Information disclosure in Oracle Coherence 15.1.1.0.0 lets a low-privileged attacker with HTTP network access read critical data or the entire contents of Coherence-accessible caches, and because the CVSS vector reports a scope change, products built on top of that grid can be exposed as well. Oracle scores it 6.3 with high attack complexity, so it is not a trivial drive-by exploit; the feed contains no public exploit code and no CISA KEV entry, and the only remediation reference is Oracle's Critical Security Patch Update advisory. Authentication is required per the PR:L metric, meaning the attacker needs an existing low-privilege foothold rather than being an anonymous internet client.
Unauthenticated attackers can push files of the component's choosing onto a Joomla site running the JoomGallery extension (all versions below 4.4.1) by abusing the extension's TUS resumable-upload endpoint, which fails to enforce access control. The practical impact is bounded — neither the file name nor the extension is attacker-controlled — and turning the upload into code execution requires an unusual web-server configuration that maps the stored artefacts to an executable handler, which is why the CVSS 4.0 base score lands at 6.3 rather than critical. No CISA KEV entry or EPSS score accompanies this CVE in the supplied data, but the CVSS 4.0 vector carries an E:A (Attacked) supplemental metric indicating the scoring source has observed exploitation activity.
Order access tokens in the J2Store/J2Commerce extension for Joomla (versions 1.0.0-3.3.2, 4.0.0-4.0.22, and 4.1.0-4.1.7) are derived predictably, so anyone who already knows the site's Joomla `secret` value can compute a valid token for any order on the store. This grants guest-level access to that order's details and any purchased digital downloads without the attacker ever placing an order. The token is never rotated, so the exposure survives even after the original secret-disclosure bug is patched unless the Joomla `secret` itself is changed. No public exploit tooling is identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV); exploitation is non-trivial because it presumes a prior foothold or disclosure of the site secret (CVSS 4.0 AC:H).
Ingress Security ACLs applied to Switched Virtual Interfaces (SVIs) in shared mode on dual-switchcard Arista EOS platforms can silently stop filtering after the secondary switchcard forwarding agent restarts or a secondary switchcard is inserted, causing packets that should be denied to be permitted (and vice versa). The flaw is rated CVSS 4.8 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N, CWE-1419 incorrect resource initialization) and only affects modular chassis configured with dual switch cards plus shared-mode SVI ingress ACLs. Arista discovered the issue internally and states it is not aware of any malicious exploitation in customer networks; no public exploit code or CISA KEV listing is associated with this CVE.
Tornado 6.5.5 through 6.5.7 allows attackers to inject arbitrary Set-Cookie attributes because the fix for CVE-2026-35536 only validated the documented lowercase keyword arguments (name/domain/path/samesite). The deprecated and still-live **kwargs path in RequestHandler.set_cookie writes values straight into the Morsel without character validation, and because Morsel.__setitem__ is case-insensitive, a capitalized kwarg such as Domain=, Path=, SameSite= or Max-Age= routes to the same reserved attribute while bypassing the filter. Any application that passes attacker-influenced data into a capitalized/legacy kwarg can be made to emit cookies with attacker-controlled Domain, Path, Secure, HttpOnly or SameSite directives; no public exploit code or CISA KEV entry has been identified at time of analysis.
Payara Server ships by default without any cap on failed authentication attempts, so its administrative console and application login endpoints can be hammered with unlimited password guesses. The issue is a classic missing-lockout / missing-rate-limit weakness (CWE-307) affecting Payara Server Enterprise 4.x, 5.x, 6.x and 7.x plus the Payara Server Community 7 line, with fixes published in releases 4.1.2.191.57, 5.89.0, 6.40.0, 7.2.0 and Community 7.2026.7. With a vendor CVSS of 6.3 (4.0 vector AV:A/AC:L/PR:N/UI:N, VC:L/SC:H), success depends on the operator enabling the bundled automatic attack protection; no public exploit code or CISA KEV listing was present in the supplied intelligence, and no EPSS score was provided.
A locally exploitable flaw in the Core component of Oracle VM VirtualBox 7.2.16 lets a low-privileged user who can log on to the host repeatedly crash the hypervisor process and tamper with some VirtualBox-accessible data. The issue requires only local logon with low privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N), no user interaction, and no network exposure, yielding a 6.1 base score driven by Availability (High) and Integrity (Low) impacts with no Confidentiality impact. There is no public exploit code identified and the CVE is not listed in CISA KEV, so current risk is concentrated in multi-user or shared-workstation deployments where untrusted users share a virtualization host.
Oracle VM VirtualBox 7.2.16 contains a Core-component flaw that lets an attacker who already has a logon on the host crash the hypervisor (complete denial of service) and make limited unauthorized modifications to VirtualBox-accessible data, provided they can induce a victim to perform a user action. The issue is local rather than network-reachable, requires no special privileges beyond an interactive session on the machine where VirtualBox runs, and is rated 6.1 on the CVSS 3.1 scale (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H). No public exploit code has been identified and the CVE is not listed in CISA KEV at time of analysis, but the integrity-plus-availability impact and the trivially low attack complexity make prompt patching worthwhile.
Unauthenticated attackers who can reach the Oracle Agile PLM Web Client over HTTP can read and tamper with a limited subset of PLM data, but only if they first persuade another user to interact with a crafted request. Oracle rates this 6.1 (medium) with a scope change, meaning a successful attack may also affect additional products reachable through the same component. No public exploit code, POC, or CISA KEV entry was identified in the supplied intelligence for this CVE.
Oracle Contract Lifecycle Management for Public Sector — specifically the Wage Determination Online component of Oracle E-Business Suite 12.2.3 through 12.2.15 — can be abused by an unauthenticated, network-based attacker who persuades another user to interact with a crafted HTTP request, yielding unauthorized read plus update/insert/delete access to module data. The CVSS 3.1 base score is 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), and the scope-change metric indicates the compromise may significantly impact additional products beyond the vulnerable module. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so this reads as a patch-cycle priority rather than an emergency.
GNOME Shell fails to validate the declared dimensions of icons returned by a remote search provider over D-Bus against the actual icon data buffer, producing an out-of-bounds read when an oversized size is supplied. A malicious or compromised search provider registered in a user's session can crash the shell — terminating the desktop session — and may leak fragments of adjacent shell memory. Rated CVSS 6.1 (AV:L/UI:R/C:L/A:H) by Red Hat; no public exploit code or CISA KEV entry was identified at time of analysis, so exploitation currently requires a locally present hostile search provider rather than remote access.
A locally reachable denial-of-service flaw in Oracle VM VirtualBox 7.2.16 (Core component) lets an attacker who already holds a high-privileged logon on the host crash or repeatedly hang the hypervisor, taking down all hosted virtual machines. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H, base 6.0) confirms the impact is availability-only and confined to already-privileged local users, but the scope-change flag indicates the resulting outage can extend to other workloads running on the same infrastructure. No EPSS score, KEV listing, or public exploit evidence was present in the supplied intelligence, so exploitation status is unknown and the flaw should be treated as a privilege-gated local availability risk rather than a remotely exploitable emergency.
Denial of service in Oracle VM VirtualBox 7.2.16 (Core component) lets a locally logged-on attacker with high privileges hang or repeatedly crash the hypervisor, with the CVSS scope-change metric indicating the disruption can extend beyond VirtualBox to other products on the same host. Exploitation requires logon access to the infrastructure running VirtualBox and high privileges (PR:H, AV:L), so it is an insider/administrator-privileged availability attack rather than a remote one. No public exploit code has been identified and the flaw is not listed in CISA KEV; EPSS data was not supplied with this record.
Denial of service in Oracle VM VirtualBox 7.2.16 allows an attacker who already holds high privileges and can log on to the machine running the hypervisor to crash the product through its Core component, producing a hang or repeatable crash. The flaw is rated CVSS 3.1 6.0 (AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H), so it is purely an availability issue with no confidentiality or integrity impact, but the scope change flag means a successful attack can degrade other workloads running alongside VirtualBox — typically guest VMs and co-resident services. It is not remotely exploitable, no public exploit code or CISA KEV entry was identified at time of analysis, and the affected build is confirmed as 7.2.16 by both the vendor advisory and ENISA EUVD.
Affected versions of Arista EOS can write plaintext TACACS+ shared secrets into a location an operator can read, exposing the secret that protects authentication traffic between the switch and its AAA servers. Exploitation is not remote: it requires a highly privileged local session (CVSS PR:H), a non-default/specific set of circumstances (AC:H), and a user action (UI:R), which is why the score sits at 6.3 despite high confidentiality, integrity, and availability metrics. There is no public exploit code identified and the issue is not listed in CISA KEV, so this is a hardening/credential-hygiene issue rather than an actively attacked one; note that a leaked TACACS+ secret is high-value for lateral movement across network infrastructure.
Cleartext user passwords can be written into Arista EOS log files when specialized, non-standard debugging trace levels are explicitly enabled on the device. Only operators who already hold authenticated local administrative shell access and who have turned on these unusual trace levels are exposed, and a user must actually authenticate while tracing is active for credentials to be recorded. Arista discovered the flaw internally, states it is not aware of any malicious exploitation, and no public exploit code or CISA KEV entry has been identified; vendor advisory SA-0153 documents the fix
Arista EOS switches can write plaintext private keys into log files when specialized, non-standard debugging trace levels are explicitly enabled on the device. Exploitation requires an attacker to already hold authenticated local administrative access to the device shell and to have those special debug trace levels turned on, so the practical exposure is primarily insider or post-compromise rather than remote. Arista discovered the flaw internally (SA-0153), states it is unaware of malicious exploitation in customer networks, and the issue is not listed in CISA KEV and no public exploit code has been identified.
Path-traversal guard bypass in moment.js 2.29.2-2.30.1 allows a remote unauthenticated attacker (in server-side Node.js contexts) to supply a crafted non-string object to moment.locale() that satisfies the string-assuming guard via a custom match() method while its toString() returns a traversal path - delivering attacker-controlled path segments to an internal require() call. This is an incomplete fix for CVE-2022-24785 and is resolved in version 2.31.0; no public exploit has been identified at time of analysis.
The API endpoint exposed by HPE Networking EdgeConnect SD-WAN Gateways can be queried by an unauthenticated remote attacker in a way that returns sensitive information, with successful exploitation yielding data that could be reused to reach other network services. Affected firmware spans the 9.4.x, 9.5.x, 9.6.x and 9.7.0.0 branches, and exploitation is rated high complexity (AC:H) even though no authentication is required. There is no public exploit code identified at time of analysis and the issue is not listed in CISA KEV, so this is currently a targeted-risk disclosure bug rather than a mass-exploitation event.
Unauthenticated remote denial-of-service in HPE Networking EdgeConnect SD-WAN Gateways lets an attacker who can reach the appliance's exposed services interrupt normal operation and take the gateway's services offline, disrupting WAN connectivity for dependent sites. Affected branches are 9.4.0.0–9.4.8.2, 9.5.0.0–9.5.8.1, 9.6.0.0–9.6.3.1 and 9.7.0.0, reported by HPE's own security-alert address. CVSS is 5.9 with a high attack-complexity qualifier and availability-only impact, and no public exploit code or confirmed active exploitation was identified at time of analysis.
DigestAuth replay protection in http4s mishandles the nonce-count it stores, so the server's counter can lag behind the highest value it has actually accepted; a passive network observer who captures one legitimate Digest Authorization header can therefore replay it repeatedly before the counter catches up. Successful replays are executed as the captured user and include state-changing requests, defeating the replay resistance that Digest authentication is supposed to provide over Basic auth. Only applications that explicitly mount the DigestAuth middleware are affected, versions 0.23.x before 0.23.35 and 1.0.0 milestones M1 through M46 are impacted, and the flaw is fixed in 0.23.35 and 1.0.0-M47. No public exploit code or active exploitation has been identified at time of analysis.
The FollowRedirect client middleware in http4s strips Authorization and Cookie headers only when a redirect crosses to a different authority, ignoring URI scheme changes; a same-host redirect from HTTPS to HTTP therefore re-sends credentials in cleartext over the network. Applications using http4s client versions prior to 0.23.35 or 1.0.0-M47 and following attacker-influenced redirects can leak bearer tokens, basic-auth credentials, and session cookies to anyone able to observe the plaintext connection. The flaw is fixed in 0.23.35 and 1.0.0-M47; no public exploit code or CISA KEV entry was identified at time of analysis, and exploitation requires the attacker to influence a redirect target and sit on the network path.
Path traversal in http4s static-content services (ResourceService and WebjarService) before 0.23.35 and 1.0.0-M47 lets remote unauthenticated attackers read classpath or WebJar resources outside the configured base directory by hiding parent-directory sequences behind percent-encoded separators (%2F or %5C). The flaw only bites when the service is mounted on a directory-backed classpath and the underlying backend preserves the encoded separator through to path resolution, which is why NVD scores the attack complexity as High; impact is limited to information disclosure (confidentiality only), with no write or availability effect. No EPSS score, CISA KEV listing, or public exploit code was provided with this report, so active exploitation is unconfirmed at time of analysis, although the public upstream patch commit and its regression tests effectively document a working trigger.
Denial of service in HPE Networking EdgeConnect SD-WAN Gateways lets an authenticated local attacker with low privileges destabilize the appliance operating system and disrupt traffic forwarding. Affected builds span the 9.4.x, 9.5.x, 9.6.x and 9.7.x branches — up to 9.4.8.2, 9.5.8.1, 9.6.3.1 and 9.7.0.0 respectively — and the trigger is both local-only and high-complexity, which keeps the CVSS score at 5.8 despite the High availability impact. No public exploit code or CISA KEV entry was identified at time of analysis, so the practical priority is patch hygiene on devices where local or delegated accounts exist.
Improper input validation in the Android Cellular Modem component lets an attacker who is radio-adjacent to a device crash the modem stack, producing a denial of service against cellular voice and data with no user interaction required. The flaw carries a CVSS 3.1 base score of 5.7 (AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) and is classified as CWE-20; only availability is affected. Google's Pixel/Android security bulletin for September 2026 (2026-09-01) is the vendor reference, but no CISA KEV listing, no public proof-of-concept, and no EPSS data were supplied, so opportunistic mass exploitation is not indicated at time of analysis. Because exploitation is confined to the radio adjacency and the impact is availability-only, this is a moderate-priority hardening item rather than a headline emergency.
Improper authentication in the admin Dashboard controller of PHPGurukul Blood Donor Management System 1.0 lets a remote, unauthenticated attacker reach administrative functionality by calling the controller's constructor route directly, bypassing the login/session check. Successful abuse exposes donor and blood-stock data and allows modification of records, giving low but real confidentiality, integrity and availability impact. Publicly available exploit code exists and the vendor has not published a fixed release, so every internet-facing deployment of version 1.0 should be assumed reachable by automated scanners.
Improper privilege assignment in SourceCodester College Notes Gallery Management System 1.0 allows unauthenticated remote attackers to self-assign elevated roles during account registration by manipulating the `role` parameter in signup.php. An attacker who registers with a crafted request can gain administrative access to the application without authorization. A public exploit has been disclosed, lowering the bar for exploitation significantly.
SQL injection in PHPGurukul Blood Donor Management System 1.0 lets remote attackers inject arbitrary SQL through the fromdate and todate parameters handled by /application/controllers/admin/Report.php, exposing or altering the underlying donor database. Publicly available exploit code exists and the vendor has published no fixed release, so any internet- or intranet-exposed deployment of this teaching/demo application remains vulnerable. CVSS 4.0 base is 5.5 with an exploit-maturity rating of Proof-of-Concept, indicating limited but real opportunistic risk rather than mass exploitation.
A SQL injection in SourceCodester Online Faculty Clearance System 1.0 lets remote attackers manipulate the 'haydi' argument handled by /update_requirement_status.php to inject arbitrary SQL into backend queries. The CVSS 4.0 vector reports AV:N/AC:L/PR:N/UI:N, so exploitation does not require prior authentication or user interaction, and the impact is scored as Low across confidentiality, integrity and availability. Publicly available exploit code exists (referenced via a public GitHub issue and the VULDB submission), and the vendor has published no patch - the product is a downloadable PHP demo application rather than a maintained commercial platform.
SQL injection in SourceCodester/katojkalemba Online Food Ordering System 1.0 allows remote unauthenticated attackers to manipulate the `id` parameter in `/web/order.php` to inject arbitrary SQL, achieving partial read and write access to the underlying database. The CVSS 4.0 vector carries an E:P modifier confirming public exploit code is available, lowering the barrier to exploitation significantly. No vendor patch has been identified at time of analysis, and no CISA KEV listing exists.
SQL injection in SourceCodester Online Food Ordering System 1.0 allows any unauthenticated remote attacker to manipulate the database through the unsanitized `ID` parameter of `/web/category-foods.php`. A public exploit has been released, enabling database extraction, record modification, or deletion without any authentication. No vendor patch has been identified at time of analysis.
Arbitrary host file creation in Podman's `podman load` command lets anyone who can supply a crafted tar archive write files on the host with the privileges of the user running Podman. The flaw (CWE-277, insecure inherited permissions) affects Podman installations where image archives are loaded from untrusted sources, and is scored a moderate CVSS 5.5 because the write primitive is limited to the invoking user's permissions rather than root. No public exploit code and no CISA KEV listing were identified at time of analysis, though the Red Hat advisory and Bugzilla tracker confirm the issue is acknowledged upstream.
A heap-based buffer overflow in the Samsung Escargot JavaScript engine is reachable when a crafted bytecode-cache file is parsed, driven by an integer wraparound (CWE-190) in the string-table length handling inside CodeCacheReader::loadStringTable. Exploitation requires local write access to the engine's bytecode-cache directory (CVSS 5.5, AV:L/PR:L), and the impact is limited to availability - a crash or memory-corruption-induced denial of service with no confidentiality or integrity loss. No public exploit code or CISA KEV listing was identified at time of analysis, and the upstream fix (Samsung PR #1650) adds a bounds check rejecting any maxLength above STRING_MAXIMUM_LENGTH.
Improper access control in the CAX Client component of the Oracle Agile PLM MCAD Connector 3.6 allows a locally logged-on, low-privileged user to read critical Agile PLM data, or all data the connector can reach. The flaw is confidentiality-only (CVSS 3.1 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so it is a post-logon insider/desktop compromise risk rather than a remote pre-auth issue. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; EPSS data was not supplied in the available intelligence.
A locally exploitable information-disclosure flaw in the CAX Client component of Oracle Agile PLM MCAD Connector 3.6 lets any attacker who already holds a low-privileged logon on the host read data they should not be able to reach, including critical PLM content the connector can access. Confidentiality is the only impacted metric (CVSS 3.1 base 5.5, AV:L/PR:L/UI:N/C:H/I:N/A:N), so integrity and availability of the connector are untouched. There is no CISA KEV listing and no public exploit code identified at time of analysis, and Oracle has published a fix through its Supply Chain Critical Security Patch Update.
Authenticated attackers holding Admin privileges on HPE Networking EdgeConnect SD-WAN Gateways can send a crafted request to an API endpoint and trigger a classic buffer overflow (CWE-120), potentially achieving arbitrary command execution on the appliance's underlying operating system. ENISA EUVD lists affected builds across the 9.4.x, 9.5.x, 9.6.x and 9.7.x release branches, with the HPE advisory as the sole authoritative reference. No public exploit code and no CISA KEV entry were reported at time of analysis, and the vendor's 5.5 CVSS score omits any confidentiality impact despite the description claiming full OS-level command execution.
Authenticated administrators of the HPE (Aruba) EdgeConnect SD-WAN Orchestrator web management interface can be tricked into running attacker-supplied script in their own browser session, exposing data handled by the management plane. The flaw is a cross-site scripting (CWE-79) issue rated CVSS 5.5 with a scope change (S:C), meaning the injected code runs in the victim's browser context rather than inside the orchestrator process itself. There is no public exploit identified at time of analysis and the issue does not appear on CISA KEV, but exploitation requires an already-authenticated account, so the practical risk depends heavily on how many privileged accounts exist and how well the UI is network-restricted.
A buffer overflow in the web-based management interface of HPE Networking EdgeConnect SD-WAN Gateways allows an authenticated administrator to crash or destabilize the appliance, producing a denial-of-service condition. All maintenance branches 9.4.0.0 through 9.4.8.2, 9.5.0.0 through 9.5.8.1, 9.6.0.0 through 9.6.3.1, and 9.7.0.0 are affected per ENISA EUVD tracking. The CVSS base of 5.5 with PR:H reflects that high administrative privileges are required, so this is not an unauthenticated remote outage; no public exploit code or CISA KEV listing was identified at time of analysis.
An out-of-bounds read in the Pixel-specific physmem_extmem driver (physmem_extmem_linux.c) of the Android kernel lets a local process with low privileges read kernel memory that was never initialized, exposing potentially sensitive data. No user interaction or elevated execution privileges are required, and the impact is limited to confidentiality (CVSS 5.5, AV:L/PR:L/C:H). The issue is addressed in the September 2026 Android/Pixel security bulletin; no public exploit code or CISA KEV listing was identified at the time of analysis.
An out-of-bounds read in the Android kernel driver routine gf_algo_get_cached_dump_data (gf_algo.c) lets a locally positioned attacker with limited privileges read past the end of a buffer and leak kernel memory contents, with no user interaction required. Pixel builds that ship the vulnerable gf_ driver are affected, and the September 2026 Android/Pixel security bulletin provides the fix. Neither public exploit code nor a CISA KEV entry was present in the supplied intelligence, and no EPSS score was provided, so active exploitation is unconfirmed and the practical threat at time of analysis is a local, post-compromise or malicious-app information leak.
An out-of-bounds read in ReadDataElement (common.c) within the Android platform allows a locally installed application to disclose sensitive memory contents without any additional execution privileges or user interaction. The flaw is a missing/incorrect bounds check on an attacker-influenced length or index value, rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N, C:H/I:N/A:N), so the practical impact is confidentiality loss rather than code execution. Affected builds are Android platform components referenced by the September 2026 Pixel/Android security bulletin; no public exploit code or CISA KEV listing was identified at time of analysis, and the EPSS signal is absent from the supplied data.
A permission bypass in Google Android stemming from a side-channel information disclosure (CWE-203) allows a local attacker holding only low-privileged code execution to escalate privileges without any user interaction. The flaw yields high confidentiality impact (CVSS 5.5, AV:L/AC:L/PR:L/UI:N) by leaking observable discrepancies that undermine permission enforcement, though the vendor vector records no integrity or availability impact. It is addressed in the September 2026 Android/Pixel security bulletin; no public exploit code or CISA KEV listing was identified in the supplied intelligence at time of analysis.
TLS private key exposure in hawtio-operator affects Red Hat Build of Apache Camel - Hawtio 4 deployments on OpenShift. When a custom Route TLS secret is configured and debug logging is set to level 1 or higher, the operator serializes the complete Route object - including the TLS private key in PEM format - to its standard output. Because operator logs are routinely aggregated into centralized logging platforms and are accessible to any principal holding pods/log access in the openshift-operators namespace, this creates a pathway for credential exfiltration without direct secret access. No public exploit code exists and this CVE is not in CISA KEV, but the low debug threshold (level 1) means the exposure is frequently triggered during normal troubleshooting workflows.
Stored XSS in the PublishPress Authors WordPress plugin (all versions through 4.15.0) allows authenticated users holding Author-level access or above to inject persistent malicious scripts via the `profile_fields_user_email_value_prefix` parameter in author box configuration. The injected payload executes in the browser of any site user who clicks the affected author box link, enabling session hijacking, credential theft, or admin account takeover through the browser context of higher-privileged victims. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Oracle Helidon 4.0.0 through 4.5.4 contains an authorization weakness in the helidon-microprofile-security component that allows a low-privileged user with ordinary HTTP network access to read a subset of Helidon-accessible data and to insert, update or delete records they should not reach, with no user interaction required. The defect is trivially reachable (CVSS 3.1 base 5.4, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), meaning any valid low-privilege account is enough to over-reach, though availability is unaffected. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied, so the practical urgency rests on whether the affected microprofile-security module is exposed and whether low-privilege accounts are widely issued.
Authenticated attackers holding only low-privileged credentials in Oracle E-Business Suite can exploit a WebUI flaw in Oracle Product Workbench 12.2.3 through 12.2.15 to read and tamper with application data, provided they can convince another user to interact with a crafted request. The CVSS 3.1 base score is 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), with a scope change meaning downstream components of the E-Business Suite may also be affected. No public exploit code or active exploitation has been identified in the supplied intelligence, and no EPSS score was provided.
Oracle Communications Cloud Native Core Security Edge Protection Proxy (SEPP) versions 26.1.200 and 25.2.201 permit a low-privileged, network-positioned attacker to reach the SEPP over HTTP and read a subset of its accessible data while also updating, inserting, or deleting some of that data. The flaw is rated 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), meaning exploitation needs an existing low-privilege account but no user interaction and no special attack complexity. There is no CISA KEV listing and no public exploit code identified at time of analysis; the issue is addressed through Oracle's Critical Patch Update advisory cspusep2026.
Oracle Fusion Middleware Control 12.2.1.4.0 and 14.1.2.0.0 contain a flaw in the Framework component that lets a low-privileged attacker with HTTP network access trick a privileged user into an interaction that results in unauthorized read and modification of data, with cross-scope impact on other Oracle products. Oracle rates it CVSS 3.1 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), meaning exploitation is easy but gated by an existing low-privileged account and victim user interaction. There is no public exploit code or CISA KEV entry in the provided data, and EPSS is not supplied; treat this as a patch-cycle item rather than an emergency.
Oracle Field Service, a component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, can be compromised over HTTP by a low-privileged attacker who induces another person to interact with a crafted request. Successful exploitation gives the attacker unauthorized read access plus insert, update, or delete capability over a subset of Field Service data, and because the CVSS scope metric is Changed, the impact may extend into additional connected products. There is no public exploit code identified and no CISA KEV listing at time of analysis, so this rates as a moderate-priority patch item rather than an emergency, with a CVSS 3.1 base score of 5.4 reflecting limited confidentiality and integrity loss and no availability impact.
Request smuggling in http4s Ember affects ember-core (server and client) before 0.23.35 and 1.0.0-M47 because the chunked decoder trims chunk-size tokens and accepts leading '+' or '-' signs instead of requiring hexadecimal digits followed by the mandatory CRLF. When Ember runs behind an intermediary that forwards chunked bodies without re-encoding and parses chunk boundaries differently, an unauthenticated attacker can achieve TE.TE request smuggling that bypasses intermediary controls, poisons shared caches, or hijacks queued requests; the same response-path leniency enables response smuggling when ember-client is used as a gateway in front of a malicious or compromised upstream. No public exploit code or CISA KEV entry is associated with this issue at time of analysis, and no EPSS score was supplied in the source data.