adm-zip 0.5.14 through 0.6.0, a widely used Node.js ZIP library, omits zlib decompression output limits whenever a ZIP entry declares an uncompressed size of zero, letting a tiny crafted archive inflate without bound and exhaust the host process memory. Any service that extracts attacker-supplied archives with an affected version — upload endpoints, import jobs, CI tooling — can be crashed by a few kilobytes of input, with no authentication or user interaction required per the CVSS 4.0 vector (PR:N/UI:N, VA:H only). No CISA KEV listing, EPSS score, or public exploit code was supplied at time of analysis, but the fix commit and diff are public and the technique is trivial to reproduce.
Docker Sandboxes 0.37.0 through 0.40.x contain a time-of-check/time-of-use race (CWE-367) in the guest-to-host Unix-domain socket relay: the host validates that a requested socket path sits inside an authorized workspace and then reconnects using that same pathname, letting a malicious guest swap an intermediate directory for a symlink in the gap. A guest that wins the race causes the host-side relay to connect to an arbitrary AF_UNIX socket outside the shared workspace, exposing whatever data or host capabilities that socket provides. Vendor-released fix: Docker Sandboxes 0.41.0; no public exploit code or CISA KEV entry was identified at time of analysis.
Hard-coded credentials in the FTP daemon (ftpd) shipped with multiple Digital Watchdog video recorders and NVRs-including VG4 Recorder, VMAX IP G4 NVR, VMAX A1 PLUS, VA1G4 Recorder, and VMAX A1 G4 DVR-let anyone who can reach the FTP service log in and operate the daemon as root. Because the ftpd runs as root, a successful login grants remote read and write access to the device filesystem, allowing an attacker to tamper with recorded surveillance video, alter device configuration, or use the box as a foothold on the camera VLAN. The flaw is rated 8.7 (CVSS 4.0, adjacent network, no privileges or interaction required), giving it a wide attack surface on flat camera networks. No public exploit code or CISA KEV entry was identified at time of analysis, so exploitation would currently require an attacker already positioned on the adjacent network segment.
Unauthenticated attackers positioned on an adjacent network segment can gain root-level control of Digital Watchdog VMAX A1 PLUS, VMAX A1 G4, VA1G4 and VG4 recorders and VMAX IP G4 NVRs, because a critical function performs no authentication and forwards received bytes straight into a system command. CWE-306 combined with that unsafe command handling gives full loss of confidentiality, integrity and availability on the device and on any footage, stored credentials or downstream network reachable through it. Neither public exploit code nor a CISA KEV entry appears in the supplied intelligence, so active exploitation is not confirmed, but the CVSS 4.0 base score of 8.7 reflects the near-trivial effort once adjacency is achieved.
Improper access control in Oracle Hyperion Financial Management 11.2.26.0.000 lets an attacker who already holds high privileges and can reach the application over the network submit crafted SQL to read, create, delete, or modify critical financial consolidation data. The CVSS 3.1 base score is 8.7 with a scope change, meaning a successful attack can extend beyond the HFM component into interconnected products that share credentials or database access. Oracle shipped a fix in its September 2026 Critical Security Patch Update, and no public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated attackers who can reach the Oracle Hyperion Financial Management 11.2.26.0.000 Security component over HTTPS can bypass its authentication controls and gain read and write access to critical financial data, with the exploit's impact crossing into other integrated Oracle EPM products (scope change). Oracle rates this CVSS 3.1 8.7 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N), explicitly noting it is difficult to exploit; no public exploit code or CISA KEV entry was present in the supplied intelligence, and no EPSS score was provided. The practical concern is data integrity and confidentiality of consolidation records rather than remote code execution, since availability impact is rated None.
Oracle BI Publisher — the reporting and publishing component of Oracle Analytics — is exposed in versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0 to an easily exploitable flaw that lets a low-privileged, authenticated user reach the application over HTTP and, once a victim is persuaded to interact, obtain full read and write access to critical BI Publisher data. The CVSS 3.1 base score of 8.7 reflects high confidentiality and integrity impact plus a scope change that allows the compromise to spill over into additional, connected Oracle products. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied, so the practical urgency currently rests on Oracle's criticality rating rather than observed exploitation.
Low-privileged attackers with network access to the Siebel Apps - Customer Order Management module (Order Management component) in Oracle Siebel CRM versions 17.0 through 26.7 can craft HTTP requests that, once a second user is induced to interact, allow unauthorized read, creation, modification, and deletion of critical order data, with a scope change that can propagate impact to connected products. The flaw carries a CVSS 3.1 base score of 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N), but no EPSS score, CISA KEV listing, or public exploit code was provided in the source data, so active exploitation is not confirmed (no public exploit identified at time of analysis). It is an easily exploitable, low-complexity issue, making patch deployment a high priority for any organization running an affected Siebel release.
Low-privileged abuse of the Order Management component in Oracle Siebel CRM (Siebel Apps - Customer Order Management, versions 17.0 through 26.7) allows an authenticated network attacker to create, delete, or modify critical order data and to read data beyond their authorization, provided a victim user is persuaded to interact with attacker-supplied content. The flaw is rated CVSS 3.1 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) on the strength of its high confidentiality and integrity impact and its scope change, which means a successful attack executed in the victim's context can reach additional connected Oracle products; there is no availability impact. Despite the 'Authentication Bypass' tag applied by the reporter, the assessed vector confirms a valid low-privileged account is required and there is no pre-authentication path, and no public exploit code has been identified at time of analysis - the practical risk is therefore conditional on phishing a different, typically higher-privileged user into viewing or acting on crafted order-management content.
Oracle iStore, the e-commerce/shopping cart module of Oracle E-Business Suite versions 12.2.3 through 12.2.15, is exposed to a cross-site style attack in which a low-privileged authenticated attacker with HTTP network access can induce a second user to interact with crafted content and thereby gain unauthorized read, create, modify, and delete access to iStore data — with the vendor warning the impact can extend to other EBS products. With CVSS 3.1 base 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N), the flaw is trivially automatable once an attacker holds any low-privileged account, but exploitation still hinges on victim interaction, which materially lowers real-world risk. No public proof-of-concept, EPSS estimate, or CISA KEV entry was present in the supplied intelligence, so exploitation is assessed as not confirmed in the wild at time of analysis.
Authentication bypass in the Core component of Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0 allows a remote, unauthenticated attacker who can reach the connector's TCP listener to read and modify the identity data it manages, with Oracle explicitly noting the attack may also significantly impact connected downstream products (scope change). Oracle scores it 8.7 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N) while describing it as difficult to exploit, so the flaw is reachable without credentials but is not trivially automatable. The supplied intelligence contains no EPSS score, no CISA KEV entry, and no evidence of public exploit code at time of analysis.
Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0 contain a flaw in the Authentication Engine component that lets a high-privileged, network-positioned attacker read, create, delete, or modify data managed by the OAM deployment — and because the flaw crosses a security scope boundary, downstream applications that trust OAM for identity can be affected as well. The CVSS 3.1 base score is 8.7 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N), reflecting an easily triggered but credentialed attack with high confidentiality and integrity impact and no availability impact. No public exploit code, EPSS score, or CISA KEV listing is present in the supplied intelligence, so it is treated as not yet publicly exploited at time of analysis; Oracle ships fixes through its Critical Patch Update / Security Alert program referenced in the advisory link.
HTTP request smuggling in http4s Ember (all releases prior to 0.23.35 and 1.0.0-M47) lets an unauthenticated remote attacker bypass front-end proxy controls by sending duplicate Content-Length headers with differing values, because the Ember HTTP/1.1 parser accepts the conflict and frames the message using the last value instead of rejecting it as a framing error. When Ember runs behind a keep-alive intermediary that selects a different occurrence, the attacker can prepend a smuggled request to a later user's connection, capture that user's headers, or poison a shared cache; the same shared parser can also misframe upstream responses when an http4s client proxies for multiple downstream consumers. No public exploit code or CISA KEV entry was identified at time of analysis, but the CVSS 8.7 scope-changed rating makes this a priority fix for exposed Scala services sitting behind reverse proxies, CDNs, or load balancers.
Let me synthesize. CVE-2026-69205: http4s Ember HTTP parser request smuggling via Transfer-Encoding header case-sensitivity and charset decoding issues. Key facts: - http4s Ember (Scala HTTP library), prior to 0.23.35 and 1.0.0-M47 - CWE-444 (Inconsistent Interpretation of HTTP Requests / request smuggling) - CVSS 8.7, CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N - No EPSS given, no KEV, no explicit POC. - Patch: 0.23.35 and 1.0.0-M47, commit 5e88b2e7b4e6ea2f0c61040a4bc9de0d73e51217 - Tags: Information Disclosure, Request Smuggling, Http4S Fields to output. Let me write carefully. Product name: "http4s Ember" — 1-3 words. "http4s" is one word. Maybe "http4s Ember". That's fine. Summary: must not start with "A vulnerability". Start with impact. E.g., "HTTP request smuggling in http4s Ember (0.23.x before 0.23.35 and 1.0.0 milestones before M47) allows attackers to desynchronize HTTP/1.1 framing between Ember and intermediary proxies..." Note S:C (scope changed) with C:H/I:H/A:N. Affected products: http4s Ember before 0.23.35, 1.0.0-M47. CPE cpe:2.3:a:http4s:http4s:*:*:*:*:*:*:*:*. Advisories GHSA-9998-894r-fwvr, releases. Remediation: upgrade to 0.23.35 or 1.0.0-M47; the fix decodes header bytes as ISO-8859-1 and rejects any transfer coding token other than "chunked" case-insensitively; workaround: reject/rewrite ambiguous Transfer-Encoding at reverse proxy, strip Transfer-Encoding, disable chunked, use HTTP/2 end-to-end. Note side effects: strict rejection of unknown transfer codings may break clients sending e.g. "gzip, chunked" or "identity" — actually the fix rejects any Transfer-Encoding other than chunked, including "identity"? codings split by ',' and all must equalIgnoreCase("chunked"). So "identity" would be rejected. Side effect: legitimate clients sending multiple codings will get errors. Note Ember is both server and client (ember-client). Response smuggling requires malicious upstream. Exploitation conditions: Requires Ember-based server behind
An arbitrary file read flaw in the J2Store e-commerce extension for Joomla (versions 1.0.0–3.3.2, 4.0.0–4.0.22 and 4.1.0–4.1.7) lets anyone holding a valid download token/pid pair for a product download retrieve files outside the configured attachment folder. The J2StoreModelOrderdownloads::getFilePath() routine builds the on-disk path by concatenating the attachments directory with the stored product_file_save_name and only runs JPath::clean() plus JFile::exists(), so a ../ segment in that stored value resolves outside the folder and exposes files such as configuration.php to the web server's read permissions. No public exploit code and no CISA KEV listing were identified at time of analysis, but a CVSS 4.0 base score of 8.7 (VC:H, AV:N, PR:N) makes this a serious confidentiality risk for exposed J2Store storefronts.
Unauthenticated blind SQL injection in the J2Store e-commerce extension for Joomla allows remote attackers to extract arbitrary database contents — including customer records, order data, and stored credentials or tokens — from any publicly reachable storefront that exposes the standard product listing or product-tags filter. Affected builds span the 1.x, 3.x, 4.0.x and 4.1.x lines (1.0.0–3.3.2, 4.0.0–4.0.22, 4.1.0–4.1.7), and the CVSS 4.0 vector indicates network-reachable exploitation with no authentication and no user interaction (PR:N/UI:N) for a high confidentiality impact. No public exploit code, EPSS score, or CISA KEV entry was supplied in the intelligence feed, so active exploitation is currently unconfirmed.
Unauthenticated order-state tampering in the J2Store e-commerce extension for Joomla (versions 1.0.0–3.3.2, 4.0.0–4.0.22, and 4.1.0–4.1.7) lets anyone mark any order as FAILED without supplying a payment amount, transaction ID, or any other verification data. An attacker can mass-fail pending orders to disrupt revenue, or flip already-fulfilled orders back to FAILED, triggering unwarranted refunds, cancellations, and customer-support load. The CVE carries a CVSS 4.0 score of 8.7 driven entirely by high integrity impact; no public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis.
URL path injection in the Lokka MCP server for Microsoft 365 (versions prior to 2.1.2) allows a crafted path value passed to the Lokka-Microsoft tool to break out of the management.azure.com base URL, causing a valid Azure Resource Manager bearer token to be transmitted to an attacker-controlled host. The flaw is a classic server-side request forgery / token-exfiltration pattern (CWE-918) caused by string concatenation instead of the standard URL API when building ARM request URLs. The vendor fixed it in 2.1.2 by validating Azure paths and composing URLs via the URL constructor; no public exploit code or CISA KEV entry was identified in the provided intelligence, so exploitation is currently assessed as requiring attacker-controlled input (for example indirect prompt injection) into the tool's path argument.
Unauthenticated user enumeration in Concrete CMS 9.0.0 through 9.5.2 allows any anonymous visitor to dump the complete backend account list — including internal user IDs, usernames and email addresses of every administrator and the super-administrator (user ID 1) — by sending an empty search to the /ccm/system/user/autocomplete endpoint and paginating the results. The endpoint enforces only a CSRF-style token that is bound to the selector's display options rather than to caller identity, and that token is handed out to anonymous visitors, so there is no authentication or privilege barrier to clear. No password hashes or session material leak, but the disclosed email and account inventory is a ready-made target list for credential stuffing, phishing and password-spray campaigns against named admins; no public exploit code and no CISA KEV entry are present in the supplied intelligence.
Authorization bypass flaws in the 'Design Scuole Italia' WordPress theme (design-scuole-wordpress-theme, versions up to and including 2.17.3) let an unauthenticated remote attacker reach content and data that should require a logged-in, authorized user. The faulty routines are the dsi_pdf_generator and dsi_csv_generator functions, and an unauthenticated RSS feed at /circolare/feed/ gives an additional, easily scriptable path to the same restricted 'Circolare' records and registered-user information. With a CVSS 4.0 base score of 8.7, no privileges or user interaction required, and high confidentiality impact, this is a straightforward data-exposure bug in a theme deployed mainly on Italian school websites; no public exploit code or CISA KEV entry was identified at time of analysis.
Memory amplification denial of service in the Tornado Python web framework before 6.5.8 lets unauthenticated remote attackers exhaust server memory with a single crafted multipart/form-data request containing tens of thousands of parts — roughly 600KB of body is enough to build a 100,000-element transient list. Tornado's parse_multipart_form_data splits the body on the boundary before it enforces the max_parts limit, so the safety check fires only after the expensive allocation has already happened. Publicly available exploit code exists (a gist with poc.py), patch status is 'available from vendor' with the fix shipped in 6.5.8, and no CISA KEV listing or EPSS score accompanied the supplied intelligence.
Arbitrary file read in atomic-agents-stack before 1.1.0: the optional dashboard HTTP server builds filesystem paths straight from the request path, so unauthenticated remote attackers can send '../' segments to DashboardHandler.do_GET and read files outside the intended agents_root directory. The flaw affects all versions through 1.0.0 and is fixed in 1.1.0; the dashboard is off by default and binds to loopback, but an operator-set --host of 0.0.0.0 exposes it to the LAN, and even loopback deployments are reachable via DNS rebinding or SSRF from a co-located service. No public exploit code or active exploitation has been identified at time of analysis.
Vikunja prior to 2.6.0 leaks the secret hash that backs a project's link shares through its single-share read endpoint, so any authenticated user holding only read-only membership in a project can read the credential that is supposed to be reserved for the link itself. Because that hash can be exchanged for a link-share JWT carrying the share's own permission level, the disclosure becomes a privilege-escalation primitive: if the leaked share was created with write or admin rights, the attacker inherits them and can modify tasks, projects, or administrative settings. The issue is fixed in 2.6.0 per the vendor advisory, and no CISA KEV listing, EPSS score, or public exploit code was present in the supplied intelligence at time of analysis.
Vikunja instances before 2.6.0 expose CalDAV BasicAuth endpoints (/dav, /.well-known, and /feeds) that are not covered by the application's anti-brute-force controls, letting a remote unauthenticated attacker send an unlimited number of credential-guessing requests. Successful guessing against password-only accounts yields full read access to the victim's tasks, projects, and feeds data. The vendor has released 2.6.0 as the fix; no public exploit code or active exploitation has been confirmed in the supplied intelligence.
Vikunja versions before 2.6.0 ship authentication endpoints under /api/v2 (login, register, password-reset, and OAuth token issuance) with no rate limiting, so remote unauthenticated attackers can hammer them with unbounded requests to guess credentials, enumerate accounts, and flood mailboxes with password-reset messages. The exposure is a confidentiality problem — the supplied CVSS 4.0 vector rates high impact to data confidentiality but none to integrity or availability — and a vendor patch exists in 2.6.0. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, so this is best treated as a hardening gap that becomes serious the moment an instance is reachable from untrusted networks.
Unauthenticated attackers can pull restricted live-stream metadata - including RTMP stream keys, stream titles, descriptions, owner details, and direct HLS playback URLs - from two JSON endpoints in the AVideo Live plugin (plugin/Live/stats.json.php and plugin/Live/calendar.json.php) in all versions up to and including 29.0. The endpoints fail to enforce the platform's user-group access restrictions, so content intended only for members of a specific group is exposed to anyone who can reach the server. No public exploit code or CISA KEV entry was identified at time of analysis, but the flaw is trivially automatable over the network with no credentials or user interaction, and CVSS 4.0 rates it 8.7 with high confidentiality impact.
Heap-based buffer overflow in FreeRDP client versions before 3.31.0 allows a malicious or compromised RDP server to corrupt client memory by sending a Server Redirection PDU whose LoadBalanceInfo field is longer than the fixed 512-byte heap buffer used in nego_send_negotiation_request. Successful exploitation crashes the client and, when chained with a memory-disclosure primitive, could lead to code execution on the connecting workstation. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied with this record, so current exploitation appears opportunistic rather than confirmed in the wild.
Denial of service in Crawl4AI before 0.9.3 lets untrusted clients exhaust disk, CPU and bandwidth on shared worker processes by choosing the PDF scraping strategy in POST crawl requests and pointing it at large remote PDFs that the server downloads without any size or page limits. The flaw is unauthenticated and remotely triggerable (CVSS 4.0 8.7, AV:N/AC:L/PR:N/UI:N) wherever the Crawl4AI HTTP/server mode is reachable by untrusted clients, while deployments that use Crawl4AI purely as an in-process library with operator-controlled URLs are not exposed. No CISA KEV listing, EPSS score or public exploit code was provided in the available intelligence, so active exploitation and exploit maturity are unconfirmed at time of analysis.
Arbitrary file write in crawl4ai before 0.9.3 allows remote attackers to plant attacker-controlled bytes anywhere the service account can write, by abusing the image_save_dir path accepted in a scrape configuration. The flaw sits in PDFContentScrapingStrategy, where _filter_untrusted_fields fails to validate untrusted configuration fields, so a crafted config body escapes the intended image output directory (CWE-22). Rated 8.7 with a network attack vector and no privileges or user interaction, but with no public exploit code or CISA KEV listing identified at the time of analysis.
An unauthenticated NoSQL injection in Flowise before 3.1.4 lets remote attackers read other users' chat history by abusing the overrideConfig.sessionId parameter handled by the MongoDBMemory node. The parameter is passed into MongoDB queries without sanitization, so submitting MongoDB operator objects (e.g. $ne, $regex, $gt) through the prediction API causes the query to match records belonging to other users in the shared chat collection. Only confidentiality is affected (CVSS 4.0 base 8.7, VC:H, no integrity or availability impact); no CISA KEV listing, EPSS score, or public exploit code was provided at time of analysis, and vendor patch status is 'available' with version 3.1.4 as the fix.
Server-side request forgery in Flowise (an open-source low-code LLM/chatflow orchestration platform) before 3.1.4 lets an authenticated user point the baseURL parameter of a chat-model node at an arbitrary host, causing the Flowise server itself to issue the outbound request. Because stored LLM provider API keys are attached to those requests, an attacker holding the chatflows:create or chatflows:update permission can harvest credentials by redirecting traffic to cloud instance-metadata endpoints (e.g. 169.254.169.254) or internal services reachable from the Flowise host. The issue is fixed in 3.1.4; no CISA KEV entry, EPSS score, or public exploit code was supplied in the source data.
Flowise self-hosted instances before 3.1.4 fail to validate the SQLite file path supplied to the SQL Database Chain node, letting any user who can create or edit a chatflow write arbitrary files on the host as the Node.js process. Because the connector creates a database file at whatever path it is given, a traversed path such as ../../ can place attacker-controlled SQLite databases, scripts, or HTML/JS payloads into system directories or the web root, escalating to command execution or stored XSS. The vendor has released a fix in 3.1.4, and no public exploit code or CISA KEV entry is identified in the supplied intelligence (authenticated, network-reachable exploitation per the CVSS 4.0 vector: PR:L, AV:N).
Unauthenticated path traversal in the Design Scuole Italia WordPress theme allows any remote attacker to read arbitrary files that are readable by the web server process, including wp-config.php and its database credentials. The flaw (CWE-22) lives in the reserved_file_check() function of the theme's functions.php and carries a CVSS 4.0 base score of 8.7 (AV:N/AC:L/PR:N/UI:N/VC:H). The issue was reported by ENISA and flagged by Italy's ACN; no public exploit code was identified at time of analysis and the CVE is not listed in CISA KEV.
Remote unauthenticated attackers can force Hirschmann HiOS industrial switches to reboot by sending a specially crafted HTTP(S) request to a specific endpoint of the device's integrated web server, causing a temporary denial of service. Affected units are those running HiOS versions prior to the fixes released in 07.1.12, 08.7.10, 09.0.13, 09.3.03, 10.3.08 and 10.5.00. No public exploit code or in-the-wild exploitation has been identified at time of analysis, but the flaw is trivially reachable over the network (CVSS 4.0 base 8.7, AV:N/PR:N/UI:N) against any switch whose management interface is exposed.
Server-side template injection in Polyaxon through 2.16.4 lets any user who can submit a run execute arbitrary operating-system commands in the scheduler process by embedding Jinja2 payloads in spec fields such as queue, namespace, conditions, presets, or dependencies. Because the scheduler renders those fields with an unsandboxed Jinja2 environment, a low-privileged authenticated tenant can reach database credentials and service tokens held by the scheduler, turning a normal ML experiment submission into host-level code execution (CWE-1336, CVSS 4.0 base 8.7). No public exploit code or CISA KEV entry was identified at time of analysis, but the attack requires only a valid low-privilege account and no user interaction.
Authenticated SSH users who can reach privileged 'enable' mode on Lite-On FF-RFI079I4 and FF-RFI078I4 5G FlexFi devices can invoke an undocumented hidden function (CWE-912) to execute arbitrary OS commands, giving full control of the appliance with high confidentiality, integrity, and availability impact. Firmware versions below 02.01.15 are affected and a vendor fix is available. No public exploit code and no CISA KEV entry were identified at time of analysis, and the vendor/JVN rates the issue CVSS 4.0 8.7 (PR:L, UI:N).
Netcore NR255-V firmware 1.5.130703 ships a stack-based buffer overflow in the reboot_timer_set.cgi web endpoint, reachable through the router's HTTP management interface. The flaw stems from improper sscanf token parsing of user-supplied input, allowing a user who already holds administrative credentials on the device to corrupt stack memory and potentially execute code in the router's firmware context or crash/reboot it. No public exploit code or CISA KEV listing was provided at time of analysis, and no vendor-published patched firmware version appears in the supplied references.
Netcore NR255-V routers running firmware 1.5.130703 build root-privileged shell command lines from unquoted DDNS configuration input in DDNSset_cgi.c and related ddns_Proc.c code, letting an authenticated administrator inject extra command arguments that execute as root. Successful abuse yields complete device compromise, including configuration theft, traffic interception, and use of the router as a foothold into the LAN. The CVSS 4.0 vector indicates network reachability with high prerequisites, and no public exploit code or CISA KEV entry was present at time of analysis; the public technical reference writeup is the main disclosure vehicle.
The user wants a JSON analysis for CVE-2026-87273, Oracle VM VirtualBox Core, CVSS 8.6, AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. Let me construct fields carefully. Product name: "Oracle VM VirtualBox" (3 words... "Oracle VM VirtualBox" - that's 3 words). Good. Summary: Do not start with "A vulnerability". Start with impact verb + product. Something like: "Oracle VM VirtualBox 7.2.16 contains a Core component flaw that lets an attacker with logon access to the host... trigger memory corruption via a crafted guest/host interaction requiring user interaction, leading to full takeover of the VirtualBox process with scope change affecting additional products." Technical context: Hypervisor/core component, scope change S:C means the vulnerability in VirtualBox can impact other components (e.g., host OS or other VMs). AV:L means local access — attacker must have logon to infrastructure where VirtualBox executes — that's a common Oracle phrasing for AV:L (local logon, but not necessarily VM guest). CWE not provided, but Oracle typically assigns memory safety / sandbox escape classes. We shouldn't invent CWE. State that CWE was not assigned/provided and the root cause class is inferred from CVSS scope change and impacts — likely a flaw in the Core component enabling escape from intended privilege boundary. Risk assessment: CVSS 8.6 high, AV:L reduces, AC:L, PR:N but requires logon (authentication requirement nuance — description says "unauthenticated attacker with logon to the infrastructure"). PR:N in vector but "with logon" is ambiguous — Oracle's AV:L/PR:N means the attacker has a local account on the host but no elevated privileges. UI:R — requires victim user interaction. S:C — scope change. EPSS not provided, no KEV, no POC info. State explicitly that EPSS/KEV data absent. Affected products: Oracle VM VirtualBox 7.2.16 (per Oracle advisory cspusep2026). Note the advisory URL. CPE not provided. Remediation: patch — Oracle advisories reference fixes in CPUs; version f
Unauthenticated remote attackers can compromise Oracle BI Publisher 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0 through the HTTP interface, gaining high-impact read access to all data reachable by the application plus limited write and partial denial-of-service capability. Oracle rates the flaw 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) and classifies it as easily exploitable in the BI Platform Security component of Oracle Analytics; no public exploit code, EPSS score, or CISA KEV entry was supplied with the source data at time of analysis.
Unauthenticated remote attackers can crash and partially tamper with Oracle BI Publisher by sending crafted requests to its SOAP web services, affecting versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. The flaw is rated CVSS 8.6 (AV:N/AC:L/PR:N/UI:N) with high availability impact plus low confidentiality and integrity impact, meaning a successful hit can hang or repeatedly crash the service while also allowing unauthorized read and update/insert/delete access to some BI Publisher data. No public exploit code or CISA KEV listing was present in the supplied intelligence, and no EPSS score was provided, so the practical exploitation risk must currently be judged from the exposure of the SOAP interface rather than from observed attack activity.
Unauthenticated network attackers can reach the Open UI component of Oracle Siebel CRM End User (versions 17.0 through 26.7) over HTTP and gain unauthorized read access to critical data, limited insert/update/delete access, and the ability to partially degrade availability. Oracle rates the issue CVSS 3.1 base 8.6 (AV:N/AC:L/PR:N/UI:N), meaning no credentials or user interaction are needed; the accompanying tags indicate an authentication-bypass class flaw. There is no CISA KEV entry, no EPSS score, and no public exploit identified at time of analysis, and Oracle has published the fix through its Critical Security Patch Update advisory.
Authentication bypass in Oracle Forms (component: Forms Services, C/S, Charmode) allows an unauthenticated remote attacker with HTTP access to reach data and functionality that should require a valid session, affecting versions 12.2.1.19.0 and 14.1.2.0.0. The flaw carries a CVSS 3.1 base score of 8.6 with a scope-change flag, meaning a compromise of Oracle Forms can pivot to impact other products connected to or served by the Forms tier. Only high confidentiality impact is documented (no integrity or availability impact per the vector), and there is no public exploit code or CISA KEV listing at time of analysis.
Unauthenticated attackers with network reachability to the SSH interface of Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.7) can bypass authentication and gain unauthorized access to critical CRM data through the Siebel Cloud Manager component. Oracle scores the flaw 8.6 with a scope change, meaning a successful compromise can extend beyond the Siebel deployment to affect additional products. No public exploit code, EPSS score, or CISA KEV entry was provided at the time of analysis, although the low-complexity, no-credentials attack profile makes rapid weaponization plausible.
Unauthenticated remote attackers can read critical data from the Oracle Identity Manager Connector (Core component) in versions 12.2.1.4.0 and 14.1.2.1.0 by sending crafted HTTP requests, with no authentication or user interaction required. Oracle scores the flaw CVSS 8.6 (AV:N/AC:L/PR:N/UI:N) and classifies it as an authentication bypass with high confidentiality impact only; the scope-change metric means a successful attack can also expose downstream products that the connector reaches. No public exploit code or active exploitation is identified at time of analysis, and EPSS data was not provided, so real-world aggressiveness cannot be quantified.
Unauthenticated attackers positioned on an adjacent network segment can crash HPE Networking EdgeConnect SD-WAN Gateway appliances by sending crafted traffic, causing a denial of service that the device cannot recover from without manual intervention. All four maintained firmware branches are affected: 9.4.0.0 through 9.4.8.2, 9.5.0.0 through 9.5.8.1, 9.6.0.0 through 9.6.3.1, and 9.7.0.0. The vendor rates this 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) and the only publicly indexed advisory is HPE's own security bulletin (hpesbnw05135en_us); no CISA KEV listing, EPSS score, or public proof-of-concept code was present in the supplied intelligence, so active exploitation is unconfirmed.
Unauthenticated attackers with network access to Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 can compromise the Authentication Engine component over HTTP, obtaining unauthorized read access to critical data or all data accessible through the product. Oracle rates this CVSS 3.1 8.6 with a scope change (S:C), meaning affected deployments can be leveraged to significantly impact downstream/connected applications that trust OAM identities. At time of analysis there is no public exploit code identified and no CISA KEV listing, but the attack is trivially automatable (AV:N/AC:L/PR:N/UI:N), so internet-exposed OAM consoles and SSO endpoints should be treated as high priority.
Unauthenticated remote code execution affects Dell Wyse Management Suite deployments running any version prior to 2605.0.3.683, caused by an unrestricted file upload (CWE-434) that lets an attacker place a file of a dangerous type on the server. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials or user interaction are required, and the high integrity impact (I:H) reflects the ability to modify or replace server-side content with attacker-controlled code. No public exploit code and no CISA KEV listing were identified at time of analysis, but the low attack complexity and network reachability of the WMS administrative web interface make rapid patching the correct posture.
Unauthenticated remote code execution in Dell Wyse Management Suite (WMS) lets any remote attacker who can reach the management/web interface upload a file of a dangerous type and have it executed on the WMS server, affecting all releases prior to 2605.0.3.683. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no credentials and no user interaction are required, so the only meaningful barrier is network reachability of the WMS console; this presents as a high-priority exposure for any organization with the console exposed beyond a trusted management network. There is no indication of confirmed active exploitation (the issue is not in CISA KEV) and no public exploit code has been identified at time of analysis, though Dell rates it 8.6 and independent assessment places the impact higher (C:H/I:H/A:H) than the vendor vector's C:L/I:H/A:L, reflecting full confidentiality, integrity and availability loss on the WMS host.
Unauthenticated remote attackers can upload files of dangerous type to Dell Wyse Management Suite deployments running versions prior to 2605.0.3.683, because the console fails to restrict uploaded file types (CWE-434), which allows a crafted payload such as a web shell to be placed and executed on the server. The flaw carries a CVSS 3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N), meaning no credentials or user interaction are required — only network reachability to the WMS web interface. Neither CISA KEV listing nor public exploit code has been identified in the supplied intelligence, so at time of analysis this is a severe but not yet confirmed-exploited issue.