URL path injection in the Lokka MCP server for Microsoft 365 (versions prior to 2.1.2) allows a crafted path value passed to the Lokka-Microsoft tool to break out of the management.azure.com base URL, causing a valid Azure Resource Manager bearer token to be transmitted to an attacker-controlled host. The flaw is a classic server-side request forgery / token-exfiltration pattern (CWE-918) caused by string concatenation instead of the standard URL API when building ARM request URLs. The vendor fixed it in 2.1.2 by validating Azure paths and composing URLs via the URL constructor; no public exploit code or CISA KEV entry was identified in the provided intelligence, so exploitation is currently assessed as requiring attacker-controlled input (for example indirect prompt injection) into the tool's path argument.
Unauthenticated user enumeration in Concrete CMS 9.0.0 through 9.5.2 allows any anonymous visitor to dump the complete backend account list — including internal user IDs, usernames and email addresses of every administrator and the super-administrator (user ID 1) — by sending an empty search to the /ccm/system/user/autocomplete endpoint and paginating the results. The endpoint enforces only a CSRF-style token that is bound to the selector's display options rather than to caller identity, and that token is handed out to anonymous visitors, so there is no authentication or privilege barrier to clear. No password hashes or session material leak, but the disclosed email and account inventory is a ready-made target list for credential stuffing, phishing and password-spray campaigns against named admins; no public exploit code and no CISA KEV entry are present in the supplied intelligence.
Authorization bypass flaws in the 'Design Scuole Italia' WordPress theme (design-scuole-wordpress-theme, versions up to and including 2.17.3) let an unauthenticated remote attacker reach content and data that should require a logged-in, authorized user. The faulty routines are the dsi_pdf_generator and dsi_csv_generator functions, and an unauthenticated RSS feed at /circolare/feed/ gives an additional, easily scriptable path to the same restricted 'Circolare' records and registered-user information. With a CVSS 4.0 base score of 8.7, no privileges or user interaction required, and high confidentiality impact, this is a straightforward data-exposure bug in a theme deployed mainly on Italian school websites; no public exploit code or CISA KEV entry was identified at time of analysis.
Memory amplification denial of service in the Tornado Python web framework before 6.5.8 lets unauthenticated remote attackers exhaust server memory with a single crafted multipart/form-data request containing tens of thousands of parts — roughly 600KB of body is enough to build a 100,000-element transient list. Tornado's parse_multipart_form_data splits the body on the boundary before it enforces the max_parts limit, so the safety check fires only after the expensive allocation has already happened. Publicly available exploit code exists (a gist with poc.py), patch status is 'available from vendor' with the fix shipped in 6.5.8, and no CISA KEV listing or EPSS score accompanied the supplied intelligence.
Arbitrary file read in atomic-agents-stack before 1.1.0: the optional dashboard HTTP server builds filesystem paths straight from the request path, so unauthenticated remote attackers can send '../' segments to DashboardHandler.do_GET and read files outside the intended agents_root directory. The flaw affects all versions through 1.0.0 and is fixed in 1.1.0; the dashboard is off by default and binds to loopback, but an operator-set --host of 0.0.0.0 exposes it to the LAN, and even loopback deployments are reachable via DNS rebinding or SSRF from a co-located service. No public exploit code or active exploitation has been identified at time of analysis.
Vikunja prior to 2.6.0 leaks the secret hash that backs a project's link shares through its single-share read endpoint, so any authenticated user holding only read-only membership in a project can read the credential that is supposed to be reserved for the link itself. Because that hash can be exchanged for a link-share JWT carrying the share's own permission level, the disclosure becomes a privilege-escalation primitive: if the leaked share was created with write or admin rights, the attacker inherits them and can modify tasks, projects, or administrative settings. The issue is fixed in 2.6.0 per the vendor advisory, and no CISA KEV listing, EPSS score, or public exploit code was present in the supplied intelligence at time of analysis.
Vikunja instances before 2.6.0 expose CalDAV BasicAuth endpoints (/dav, /.well-known, and /feeds) that are not covered by the application's anti-brute-force controls, letting a remote unauthenticated attacker send an unlimited number of credential-guessing requests. Successful guessing against password-only accounts yields full read access to the victim's tasks, projects, and feeds data. The vendor has released 2.6.0 as the fix; no public exploit code or active exploitation has been confirmed in the supplied intelligence.
Vikunja versions before 2.6.0 ship authentication endpoints under /api/v2 (login, register, password-reset, and OAuth token issuance) with no rate limiting, so remote unauthenticated attackers can hammer them with unbounded requests to guess credentials, enumerate accounts, and flood mailboxes with password-reset messages. The exposure is a confidentiality problem — the supplied CVSS 4.0 vector rates high impact to data confidentiality but none to integrity or availability — and a vendor patch exists in 2.6.0. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, so this is best treated as a hardening gap that becomes serious the moment an instance is reachable from untrusted networks.
Unauthenticated attackers can pull restricted live-stream metadata - including RTMP stream keys, stream titles, descriptions, owner details, and direct HLS playback URLs - from two JSON endpoints in the AVideo Live plugin (plugin/Live/stats.json.php and plugin/Live/calendar.json.php) in all versions up to and including 29.0. The endpoints fail to enforce the platform's user-group access restrictions, so content intended only for members of a specific group is exposed to anyone who can reach the server. No public exploit code or CISA KEV entry was identified at time of analysis, but the flaw is trivially automatable over the network with no credentials or user interaction, and CVSS 4.0 rates it 8.7 with high confidentiality impact.
Denial of service in Crawl4AI before 0.9.3 lets untrusted clients exhaust disk, CPU and bandwidth on shared worker processes by choosing the PDF scraping strategy in POST crawl requests and pointing it at large remote PDFs that the server downloads without any size or page limits. The flaw is unauthenticated and remotely triggerable (CVSS 4.0 8.7, AV:N/AC:L/PR:N/UI:N) wherever the Crawl4AI HTTP/server mode is reachable by untrusted clients, while deployments that use Crawl4AI purely as an in-process library with operator-controlled URLs are not exposed. No CISA KEV listing, EPSS score or public exploit code was provided in the available intelligence, so active exploitation and exploit maturity are unconfirmed at time of analysis.
Arbitrary file write in crawl4ai before 0.9.3 allows remote attackers to plant attacker-controlled bytes anywhere the service account can write, by abusing the image_save_dir path accepted in a scrape configuration. The flaw sits in PDFContentScrapingStrategy, where _filter_untrusted_fields fails to validate untrusted configuration fields, so a crafted config body escapes the intended image output directory (CWE-22). Rated 8.7 with a network attack vector and no privileges or user interaction, but with no public exploit code or CISA KEV listing identified at the time of analysis.
An unauthenticated NoSQL injection in Flowise before 3.1.4 lets remote attackers read other users' chat history by abusing the overrideConfig.sessionId parameter handled by the MongoDBMemory node. The parameter is passed into MongoDB queries without sanitization, so submitting MongoDB operator objects (e.g. $ne, $regex, $gt) through the prediction API causes the query to match records belonging to other users in the shared chat collection. Only confidentiality is affected (CVSS 4.0 base 8.7, VC:H, no integrity or availability impact); no CISA KEV listing, EPSS score, or public exploit code was provided at time of analysis, and vendor patch status is 'available' with version 3.1.4 as the fix.
Server-side request forgery in Flowise (an open-source low-code LLM/chatflow orchestration platform) before 3.1.4 lets an authenticated user point the baseURL parameter of a chat-model node at an arbitrary host, causing the Flowise server itself to issue the outbound request. Because stored LLM provider API keys are attached to those requests, an attacker holding the chatflows:create or chatflows:update permission can harvest credentials by redirecting traffic to cloud instance-metadata endpoints (e.g. 169.254.169.254) or internal services reachable from the Flowise host. The issue is fixed in 3.1.4; no CISA KEV entry, EPSS score, or public exploit code was supplied in the source data.
Flowise self-hosted instances before 3.1.4 fail to validate the SQLite file path supplied to the SQL Database Chain node, letting any user who can create or edit a chatflow write arbitrary files on the host as the Node.js process. Because the connector creates a database file at whatever path it is given, a traversed path such as ../../ can place attacker-controlled SQLite databases, scripts, or HTML/JS payloads into system directories or the web root, escalating to command execution or stored XSS. The vendor has released a fix in 3.1.4, and no public exploit code or CISA KEV entry is identified in the supplied intelligence (authenticated, network-reachable exploitation per the CVSS 4.0 vector: PR:L, AV:N).
Unauthenticated path traversal in the Design Scuole Italia WordPress theme allows any remote attacker to read arbitrary files that are readable by the web server process, including wp-config.php and its database credentials. The flaw (CWE-22) lives in the reserved_file_check() function of the theme's functions.php and carries a CVSS 4.0 base score of 8.7 (AV:N/AC:L/PR:N/UI:N/VC:H). The issue was reported by ENISA and flagged by Italy's ACN; no public exploit code was identified at time of analysis and the CVE is not listed in CISA KEV.
Remote unauthenticated attackers can force Hirschmann HiOS industrial switches to reboot by sending a specially crafted HTTP(S) request to a specific endpoint of the device's integrated web server, causing a temporary denial of service. Affected units are those running HiOS versions prior to the fixes released in 07.1.12, 08.7.10, 09.0.13, 09.3.03, 10.3.08 and 10.5.00. No public exploit code or in-the-wild exploitation has been identified at time of analysis, but the flaw is trivially reachable over the network (CVSS 4.0 base 8.7, AV:N/PR:N/UI:N) against any switch whose management interface is exposed.
Server-side template injection in Polyaxon through 2.16.4 lets any user who can submit a run execute arbitrary operating-system commands in the scheduler process by embedding Jinja2 payloads in spec fields such as queue, namespace, conditions, presets, or dependencies. Because the scheduler renders those fields with an unsandboxed Jinja2 environment, a low-privileged authenticated tenant can reach database credentials and service tokens held by the scheduler, turning a normal ML experiment submission into host-level code execution (CWE-1336, CVSS 4.0 base 8.7). No public exploit code or CISA KEV entry was identified at time of analysis, but the attack requires only a valid low-privilege account and no user interaction.
Authenticated SSH users who can reach privileged 'enable' mode on Lite-On FF-RFI079I4 and FF-RFI078I4 5G FlexFi devices can invoke an undocumented hidden function (CWE-912) to execute arbitrary OS commands, giving full control of the appliance with high confidentiality, integrity, and availability impact. Firmware versions below 02.01.15 are affected and a vendor fix is available. No public exploit code and no CISA KEV entry were identified at time of analysis, and the vendor/JVN rates the issue CVSS 4.0 8.7 (PR:L, UI:N).
Authentication bypass in Oracle Forms (component: Forms Services, C/S, Charmode) allows an unauthenticated remote attacker with HTTP access to reach data and functionality that should require a valid session, affecting versions 12.2.1.19.0 and 14.1.2.0.0. The flaw carries a CVSS 3.1 base score of 8.6 with a scope-change flag, meaning a compromise of Oracle Forms can pivot to impact other products connected to or served by the Forms tier. Only high confidentiality impact is documented (no integrity or availability impact per the vector), and there is no public exploit code or CISA KEV listing at time of analysis.
Unauthenticated remote attackers can read critical data from the Oracle Identity Manager Connector (Core component) in versions 12.2.1.4.0 and 14.1.2.1.0 by sending crafted HTTP requests, with no authentication or user interaction required. Oracle scores the flaw CVSS 8.6 (AV:N/AC:L/PR:N/UI:N) and classifies it as an authentication bypass with high confidentiality impact only; the scope-change metric means a successful attack can also expose downstream products that the connector reaches. No public exploit code or active exploitation is identified at time of analysis, and EPSS data was not provided, so real-world aggressiveness cannot be quantified.
Unauthenticated remote attackers can upload files of dangerous type to Dell Wyse Management Suite deployments running versions prior to 2605.0.3.683, because the console fails to restrict uploaded file types (CWE-434), which allows a crafted payload such as a web shell to be placed and executed on the server. The flaw carries a CVSS 3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N), meaning no credentials or user interaction are required — only network reachability to the WMS web interface. Neither CISA KEV listing nor public exploit code has been identified in the supplied intelligence, so at time of analysis this is a severe but not yet confirmed-exploited issue.
Unauthenticated attackers with network reachability to the SSH interface of Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.7) can bypass authentication and gain unauthorized access to critical CRM data through the Siebel Cloud Manager component. Oracle scores the flaw 8.6 with a scope change, meaning a successful compromise can extend beyond the Siebel deployment to affect additional products. No public exploit code, EPSS score, or CISA KEV entry was provided at the time of analysis, although the low-complexity, no-credentials attack profile makes rapid weaponization plausible.
Unauthenticated attackers with network access to Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 can compromise the Authentication Engine component over HTTP, obtaining unauthorized read access to critical data or all data accessible through the product. Oracle rates this CVSS 3.1 8.6 with a scope change (S:C), meaning affected deployments can be leveraged to significantly impact downstream/connected applications that trust OAM identities. At time of analysis there is no public exploit code identified and no CISA KEV listing, but the attack is trivially automatable (AV:N/AC:L/PR:N/UI:N), so internet-exposed OAM consoles and SSO endpoints should be treated as high priority.
Netcore NR255-V firmware 1.5.130703 ships a stack-based buffer overflow in the reboot_timer_set.cgi web endpoint, reachable through the router's HTTP management interface. The flaw stems from improper sscanf token parsing of user-supplied input, allowing a user who already holds administrative credentials on the device to corrupt stack memory and potentially execute code in the router's firmware context or crash/reboot it. No public exploit code or CISA KEV listing was provided at time of analysis, and no vendor-published patched firmware version appears in the supplied references.
Netcore NR255-V routers running firmware 1.5.130703 build root-privileged shell command lines from unquoted DDNS configuration input in DDNSset_cgi.c and related ddns_Proc.c code, letting an authenticated administrator inject extra command arguments that execute as root. Successful abuse yields complete device compromise, including configuration theft, traffic interception, and use of the router as a foothold into the LAN. The CVSS 4.0 vector indicates network reachability with high prerequisites, and no public exploit code or CISA KEV entry was present at time of analysis; the public technical reference writeup is the main disclosure vehicle.
The user wants a JSON analysis for CVE-2026-87273, Oracle VM VirtualBox Core, CVSS 8.6, AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. Let me construct fields carefully. Product name: "Oracle VM VirtualBox" (3 words... "Oracle VM VirtualBox" - that's 3 words). Good. Summary: Do not start with "A vulnerability". Start with impact verb + product. Something like: "Oracle VM VirtualBox 7.2.16 contains a Core component flaw that lets an attacker with logon access to the host... trigger memory corruption via a crafted guest/host interaction requiring user interaction, leading to full takeover of the VirtualBox process with scope change affecting additional products." Technical context: Hypervisor/core component, scope change S:C means the vulnerability in VirtualBox can impact other components (e.g., host OS or other VMs). AV:L means local access — attacker must have logon to infrastructure where VirtualBox executes — that's a common Oracle phrasing for AV:L (local logon, but not necessarily VM guest). CWE not provided, but Oracle typically assigns memory safety / sandbox escape classes. We shouldn't invent CWE. State that CWE was not assigned/provided and the root cause class is inferred from CVSS scope change and impacts — likely a flaw in the Core component enabling escape from intended privilege boundary. Risk assessment: CVSS 8.6 high, AV:L reduces, AC:L, PR:N but requires logon (authentication requirement nuance — description says "unauthenticated attacker with logon to the infrastructure"). PR:N in vector but "with logon" is ambiguous — Oracle's AV:L/PR:N means the attacker has a local account on the host but no elevated privileges. UI:R — requires victim user interaction. S:C — scope change. EPSS not provided, no KEV, no POC info. State explicitly that EPSS/KEV data absent. Affected products: Oracle VM VirtualBox 7.2.16 (per Oracle advisory cspusep2026). Note the advisory URL. CPE not provided. Remediation: patch — Oracle advisories reference fixes in CPUs; version f
Unauthenticated remote attackers can compromise Oracle BI Publisher 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0 through the HTTP interface, gaining high-impact read access to all data reachable by the application plus limited write and partial denial-of-service capability. Oracle rates the flaw 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) and classifies it as easily exploitable in the BI Platform Security component of Oracle Analytics; no public exploit code, EPSS score, or CISA KEV entry was supplied with the source data at time of analysis.
Unauthenticated remote attackers can crash and partially tamper with Oracle BI Publisher by sending crafted requests to its SOAP web services, affecting versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. The flaw is rated CVSS 8.6 (AV:N/AC:L/PR:N/UI:N) with high availability impact plus low confidentiality and integrity impact, meaning a successful hit can hang or repeatedly crash the service while also allowing unauthorized read and update/insert/delete access to some BI Publisher data. No public exploit code or CISA KEV listing was present in the supplied intelligence, and no EPSS score was provided, so the practical exploitation risk must currently be judged from the exposure of the SOAP interface rather than from observed attack activity.
Unauthenticated network attackers can reach the Open UI component of Oracle Siebel CRM End User (versions 17.0 through 26.7) over HTTP and gain unauthorized read access to critical data, limited insert/update/delete access, and the ability to partially degrade availability. Oracle rates the issue CVSS 3.1 base 8.6 (AV:N/AC:L/PR:N/UI:N), meaning no credentials or user interaction are needed; the accompanying tags indicate an authentication-bypass class flaw. There is no CISA KEV entry, no EPSS score, and no public exploit identified at time of analysis, and Oracle has published the fix through its Critical Security Patch Update advisory.
Unauthenticated attackers positioned on an adjacent network segment can crash HPE Networking EdgeConnect SD-WAN Gateway appliances by sending crafted traffic, causing a denial of service that the device cannot recover from without manual intervention. All four maintained firmware branches are affected: 9.4.0.0 through 9.4.8.2, 9.5.0.0 through 9.5.8.1, 9.6.0.0 through 9.6.3.1, and 9.7.0.0. The vendor rates this 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) and the only publicly indexed advisory is HPE's own security bulletin (hpesbnw05135en_us); no CISA KEV listing, EPSS score, or public proof-of-concept code was present in the supplied intelligence, so active exploitation is unconfirmed.
Unauthenticated remote code execution affects Dell Wyse Management Suite deployments running any version prior to 2605.0.3.683, caused by an unrestricted file upload (CWE-434) that lets an attacker place a file of a dangerous type on the server. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials or user interaction are required, and the high integrity impact (I:H) reflects the ability to modify or replace server-side content with attacker-controlled code. No public exploit code and no CISA KEV listing were identified at time of analysis, but the low attack complexity and network reachability of the WMS administrative web interface make rapid patching the correct posture.
Unauthenticated remote code execution in Dell Wyse Management Suite (WMS) lets any remote attacker who can reach the management/web interface upload a file of a dangerous type and have it executed on the WMS server, affecting all releases prior to 2605.0.3.683. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no credentials and no user interaction are required, so the only meaningful barrier is network reachability of the WMS console; this presents as a high-priority exposure for any organization with the console exposed beyond a trusted management network. There is no indication of confirmed active exploitation (the issue is not in CISA KEV) and no public exploit code has been identified at time of analysis, though Dell rates it 8.6 and independent assessment places the impact higher (C:H/I:H/A:H) than the vendor vector's C:L/I:H/A:L, reflecting full confidentiality, integrity and availability loss on the WMS host.
Agent-coderag versions up to and including 1.3.0 execute a repository-supplied Gradle wrapper during the default `agent-coderag sync` dependency-discovery flow, letting an attacker who plants a malicious `gradlew` in a Gradle project run arbitrary code with the victim's operating-system privileges. The flaw is a command-injection design error (CWE-78) in `code_rag/core/manager.py`, where a repository-local `gradlew` is unconditionally preferred over the system `gradle` binary and passed to `asyncio.create_subprocess_exec`; CVSS 3.1 base 8.6 with user interaction required (UI:R) because the victim must index the hostile repository. Upstream fixed the issue in 1.3.1 by using only the PATH-resolved system `gradle`; no public exploit code has been identified and the CVE is not in CISA KEV at time of analysis.
Full takeover of Oracle Access Manager is achievable by a low-privileged, network-positioned attacker who can reach the product's HTTP Authentication Engine, affecting supported versions 12.2.1.4.0 and 14.1.2.1.0 of Oracle Fusion Middleware. The flaw requires valid low-privilege credentials (PR:L) and is rated hard to exploit (AC:H), but its scope-change rating means a successful attack against OAM can cascade into the downstream applications that rely on it for single sign-on. As of analysis, no public exploit code and no CISA KEV listing were identified, and the input contained no EPSS score, so real-world exploitation pressure is unquantified despite the 8.5 base score.
Oracle Marketing, a module of Oracle E-Business Suite (Audience component), versions 12.2.3 through 12.2.15, exposes an easily exploitable flaw that lets a low-privileged, network-connected attacker read critical data and modify some records through the HTTP interface — with a scope change that can extend impact to other EBS products. Oracle rates it CVSS 3.1 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) and released a fix in its Critical Security Patch Update (cspusep2026.html). No public exploit code or CISA KEV listing was present in the supplied intelligence, so exploitation is currently assessed as opportunistic rather than confirmed active.
Improper authorization on the SOAP-facing Client Bundle interface of Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged, network-positioned attacker read all data the application can reach and modify a subset of it. Oracle scores it 8.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N), and the Changed scope metric indicates the blast radius can extend beyond Capture into other Fusion Middleware components. No public exploit code or CISA KEV entry was identified at time of analysis; the Oracle Critical Security Patch Update advisory (cspusep2026) is the authoritative source.
Low-privileged authenticated users with network access can exploit a flaw in the Client Bundle component of Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 to read critical data and modify records, with the impact extending beyond the vulnerable product itself (scope change). Oracle rates the issue CVSS 3.1 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N), driven by high confidentiality impact and cross-component scope change rather than by availability or integrity loss. No public exploit code and no evidence of active exploitation were identified at time of analysis, and no EPSS or CISA KEV data was supplied with the source material.
Oracle PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 contain a flaw in the Business Interlink component that lets a low-privileged, network-reachable user read or fully compromise PeopleTools-accessible data and modify or delete some of it, with impact extending to other connected products (scope change). Oracle rates it CVSS 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) and notes it is 'easily exploitable' by a low-privileged attacker over HTTP. No EPSS score, CISA KEV listing, or public proof-of-concept was present in the supplied intelligence, so active exploitation is not confirmed at time of analysis.
Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 contain an easily exploited authorization flaw in the Runtime Tools component that lets a low-privileged, network-connected user reach and manipulate data well outside their intended scope, including data belonging to connected products (CVSS 8.5, scope change, high confidentiality and low integrity impact). Exploitation requires only a valid low-privilege portal account and standard HTTP access — no user interaction — making it attractive for lateral movement inside enterprise portal deployments. There is no public exploit identified at time of analysis, and no CISA KEV listing or EPSS score was supplied in the available intelligence.
Authentication bypass in the Security component of Oracle Hyperion Financial Management 11.2.26.0.000 lets a low-privileged user with network access over HTTP read critical financial data and make limited unauthorized modifications, with a scope change that can expose other connected Oracle products. Oracle rates it CVSS 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N), meaning exploitation requires only a low-privileged authenticated session — not administrative rights — and no user interaction. No public exploit code has been identified and the issue is not listed as confirmed actively exploited (CISA KEV); no EPSS score was supplied with the available data, so real-world exploitation likelihood is unquantified at this time.
Improper access control in the Oracle HRMS (India) module of Oracle E-Business Suite lets a low-privileged, network-connected attacker read, and to a lesser extent modify, data they should not reach by sending crafted HTTP requests to the Internal Operations component. Supported releases 12.2.3 through 12.2.15 are affected; due to a scope change the compromise can propagate beyond the HRMS (India) module into other reachable EBS data. No public proof-of-concept, EPSS score, or CISA KEV listing was present in the supplied intelligence, so there is no confirmed evidence of active exploitation at time of analysis.
Oracle iRecruitment, a module of Oracle E-Business Suite, contains an easily exploitable flaw in its Internal Operations component affecting versions 12.2.3 through 12.2.15. An attacker holding a low-privileged account can exploit it over HTTP without user interaction to read critical recruitment data and modify some of it, with the impact able to extend into other EBS modules because the CVSS vector carries a scope change (S:C). No public exploit code or CISA KEV listing was identified at time of analysis, so prioritization should rest on the CVSS 8.5 base score and the breadth of the affected version range rather than observed exploitation.
Authenticated takeover of Oracle Product Workbench in Oracle E-Business Suite 12.2.3 through 12.2.15 is achievable by a low-privileged attacker reaching the application over HTTP, with the vendor scoring it 8.5 for high confidentiality, integrity and availability impact plus a scope change that extends damage onto other EBS products. Exploitation is rated difficult (AC:H) because the attacker must satisfy specific conditions inside the Internal Operations component, and no public exploit code or CISA KEV entry has been identified at time of analysis. No EPSS score was supplied, so real-world exploitation likelihood is not independently quantified and the flaw should be treated as a patch-cycle priority rather than a confirmed emergency.
A low-privileged authenticated attacker with HTTP access to the Oracle Bills of Material module in Oracle E-Business Suite 12.2.3 through 12.2.15 can read critical Bills of Material data beyond their authorization and partially degrade availability of the module, with the impact extending into other, additional Oracle products (scope change). Oracle rates this 8.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) in its 2026 Critical Security Patch Update advisory, and the flaw is considered easily exploitable because it needs no user interaction or complex timing. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; no EPSS score or POC reference was supplied with the intelligence for this analysis.
Low-privileged authenticated users of Oracle Complex Maintenance, Repair and Overhaul (CMRO) 12.2.12–12.2.15 can send crafted HTTP requests to the Internal Operations component to gain unauthorized access to critical data and partially degrade availability, with the CVSS scope-change flag indicating impact can extend to other Oracle E-Business Suite modules. Oracle's Critical Security Patch Update is the only remediation reference supplied; there is no EPSS score, no CISA KEV listing and no public exploit evidence in the provided intelligence, so the issue is currently a patch-now hygiene item rather than a confirmed actively exploited threat.
Oracle Business Intelligence Enterprise Edition (BI EE) versions 8.2.0.0.0 and 26.01.0.0.0 contain an easily exploitable flaw in the Analytics Actions component that lets a low-privileged, HTTP-reachable user read critical data and tamper with a subset of stored data, with the impact extending beyond the BI EE instance itself (CVSS scope change). Oracle rates it 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N), and the vulnerability is addressed in the April 2026 Critical Security Patch Update. No public exploit code has been identified and the issue is not listed in CISA KEV, so risk is driven by exposure of BI EE endpoints to authenticated internal or external users.
Oracle BI Publisher (a component of Oracle Analytics) is affected by an easily exploitable, network-reachable flaw in the BI Platform Security component across versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. A low-privileged attacker who can reach the SOAP interface can compromise the reporting platform, obtaining high-confidence read access to critical data and limited ability to modify it, with the impact spilling over into other Oracle products because the CVSS vector carries a scope change (S:C). No public exploit code or CISA KEV entry was present at time of analysis, and the vendor's own score of 8.5 reflects high confidentiality impact rather than a wormable, unauthenticated issue.
Oracle BI Publisher (an Oracle Analytics reporting component) versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0 contain a flaw in the Web Server component that lets a low-privileged, network-positioned attacker read critical data and alter or delete a subset of records through HTTP, with impact potentially extending beyond the vulnerable component to other Oracle Analytics products. Oracle rates it CVSS 3.1 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) in its October-lineage Security Alert. No public exploit code, EPSS score, or CISA KEV entry was present in the supplied intelligence, so active exploitation is unconfirmed.
Oracle BI Publisher versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0 contain a flaw in the BI Platform Security component that lets a low-privileged attacker with network access to the SOAP interface alter or delete critical report and platform data, and read a limited portion of it. The CVSS 3.1 base score is 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N), driven by a scope change that means compromise of BI Publisher can cascade into other Oracle Analytics components. No public exploit code or active exploitation has been identified at time of analysis, and no CWE or EPSS data was supplied.
Oracle BI Publisher 12.2.1.4.0, the enterprise reporting tier of Oracle Analytics, lets a low-privileged network attacker reach data well beyond their granted entitlements and partially degrade the service through crafted HTTP requests to the BI Publisher Security component. Oracle scores it 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L), and the scope-change metric indicates that a compromised deployment can expose additional, integrated Oracle products that trust BI Publisher. No public exploit code, CISA KEV listing, or EPSS estimate was supplied with the source data, so exploitation status at time of analysis is 'no public exploit identified' and remediation depends on the referenced Oracle security alert.