Full takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 is achievable by an unauthenticated remote attacker who can reach the Forge component over TCP, with successful exploitation yielding complete confidentiality, integrity, and availability impact (C:H/I:H/A:H) per Oracle's advisory and the corroborating ENISA EUVD-2026-79606 record. Oracle explicitly characterises the flaw as 'Difficult to exploit' (CVSS AC:H), meaning a condition outside the attacker's direct control - such as a timing window, race condition, or a specific data-processing state - must be satisfied before exploitation becomes reliable, so mass opportunistic scanning is unlikely. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied with the source data; practical exposure is bounded to installations where Forge is network-reachable, which for most deployments is an internal data-pipeline interface rather than an internet-facing default service.
Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 contains a vulnerability in the Forge component that lets an unauthenticated attacker reachable over HTTP take over the affected instance, with full confidentiality, integrity, and availability impact. Oracle rates the flaw 8.1 but notes it is difficult to exploit (AC:H), which suggests a race condition, timing dependency, or narrow parsing precondition rather than a straightforward request-and-execute path. No public exploit code has been identified and the issue is not listed in CISA KEV, so current exposure is driven by the value of an internet-facing commerce platform rather than by observed mass exploitation.
Unauthenticated remote attackers can achieve full takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 by exploiting a difficult-to-trigger flaw in the Forge component that is reachable over HTTP. Oracle rates the issue CVSS 8.1 (AV:N/AC:H/PR:N/UI:N with high confidentiality, integrity and availability impact) while explicitly describing it as hard to exploit. No public exploit code or CISA KEV entry has been identified, and no EPSS score was supplied with the advisory data, so active exploitation is not evidenced at time of analysis.
Oracle Siebel CRM Integration versions 23.6 through 26.7 expose the Event Publish and Subscribe component to unauthenticated attackers who can reach the server from the same network segment, allowing them to read, create, delete, or modify critical CRM data (CVSS 3.1 base 8.1, AV:A/AC:L/PR:N/UI:N/C:H/I:H/A:N). Because the attack vector is adjacent network rather than internet-facing, exposure is gated by network topology rather than by credentials, and no public exploit code or CISA KEV entry is associated with this CVE at time of analysis. Exploitation probability scoring (EPSS) was not supplied with the source data, so prioritization should rest on asset criticality and segment reachability.
Oracle Siebel CRM End User (Open UI component) versions 17.0 through 26.7 can be taken over by an unauthenticated, network-positioned attacker who reaches the Open UI HTTP interface, and who manages to satisfy the high-complexity conditions of the flaw. Oracle's own CVSS 3.1 rating is 8.1 with high confidentiality, integrity and availability impact, reflecting full application compromise rather than a narrow data leak. No public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis, so the practical urgency stems from the breadth of the affected version range and the criticality of CRM data rather than from observed attacks.
Oracle Siebel CRM Deployment (Server Infrastructure component), versions 17.0 through 26.7, can be fully taken over by an unauthenticated network attacker who reaches the deployment's TCP service and successfully exploits a difficult-to-trigger flaw. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N, C:H/I:H/A:H, score 8.1) confirms no credentials or user interaction are required, but the high attack complexity means the attacker must satisfy a narrow, non-trivial condition to succeed. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and no EPSS score was supplied; Oracle published the fix in its Critical Security Patch Update advisory referenced below.
Low-privileged users of Oracle One-to-One Fulfillment (the Documents component of Oracle E-Business Suite 12.2.3 through 12.2.15) can read, create, delete, or modify critical fulfillment and document data over HTTP without any user interaction. Oracle assigns it a CVSS 3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), meaning the attacker only needs network reachability plus a low-privileged account, not administrative rights. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied in the source data.
Improper authorization in the Application Framework component of Oracle CRM Technical Foundation (Oracle E-Business Suite 12.2.3–12.2.15) lets a low-privileged user with ordinary HTTP access to the instance read and alter critical CRM data that should be restricted to higher-privileged roles — integrity and confidentiality are both rated High, availability is unaffected. Oracle scores it 8.1 (AV:N/AC:L/PR:L/UI:N), meaning exploitation is straightforward but requires a valid low-privilege account rather than anonymous access. No public exploit code or active exploitation has been reported in the supplied intelligence, and no EPSS value was provided, so it should be treated as a patch-priority issue rather than an emergency.
Unauthenticated attackers who can reach the One-to-One Fulfillment module of Oracle E-Business Suite 12.2.3 through 12.2.15 over HTTP can achieve complete takeover of that component, with high confidentiality, integrity, and availability impact (CVSS 8.1). Oracle characterizes the flaw as difficult to exploit (AC:H), which tempers the unauthenticated network attack vector, and the issue resides in the module's Java Server layer. No public exploit code and no CISA KEV listing were identified at time of analysis, and Oracle published the fix as part of its September 2026 Critical Security Patch Update.
Improper authorization control in the Oracle Project Intelligence module of Oracle E-Business Suite allows a low-privileged authenticated user with network access to read, create, modify, or delete data across the module, including records the account should never reach. Affected releases are 12.2.3 through 12.2.15; the vendor's own CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:N, base 8.1) indicates the flaw is trivially automatable once credentials exist, because no user interaction is needed. No public exploit code, KEV listing, or EPSS estimate was supplied with the available intelligence, so active exploitation should be treated as unconfirmed rather than assumed.
Unauthenticated network attackers can bypass authentication in the eDetailing component of the Siebel Apps - Life Sciences module shipped with Oracle Siebel CRM, affecting versions 17.0 through 26.7, and gain both read and write access to critical CRM data — provided a human other than the attacker is induced to interact with a crafted HTTP request. Oracle scores this 8.1 (AV:N/AC:L/PR:N/UI:R, C:H/I:H/A:N), reflecting full confidentiality and integrity compromise but no availability impact and only the Life Sciences vertical exposed. No public exploit code or active exploitation has been identified at time of analysis, and the vendor advisory is Oracle's September 2026 Critical Security Patch Update (cspusep2026.html).
Authenticated, low-privileged attackers with HTTP access to Oracle iStore in Oracle E-Business Suite 12.2.3 through 12.2.15 can read, create, modify, or delete critical shopping-cart, order, and customer data, giving them full read and write reach into all iStore-accessible records. The flaw sits in the Shopping Cart component and is rated CVSS 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), meaning it is remotely reachable over HTTP with no user interaction and only a low-privilege account. No CISA KEV listing and no public exploit code were identified at time of analysis, so exploitation is currently presumed opportunistic rather than confirmed in the wild.
Unauthenticated remote attackers able to reach the Oracle Forms Services HTTP listener can fully compromise Oracle Forms deployments in Oracle Fusion Middleware 12.2.1.19.0 and 14.1.2.0.0, gaining complete control of confidentiality, integrity and availability of the affected service (CVSS 3.1 8.1, AV:N/AC:H/PR:N/UI:N). The flaw resides in the Forms Services, C/S and Charmode component set and is described by Oracle as difficult to exploit, meaning success depends on specific timing or state conditions rather than a trivial one-shot request. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied, so the current exploitation signal is theoretical rather than confirmed in the wild.
Oracle Alert, a component of Oracle E-Business Suite (12.2.3 through 12.2.15), exposes an authorization weakness in its Internal Operations component that lets a low-privileged, network-positioned attacker read and manipulate critical Alert data over HTTP. The flaw carries a CVSS 3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:N), reflecting high confidentiality and integrity impact with no user interaction required. No public exploit code has been identified at time of analysis, and the issue has not been confirmed as actively exploited (CISA KEV); remediation is available through Oracle's Critical Security Patch Update cycle, so patching should be prioritized for internet- or partner-facing EBS deployments.
Oracle Siebel CRM Cloud Applications versions 22.3 through 26.7 expose the Siebel Cloud Manager component to unauthenticated attackers who can reach the host over an adjacent network segment, allowing full read and write access to critical CRM data. The flaw is rated CVSS 8.1 (AV:A/AC:L/PR:N/UI:N, C:H/I:H/A:N) and is tagged as an authentication bypass, meaning no credentials or user interaction are required once an attacker is positioned on the same physical or logical communication segment as the affected service. There is no CISA KEV listing and no public exploit identified at time of analysis, but the low attack complexity and lack of authentication make the vulnerability highly automatable for anyone who already holds a foothold inside the hosting network or cloud subnet.
Authenticated low-privileged users of Oracle E-Business Suite 12.2.3 through 12.2.15 can abuse the Applications Framework 'Search Bean' component to read, create, delete, or modify critical data they should not be able to touch, giving an attacker with a basic application account broad confidentiality and integrity impact across the framework. The vulnerability is remotely reachable over HTTP with low attack complexity and no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 8.1), so any valid low-privilege credential is effectively a stepping stone to full data compromise. There is no public exploit code and no CISA KEV listing at time of analysis, but the Oracle quarterly patch referenced in the advisory is the only reliable fix.
Oracle JDeveloper 12.2.1.4.0 and 14.1.2.0.0 expose the ADF Shared Components to low-privileged attackers who can reach the product over HTTP, allowing unauthorized creation, deletion, or modification of critical data and repeatable crashes that produce a complete denial of service. Rated CVSS 8.1 (AV:N/AC:L/PR:L/UI:N, integrity and availability high, confidentiality none), it is trivially automatable once any valid low-privileged account exists, but no public exploit code and no CISA KEV entry have been identified at time of analysis and no EPSS score was supplied with the source data. Because JDeveloper is a developer IDE rather than an internet-facing production service, real-world exposure is largely confined to development and build environments where the integrated ADF/WebLogic runtime is reachable on the network.
Unauthenticated remote code execution and denial-of-service in HPE Aruba Networking EdgeConnect SD-WAN Gateways (versions 9.4.0.0–9.4.8.2, 9.5.0.0–9.5.8.1, 9.6.0.0–9.6.3.1, and 9.7.0.0) arise from flawed parsing of malformed or truncated packets in the proxy packet-processing path, where incorrect length arithmetic triggers an integer overflow that can become a memory-corruption (buffer overflow) condition. Successful exploitation can let a network-positioned attacker execute code or crash the gateway, taking down the SD-WAN overlay. The HPE advisory at support.hpe.com confirms affected version ranges, but there is no CISA KEV listing, no EPSS score, and no public exploit code identified at time of analysis, so this is currently a patch-now, watch-for-exploitation item rather than a confirmed active campaign.
Unauthenticated remote attackers can circumvent the authentication controls exposed by the API of HPE Networking EdgeConnect SD-WAN Orchestrator, escalating to administrative privileges and achieving complete compromise of the orchestrator host. The vendor rates this 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), and EUVD maps the affected code lines to EdgeConnect SD-WAN releases 9.4.0 through 9.4.10, 9.5.0 through 9.5.8, 9.6.0 through 9.6.3, and 9.7.0. No CISA KEV listing or public exploit code was identified in the supplied intelligence, and EPSS data was not provided, so the practical exploitation risk rests on the high attack complexity (AC:H) noted in the vendor vector.
A buffer overflow in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways allows an unauthenticated remote attacker to execute arbitrary commands on the underlying host, resulting in full operating-system compromise of the appliance. Multiple maintenance trains are affected — 9.4.0.0 through 9.4.8.2, 9.5.0.0 through 9.5.8.1, 9.6.0.0 through 9.6.3.1, and the 9.7.0.0 release. The vendor's own CVSS rating is 8.1 (AV:N/AC:H/PR:N/UI:N), reflecting that exploitation is unauthenticated but gated by preconditions outside the attacker's control; no public exploit code or CISA KEV listing was identified at time of analysis.
Improper validation of the quantity parameter in Webkul Bagisto 2.4.9's add-to-cart path lets an authenticated storefront shopper submit a manipulated quantity so the cart and resulting order total fall below the legitimate price of shippable goods, allowing them to underpay for their own orders. The independent assessment rates this as a low-integrity impact (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), which is materially lower than the originally published 8.1 high score (C:H/I:H/A:N), because exploitation only affects the attacker's own cart pricing, exposes no other users' data, and causes no availability loss. There is no public exploit identified at time of analysis and the issue is not confirmed as actively exploited; the practical consequence is financial loss to the merchant rather than system compromise.
A heap buffer overflow in the IBM MQ client (CWE-787) can be triggered when the client processes crafted messages delivered by a malicious or compromised queue manager, or by an attacker positioned to man-in-the-middle the client-to-manager channel. Successful exploitation can crash the client for a denial-of-service condition or, more seriously, allow arbitrary code execution in the context of the client process. IBM has released a vendor fix via support bulletin 7284943; there is no public exploit code or CISA KEV entry identified at time of analysis, and the elevated complexity (the attacker must control the server side of the connection) keeps real-world risk below its 8.1 CVSS base score for most deployments.
IBM MQ versions 9.1.0.0 through 9.4.5.1 across LTS and CD streams and 10.0.0.0 are affected by a JNDI injection flaw that can lead to information disclosure or remote code execution. The issue arises from insufficient input validation before JNDI lookup (CWE-74), and according to the supplied CVSS vector it is remotely reachable without authentication (AV:N/AC:H/PR:N/UI:N), though exploitation requires the attacker to also control a network-reachable directory service and successfully resolve malicious object references in the MQ JVM. No public exploit identified at time of analysis, and CISA SSVC records exploitation as none with automatable set to no; IBM has released patches per its advisory.
IBM MQ message queueing middleware fails to properly restrict XML external entity resolution while processing MQRFH2 message headers, letting an authenticated queue user read server-side files or resources and drive the broker and its Java clients into a denial-of-service state. Affected releases span the 9.1.x, 9.2.x, 9.3.x and 9.4.x LTS/CD streams plus 10.0.0.0 Classes for Java, so any environment running the JMS/XMS or Java messaging client against a current broker is in scope. IBM has published a vendor fix and there is no public exploit code or CISA KEV entry identified at time of analysis, but the confidentiality and availability impact are both rated High (CVSS 8.1, AV:N/AC:L/PR:L/UI:N).
An authentication bypass in OpenBMC's phosphor-net-ipmid IPMI stack lets a network attacker with no credentials complete IPMI 2.0 RAKP session authentication and obtain full BMC control. A crafted RAKP Message 1 forces the handler to return before the authentication object's constructor defaults are overwritten, so the service accepts a RAKP Message 3 whose HMAC is keyed with the hard-coded 20-byte 'userKey' derived from the string '0penBmc' combined with an often-predictable 'bmcRandomNum'. The flaw affects downstream vendors that ship phosphor-net-ipmid as their IPMI implementation, including NVIDIA and H3C, and runZero published a public advisory; no CISA KEV entry or EPSS score was supplied, and no patched version was identified in the provided data.
Authenticated server-side request forgery in CRMEB v6.0.0 lets a logged-in user coerce the server into issuing arbitrary outbound HTTP requests through the /adminapi/file/online_upload endpoint, enabling internal network reconnaissance and access to resources that are otherwise unreachable from the internet. The flaw is trivially triggered with a crafted POST request (CVSS 8.1, AV:N/AC:L/PR:L/UI:N) and requires only a valid low-privileged session on the admin API. There is no CISA KEV listing and no confirmed public exploit code at time of analysis, though a third-party advisory was published alongside the CVE.
Scheduled-job management functionality in 1024-lab SmartAdmin v3.30.0 is exposed without method-level permission checks, so any user who already holds a valid low-privileged account can reach administrator-only endpoints in AdminSmartJobController. Successful exploitation yields high confidentiality and integrity impact — job definitions and their parameters can be read, created, modified, or deleted — while availability is not directly affected per the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 8.1). There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was supplied, so current risk is driven by exposure of the application to authenticated non-admin users rather than by observed mass exploitation.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets an attacker who already holds a low-privileged account and sits on the same adjacent network segment as the HFM server take full control of the application. Exploitation is rated AV:A/AC:L/PR:L/UI:N with high confidentiality, integrity and availability impact, and Oracle's January 2026 Security Alert (cspusep2026) is the authoritative advisory. No public exploit code has been identified and there is no CISA KEV listing at the time of analysis, so risk is concentrated in environments where untrusted parties can reach the HFM host's network segment.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets an unauthenticated attacker positioned on the same adjacent network segment read and tamper with critical financial consolidation data. The vendor rates it CVSS 8.0 (AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N), reflecting a hard-to-execute but high-impact attack that can also affect connected EPM products through a scope change. No public exploit code or CISA KEV listing was identified at time of analysis, and no CWE or EPSS data accompanies the advisory.
Oracle Banking Branch versions 14.5.0.0.0 through 14.9.0.0.0 contain an exploitable weakness in the Reports component that lets a low-privileged, network-connected user achieve full takeover of the application, with potential knock-on impact to other connected products (scope change). Exploitation is rated 8.0 by Oracle's CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H), meaning the attacker must already hold a valid low-privilege account and must persuade a second person to perform an action, which raises attack complexity despite the high impact. No public exploit code and no CISA KEV listing were present in the supplied intelligence at time of analysis.
Oracle Advanced Benefits, a module of Oracle E-Business Suite versions 12.2.3 through 12.2.15, can be fully taken over by a high-privileged attacker who reaches the Self-Service What-if Analysis component over HTTP. The vendor-assigned CVSS 3.1 score is 8.0 (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H), reflecting a hard-to-exploit but high-impact flaw that can also affect additional products beyond the vulnerable component (scope change). No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS probability was supplied with the source data.
High-privileged users who can already authenticate to Oracle E-Business Suite can trigger a hard-to-reach flaw in the Bills of Material Setup Workbench component of versions 12.2.3 through 12.2.15 and take full control of that module, with the potential to pivot into other connected EBS products because of the scope change. Oracle rates the issue CVSS 3.1 base 8.0 with high confidentiality, integrity and availability impact, but exploitation is described as difficult and requires an authenticated, privileged position plus network access over HTTP. No public exploit code or confirmed active exploitation has been identified at the time of analysis, and the only reference available is Oracle's Critical Security Patch Update advisory.
Authenticated high-privilege abuse in Oracle Application Object Library (AOL) Core, the shared foundation component of Oracle E-Business Suite 12.2.3 through 12.2.15, lets an attacker who already holds elevated EBS application privileges reach a vulnerable code path over HTTP and achieve full takeover of the AOL component itself. Exploitation is rated difficult (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H, base 8.0), so success depends on conditions outside the attacker's direct control, and the high-privilege prerequisite sharply limits who can mount the attack. The offsetting aggravator is the scope change: a successful compromise can significantly impact additional integrated EBS products beyond AOL, and no public exploit code has been identified at time of analysis, so this is a genuine but hard-to-reach post-authentication risk rather than an opportunistic remote flaw.
An adjacent-network attacker holding a low-privileged Oracle E-Business Suite account can fully take over the Oracle One-to-One Fulfillment module (Documents component) in EBS releases 12.2.3 through 12.2.15, with high confidentiality, integrity and availability impact. Exploitation requires the attacker to sit on the physical communication segment serving the host where One-to-One Fulfillment runs, but needs no user interaction and no elevated privileges once there, making a single craftable request sufficient for complete compromise of the module. No public exploit code and no CISA KEV listing were present in the available intelligence at time of analysis, and no EPSS score was supplied to quantify real-world exploitation likelihood.
Command-line processing in Oracle Applications Manager, a component of Oracle E-Business Suite 12.2.3 through 12.2.15, can be abused by a high-privileged attacker with network access over HTTP to take full control of the Applications Manager host and, because of a scope change, to significantly impact other linked EBS products. Oracle's own vector (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) indicates that exploitation is difficult and requires an already-elevated account (a privileged operator, administrator, or equivalent account with access to the RapidClone command-line functionality), and no public exploit code or CISA KEV listing has been identified at time of analysis. No EPSS score was supplied with the source data, so the probability of real-world exploitation cannot be quantified from the available intelligence.
A high-severity flaw in the Internal Operations component of Oracle Spares Management, part of Oracle E-Business Suite, lets a high-privileged attacker who already holds a valid EBS account and HTTP network access take over the Spares Management module and pivot into connected products. All supported 12.2.3 through 12.2.15 releases are affected, and because the flaw is rated hard to exploit (AC:H) the window for a successful attack depends on satisfying a specific, currently undisclosed technical precondition. No CISA KEV listing, public exploit code, or EPSS score was provided, so the risk is driven by the CVSS 8.0 impact profile and the breadth of EBS deployments rather than by observed exploitation.
Oracle Banking Corporate Lending versions 14.5.0.0.0 through 14.9.0.0.0 contain an unauthenticated, hard-to-trigger flaw in the Core component that lets an attacker positioned on an adjacent network segment read and modify critical lending data, with a scope change that can extend impact to connected Oracle Financial Services products. The CVSS 3.1 base score is 8.0 (AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N), reflecting high confidentiality and integrity impact on a non-internet-exposed attack surface. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied, so real-world exploitation is currently unconfirmed.
A heap-based buffer overflow (out-of-bounds write) exists in the Android Cellular Modem component, allowing an attacker within adjacent/proximal radio range to corrupt heap memory and potentially execute code in the modem context without user interaction. The flaw carries a CVSS base score of 8.0 (AV:A/AC:L/PR:L/UI:N) and affects Google Android devices per the Android/Google Devices CPE. No public exploit code or CISA KEV listing was provided at time of analysis, so exploitation status is unconfirmed; the vendor fix is documented in the September 2026 Pixel/Android Security Bulletin.
In decodeAmr of ImsMediaAudioPlayer.cpp, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation.
Information tampering in Dell Wyse Management Suite (WMS) releases prior to 2605.0.3.683 is possible because the console omits a required cryptographic step (CWE-325), allowing an attacker who already holds a high-privileged WMS account to defeat integrity protections on data or artifacts the suite handles. The flaw is remotely reachable but constrained by PR:H and AC:H, making it a post-compromise or privileged-insider vector rather than an unauthenticated remote takeover. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied in the intelligence feed.
Adjacent-network attackers can fully compromise Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 through a flaw in the product's Client Bundle component, achieving high confidentiality, integrity and availability impact plus a scope change onto connected products. The attack is unauthenticated but difficult to pull off, requiring high attack complexity and a separate user's interaction, which means it is only reachable from the physical/L2 communication segment attached to the hardware running the capture service. No public exploit code and no CISA KEV listing were identified at time of analysis, so the practical risk is bounded by the constrained attack vector rather than by the severity score alone.
Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 (Fusion Middleware, components Forms Services, C/S and Charmode) can be compromised by a low-privileged attacker with network access over HTTP, resulting in full read/write access to Forms-accessible data plus a partial denial of service. Exploitation is difficult (AC:H) and depends on a victim other than the attacker performing some action (UI:R), but the flaw carries a scope change, meaning a successful attack can significantly affect products beyond the vulnerable component itself. Oracle rates it CVSS 3.1 7.9; no public exploit code, KEV listing or EPSS score was present in the supplied intelligence at time of analysis.
Oracle Siebel CRM Cloud Applications versions 22.3 through 26.7 contain a flaw in the Siebel Cloud Manager component that a high-privileged attacker with a logon to the underlying infrastructure can use to read and modify critical Siebel data and, through a scope change, impact additional products. The CVSS 3.1 base score is 7.9 (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N), so exploitation is rated easy once the attacker already holds elevated local access — this is an insider/privileged-tenant risk rather than a remotely reachable pre-auth bug. No public exploit code and no CISA KEV entry were present in the supplied intelligence, and no EPSS data was provided, so active exploitation is not confirmed.
Local privilege abuse in Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0 lets an attacker who already holds a low-privileged logon on the host running the connector seize full control of the connector, with high confidentiality, integrity and availability impact (CVSS 7.8). The flaw sits in the Core component of the Fusion Middleware connector and requires local logon, not
Local, low-privileged compromise of the SQR component in Oracle PeopleSoft Enterprise PeopleTools 8.61–8.63 lets an attacker who already holds a logon to the host where PeopleTools runs take full control of the PeopleTools instance, with complete confidentiality, integrity and availability impact (CVSS 3.1 base 7.8). The flaw is rated easily exploitable once host access exists (AC:L, PR:L, UI:N), but the AV:L vector means it is not remotely reachable from the network without some foothold on the target infrastructure. The provided intelligence contains no EPSS score, no CISA KEV listing and no public exploit reference, so no public exploit was identified at time of analysis, though the code-execution outcome makes this a high-value post-compromise escalation path.
Oracle Platform Security for Java (component: Centralized Thirdparty Jars) in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with logon access to the host to fully compromise the component, resulting in high confidentiality, integrity, and availability impact. The flaw is locally exploitable (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) and requires only a valid low-privileged account on the infrastructure where the component executes. No public exploit code or CISA KEV listing is identified at time of analysis, and the vendor advisory is available via Oracle's Critical Patch Update.
Local privilege escalation in the Installation component of Oracle Siebel CRM Deployment (supported versions 17.0 through 26.7) lets any low-privileged user who can log on to the host running Siebel CRM Deployment to fully compromise that deployment. Because the flaw is reachable through the local attack surface with no user interaction and yields complete loss of confidentiality, integrity and availability, an attacker with an otherwise ordinary account can effectively take over the CRM environment. No public exploit code or in-the-wild exploitation is identified in the available intelligence at time of analysis, and the vendor advisory from Oracle is the sole reference for affected versions and fixes.
Local privilege escalation in Google Android/Pixel devices allows an already-running non-privileged app to bypass permission checks and gain elevated privileges through a logic error in the code. Exploitation requires the attacker to have existing local code execution at User level on an unpatched device, with no user interaction needed once the malicious or compromised app is running. No public exploit code or active exploitation is identified at time of analysis, and EPSS is low at 0.13% (percentile 3%).
Local privilege escalation in the Android VPU (Video Processing Unit) component lets an attacker who already holds low-privilege code execution - such as a malicious or compromised app running on the device - bypass a missing permission check and elevate to System-level execution privileges, with no user interaction required. The flaw is assessed at CVSS 7.8 (AV:L/AC:L/PR:L/UI:N) and was reported by Google Devices against the Pixel security bulletin, so real-world exposure centers on Pixel hardware that exposes the affected VPU subsystem rather than all devices matching the broad google:android CPE. EPSS is only 0.12% (2nd percentile) and no public exploit identified at time of analysis; impact is bounded to System privileges, not full kernel or root.
Heap-based buffer overflow in GIMP's file-psd import plugin allows a crafted PSD file to corrupt adjacent heap memory, causing an application crash or potentially arbitrary code execution when the user opens the file or when a thumbnail preview is generated for it. The root cause is an integer overflow (CWE-190) in the multiplication of values taken from an embedded JPEG header, which yields an undersized heap allocation that is subsequently overrun during image decoding and can be turned into a controlled memory write. The assessed vector (CVSS 3.1, 7.8 High, AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms this is a local, user-interaction-dependent flaw rather than a remotely reachable service bug, so exploitation requires delivering the malicious PSD to a machine where GIMP or an automatic PSD thumbnailer processes it; no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.