Unauthenticated remote attackers with HTTP access can exploit improper authentication in Oracle Hyperion Financial Management 11.2.26.0.000 to read, create, delete, or modify all data accessible through the application. The Security-component flaw carries CVSS 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) and is fully automatable with total technical impact, though no public exploit or active exploitation is identified at time of analysis; exposure is chiefly constrained by whether the HFM web tier is reachable from attacker networks.
Authentication bypass in Oracle Hyperion Data Relationship Management (DRM) 11.2.26.0.000 lets an unauthenticated remote attacker with HTTP access to the DRM web tier read and modify the application's master data without supplying valid credentials. The flaw sits in the 'Access and security' component and carries a CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), meaning no privileges, no user interaction, and low attack complexity are required; availability is explicitly not impacted (A:N). No public exploit code has been identified at time of analysis and the vulnerability is not confirmed actively exploited (CISA KEV), but CISA's SSVC assessment rates it automatable with total technical impact, and EUVD tracks it as EUVD-2026-79784 - making it a high-priority item for any organization exposing DRM beyond a trusted internal network.
Unauthenticated remote attackers can bypass authentication in Oracle Hyperion Data Relationship Management version 11.2.26.0.000 (component: Access and security) to create, delete, or modify critical data and fully access all data accessible through the product via HTTP. This high-severity flaw (CVSS 9.1, CWE-287) requires no authentication, no user interaction, and low attack complexity, though practical exposure is limited to deployments where the DRM web interface is network-reachable. No public exploit code has been identified at time of analysis and it is not confirmed as actively exploited (CISA KEV); the SSVC assessment rates exploitation as none, automatable as yes, and technical impact as total.
High-privileged takeover of Oracle BI Publisher is possible through the BI Platform Security component in versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0, where an attacker who already holds administrative access on the instance can exploit the flaw over HTTP with a Critical CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), taking over the application with full confidentiality, integrity and availability impact. Because the CVSS scope metric is changed (S:C), a successful compromise can extend beyond BI Publisher into additional integrated products rather than being contained by the BI Publisher trust boundary. Exploitation is authenticated and privilege-gated (PR:H) with no user interaction required, so realistic risk is concentrated in deployments where administrative accounts are shared, over-provisioned or reachable from untrusted networks; no public exploit identified at time of analysis.
Takeover of Oracle Agile PLM 9.3.6 is achievable through the Event Java PX component, where an attacker with high privileges and network reachability over T3 or IIOP can fully compromise confidentiality, integrity, and availability while the scope change (S:C) allows significant impact on additional products. The CVSS 3.1 base score is 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), and the dominant real-world limiter is the PR:H requirement - the attacker must already hold an elevated, authenticated role, so realistic exploitation is confined to insiders or adversaries who have already compromised a privileged account. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (the CVE is not in CISA KEV).
Takeover of Siebel CRM Deployment 17.0 through 26.7 is possible for high-privileged attackers via HTTP requests to the Siebel Management Console. Oracle rates this 9.1 Critical with low attack complexity and no user interaction, and a scope change means compromise can affect additional products beyond the vulnerable component. No public exploit or CISA KEV listing was identified in the provided data.
Authentication bypass in the Server Infrastructure component of Oracle Siebel CRM Deployment (supported versions 17.0 through 26.7) lets an unauthenticated remote attacker reach the HTTP interface and take full read/write control of deployment data. The assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (score 9.1) confirms no credentials, no user interaction, and no non-default configuration are required; impact is confined to confidentiality and integrity, so data can be stolen or tampered with but the service cannot be disrupted (A:N). No public exploit code has been identified at time of analysis and CISA SSVC rates exploitation as 'none', though the flaw is rated automatable with total technical impact - making exposure reduction the key control while patching.
Authentication bypass in the Server Infrastructure component of Oracle Siebel CRM Deployment (versions 17.0 through 26.7) lets an unauthenticated remote attacker reach critical CRM data over HTTP and read, create, delete, or modify it at will. Rated CVSS 3.1 base 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) and classified CWE-287, the flaw requires no credentials and no user interaction - the only meaningful barrier is network reachability of the Siebel HTTP interface. No public exploit code exists and there is no confirmed active exploitation (CISA SSVC exploitation: none), but the issue is assessed as automatable with total technical impact, so exposure should be treated as urgent for internet-facing deployments; EPSS data was not provided for this CVE.
Oracle Siebel CRM's Financial Services module (Financial Accounts component) can be compromised by an unauthenticated attacker with network access over HTTP, exposing critical Financial Accounts data and enabling a hang or repeatable crash of the affected service. Supported versions 17.0 through 26.7 are impacted, and the assessed vector (AV:N/AC:L/PR:N/UI:N) indicates exploitation is possible without credentials, user interaction, or non-default configuration, with impact limited to confidentiality and availability (no data modification). No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV); practical exposure is governed mainly by whether the Siebel HTTP endpoint is reachable from untrusted networks, since many deployments are intranet-facing.
Privileged compromise of the Server Infrastructure component in Oracle Siebel CRM Deployment (versions 17.0 through 26.7) allows an attacker who already holds administrative-level access to escalate into a full takeover of the Deployment environment over HTTP. Oracle scores it CVSS 3.1 9.1 with a scope change (S:C), meaning a successful attack can significantly impact additional products reachable from the affected deployment, with high confidentiality, integrity and availability impact. Because the vector requires high privileges (PR:H), this is a post-authentication escalation and lateral-movement risk rather than an anonymous remote compromise; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
Unauthenticated attackers with network reachability to the Siebel CRM Open UI SOAP interface can bypass authentication in Oracle Siebel CRM End User versions 17.0 through 26.7 and obtain full read, create, modify, and delete access to all data reachable through the affected component. Rated CVSS 3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), the flaw requires no credentials, no user interaction, and has low attack complexity, though it carries no availability impact (A:N). No public exploit code and no confirmed active exploitation were identified at time of analysis, so the primary real-world risk driver is whether the SOAP endpoint of a given deployment is exposed beyond trusted networks.
Oracle Application Testing Suite 13.3.0.1 allows an authenticated attacker holding only the low-privilege 'Test Manager for Web Apps' role to obtain unauthorized access to critical data, perform unauthorized inserts, updates, or deletes, and cause a partial denial of service, with a scope change (S:C) indicating that a successful attack can significantly affect other products beyond the tested application. The CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L) reflects low attack complexity and no user interaction over HTTP, but the low-privileged account requirement is the primary limiter - an anonymous or externally unauthenticated attacker cannot exploit this, and exposure is confined to deployments running 13.3.0.1 with the Web Apps test component deployed and network-reachable. No public exploit code or confirmed active exploitation was identified at time of analysis.
High-privileged attackers who already hold administrative access within Oracle Fusion Middleware and can reach Oracle Forms over HTTP can achieve full takeover of the Forms service, with impact extending into other connected products. The flaw affects the Forms Services / Client-Server (C/S) Charmode component in Oracle Forms 12.2.1.19.0 and 14.1.2.0.0, and carries a CVSS 3.1 base score of 9.1 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) with high confidentiality, integrity and availability impact and a scope change - but the PR:H metric is decisive: this is not an unauthenticated remote exploit, no user interaction is needed, and the attacker must already be highly privileged before the attack begins. No public exploit code and no CISA KEV entry were identified from the available intelligence sources at the time of analysis, and no EPSS score was supplied in the source data.
Improper authentication in the Oracle Forms Client/Server (C/S) Charmode runtime allows an unauthenticated, network-reachable attacker to bypass authentication and operate with the data privileges granted to the Oracle Forms application, yielding high confidentiality and integrity impact (CVSS 3.1 base 9.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). Oracle Forms 12.2.1.19.0 and 14.1.2.0.0, as shipped in Oracle Fusion Middleware (Forms Services, C/S, Charmode), are affected; the vector requires no credentials and no user interaction, and there is no availability impact. No public exploit code and no confirmed active exploitation were identified at the time of analysis, and exposure is limited to deployments whose C/S Charmode listener is network-reachable over TCP from an untrusted network.
Full takeover of Oracle Forms is possible in the Forms Services component of Oracle Fusion Middleware for versions 12.2.1.19.0 and 14.1.2.0.0, where an attacker who already holds high privileges on the target and has HTTP network access to the Forms Services listener (including C/S and Charmode deployments) can achieve complete confidentiality, integrity, and availability impact and, because of a scope change, extend that impact to other products in the same deployment. The 9.1 CVSS base score reflects low attack complexity and no user interaction, but the PR:H prerequisite is the dominant limiter - this is not exploitable by an unauthenticated remote actor, so the realistic threat is a privileged insider or an attacker who has already obtained elevated credentials. No public exploit code or evidence of active exploitation (CISA KEV) was identified at time of analysis, and no EPSS score was supplied with the source data.
Takeover of Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 is achievable by an attacker who already holds a high-privilege account on the portal, reaching the Runtime Tools component over HTTP. The flaw is easy to execute once that privileged foothold exists - network vector, low attack complexity, no user interaction required - and its scope-change metric means the fallout can extend into additional Oracle Fusion Middleware products beyond WebCenter Portal itself, with full confidentiality, integrity and availability impact on the portal. The CVSS 3.1 base score is 9.1, but the PR:H prerequisite is the dominant practical constraint: it excludes anonymous and unauthenticated attackers and makes insider abuse or the reuse of stolen administrator credentials the realistic exploitation path. No public exploit code and no confirmed active exploitation were identified at time of analysis, so priority rests on the high severity and low post-authentication effort rather than on observed attacks.
Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebCenter Enterprise Capture. While the vulnerability is in Oracle WebCenter Enterprise Capture, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Enterprise Capture. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
Full takeover of Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 is achievable by an authenticated, high-privileged attacker who can reach the Authentication Engine over HTTP, with a CVSS 3.1 base score of 9.1 due to low attack complexity, no user interaction, and scope change that can affect integrated identity/SSO products. The PR:H prerequisite means this is realistically an insider or post-compromise privilege-abuse path rather than a remote unauthenticated break-in. No public exploit code was identified at time of analysis and no CISA KEV listing is present in the provided intelligence.
Authenticated command injection in the command-line interface of HPE Aruba EdgeConnect SD-WAN Gateways allows an attacker who already holds high-privileged CLI credentials to break out of the appliance shell and execute arbitrary commands on the underlying operating system, resulting in complete compromise of the gateway. The flaw affects the 9.4.x, 9.5.x, 9.6.x and 9.7.x maintenance streams (9.4.0.0–9.4.8.2, 9.5.0.0–9.5.8.1, 9.6.0.0–9.6.3.1 and 9.7.0.0) and carries a vendor-assigned CVSS of 9.1 with a scope change from the CLI component to the host OS. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied, so the practical priority is driven by exposure of the management CLI rather than by evidence of active exploitation.
Improper authentication in the Portlet Services component of Oracle WebCenter Portal allows unauthenticated attackers with HTTP network access to the portal to bypass authentication and gain read and write access to all portal-accessible data, including the ability to create, delete, or modify critical content. Only versions 12.2.1.4.0 and 14.1.2.0.0 of this Oracle Fusion Middleware product are affected, and the flaw is rated high severity (CVSS 3.1 base 9.1, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) with no availability impact. No public exploit code and no confirmed active exploitation were identified at time of analysis, so exploitation risk is driven primarily by internet or broad-network exposure of an unpatched portal.
Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 contain a flaw in the Authentication Engine component that lets a high-privileged attacker with HTTP network access fully compromise the product, taking over the authentication service itself (CVSS 3.1 base 9.1, AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). Because the score includes a scope change (S:C), a successful attack can spill over and significantly impact other products and applications that rely on OAM for authentication, turning a single privileged compromise into a broader identity-layer incident. The critical caveat is the PR:H prerequisite: this is a post-authentication, privileged-abuse issue rather than an unauthenticated remote takeover, so realistic exposure centers on malicious insiders, stolen or misused administrative credentials, or chained privilege-escalation paths. No public exploit code or confirmed exploitation was identified at time of analysis, and the weaknesses make it a priority for patch cycles rather than emergency internet-facing response.
Unauthenticated remote attackers can bypass authentication in Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0, gaining full read and write access to all data managed by the affected component. This easily exploitable vulnerability (CVSS 9.1) requires only network access to the OAM authentication engine over HTTP and no credentials or user interaction. No public exploit code or active exploitation has been observed at the time of analysis, but the lack of authentication and high impact make it a critical risk for exposed instances.
Authentication bypass in BookStack social login (all versions before 26.05.5) allows unauthenticated attackers to sign in as arbitrary users, enabling full account takeover of both regular accounts and administrators. The flaw is a provider-confusion bug in SocialAuthService::handleLoginCallback, which retrieves linked-account records by driver_id while ignoring the driver column, so an attacker who authenticates at one enabled social provider using a user ID that collides with a victim's driver_id under a different provider is accepted without credential verification. No public exploit identified at time of analysis (CISA SSVC exploitation: none; no KEV listing), and successful exploitation requires two enabled social providers sharing an overlapping driver_id namespace plus attacker control of a matching provider account, which is why vendor scoring lands at CVSS 9.1 while our independent vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) caps the attack at high complexity.
Code execution is possible on Dell SmartFabric OS10 switches running versions prior to 10.6.1.3 because the platform downloads code and software images without validating their integrity (CWE-494), so a high-privileged administrator - or an attacker who has already hijacked such an account - can make the device fetch and execute attacker-supplied code. The vendor rates this 9.1 using CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, but the flaw is explicitly not pre-authentication: remote network reachability to the management plane plus existing administrative credentials are mandatory, which is why CISA's SSVC assessment records Exploitation: none, Automatable: no, and Technical Impact: total, and no public exploit was identified at time of analysis. Dell has released a fixed build, OS10 10.6.1.3, under advisory DSA-2026-343.
Unauthenticated remote attackers who can reach the HTTP interface of Oracle Forms Services in a Client/Server, Character mode (C/S, Charmode) deployment can potentially achieve full takeover of the affected Oracle Forms instance on versions 12.2.1.19.0 and 14.1.2.0.0. The assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, base 9.0) reflects complete confidentiality, integrity and availability impact plus a scope change, meaning a successful compromise can materially affect products beyond Oracle Forms itself; however, the High attack complexity rating means exploitation is difficult and depends on a condition outside the attacker's direct control, which limits reliability and mass exploitation. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV) - real-world exposure is confined to environments running the affected Forms Services C/S Charmode component with its HTTP listener reachable by the attacker.
Server-Side Request Forgery (SSRF) vulnerability in Slab safeurl allows an attacker who controls a validated URL to reach internal network destinations the library is configured to block. Only IPv4 addresses are matched against the reserved ranges and the blocklist. Every other address is treated as matching nothing, so a destination that is rejected in its IPv4 form is accepted when written as an IPv6 address, IPv6 entries in the blocklist never match, and a host that resolves to no IPv4 address is accepted regardless of where it points. Deployments that rely on the allowlist instead are unaffected, because there an unmatched address is rejected. This issue affects safeurl: from 0.1.0 onward.
Server-side request forgery protection bypass in Slab safeurl (Elixir) 0.1.0 and later lets an attacker who controls authoritative DNS for a submitted hostname reach internal network destinations that validation had rejected. The library validates one DNS lookup but returns only a verdict rather than the approved address, so the bundled HTTPoison client resolves the original hostname a second time at request time and can be steered to a blocked internal IP. Exploitation is conditional - the attacker must control DNS for the name, win the resolution race, and the host application must route user-influenced URLs through safeurl (assessed CVSS:3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N, high confidentiality impact); no public exploit code or confirmed active exploitation was identified at time of analysis, and the same race can occur non-maliciously with short-TTL or rotating DNS records.
Authenticated remote code execution affects Flowise versions before 3.1.4 through a validation bypass in MCP server configuration nodes: the path validation routine inspects the clean filename passed in the args array but never checks the cwd (working directory) parameter, so an account able to create or modify an MCP server node can point the working directory at attacker-controlled content and have the spawned process execute it. Publicly available exploit code exists, and the independent assessment rates the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (vendor score 9.0 under CVSS 4.0), meaning full confidentiality, integrity and availability loss once the low-privileged authentication prerequisite is satisfied. No CISA KEV entry confirms active exploitation at time of analysis, and CISA's SSVC decision marks the issue as not automatable, so real-world risk concentrates in deployments where ordinary user accounts can define or edit MCP server configuration.
Authenticated remote code execution in Flowise versions before 3.1.4 lets a low-privileged user who can create or edit a Custom MCP node run arbitrary code on the Flowise server by supplying attacker-controlled npm package names in the mcpServerConfig parameter, which Flowise then invokes through npx. The issue carries a vendor-published CVSS 4.0 score of 9.0, while our independent assessment rates it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8), reflecting that the attacker must first hold a valid Flowise account with access to the node editor - no pre-authentication path was identified. No public exploit code was identified at time of analysis and the vulnerability has not been confirmed actively exploited (no CISA KEV listing), so risk is driven mainly by how many users can reach the MCP node configuration UI and whether the instance is internet-facing or uses weak or shared credentials.
Ar
OS command injection in the Lite-On FlexFi 5G radio products FF-RFI079I4 and FF-RFI078I4 allows anyone who can authenticate to the device's M-Plane (NETCONF) management interface to run arbitrary operating-system commands with the privileges of the management service, leading to full compromise of the radio unit. Affected firmware is version 02.01.15 and earlier; Lite-On has released a fix. EPSS is low (1.03%, 62nd percentile) and CISA's SSVC rates exploitation as 'none' with automatable 'no', so this is currently a targeted-risk rather than a mass-exploitation issue, with no public exploit identified at time of analysis.
Arbitrary command execution in the npm TypeScript package praisonai (versions 1.5.1 through 1.7.1) allows an attacker who can influence the string passed to the exported shell() helper to break out of its read-only allowlist by prefixing an approved command and appending a second one with shell chaining syntax such as 'echo ok; <payload>'. Because utility-tools.ts validates only the first whitespace-delimited token and then hands the complete original string to Node's child_process.exec(), the injected command runs with the PraisonAI process privileges. The flaw is fixed in 1.7.2; the advisory includes a deterministic local proof-of-value, and there is no CISA KEV listing or EPSS data indicating active exploitation at time of analysis.
Oracle Business Intelligence Enterprise Edition (8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0) exposes an unauthenticated, network-reachable flaw in the Analytics Web General component that lets an attacker read and tamper with critical data and degrade service availability, with the impact extending beyond the vulnerable product itself (scope change). Oracle rates it 8.9 but flags it as difficult to exploit, meaning the high attack complexity — not missing credentials or user interaction — is the main barrier. No public exploit code and no CISA KEV listing were identified at time of analysis.
Approval bypass in PraisonAI's TypeScript agent loop (npm package 'praisonai' 1.4.0 through 1.7.1) causes executable tool handlers to run inside generateText() before the onToolCall approval callback is consulted, so a tool that the application policy rejects has already performed its file, shell, API, or data-modifying side effects. Applications that treat onToolCall as a human or policy approval boundary can therefore be steered — typically by prompt injection through untrusted model input — into executing denied operations, while the library still reports finishReason 'tool_rejected'. The vendor fixed the ordering flaw in 1.7.2; a deterministic local proof-of-concept exists, EPSS is only ~0.44% (37th percentile) and the issue is not in CISA KEV.
Memory corruption via use-after-free in Microsoft Edge (Chromium-based) lets a remote attacker run arbitrary code at elevated privilege in the browser and ultimately on the host, provided the victim opens attacker-controlled content. Microsoft scores it 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), so no credentials are needed but a single user visit is — a classic one-click browser exploitation pattern rather than a zero-click worm. The intelligence feed contains no EPSS score, no CISA KEV listing, and no public exploit reference, so at time of analysis this is a high-severity but not yet observed-exploited issue.
Heap-based buffer overflow in Microsoft Edge (Chromium-based) versions 1.0.0.0 through 153.0.4234.32 allows remote attackers to execute arbitrary code in the browser by getting a victim to load attacker-controlled web content. The flaw carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning no authentication or privileges are needed but successful exploitation requires user interaction such as visiting a crafted page or opening malicious content rendered by Edge. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but a vendor patch is available from Microsoft and the affected range is bounded precisely by the fixed build, so exposure is limited to unpatched or unmanaged installations.
Use-after-free in the V8 JavaScript engine of Google Chrome desktop builds prior to 153.0.8010.47 allows unauthenticated remote attackers to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. Because the CVSS vector is PR:N/UI:R, no credentials or special browser configuration are required, but the victim must actively navigate to attacker-controlled content; the memory-corruption primitive is confined to the renderer process, so full host compromise would require a second, independent sandbox-escape vulnerability. No public exploit code has been identified at time of analysis, and the vendor has released a fixed build, making this a high-priority patch item rather than a confirmed active-exploitation emergency.
Type confusion in Chrome's CacheStorage implementation in builds prior to 153.0.8010.47 lets a remote, unauthenticated attacker execute arbitrary code inside the browser's renderer sandbox when a victim loads a crafted HTML page. The bug is rated High by Chromium and 8.8 by NVD (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), but it is a renderer-level compromise rather than a sandbox escape, so host impact requires chaining a second vulnerability. No CISA KEV listing and no public exploit code were identified at time of analysis, and no EPSS score was supplied in the input data.
Remote code execution inside the renderer sandbox can be triggered in unpatched Google Chrome builds by a use-after-free in the browser's built-in PDF rendering component. Exploitation is unauthenticated (CVSS PR:N) but requires the victim to open a crafted HTML page that embeds malicious PDF content (UI:R), and any resulting code execution is confined to Chrome's renderer sandbox - meaning this bug alone does not compromise the host and would typically need to be chained with a separate sandbox-escape flaw for full system compromise. A vendor patch is available in Chrome 153.0.8010.47; no public exploit code has been identified at time of analysis and there is no CISA KEV listing, though the 8.8 CVSS score and the ubiquity of Chrome make timely patching a priority.
Use-after-free in Chrome's DOM implementation allows a remote attacker to execute arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page in Chrome versions prior to 153.0.8010.47. The flaw carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and is rated High by Chromium security severity; a vendor patch is available and no public exploit code or CISA KEV entry was identified at time of analysis.
Remote code execution inside the renderer sandbox affects Google Chrome desktop builds prior to 153.0.8010.47, caused by a type confusion flaw in the browser's compositing pipeline (CWE-843) that is reachable from a crafted HTML page. An attacker needs only to convince a user to load the page: the CVSS 3.1 vector is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), so no credentials or privileges are required, but user interaction is mandatory. Google rates the issue Chromium security severity High and has shipped a fixed stable-channel build; no public exploit code or CISA KEV listing appears in the supplied intelligence, and no EPSS score was provided, so the current exploitation picture is best described as patch-now-but-not-known-exploited.
Use-after-free in Google Chrome's Input handling allows a remote attacker to achieve code execution in affected desktop builds prior to 153.0.8010.47. Exploitation is unauthenticated (PR:N) but requires the victim to render attacker-controlled HTML (UI:R), making drive-by or malicious-page delivery the primary vector; default configurations are affected with no non-default prerequisites. The vulnerability is rated CVSS 8.8 (C:H/I:H/A:H) and a vendor patch is available in the Stable channel build 153.0.8010.47; no public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing).
A use-after-free in Google Chrome's Internals component allows a remote attacker to potentially execute arbitrary code outside the browser sandbox when a victim opens a crafted HTML page, affecting all Chrome builds prior to 153.0.8010.47 on desktop. Exploitation requires user interaction (visiting the page) but no authentication or elevated privileges, and Google rates the Chromium security severity as Critical. Vendor-released patch: 153.0.8010.47. There is no public exploit code identified at time of analysis and no confirmed actively exploited (CISA KEV) status, though the SSVC framework assigns total technical impact.
Type confusion in Chrome's ServiceWorker implementation allows a remote attacker to achieve arbitrary code execution inside the renderer sandbox by enticing a victim to load a crafted HTML page in any Chrome build prior to 153.0.8010.47. Exploitation is unauthenticated (PR:N) but requires user interaction (UI:R) - the victim must visit or be redirected to attacker-controlled content - and the resulting code execution is confined to the sandbox (S:U), so full host compromise would require chaining a separate sandbox-escape flaw. There is no public exploit identified at time of analysis, and a vendor-released patch (153.0.8010.47) is available, making this a high-priority but practically bounded patching task rather than an urgent zero-day response.
Type confusion in Google Chrome's ServiceWorker implementation before version 153.0.8010.47 allows a remote attacker to achieve arbitrary code execution inside the renderer sandbox by getting a user to open a crafted HTML page. The flaw carries a CVSS base score of 8.8 (AV:N/AC:L/PR:N/UI:R), the classic memory-corruption profile for Chrome renderer bugs, and Google rated it High in its Chromium severity scheme. A vendor patch shipped in the 153.0.8010.47 stable release, and there is no public exploit code identified and no CISA KEV entry at time of analysis, so this is a prioritise-and-patch issue rather than a confirmed active campaign.
Authenticated low-privileged attackers who can reach the SQL-facing surface of Oracle Hyperion Financial Management 11.2.26.0.000 can achieve complete takeover of the application. Oracle's advisory rates this 8.8 with full confidentiality, integrity, and availability impact, and the flaw is described as easily exploitable with no user interaction required. At the time of analysis there is no public exploit code, no CISA KEV listing, and no EPSS score in the supplied intelligence, so this should be treated as a high-severity, patch-now issue rather than a known active campaign.
Oracle Hyperion Financial Management 11.2.26.0.000 can be fully taken over by an authenticated, low-privileged attacker who reaches the application over the network via HTTP and exploits a flaw in its Security component. Oracle's advisory rates it 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), describing it as easily exploitable with complete loss of confidentiality, integrity and availability. No EPSS score, CISA KEV entry, or public proof-of-concept was supplied in the available intelligence, so active exploitation is unconfirmed; the only vendor reference is the Oracle Critical Security Patch Update advisory.
A low-privileged attacker with network access over HTTP can fully compromise Oracle Hyperion Financial Management 11.2.26.0.000, achieving complete loss of confidentiality, integrity, and availability of the application (CVSS 3.1 base 8.8). The defect resides in the product's Security component and requires only a valid low-privileged account, with no user interaction, making it straightforward to automate once an attacker has a foothold. There is no public exploit identified at time of analysis and no CISA KEV listing, but Oracle's Critical Security Patch Update advisory is the authoritative source for the fix.
Low-privileged authenticated attackers with HTTP network access can exploit the Security component of Oracle Hyperion Financial Management 11.2.26.0.000 to fully take over the application, with high impact to confidentiality, integrity and availability. Oracle scores the flaw 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation is low-complexity once a valid low-privilege account exists, and a fix is published through Oracle's Critical Patch Update process. No public exploit code or CISA KEV entry has been identified at the time of analysis, and no EPSS score was supplied.
Authenticated low-privileged attackers with HTTP access can fully compromise Oracle Hyperion Financial Management 11.2.26.0.000 through a flaw in the product's Security component, gaining complete control of confidentiality, integrity and availability (CVSS 8.8). The issue is easily exploitable once a valid account exists — low complexity, no user interaction — and results in takeover of the HFM application rather than a limited data leak. No EPSS score, CISA KEV entry, or public exploit code was present in the supplied intelligence, so active exploitation is not confirmed and no public exploit code was identified at time of analysis.