Oracle Fusion Middleware Control — the Enterprise Manager-style administration console bundled with Oracle Fusion Middleware — is vulnerable in the Framework component of versions 12.2.1.4.0 and 14.1.2.0.0, allowing a low-privileged user who can reach the console over HTTP to fully compromise it (CVSS 8.8, C:H/I:H/A:H), effectively achieving takeover of the management console itself. Because the console is the administrative nerve center for the middleware stack, a takeover grants a foothold with very broad downstream authority. No CISA KEV listing, EPSS score, or public exploit code was present in the supplied intelligence, so active exploitation is not confirmed at time of analysis.
Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 contain an easily exploitable flaw in the Runtime Tools component that lets any authenticated low-privileged user reach the portal over HTTP and take full control of the application (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N with high confidentiality, integrity, and availability impact). An attacker only needs a valid low-privilege account and network reachability to the portal — no user interaction and no elevated privileges are required. Oracle has published a Critical Security Patch Update (cspusep2026) covering the issue; there is no public exploit code and no CISA KEV listing at time of analysis, so exploitation is currently assessed as opportunistic rather than confirmed in the wild.
Low-privilege authenticated attackers can escalate to root on HPE Networking EdgeConnect SD-WAN Gateways by abusing an API endpoint, gaining the ability to run arbitrary operating-system commands. The flaw carries a CVSS base score of 8.8 (AV:N/AC:L/PR:L/UI:N), meaning the attacker needs only valid low-privileged credentials and network reachability to the management API — no user interaction is required. Affected branches span EdgeConnect SD-WAN Gateways 9.4.x through 9.7.0.0; no public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis.
Privilege escalation in the EdgeConnect SD-WAN Gateway API lets a remote, authenticated low-privileged user gain administrative rights on the web-management interface, resulting in complete compromise of the gateway (CVSS 8.8, AV:N/PR:L). Affected branches are 9.4.0.0–9.4.8.2, 9.5.0.0–9.5.8.1, 9.6.0.0–9.6.3.1, and 9.7.0.0. No public exploit code, EPSS score, or CISA KEV listing was provided at time of analysis; exploitation requires a valid low-privileged account and reachability of the management API.
A buffer overflow in the underlying operating system of HPE Aruba Networking EdgeConnect SD-WAN Gateways lets an unauthenticated attacker on an adjacent network segment execute arbitrary code as a privileged OS user, resulting in full compromise of the appliance. Affected branches span the 9.4.x, 9.5.x, 9.6.x and 9.7.0.0 release trains (up to 9.4.8.2, 9.5.8.1, 9.6.3.1 and 9.7.0.0 respectively). The vendor describes exploitation as conditional on preconditions outside the attacker's control, and no public exploit code, EPSS score or CISA KEV entry was present in the supplied intelligence at time of analysis.
Let me synthesize. CVE-2026-58710: DecodeFilmGrainParams in film_grain_dec.cc — Android libavc / media codec film grain decoding. Missing bounds check → OOB write → RCE. CVSS 8.8 with AV:N/AC:L/PR:L/UI:N — note PR:L is odd but that's given. CWE-120 (buffer copy without checking size). Reported by Google Devices, references Android Security Bulletin Pixel 2026-09-01. CPE google:android. EUVD affected versions: "Android Android kernel" — weird. Tags: RCE, Buffer Overflow, Google. Missing tag maybe "android". Product name: "Android" — or "Android Film Grain Decoder"? 1-3 words. "Google Android" maybe. Let's use "Android Media Codecs"? Hmm. The vulnerability is in film_grain_dec.cc which is part of libavc (Android's AVC decoder) or a codec2 component. Probably Android's media framework. Product name should be specific: "Android". Let's pick "Google Android" (2 words). Prevalence: Android is ubiquitous. Assessed CVSS vector: Given description "remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation." But CVSS vector says PR:L. Hmm. Media decoding typically happens when processing a media file — remotely delivered via messaging, or via media server. PR:L suggests some level of privilege required — perhaps access to a media-decoding service context, or the requirement to send media to a privileged process. Actually, for Android media codecs, an app can trigger decoding with its own privileges. The vendor assigned PR:L. I should give my own assessment. Given the description says "no additional execution privileges needed" and UI:N, but AV:N with media parsing... Typically media parsing is AV:L or AV:N depending on delivery. Android media codec flaws are usually CVSS AV:N/AC:L/PR:N/UI:R for a crafted file. Here UI:N suggests it's triggered via a network media stream (e.g., RTP, video call) without user opening a file. PR:L — the attacker needs local privileges? Hmm, in Android, media codec processes (media.
An out-of-bounds write in Android's IP Multimedia Subsystem (IMS) telephony stack allows an attacker positioned on the cellular signaling path to corrupt memory and achieve code execution inside the privileged process that handles VoLTE/VoWiFi traffic. User interaction on the target is not required, and the September 2026 Pixel bulletin identifies the flaw as remotely triggerable via improperly validated input. No public exploit code or CISA KEV entry was identified at the time of analysis, and no EPSS score was supplied with the source data, so real-world exploitation activity is unconfirmed.
An out-of-bounds write in Av1DecodeFrameTag (vp9hwd_headers.cc) in the Android media decoding stack allows crafted AV1/VP9 media content to corrupt memory and potentially achieve remote code execution in the codec process, which runs with elevated system privileges relative to a normal app. Google's Pixel security bulletin dated 2026-09-01 lists the fix, and no user interaction is required, though the provided CVSS vector (PR:L) implies the attacker must already be able to route content into the decoder path. No EPSS score, CISA KEV entry, or public exploit code was supplied with this record, so active exploitation is unconfirmed.
An out-of-bounds write in Android's audio RTP payload encoder node (AudioRtpPayloadEncoderNode.cpp) lets a remote attacker execute arbitrary code in the media framework process by supplying a crafted audio RTP payload that the node fails to validate. Affected builds are Android/Pixel devices covered by the September 2026 Android Security Bulletin; the vendor description states user interaction is required to trigger the flaw, and an NVD/EUVD record exists alongside the source.android.com advisory. No public exploit code or CISA KEV entry was identified in the supplied intelligence, and no EPSS score was provided at time of analysis.
An out-of-bounds write in ReadTileInfo of vp9hwd_headers.cc lets a crafted VP9 bitstream corrupt memory inside Android's VP9 hardware-decoder header parser, which Google rates as remote escalation of privilege with no additional execution privileges and no user interaction required. Affected builds are those tracked under the Google Android CPE and addressed by the Android/Pixel security bulletin dated 2026-09-01. There is no CISA KEV listing and no public exploit code identified at time of analysis, so this is currently a patch-window issue rather than a confirmed in-the-wild campaign.
Let me synthesize. CVE-2026-56920: Android HEVC decoder, firmware header parsing (fw_hevc_dec_header.c), s_decode_vui_param out-of-bounds write, CWE-787, CVSS 8.8 AV:N/AC:L/PR:L/UI:N. Note: "remote code execution with no additional execution privileges needed" — but CVSS says PR:L. Hmm, this is typical Android bulletin wording: "This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation." That's media framework / remote. But CVSS says PR:L which contradicts "no additional execution privileges needed". Actually Android media codecs often run in a sandboxed process (mediaserver), so PR:L reflects the sandbox context. There's a conflict worth noting. Product name: Android (Google Android). Or "Android HEVC Decoder"? 1-3 words. "Google Android" or "Android". Let's use "Android Media Framework"? Hmm — the file is fw_hevc_dec_header.c, HEVC decoder header parsing. Probably part of Android's media codec/firmware. I'll say "Android HEVC Decoder" — 3 words. Actually the CPE says google:android. Product name: "Android HEVC Decoder". Hmm, maybe safer: "Google Android". The field says the specific product or service name affected. CPE is google:android, and it's the HEVC decoder in Android firmware for Pixel devices (bulletin is Pixel). I'll go with "Android HEVC Decoder". Summary: Out-of-bounds write in HEVC VUI parameter decoding. Affected: Android devices with affected firmware (Pixel bulletin 2026-09-01). Remote code execution with no user interaction. No KEV, no POC identified. EPSS: not provided. KEV: not stated → assume not in KEV. POC: not provided → "no public exploit identified at time of analysis". Technical context: HEVC/H.265 VUI (Video Usability Information) parameters in SPS/VPS NAL units; s_decode_vui_param in fw_hevc_dec_header.c; firmware-based HEVC decoder in Android; logic error → insufficient bounds validation → OOB write → memory corruption in media codec process. CWE-787.
Let me synthesize. CVE-2026-56882: Cellular Modem (Android Pixel), information disclosure due to logic error, leading to RCE, no additional execution privileges, no UI. CVSS 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. CWE-200 (Exposure of Sensitive Information). Reported by Google_Devices, Pixel bulletin September 2026. Product name: "Android Cellular Modem" — 1-3 words. Maybe "Android Cellular Modem" (3 words). Or "Pixel Cellular Modem". Let's use "Android Cellular Modem". Prevalence: Android is ubiquitous. But cellular modem specifically... The affected component is the cellular modem firmware in Android/Pixel devices. Prevalence of Android = ubiquitous. Hmm. The CPE is google:android. Modem component. I'd say "ubiquitous" given Android base. But the specific modem component... The CPE says google:android, so I'll go with ubiquitous. Actually maybe "high"? Android is on billions of devices — ubiquitous is defensible. Let me say ubiquitous with basis "core platform component across billions of Android devices". Hmm, but cellular modem is only in phones with cellular. Still ubiquitous. Actually, let's be careful — the CPE is google:android which is the whole OS. Cellular modem affects devices with cellular radios = most Android phones. I'll go with ubiquitous. CVSS vector given: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H — PR:L is odd for a modem, but that's the input. Note the mismatch: description says "no additional execution privileges needed" but vector says PR:L. That's a conflict to note. My assessed vector: Given it's a modem logic error leading to info disclosure → RCE, remote. I'll assess AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H? Hmm. Let me think. Cellular modem attack — typically over-the-air from a rogue base station or via malicious network. AC:H might be reasonable (requires specific modem state / malformed signaling). But CVSS says AC:L. I'll go with AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H — hmm, but "no additional execution privileges needed" suggests PR:N. But
An out-of-bounds write in Android's IP Multimedia Subsystem (IMS) telephony stack, corrected in the September 2026 Android/Pixel security bulletin, can be turned into remote code execution against affected devices. The published vector (CVSS 8.8, AV:N/AC:L/PR:L/UI:N, C/I/A all High) indicates network-reachable exploitation with no user interaction, though it assumes low-level privileges while the description claims no additional execution privileges are needed. No public exploit code, EPSS score, or CISA KEV entry was provided, so active exploitation is not confirmed at time of analysis.
A use-after-free race condition in multiple locations of the Android kernel allows an attacker to corrupt kernel memory and escalate to remote code execution, affecting Android devices covered by the September 2026 Android Security Bulletin. Exploitation requires an attacker to already hold a low-privilege foothold on the device (CVSS PR:L) — typically a malicious or compromised application — and no user interaction is needed once that foothold exists. No public exploit code or CISA KEV listing was identified at time of analysis, so this is currently a patch-now kernel hardening issue rather than a confirmed in-the-wild campaign.
Remote exploitation of the cellular modem stack in Google Android devices allows an attacker who controls the radio path to trigger a heap-based out-of-bounds write and escalate privileges on the handset, without any user interaction. The supplied CVSS 3.1 base score of 8.8 reflects high confidentiality, integrity and availability impact, but its PR:L metric (low privileges required) conflicts with the vendor description stating that no additional execution privileges are needed. No public exploit code, EPSS score, or CISA KEV entry was included in the intelligence feed, so active exploitation is unconfirmed at the time of analysis.
An out-of-bounds write in the Android kernel, caused by a logic error in multiple code locations, allows code execution in the kernel context with high impact to confidentiality, integrity and availability. The flaw is remotely reachable per the CVSS vector (AV:N/AC:L/PR:L/UI:N) and requires no user interaction, though the vector indicates a low-privileged rather than fully unauthenticated attacker. Google published a fix in the Pixel security bulletin dated 2026-09-01; no public exploit code, EPSS score, or CISA KEV listing was provided in the available intelligence, so active exploitation is not confirmed.
An out-of-bounds write in Android's VP9 hardware decoder (Vp9DecodeFrameTag in vp9hwd_headers.cc) lets a crafted VP9 video stream corrupt memory in the codec context, giving an attacker code execution at the decoder's privilege level. Affected devices are those running Android builds that include the vulnerable VP9 hardware decoding path prior to the September 2026 Pixel security bulletin fix. No public exploit code or CISA KEV entry was identified at time of analysis, so exploitation appears to require a motivated actor with a delivery path for malicious media.
An out-of-bounds write in Google's Android Cellular Modem component allows code execution in the baseband when a crafted message is delivered to the modem, with no user interaction required. Google Pixel devices running Android builds prior to the September 2026 patch level are affected, per the Pixel security bulletin. Rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N, high confidentiality, integrity and availability impact); no public exploit code or CISA KEV entry was identified at time of analysis, so the immediate risk is to targeted radio-layer attacks rather than mass exploitation.
Local privilege escalation in the CrowdStrike Falcon sensor for Windows occurs when the Microsoft Office File Malicious Macro Removal policy setting is enabled, letting an unprivileged process race the sensor's macro-cleanup file operation (CWE-367) and write arbitrary files to protected locations, ultimately reaching SYSTEM-level privileges. Affected builds are the Falcon sensor for Windows at 7.34 and above, the 7.32 LTS line, and 7.16 on Windows 7/2008 R2; the CrowdStrike Laroux Malware Cleanup Tool is also affected, while Mac, Linux, and Legacy sensor platforms are not. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, though the CVSS 3.1 base score is 8.8.
Authenticated remote code execution in IBM MQ lets an attacker who holds valid MQ credentials - or who can reach a channel configured with weak or blank authentication - deliver malicious serialized data that the queue manager deserializes and executes. The flaw affects the 9.1, 9.2, 9.3, 9.4 and 10.0 streams up to their respective maintenance levels (9.1.0.0-9.1.0.37 LTS, 9.2.0.0-9.2.0.43 LTS, 9.3.0.0-9.3.0.41 LTS and 9.3.0.0-9.3.5.1 CD, 9.4.0.0-9.4.0.25 LTS and 9.4.0.0-9.4.5.1 CD, plus 10.0.0.0), giving a 8.8 CVSS base score with high confidentiality, integrity and availability impact under AV:N/AC:L/PR:L/UI:N/S:U. Because the vector requires PR:L, no unauthenticated path is confirmed; no public exploit code has been identified at time of analysis, and IBM has released a vendor fix.
Authenticated remote code execution in Koha lets anyone who can reach the affected web service on TCP port 8081 feed a crafted string into an eval() call and run arbitrary code as the service account. The bug is rated CVSS 8.8 (CWE-95) because it needs only a low-privilege authenticated session and no user interaction, yet yields full confidentiality, integrity and availability impact. No CISA KEV listing and no public exploit code were identified at time of analysis.
Privilege escalation in OpenBMC's phosphor-net-ipmid IPMI stack allows an attacker who already holds a valid low-privileged IPMI session to redirect that session's authorization context to a different, higher-privileged account while the original integrity and encryption keys stay in place, so no re-authentication ever occurs. Downstream vendors that package phosphor-net-ipmid — NVIDIA and H3C among them — inherit the flaw in their BMC firmware. Rated CVSS 8.8 with high confidentiality, integrity and availability impact; no public exploit code identified at time of analysis, and the issue is not listed in CISA KEV.
Authenticated privilege escalation in the Consulting WordPress theme (versions up to and including 6.7.16) lets any subscriber-level user take over a site as administrator by chaining two coding flaws. The theme's masterstudy_ms_stm_set_discard_transient AJAX action writes an attacker-chosen transient value without any capability check or nonce, and the theme's "developer access" login path trusts a transient value in legacy string mode, so an attacker can seed a known token and then log in as any existing account, including an admin. The CVSS score is 8.8 (network, low privileges, no user interaction, full confidentiality/integrity/availability impact); no EPSS score, KEV listing, or public exploit code was provided at time of analysis.
Privilege escalation in Mozilla Firefox for Android allows an attacker who can get a user to open a crafted web page to gain privileges beyond those normally granted to web content, with high impact to confidentiality, integrity, and availability. Mozilla fixed the flaw in Firefox 156; no public exploit code and no active exploitation have been identified, and CISA's SSVC assessment rates exploitation as 'none' with automatable 'no'. The 8.8 CVSS score is driven entirely by a network attack vector plus required user interaction (UI:R), so real-world risk depends on convincing a target to browse attacker-controlled content rather than on mass scanning.
Incorrect boundary conditions in Firefox's Graphics component allow a privilege escalation that was fixed in Firefox ESR 115.41 and Firefox ESR 140.16. An attacker who can get a victim to load crafted content — a web page or similar rendered surface — can trigger a buffer overflow (CWE-120) in the graphics pipeline and potentially cross from the low-privilege content process into a more privileged browser context, yielding high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and CISA SSVC records exploitation status as 'none', though the CVSS base score of 8.8 and the total technical impact rating make patching a priority for any organization running an unpatched ESR branch.
Remote code execution in RuoYi-Vue-Plus 6.0.0 lets an authenticated low-privileged user run arbitrary Java code on the server through the workflow task-completion endpoint POST /workflow/task/completeTask, which flows through FlwTaskController.java into FlwTaskServiceImpl.completeTask, CompleteExecuteComponent.process and the Warm-Flow TaskService.skip path. The CVSS 3.1 base score is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting network reachability and complete confidentiality, integrity and availability impact, but it requires a valid authenticated session rather than being pre-auth. No public exploit code or CISA KEV entry was identified from the supplied intelligence, and no EPSS score was provided.
Authenticated command injection in the MitraStar GPT-2742GX4X5v6-SV gateway (firmware GL_g2.5_100XNT0b23_3) lets an attacker who already holds valid web-interface credentials run arbitrary operating-system commands through the /cgi-bin/device-management-utilities-internet.cgi endpoint, taking full control of the device. The flaw is scored CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-78, so compromise yields complete loss of confidentiality, integrity and availability of the unit. No CISA KEV entry or EPSS score was supplied with the intelligence, and no vendor-released patch has been identified; the cveorg reference points to a public GitHub repository that appears to carry technical detail, so publicly available exploit code should be assumed plausible pending verification.
Authentication bypass in the Core component of Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0 allows a remote, unauthenticated attacker who can reach the connector's TCP listener to read and modify the identity data it manages, with Oracle explicitly noting the attack may also significantly impact connected downstream products (scope change). Oracle scores it 8.7 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N) while describing it as difficult to exploit, so the flaw is reachable without credentials but is not trivially automatable. The supplied intelligence contains no EPSS score, no CISA KEV entry, and no evidence of public exploit code at time of analysis.
Insufficient session expiration in bizwell xClick groupware allows authentication bypass through replay of session tokens that should have been invalidated after logout or timeout. Affecting versions R2, R3, and R3.1, the flaw enables an attacker who has obtained a victim's session token to continue using it with full account-level access even after the legitimate session should have ended, carrying high confidentiality, integrity, and availability impact per the CVSS 4.0 score of 8.7. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog.
Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0 contain a flaw in the Authentication Engine component that lets a high-privileged, network-positioned attacker read, create, delete, or modify data managed by the OAM deployment — and because the flaw crosses a security scope boundary, downstream applications that trust OAM for identity can be affected as well. The CVSS 3.1 base score is 8.7 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N), reflecting an easily triggered but credentialed attack with high confidentiality and integrity impact and no availability impact. No public exploit code, EPSS score, or CISA KEV listing is present in the supplied intelligence, so it is treated as not yet publicly exploited at time of analysis; Oracle ships fixes through its Critical Patch Update / Security Alert program referenced in the advisory link.
Authenticated attackers can inject crafted arguments into the tcpdump launch routines exposed by the Nettools feature of Netcore NR255-V firmware 1.5.130703, causing the device to execute attacker-manipulated system commands as part of the tcpdump invocation. The flaw affects multiple CGI/handler components — ntools_start_set_cgi, ntools_tcpdump_start_set_cgi, exe_default and ntools_proc — and carries a CVSS 4.0 base score of 8.7 (AV:N/AC:L/PR:L/UI:N) with high confidentiality, integrity and availability impact confined to the device itself. Exploitation requires a low-privileged foothold on the router's management interface, and no public exploit code, EPSS score, or CISA KEV listing was supplied in the available intelligence.
A stack-based buffer overflow in the Netcore NR255-V router (firmware 1.5.130703) allows an attacker who can reach the web management interface to smash a fixed-size stack buffer by submitting oversized form values to the ntools_tcpdump_start_set.cgi endpoint, which passes input to an unsized sprintf call. Successful exploitation can corrupt the saved return address and potentially lead to arbitrary code execution with the privileges of the CGI process on the device. The supplied CVSS 4.0 vector (8.7) rates confidentiality, integrity and availability impact as high with a network vector, but PR:L indicates some level of authentication or low-privilege access is required; no EPSS score, CISA KEV listing, or confirmed public exploit code was included in the intelligence feed, and no vendor patch reference was provided.
Stack-based buffer overflow in the wake_up_set.cgi endpoint of Netcore NR255-V firmware version 1.5.130703 lets an attacker who can reach the router's web management interface corrupt memory by submitting oversized MAC and ID parameter values that are tokenized without any length bound. Successful exploitation yields high confidentiality, integrity, and availability impact on the device - potentially full compromise of the router as a network chokepoint - with a CVSS 4.0 base score of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N). No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so current risk is driven by exposure of the management interface rather than confirmed in-the-wild activity.
Netcore NR268 routers running firmware 1.7.121109 accept forged firmware images because the mtd_write flashing path does not properly validate the firmware authenticity check performed by check_image_uuid.c, allowing an attacker who can reach the upload endpoint (put_file.cgi) with low privileges to load unauthorized firmware. Successful exploitation gives an attacker full control over the device — high confidentiality, integrity and availability impact per the CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N) — and the malicious image persists across reboots. The flaw is not listed in CISA KEV and no public exploit code has been identified at time of analysis, though a public technical write-up of the forgery technique and a VulnCheck advisory are available.
adm-zip 0.5.14 through 0.6.0, a widely used Node.js ZIP library, omits zlib decompression output limits whenever a ZIP entry declares an uncompressed size of zero, letting a tiny crafted archive inflate without bound and exhaust the host process memory. Any service that extracts attacker-supplied archives with an affected version — upload endpoints, import jobs, CI tooling — can be crashed by a few kilobytes of input, with no authentication or user interaction required per the CVSS 4.0 vector (PR:N/UI:N, VA:H only). No CISA KEV listing, EPSS score, or public exploit code was supplied at time of analysis, but the fix commit and diff are public and the technique is trivial to reproduce.
Docker Sandboxes 0.37.0 through 0.40.x contain a time-of-check/time-of-use race (CWE-367) in the guest-to-host Unix-domain socket relay: the host validates that a requested socket path sits inside an authorized workspace and then reconnects using that same pathname, letting a malicious guest swap an intermediate directory for a symlink in the gap. A guest that wins the race causes the host-side relay to connect to an arbitrary AF_UNIX socket outside the shared workspace, exposing whatever data or host capabilities that socket provides. Vendor-released fix: Docker Sandboxes 0.41.0; no public exploit code or CISA KEV entry was identified at time of analysis.
Hard-coded credentials in the FTP daemon (ftpd) shipped with multiple Digital Watchdog video recorders and NVRs-including VG4 Recorder, VMAX IP G4 NVR, VMAX A1 PLUS, VA1G4 Recorder, and VMAX A1 G4 DVR-let anyone who can reach the FTP service log in and operate the daemon as root. Because the ftpd runs as root, a successful login grants remote read and write access to the device filesystem, allowing an attacker to tamper with recorded surveillance video, alter device configuration, or use the box as a foothold on the camera VLAN. The flaw is rated 8.7 (CVSS 4.0, adjacent network, no privileges or interaction required), giving it a wide attack surface on flat camera networks. No public exploit code or CISA KEV entry was identified at time of analysis, so exploitation would currently require an attacker already positioned on the adjacent network segment.
Unauthenticated attackers positioned on an adjacent network segment can gain root-level control of Digital Watchdog VMAX A1 PLUS, VMAX A1 G4, VA1G4 and VG4 recorders and VMAX IP G4 NVRs, because a critical function performs no authentication and forwards received bytes straight into a system command. CWE-306 combined with that unsafe command handling gives full loss of confidentiality, integrity and availability on the device and on any footage, stored credentials or downstream network reachable through it. Neither public exploit code nor a CISA KEV entry appears in the supplied intelligence, so active exploitation is not confirmed, but the CVSS 4.0 base score of 8.7 reflects the near-trivial effort once adjacency is achieved.
Improper access control in Oracle Hyperion Financial Management 11.2.26.0.000 lets an attacker who already holds high privileges and can reach the application over the network submit crafted SQL to read, create, delete, or modify critical financial consolidation data. The CVSS 3.1 base score is 8.7 with a scope change, meaning a successful attack can extend beyond the HFM component into interconnected products that share credentials or database access. Oracle shipped a fix in its September 2026 Critical Security Patch Update, and no public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated attackers who can reach the Oracle Hyperion Financial Management 11.2.26.0.000 Security component over HTTPS can bypass its authentication controls and gain read and write access to critical financial data, with the exploit's impact crossing into other integrated Oracle EPM products (scope change). Oracle rates this CVSS 3.1 8.7 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N), explicitly noting it is difficult to exploit; no public exploit code or CISA KEV entry was present in the supplied intelligence, and no EPSS score was provided. The practical concern is data integrity and confidentiality of consolidation records rather than remote code execution, since availability impact is rated None.
Oracle BI Publisher — the reporting and publishing component of Oracle Analytics — is exposed in versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0 to an easily exploitable flaw that lets a low-privileged, authenticated user reach the application over HTTP and, once a victim is persuaded to interact, obtain full read and write access to critical BI Publisher data. The CVSS 3.1 base score of 8.7 reflects high confidentiality and integrity impact plus a scope change that allows the compromise to spill over into additional, connected Oracle products. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied, so the practical urgency currently rests on Oracle's criticality rating rather than observed exploitation.
Low-privileged attackers with network access to the Siebel Apps - Customer Order Management module (Order Management component) in Oracle Siebel CRM versions 17.0 through 26.7 can craft HTTP requests that, once a second user is induced to interact, allow unauthorized read, creation, modification, and deletion of critical order data, with a scope change that can propagate impact to connected products. The flaw carries a CVSS 3.1 base score of 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N), but no EPSS score, CISA KEV listing, or public exploit code was provided in the source data, so active exploitation is not confirmed (no public exploit identified at time of analysis). It is an easily exploitable, low-complexity issue, making patch deployment a high priority for any organization running an affected Siebel release.
Low-privileged abuse of the Order Management component in Oracle Siebel CRM (Siebel Apps - Customer Order Management, versions 17.0 through 26.7) allows an authenticated network attacker to create, delete, or modify critical order data and to read data beyond their authorization, provided a victim user is persuaded to interact with attacker-supplied content. The flaw is rated CVSS 3.1 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) on the strength of its high confidentiality and integrity impact and its scope change, which means a successful attack executed in the victim's context can reach additional connected Oracle products; there is no availability impact. Despite the 'Authentication Bypass' tag applied by the reporter, the assessed vector confirms a valid low-privileged account is required and there is no pre-authentication path, and no public exploit code has been identified at time of analysis - the practical risk is therefore conditional on phishing a different, typically higher-privileged user into viewing or acting on crafted order-management content.
Oracle iStore, the e-commerce/shopping cart module of Oracle E-Business Suite versions 12.2.3 through 12.2.15, is exposed to a cross-site style attack in which a low-privileged authenticated attacker with HTTP network access can induce a second user to interact with crafted content and thereby gain unauthorized read, create, modify, and delete access to iStore data — with the vendor warning the impact can extend to other EBS products. With CVSS 3.1 base 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N), the flaw is trivially automatable once an attacker holds any low-privileged account, but exploitation still hinges on victim interaction, which materially lowers real-world risk. No public proof-of-concept, EPSS estimate, or CISA KEV entry was present in the supplied intelligence, so exploitation is assessed as not confirmed in the wild at time of analysis.
HTTP request smuggling in http4s Ember (all releases prior to 0.23.35 and 1.0.0-M47) lets an unauthenticated remote attacker bypass front-end proxy controls by sending duplicate Content-Length headers with differing values, because the Ember HTTP/1.1 parser accepts the conflict and frames the message using the last value instead of rejecting it as a framing error. When Ember runs behind a keep-alive intermediary that selects a different occurrence, the attacker can prepend a smuggled request to a later user's connection, capture that user's headers, or poison a shared cache; the same shared parser can also misframe upstream responses when an http4s client proxies for multiple downstream consumers. No public exploit code or CISA KEV entry was identified at time of analysis, but the CVSS 8.7 scope-changed rating makes this a priority fix for exposed Scala services sitting behind reverse proxies, CDNs, or load balancers.
Let me synthesize. CVE-2026-69205: http4s Ember HTTP parser request smuggling via Transfer-Encoding header case-sensitivity and charset decoding issues. Key facts: - http4s Ember (Scala HTTP library), prior to 0.23.35 and 1.0.0-M47 - CWE-444 (Inconsistent Interpretation of HTTP Requests / request smuggling) - CVSS 8.7, CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N - No EPSS given, no KEV, no explicit POC. - Patch: 0.23.35 and 1.0.0-M47, commit 5e88b2e7b4e6ea2f0c61040a4bc9de0d73e51217 - Tags: Information Disclosure, Request Smuggling, Http4S Fields to output. Let me write carefully. Product name: "http4s Ember" — 1-3 words. "http4s" is one word. Maybe "http4s Ember". That's fine. Summary: must not start with "A vulnerability". Start with impact. E.g., "HTTP request smuggling in http4s Ember (0.23.x before 0.23.35 and 1.0.0 milestones before M47) allows attackers to desynchronize HTTP/1.1 framing between Ember and intermediary proxies..." Note S:C (scope changed) with C:H/I:H/A:N. Affected products: http4s Ember before 0.23.35, 1.0.0-M47. CPE cpe:2.3:a:http4s:http4s:*:*:*:*:*:*:*:*. Advisories GHSA-9998-894r-fwvr, releases. Remediation: upgrade to 0.23.35 or 1.0.0-M47; the fix decodes header bytes as ISO-8859-1 and rejects any transfer coding token other than "chunked" case-insensitively; workaround: reject/rewrite ambiguous Transfer-Encoding at reverse proxy, strip Transfer-Encoding, disable chunked, use HTTP/2 end-to-end. Note side effects: strict rejection of unknown transfer codings may break clients sending e.g. "gzip, chunked" or "identity" — actually the fix rejects any Transfer-Encoding other than chunked, including "identity"? codings split by ',' and all must equalIgnoreCase("chunked"). So "identity" would be rejected. Side effect: legitimate clients sending multiple codings will get errors. Note Ember is both server and client (ember-client). Response smuggling requires malicious upstream. Exploitation conditions: Requires Ember-based server behind
An arbitrary file read flaw in the J2Store e-commerce extension for Joomla (versions 1.0.0–3.3.2, 4.0.0–4.0.22 and 4.1.0–4.1.7) lets anyone holding a valid download token/pid pair for a product download retrieve files outside the configured attachment folder. The J2StoreModelOrderdownloads::getFilePath() routine builds the on-disk path by concatenating the attachments directory with the stored product_file_save_name and only runs JPath::clean() plus JFile::exists(), so a ../ segment in that stored value resolves outside the folder and exposes files such as configuration.php to the web server's read permissions. No public exploit code and no CISA KEV listing were identified at time of analysis, but a CVSS 4.0 base score of 8.7 (VC:H, AV:N, PR:N) makes this a serious confidentiality risk for exposed J2Store storefronts.
Unauthenticated blind SQL injection in the J2Store e-commerce extension for Joomla allows remote attackers to extract arbitrary database contents — including customer records, order data, and stored credentials or tokens — from any publicly reachable storefront that exposes the standard product listing or product-tags filter. Affected builds span the 1.x, 3.x, 4.0.x and 4.1.x lines (1.0.0–3.3.2, 4.0.0–4.0.22, 4.1.0–4.1.7), and the CVSS 4.0 vector indicates network-reachable exploitation with no authentication and no user interaction (PR:N/UI:N) for a high confidentiality impact. No public exploit code, EPSS score, or CISA KEV entry was supplied in the intelligence feed, so active exploitation is currently unconfirmed.
Unauthenticated order-state tampering in the J2Store e-commerce extension for Joomla (versions 1.0.0–3.3.2, 4.0.0–4.0.22, and 4.1.0–4.1.7) lets anyone mark any order as FAILED without supplying a payment amount, transaction ID, or any other verification data. An attacker can mass-fail pending orders to disrupt revenue, or flip already-fulfilled orders back to FAILED, triggering unwarranted refunds, cancellations, and customer-support load. The CVE carries a CVSS 4.0 score of 8.7 driven entirely by high integrity impact; no public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis.
URL path injection in the Lokka MCP server for Microsoft 365 (versions prior to 2.1.2) allows a crafted path value passed to the Lokka-Microsoft tool to break out of the management.azure.com base URL, causing a valid Azure Resource Manager bearer token to be transmitted to an attacker-controlled host. The flaw is a classic server-side request forgery / token-exfiltration pattern (CWE-918) caused by string concatenation instead of the standard URL API when building ARM request URLs. The vendor fixed it in 2.1.2 by validating Azure paths and composing URLs via the URL constructor; no public exploit code or CISA KEV entry was identified in the provided intelligence, so exploitation is currently assessed as requiring attacker-controlled input (for example indirect prompt injection) into the tool's path argument.