Local low-privileged users who can log on to hosts running Oracle PeopleSoft Enterprise FIN Engineering Brazil 9.1 can fully take over the affected Engineering component, with high impact to confidentiality, integrity and availability. Oracle's advisory assigns a base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning the flaw is trivially exploitable once any valid low-privilege logon on the infrastructure is obtained - no user interaction and no elevated privileges are required. There is no public exploit code or CISA KEV listing identified at time of analysis, so the immediate risk is concentrated in environments where untrusted or over-privileged users share the PeopleSoft application or database host.
A locally exploitable privilege-escalation vulnerability in the Remote Diagnostic Agent component of Oracle Middleware Common Libraries and Tools (Oracle Fusion Middleware) allows any low-privileged user with a logon on the host to fully compromise the affected middleware installation. Successful exploitation results in complete loss of confidentiality, integrity, and availability — effectively a full takeover — across versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. No public exploit code has been identified and the issue is not listed in CISA KEV, so risk is concentrated in multi-tenant or shared-host deployments where untrusted users already have accounts.
Local privilege escalation in Oracle Business Intelligence Enterprise Edition (Analytics Server component) lets any low-privileged user who can log on to the host where the service runs take full control of the BI platform. Both supported branches - 8.2.0.0.0 and 26.01.0.0.0.0 - are affected, with a CVSS 3.1 base score of 7.8 reflecting complete loss of confidentiality, integrity and availability. Oracle addressed it in its Critical Patch Update (cspusep2026); no public exploit code or CISA KEV entry was identified at time of analysis.
Local privilege escalation in the Installation component of Oracle Business Intelligence Enterprise Edition lets any low-privileged user who can log on to the host running the product take full control of the BI platform, affecting versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. With complete confidentiality, integrity and availability impact (CVSS 3.1 base 7.8), the flaw is attractive as a post-compromise escalation step, but it is not network-reachable and requires an existing OS-level account on the infrastructure. No public exploit code has been identified at time of analysis, there is no CISA KEV listing, and no EPSS data was supplied to gauge mass-exploitation likelihood.
Local privilege escalation in Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 lets any user who already holds a low-privileged logon to the infrastructure hosting the BI server take full control of the platform, with complete loss of confidentiality, integrity and availability. The flaw sits in the FNDN (foundation) component and is rated 7.8 by Oracle, but it is a local vector (AV:L/PR:L) rather than a network-reachable bug, so exploitation requires prior host access as an ordinary user. No public exploit code or active exploitation is identified in the available data, and no EPSS score, KEV entry or CWE classification was supplied.
Local privilege escalation in Oracle Business Intelligence Enterprise Edition (Platform Security component) lets a low-privileged user who can log on to the host running the BI software take full control of the deployment. Affected releases are 8.2.0.0.0 and 26.01.0.0.0, which receive complete confidentiality, integrity and availability impact on successful exploitation. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied; the practical barrier is that the attacker must already hold some form of logon/execution capability on the infrastructure where OBIEE runs.
A locally exploitable privilege-escalation flaw in the Platform Security component of Oracle Business Intelligence Enterprise Edition (Oracle Analytics) lets any user who can log on to the operating-system host running the product take full control of the BI platform. Affected supported releases are 8.2.0.0.0 and 26.01.0.0.0. With CVSS 7.8 (AV:L/AC:L/PR:L/UI:N, high confidentiality, integrity and availability impact), the exploit is trivial once host access exists, and no public exploit code or CISA KEV listing was identified at time of analysis, so risk is concentrated in environments where untrusted or over-privileged local accounts exist on BI servers.
Local privilege escalation to full instance takeover in Oracle Business Intelligence Enterprise Edition (component: BI Search) affects versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. An attacker who can log on to the host running the BI EE service with only low-privileged credentials can exploit the BI Search component to gain complete control of the platform, with high impact to confidentiality, integrity and availability (CVSS 3.1 base 7.8). No public exploit code or CISA KEV entry is identified in the available data, so this is treated as a patch-now hardening issue rather than an observed campaign.
A privilege-escalation flaw in the Server Infrastructure component of Oracle Siebel CRM Deployment lets an attacker who already holds a low-privileged logon on the host where Siebel Deployment runs take full control of that deployment. Affected releases span Siebel CRM 17.0 through 26.7, and the CVSS 3.1 base score is 7.8 (AV:L/AC:L/PR:L/UI:N, high confidentiality, integrity and availability impact). Exploitation status is currently unconfirmed: no public exploit code and no CISA KEV listing were provided at time of analysis, and Oracle does not publish PoC details with its Critical Patch Update advisories.
Local privilege escalation and full takeover in Oracle PeopleSoft Enterprise FIN Inventory Brazil 9.1, where any attacker holding a valid low-privileged logon to the host running the application can compromise confidentiality, integrity and availability of the Inventory component entirely. Because the flaw is reached via local access (AV:L, PR:L, UI:N) with low attack complexity, it is most relevant to insider threat, shared-host environments and post-compromise lateral movement on PeopleSoft infrastructure rather than to internet-facing attackers. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied.
Local privilege escalation in Oracle E-Business Suite's Applications DBA (AD Utilities) lets any attacker holding a valid low-privileged logon on the tier where AD Utilities executes take complete control of the component, with full confidentiality, integrity and availability impact on the affected schemas and utilities. Only versions 12.2.3 through 12.2.15 are affected, and exploitation requires prior host access rather than reachability over the network, so the realistic threat is an insider, a compromised application-tier service account, or a post-exploitation escalation step. No public exploit code was identified and the flaw is not listed as confirmed actively exploited (CISA KEV), so risk is driven by the value of the EBS environment and who already holds a login on that infrastructure.
Local privilege escalation in Oracle Business Intelligence Enterprise Edition (component: Machine Learning) allows a user who already holds a low-privileged operating-system account on the host running the BI system to escalate to full takeover of the BI EE platform, with complete loss of confidentiality, integrity and availability. Only versions 8.2.0.0.0 and 26.01.0.0.0 are listed as affected in Oracle's critical security patch update. Exploitation requires logon access to the infrastructure where BI EE executes, so the flaw is primarily a post-authentication, same-host escalation risk rather than an internet-facing one; no public exploit code or CISA KEV entry was identified in the supplied intelligence.
Local privilege abuse in Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0 lets an attacker who already holds a low-privileged logon on the host running the connector seize full control of the connector, with high confidentiality, integrity and availability impact (CVSS 7.8). The flaw sits in the Core component of the Fusion Middleware connector and requires local logon, not
Local, low-privileged compromise of the SQR component in Oracle PeopleSoft Enterprise PeopleTools 8.61–8.63 lets an attacker who already holds a logon to the host where PeopleTools runs take full control of the PeopleTools instance, with complete confidentiality, integrity and availability impact (CVSS 3.1 base 7.8). The flaw is rated easily exploitable once host access exists (AC:L, PR:L, UI:N), but the AV:L vector means it is not remotely reachable from the network without some foothold on the target infrastructure. The provided intelligence contains no EPSS score, no CISA KEV listing and no public exploit reference, so no public exploit was identified at time of analysis, though the code-execution outcome makes this a high-value post-compromise escalation path.
Oracle Platform Security for Java (component: Centralized Thirdparty Jars) in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with logon access to the host to fully compromise the component, resulting in high confidentiality, integrity, and availability impact. The flaw is locally exploitable (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) and requires only a valid low-privileged account on the infrastructure where the component executes. No public exploit code or CISA KEV listing is identified at time of analysis, and the vendor advisory is available via Oracle's Critical Patch Update.
Local privilege escalation in the Installation component of Oracle Siebel CRM Deployment (supported versions 17.0 through 26.7) lets any low-privileged user who can log on to the host running Siebel CRM Deployment to fully compromise that deployment. Because the flaw is reachable through the local attack surface with no user interaction and yields complete loss of confidentiality, integrity and availability, an attacker with an otherwise ordinary account can effectively take over the CRM environment. No public exploit code or in-the-wild exploitation is identified in the available intelligence at time of analysis, and the vendor advisory from Oracle is the sole reference for affected versions and fixes.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets a low-privileged attacker who can log on to the host running the application take full control of the product. Successful exploitation results in complete loss of confidentiality, integrity and availability of the financial consolidation environment (CVSS 3.1 base 7.8, AV:L/PR:L). No public exploit code or CISA KEV listing was identified in the supplied intelligence, and the only reference is Oracle's Critical Security Patch Update advisory, so patch status should be confirmed against that document.
Heap memory corruption in FreeRDP's server-side static virtual channel handling (all versions before 3.31.0) allows an authenticated RDP client to send channel messages larger than the expected chunk size, triggering an integer underflow that corrupts heap memory and can overwrite live pointers, potentially yielding code execution on the RDP server. Reachability is gated on the server enabling CHANNEL_OPTION_SHOW_PROTOCOL for the channel, and on the attacker already holding a valid session, so this is a post-authentication, configuration-dependent flaw rather than a pre-auth RCE. A vendor fix is available in 3.31.0 via upstream commit 40d9202, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Local attackers who already hold a logon on the host running Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 can
Oracle E-Business Suite's Applications DBA component (ADPatch) contains a flaw in versions 12.2.3 through 12.2.15 that allows an attacker who already holds a logon on the host infrastructure to take over Applications DBA without presenting Oracle application credentials. Exploitation requires the attacker to persuade another person to perform some interaction (UI:R) and is scored 7.8 with full confidentiality, integrity and availability impact. No public exploit code, EPSS score, or CISA KEV entry was provided in the available intelligence, so active exploitation is unconfirmed at time of analysis.
Local privilege escalation in Oracle VM VirtualBox 7.2.16 on Windows hosts allows a low-privileged user who can log on to the machine to take full control of the hypervisor, with high confidentiality, integrity and availability impact (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N). Oracle's advisory rates the flaw as easily exploitable, but no public exploit code has been identified at time of analysis. The vulnerability applies only to Windows hosts, so Linux and macOS installations of the same release are not in scope according to the vendor.
A local attacker who already holds a low-privileged logon on a Windows host running Oracle VM VirtualBox 7.2.16 can fully take over the VirtualBox product through a flaw in its Core component, achieving high confidentiality, integrity and availability impact within the VirtualBox context (CVSS 3.1 base 7.8, AV:L/PR:L/UI:N). Only Windows hosts are affected per Oracle, and the vendor characterises the issue as easily exploitable with no user interaction required. No KEV listing, EPSS score or public exploit code was present in the supplied intelligence, so no public exploit is identified at time of analysis.
Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 can be taken over by a low-privileged local attacker with logon access to the host infrastructure, allowing complete compromise of the Content Server component's confidentiality, integrity, and availability. The flaw is easily exploitable given local access and a valid account, but no public exploit or active exploitation has been identified at time of analysis. This is a locally-scoped critical-impact issue, not a remote-drive-by vulnerability.
Local privilege escalation in Oracle Utilities Network Management System (NMS) allows any attacker holding a low-privileged logon on the host where the product executes to take over the affected application, with full loss of confidentiality, integrity and availability. The flaw spans the entire supported release line, from 2.4.0.1.0 through 2.4.0.1.33, 2.5.0.1.0-2.5.0.1.19, 2.5.0.2.0-2.5.0.2.13, 2.6.0.1.0-2.6.0.12B, 2.6.0.2.0-2.6.0.2.10A and 25.12.0.0.0-25.12.0.0.3, so virtually every deployed version is affected until the Vendor-released patch per the Oracle Critical Security Patch Update is applied. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the low attack complexity and absence of user interaction make the flaw attractive once an attacker already has a foothold on the utility server.
A local privilege-escalation flaw in the Siebel CRM Deployment component (Server Infrastructure) lets a low-privileged user who can log on to the host where Siebel CRM Deployment runs take full control of that deployment. All supported releases from 17.0 through 26.7 are affected, with a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N, high confidentiality, integrity and availability impact). Oracle published the fix in its Critical Security Patch Update advisory; no public exploit code or CISA KEV entry was identified at time of analysis, so the practical threat is currently insider- or foothold-driven rather than mass-exploited.
Local privilege escalation in Oracle Siebel CRM Deployment (Server Infrastructure component) lets any low-privileged user who can log on to the host running the Deployment service take full control of that deployment. All supported releases from 17.0 through 26.7 are affected, and successful exploitation yields complete loss of confidentiality, integrity and availability of the Siebel environment (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N). There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the low attack complexity and absence of user interaction mean any compromised service or operator account on a Siebel host is a viable stepping stone.
Privilege escalation in the Android Bootloader allows a local attacker who already holds System execution privileges to bypass an intended permission check and obtain higher-privileged code execution on affected devices. The root cause is a logic error in bootloader permission enforcement (CWE-693, protection mechanism failure) that requires no user interaction and is reachable only through local access, making it a privilege-escalation link inside a larger exploit chain rather than a standalone remote threat; the affected scope appears limited to Google Pixel devices addressed by the 2026-09-01 Pixel security bulletin. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS data accompanied the available reporting.
Local privilege escalation in Google Android/Pixel devices allows an already-running non-privileged app to bypass permission checks and gain elevated privileges through a logic error in the code. Exploitation requires the attacker to have existing local code execution at User level on an unpatched device, with no user interaction needed once the malicious or compromised app is running. No public exploit code or active exploitation is identified at time of analysis, and EPSS is low at 0.13% (percentile 3%).
Local privilege escalation in the Android VPU (Video Processing Unit) component lets an attacker who already holds low-privilege code execution - such as a malicious or compromised app running on the device - bypass a missing permission check and elevate to System-level execution privileges, with no user interaction required. The flaw is assessed at CVSS 7.8 (AV:L/AC:L/PR:L/UI:N) and was reported by Google Devices against the Pixel security bulletin, so real-world exposure centers on Pixel hardware that exposes the affected VPU subsystem rather than all devices matching the broad google:android CPE. EPSS is only 0.12% (2nd percentile) and no public exploit identified at time of analysis; impact is bounded to System privileges, not full kernel or root.
Local privilege escalation in the Pixel-specific kernel PHY power driver, specifically the gmc_phy_lp3_exit_restore_registers routine in phy_power.c, where a missing bounds check permits an out-of-bounds memory write (CWE-120). Reaching the vulnerable code path requires code already executing at Android System privilege level on an affected Pixel device, and no user interaction is needed once that context is held; per the assessed vector (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) this is an authenticated/high-privilege local issue rather than an unprivileged-app primitive, making it most useful as a later stage in an exploit chain. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; a vendor fix is available through the September 2026 Pixel security bulletin.
Local privilege escalation in the Forge component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 allows a low-privileged user who can log on to the underlying host to fully take over the platform, with the attack scope extending to additional products. Exploitation is rated difficult (high attack complexity) and requires prior local logon, so this is primarily an insider/co-tenancy and post-compromise escalation risk rather than a remotely reachable flaw. No public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis; EPSS data was not supplied. Oracle released the fix as part of its Critical Patch Update advisory (cspusep2026.html), though the input does not state an exact patched build number.
Local privilege escalation in the Android kernel's fingerprint (gf) driver allows a process with access to the fingerprint device interface to corrupt kernel heap memory and gain root-level code execution. The flaw is a heap-based out-of-bounds write in gf_base_update_finger_base() within gf_base.c, exploitable with a low-privileged local context and no user interaction, consistent with a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N). Fixes are delivered through the Android/Pixel Security Bulletin dated 2026-09-01; no public exploit code or CISA KEV listing was identified at time of analysis.
An out-of-bounds write in the NXP NFC hardware abstraction layer (phNxpNciHal_ext_process_nfc_init_rsp in phNxpNciHal_ext.cc) lets a local attacker corrupt memory beyond the intended buffer while the HAL processes an NFC initialization response. Affected are Android devices that ship the NXP NFC HAL, which the Android CPE lists without a version bound; the flaw requires no user interaction and, per Google's bulletin wording, no additional execution privileges, so a typical app-level foothold is enough to attempt escalation. There is no CISA KEV listing and no public exploit code reported in the supplied intelligence, so exploitation is assessed as feasible but not yet observed.
An integer overflow in the Android VPU (video processing unit) driver's size handling leads to an out-of-bounds write in kernel memory, allowing a locally installed application to escalate privileges to kernel/system level on affected Pixel devices. Exploitation requires only local low-privileged access (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) and no user interaction, making it attractive for a malicious or trojanized app. No public exploit code or CISA KEV listing was identified at time of analysis, and the EPSS signal is not provided; the vulnerability is addressed in the September 2026 Android/Pixel security bulletin.
An out-of-bounds write in the Goodix fingerprint trusted-application test handler (gf_ta_test_set_config in gf_ta_test.c) on Android allows a locally installed application holding low privileges to corrupt memory and escalate to kernel-level privileges without any user interaction. The flaw stems from improper validation of caller-supplied input reaching a memory-write path inside the fingerprint TA interface. Google addressed it in the Pixel security bulletin dated 2026-09-01; no public exploit code or CISA KEV entry was identified at time of analysis.
Local privilege escalation in the Android kernel's Arm SMMUv3 driver (arm-smmu-v3.c) allows an attacker holding a low-privileged local context to subvert the IOMMU's protection mechanism and reach kernel-level access on a vulnerable device. The flaw is a logic error affecting multiple functions of the driver, rated CVSS 7.8 with a local attack vector, low privileges, and no user interaction required. Google ships the fix in the September 2026 Pixel/Android security bulletin; no CISA KEV listing and no public exploit code were identified at the time of analysis.
Improper input validation in multiple locations of the Android kernel allows a locally installed application to escalate privileges on affected Pixel and Android devices, with no additional execution privileges or user interaction required. The flaw is rated 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting a local attacker who already holds low-privileged code execution but can reach high-integrity kernel operations. It is addressed in the September 2026 Android/Pixel security bulletin; at time of analysis there is no CISA KEV listing, no confirmed public exploit code, and no EPSS signal was supplied with the source data.
Local privilege escalation in Google Android's VPU (Video Processing Unit) driver lets an unprivileged app trigger an out-of-bounds write through a confused-deputy path, corrupting kernel memory and gaining root-level code execution on the device. Per the CVSS vector, the attacker must already hold local code execution (PR:L) but needs no user interaction, and the September 2026 Pixel/Android Security Bulletin confirms a vendor fix. No public exploit code or CISA KEV activity has been identified at time of analysis.
Let me parse the data. CVE-2026-19407: Bucket Squatting in Google Cloud Gemini Enterprise Agent Platform SDK for Python versions prior to 1.166.1. Allows RCE and tenant-project token theft. CVSS 7.7, CVSS 4.0 vector: AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L. CWE-330 (Use of Insufficiently Random Entropy — actually CWE-330 is "Use of Insufficiently Random Values"). Bucket squatting: attacker registers a cloud storage bucket name that the SDK attempts to use (predictable/guessable name), and the SDK downloads code/artifacts from that bucket, leading to RCE. Related to insufficient randomness in bucket naming. EPSS: not provided. KEV: not provided (no). POC: not provided. Note discrepancy: Description says versions prior to 1.166.1; EUVD says "1.16.0 <1.165.1". That's a data conflict — flag in confidence_notes. Patch: Available from vendor — release notes from March 31, 2026. Affected products: Google Cloud Gemini Enterprise Agent Platform SDK for Python, versions prior to 1.166.1 (fix version 1.166.1). Prevalence: This is a specific SDK — medium/low. It's a Google Cloud SDK for an agent platform — niche enterprise. I'd say "low". Hmm. Gemini Enterprise Agent Platform SDK for Python — AI agent dev kit. Deployment footprint probably low-medium. I'll say "low" with basis "specialized Google Cloud AI agent SDK, limited deployment footprint". Actually maybe "medium" since Google Cloud + Gemini is popular. But the specific SDK for agent platform — low. I'll go with "low". Assessed CVSS vector: AT:P means attack requirements are present (attacker must pre-register the bucket name — that's an attack requirement). PR:N, UI:P (victim must run the SDK / user interaction). So my 3.1 vector: AV:N/AC:H/PR:N/UI:R/S:C? Hmm. Scope — subsequent system impact SC:L/SI:L/SA:L, so scope changed in 3.1 terms. Let's do: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. Hmm, but scope change with C:H/I:H/A:H might be too high. Actually the vulnerable system impact is H/H/H.
An out-of-bounds read in the App object handling of pdfforge's PDF Architect allows an attacker to execute arbitrary code in the context of the current process when a victim opens a crafted PDF or visits a malicious page. The flaw is a user-interaction-dependent memory-safety bug (CWE-125) driven by missing validation of user-supplied data, reported through the Zero Day Initiative as ZDI-CAN-28570. No public exploit code and no CISA KEV listing are present in the available intelligence, and EPSS data was not supplied, so the current risk is driven mainly by the 7.8 CVSS base score and the file-parsing attack surface rather than by observed in-the-wild activity.
Opening a crafted PDF file in pdfforge PDF Architect can drive an out-of-bounds heap write inside the application's PDF parsing logic, allowing a remote attacker to run arbitrary code in the context of the current process. Exploitation is client-side: the victim must open a malicious document or visit a page that delivers one, so an attacker must first convince the user to interact with the file. The flaw carries a CVSS 3.0 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CWE-787) and was reported through Trend Micro's Zero Day Initiative as ZDI-CAN-28673 / ZDI-26-612; no KEV listing or public exploit indicator was present in the supplied intelligence, so no public exploit is identified at time of analysis.
Memory corruption in the PDF parsing routine of pdfforge PDF Architect lets an attacker execute arbitrary code in the context of the current process when a victim opens a crafted PDF or loads one from a malicious page. The vendor CPE (pdfforge:pdf_architect:*) gives no version boundaries, so all released builds are presumed affected until a fixed release appears. The flaw was reported through Trend Micro's Zero Day Initiative (ZDI-CAN-28916, advisory ZDI-26-613); at time of analysis there is no CISA KEV entry and no public exploit code identified, and exploitation is gated by the requirement that a user open the malicious document.
Remote attackers can achieve arbitrary code execution by luring a user into opening a maliciously crafted PDF document in pdfforge PDF Architect, where the PDF parser writes past the end of an allocated buffer (CWE-787). Exploitation requires user interaction - the victim must open the malicious PDF or visit a page that triggers PDF rendering - but needs no prior privileges, and any resulting code runs with the privileges of the PDF Architect process. The flaw was reported through Trend Micro's Zero Day Initiative (ZDI-CAN-29219 / ZDI-26-614); no public exploit code or CISA KEV listing was present in the supplied intelligence, and no vendor fix version is confirmed in the available data.
Local privilege escalation in pdfforge PDF Architect allows an attacker who already holds low-privileged code execution on a Windows host to hijack a library loaded by the product's activation-service (Update Service) process and run code as SYSTEM. The flaw is an uncontrolled search path element (CWE-427) in which the service resolves a DLL from a location an unprivileged user can write to, so no remote vector or user interaction is required once the foothold exists. It was reported through Trend Micro's Zero Day Initiative as ZDI-CAN-29536 / ZDI-26-615; no public exploit code, EPSS telemetry, or CISA KEV entry is present in the supplied data.
Heap-based buffer overflow in Ashlar-Vellum Cobalt during parsing of VS drawing files allows an attacker to execute arbitrary code in the context of the victim's process. Exploitation requires the target to open a crafted VS file (user interaction), and no authentication or server-side access is needed because the flaw sits in the file parser. No public exploit code has been identified and the issue is not listed in CISA KEV; the vendor advisory is ZDI-26-587.
Memory corruption in the OGM file parser of OriginLab Origin Viewer (CWE-119) lets an attacker run arbitrary code in the context of the current process when a victim opens a crafted OGM file or is lured to a page that triggers the viewer. Exploitation requires user interaction and executes with the privileges of the logged-on user rather than escalating to SYSTEM, but all three impact metrics (confidentiality, integrity, availability) are rated high, giving a CVSS 3.0 base score of 7.8. Neither public exploit code nor a CISA KEV entry was identified at the time of analysis, so exploitation is currently treated as targeted rather than widespread.
OriginLab Origin Viewer fails to properly validate user-supplied data while parsing OGWU files, resulting in an out-of-bounds write past the end of an allocated buffer. An attacker who convinces a victim to open a crafted OGWU file (or visit a page that loads one) can corrupt memory and execute arbitrary code in the context of the current process, with CVSS 3.0 base score 7.8 (AV:L/AC:L/PR:N/UI:R). No public exploit code or CISA KEV listing was provided in the intelligence feed, so active exploitation is not confirmed, though the local attack vector and required user interaction mean the primary risk is targeted file-delivery attacks such as email attachments or malicious downloads.
A denial-of-service flaw in the RDBMS component of Oracle Database Server (versions 23.4.0 through 23.26.3) lets a low-privileged, authenticated user reach the database over Oracle Net and force a hang or repeatable crash of the instance. The CVSS 3.1 base score of 7.7 reflects network reachability, low attack complexity and a Scope Change because the outage can ripple into dependent applications layered on the database. No public exploit code or CISA KEV entry has been identified at time of analysis, so current risk is driven by the ease of the attack for anyone holding a valid database account rather than by observed exploitation.
Oracle Agile PLM 9.3.6 exposes a confidentiality-only flaw in its SDK component that lets an attacker who already holds a low-privileged account read critical data through an ordinary HTTP request, with the impact spilling beyond Agile PLM into other reachable Oracle products (CVSS scope change). Oracle rates the issue 7.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), noting no integrity or availability impact. No CISA KEV listing, EPSS score, or public exploit code was present in the supplied intelligence, so active exploitation is not confirmed at time of analysis.
Authenticated, low-privileged users with network HTTP access to the Oracle Bills of Material Setup Workbench in Oracle E-Business Suite 12.2.3 through 12.2.15 can read critical Bills of Material data they are not authorized to see, including data belonging to other integrated Oracle products because the vulnerability crosses a security scope boundary (CVSS 3.1 base score 7.7, High). The weakness is confidentiality-only - there is no integrity or availability impact - and exploitation requires a valid low-privileged application account (PR:L) plus reachable HTTP access to the affected component, with no user interaction needed. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and no EPSS score was supplied; the limiting factors are the authentication prerequisite and the read-only nature of the impact.