No public exploit code or evidence of active exploitation (CISA KEV) was identified at time of analysis, and no EPSS score was supplied with the source data.
Takeover of Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 is achievable by an attacker who already holds a high-privilege account on the portal, reaching the Runtime Tools component over HTTP. The flaw is easy to execute once that privileged foothold exists - network vector, low attack complexity, no user interaction required - and its scope-change metric means the fallout can extend into additional Oracle Fusion Middleware products beyond WebCenter Portal itself, with full confidentiality, integrity and availability impact on the portal. The CVSS 3.1 base score is 9.1, but the PR:H prerequisite is the dominant practical constraint: it excludes anonymous and unauthenticated attackers and makes insider abuse or the reuse of stolen administrator credentials the realistic exploitation path. No public exploit code and no confirmed active exploitation were identified at time of analysis, so priority rests on the high severity and low post-authentication effort rather than on observed attacks.
Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebCenter Enterprise Capture. While the vulnerability is in Oracle WebCenter Enterprise Capture, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Enterprise Capture. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
Full takeover of Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 is achievable by an authenticated, high-privileged attacker who can reach the Authentication Engine over HTTP, with a CVSS 3.1 base score of 9.1 due to low attack complexity, no user interaction, and scope change that can affect integrated identity/SSO products. The PR:H prerequisite means this is realistically an insider or post-compromise privilege-abuse path rather than a remote unauthenticated break-in. No public exploit code was identified at time of analysis and no CISA KEV listing is present in the provided intelligence.
Authenticated command injection in the command-line interface of HPE Aruba EdgeConnect SD-WAN Gateways allows an attacker who already holds high-privileged CLI credentials to break out of the appliance shell and execute arbitrary commands on the underlying operating system, resulting in complete compromise of the gateway. The flaw affects the 9.4.x, 9.5.x, 9.6.x and 9.7.x maintenance streams (9.4.0.0–9.4.8.2, 9.5.0.0–9.5.8.1, 9.6.0.0–9.6.3.1 and 9.7.0.0) and carries a vendor-assigned CVSS of 9.1 with a scope change from the CLI component to the host OS. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied, so the practical priority is driven by exposure of the management CLI rather than by evidence of active exploitation.
Improper authentication in the Portlet Services component of Oracle WebCenter Portal allows unauthenticated attackers with HTTP network access to the portal to bypass authentication and gain read and write access to all portal-accessible data, including the ability to create, delete, or modify critical content. Only versions 12.2.1.4.0 and 14.1.2.0.0 of this Oracle Fusion Middleware product are affected, and the flaw is rated high severity (CVSS 3.1 base 9.1, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) with no availability impact. No public exploit code and no confirmed active exploitation were identified at time of analysis, so exploitation risk is driven primarily by internet or broad-network exposure of an unpatched portal.
Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 contain a flaw in the Authentication Engine component that lets a high-privileged attacker with HTTP network access fully compromise the product, taking over the authentication service itself (CVSS 3.1 base 9.1, AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). Because the score includes a scope change (S:C), a successful attack can spill over and significantly impact other products and applications that rely on OAM for authentication, turning a single privileged compromise into a broader identity-layer incident. The critical caveat is the PR:H prerequisite: this is a post-authentication, privileged-abuse issue rather than an unauthenticated remote takeover, so realistic exposure centers on malicious insiders, stolen or misused administrative credentials, or chained privilege-escalation paths. No public exploit code or confirmed exploitation was identified at time of analysis, and the weaknesses make it a priority for patch cycles rather than emergency internet-facing response.
Unauthenticated remote attackers can bypass authentication in Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0, gaining full read and write access to all data managed by the affected component. This easily exploitable vulnerability (CVSS 9.1) requires only network access to the OAM authentication engine over HTTP and no credentials or user interaction. No public exploit code or active exploitation has been observed at the time of analysis, but the lack of authentication and high impact make it a critical risk for exposed instances.
Authentication bypass in BookStack social login (all versions before 26.05.5) allows unauthenticated attackers to sign in as arbitrary users, enabling full account takeover of both regular accounts and administrators. The flaw is a provider-confusion bug in SocialAuthService::handleLoginCallback, which retrieves linked-account records by driver_id while ignoring the driver column, so an attacker who authenticates at one enabled social provider using a user ID that collides with a victim's driver_id under a different provider is accepted without credential verification. No public exploit identified at time of analysis (CISA SSVC exploitation: none; no KEV listing), and successful exploitation requires two enabled social providers sharing an overlapping driver_id namespace plus attacker control of a matching provider account, which is why vendor scoring lands at CVSS 9.1 while our independent vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) caps the attack at high complexity.
Code execution is possible on Dell SmartFabric OS10 switches running versions prior to 10.6.1.3 because the platform downloads code and software images without validating their integrity (CWE-494), so a high-privileged administrator - or an attacker who has already hijacked such an account - can make the device fetch and execute attacker-supplied code. The vendor rates this 9.1 using CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, but the flaw is explicitly not pre-authentication: remote network reachability to the management plane plus existing administrative credentials are mandatory, which is why CISA's SSVC assessment records Exploitation: none, Automatable: no, and Technical Impact: total, and no public exploit was identified at time of analysis. Dell has released a fixed build, OS10 10.6.1.3, under advisory DSA-2026-343.
Unauthenticated remote attackers who can reach the HTTP interface of Oracle Forms Services in a Client/Server, Character mode (C/S, Charmode) deployment can potentially achieve full takeover of the affected Oracle Forms instance on versions 12.2.1.19.0 and 14.1.2.0.0. The assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, base 9.0) reflects complete confidentiality, integrity and availability impact plus a scope change, meaning a successful compromise can materially affect products beyond Oracle Forms itself; however, the High attack complexity rating means exploitation is difficult and depends on a condition outside the attacker's direct control, which limits reliability and mass exploitation. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV) - real-world exposure is confined to environments running the affected Forms Services C/S Charmode component with its HTTP listener reachable by the attacker.
Server-Side Request Forgery (SSRF) vulnerability in Slab safeurl allows an attacker who controls a validated URL to reach internal network destinations the library is configured to block. Only IPv4 addresses are matched against the reserved ranges and the blocklist. Every other address is treated as matching nothing, so a destination that is rejected in its IPv4 form is accepted when written as an IPv6 address, IPv6 entries in the blocklist never match, and a host that resolves to no IPv4 address is accepted regardless of where it points. Deployments that rely on the allowlist instead are unaffected, because there an unmatched address is rejected. This issue affects safeurl: from 0.1.0 onward.
Server-side request forgery protection bypass in Slab safeurl (Elixir) 0.1.0 and later lets an attacker who controls authoritative DNS for a submitted hostname reach internal network destinations that validation had rejected. The library validates one DNS lookup but returns only a verdict rather than the approved address, so the bundled HTTPoison client resolves the original hostname a second time at request time and can be steered to a blocked internal IP. Exploitation is conditional - the attacker must control DNS for the name, win the resolution race, and the host application must route user-influenced URLs through safeurl (assessed CVSS:3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N, high confidentiality impact); no public exploit code or confirmed active exploitation was identified at time of analysis, and the same race can occur non-maliciously with short-TTL or rotating DNS records.
Authenticated remote code execution affects Flowise versions before 3.1.4 through a validation bypass in MCP server configuration nodes: the path validation routine inspects the clean filename passed in the args array but never checks the cwd (working directory) parameter, so an account able to create or modify an MCP server node can point the working directory at attacker-controlled content and have the spawned process execute it. Publicly available exploit code exists, and the independent assessment rates the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (vendor score 9.0 under CVSS 4.0), meaning full confidentiality, integrity and availability loss once the low-privileged authentication prerequisite is satisfied. No CISA KEV entry confirms active exploitation at time of analysis, and CISA's SSVC decision marks the issue as not automatable, so real-world risk concentrates in deployments where ordinary user accounts can define or edit MCP server configuration.
Authenticated remote code execution in Flowise versions before 3.1.4 lets a low-privileged user who can create or edit a Custom MCP node run arbitrary code on the Flowise server by supplying attacker-controlled npm package names in the mcpServerConfig parameter, which Flowise then invokes through npx. The issue carries a vendor-published CVSS 4.0 score of 9.0, while our independent assessment rates it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8), reflecting that the attacker must first hold a valid Flowise account with access to the node editor - no pre-authentication path was identified. No public exploit code was identified at time of analysis and the vulnerability has not been confirmed actively exploited (no CISA KEV listing), so risk is driven mainly by how many users can reach the MCP node configuration UI and whether the instance is internet-facing or uses weak or shared credentials.
Remote code execution inside the Apache Airflow scheduler is possible through the Apache Kafka provider (apache-airflow-providers-apache-kafka) 1.15.0 to before 2.0.0, which resolves dotted-path strings from a Kafka connection's extra field into Python callables via import_string with no allowlist and hands them to the confluent-kafka client. An authenticated user whose only privilege is editing Airflow connections can thereby execute arbitrary code in the control plane when the non-default Kafka event producer (dag_run_events_enabled or task_instance_events_enabled) is switched on, exceeding the Airflow security model that limits connection-configuration users to code execution on workers. No public exploit code or CISA KEV listing was identified at time of analysis; deployments using Google Managed Kafka are not affected because that code path overwrites any user-supplied oauth_cb, while plain brokers and Amazon MSK are exposed.
The Apache Airflow FAB provider (apache-airflow-providers-fab) before 3.9.0 fails to validate the issuer and audience claims of id_tokens presented to its Authentik OAuth login path, so any token that the same Authentik deployment minted for a different client application is accepted by Airflow and authenticates the attacker as the user named in that token. Only deployments running the FAB auth manager with Authentik OAuth against an Authentik instance that also serves other applications are affected — the attacker needs a valid token for one of those other apps, not for Airflow itself. This is a follow-up to CVE-2026-75156, which fixed the identical missing-validation flaw on the Azure AD path in the same file while leaving the Authentik path untouched; upgrade to 3.9.0 or later to remediate. No public exploit code or active-exploitation telemetry was provided in the source data.
Deactivated user accounts in the Apache Airflow FAB auth provider (apache-airflow-providers-fab 2.0.0 before 3.9.0) keep working through the Airflow 3 Core API: the password login path correctly rejects a disabled account, but any JWT access token issued before deactivation is still accepted and can be exchanged for a fresh token indefinitely. The result is that an administrative deactivation — typically performed as a containment action against a departing employee or compromised account — silently fails, leaving the account with its original role-scoped access to the Airflow control plane. No signature forgery or privilege escalation is involved; the holder simply replays their own still-valid credential. The issue is rated moderate by the project, with no CVSS vector, CWE, EPSS score, KEV entry, or public exploit code supplied in the available intelligence, and remediation is available in version 3.9.0.