OS command injection in EFM ipTIME C200E firmware 1.094 allows an authenticated remote attacker with administrative privileges to execute arbitrary operating system commands via a crafted request to the iux_set.cgi endpoint in the System Setup component. A public proof-of-concept exploit, including a video demonstration, has been disclosed. No patch has been confirmed at time of analysis. No public exploit identified at time of analysis as confirmed active exploitation (CISA KEV status absent), though the POC lowers the bar for exploitation significantly.
Unauthenticated information disclosure in Dromara lamp-cloud through 5.10.0 stems from an overly broad anonymous-access whitelist pattern (/*/anno/**) that exposes the /defGenProject/anno/getProperties endpoint. Any remote attacker who can reach the service via HTTP can POST to that path and receive the server's complete JVM system property map, leaking classpath entries, filesystem paths, OS build details, and startup secrets injected as properties. Exploit code is publicly available (a writeup and proof-of-concept are linked from the CVE references and VulnCheck advisory), and the flaw has not been listed in CISA KEV, so it is a high-value reconnaissance and credential-harvesting primitive rather than a confirmed mass-exploitation event.
Path traversal in the Weights & Biases (wandb) Python client before 0.29.0 lets a malicious or compromised W&B backend push crafted file names through the File.download path, writing attacker-controlled files outside the intended download directory. Publicly available exploit code exists, and because arbitrary file writes can target shell startup files or Python import paths, successful abuse can escalate to code execution on the victim host. No CISA KEV listing has been reported, so exploitation appears to be proof-of-concept driven rather than confirmed widespread activity.
Stack-based buffer overflow in GNU libextractor before 1.15 allows remote, unauthenticated attackers to crash any application that uses libextractor to extract metadata from a crafted StarOffice document. The vulnerability resides in the process_star_office function, which allocates a variable-length stack array sized from attacker-controlled OLE2 stream data - enabling up to 4 MB of forced stack allocation, exhausting stack space and causing a process crash. A publicly available exploit exists (referenced as libextractor-ole2-rce on GitHub), and a vendor patch has been released in version 1.15, though no CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow in the D-Link DI-8400 router (firmware 16.07) allows authenticated remote attackers to overwrite stack memory via oversized input to any of eight parameters - serv, user, host, wild, mx, bmx, cust, or ip - handled by the ddns_asp() function at the /ddns.asp DDNS configuration endpoint. Successful exploitation can yield arbitrary code execution on the device, giving an attacker full control over the router. A public exploit script exists on GitHub (ddns_asp.py), and no vendor-released patch has been identified at time of analysis.
Stack-based buffer overflow in the rzgl_asp CGI handler of D-Link DI-8300 firmware 16.07 lets a remote attacker who can reach the device's web management interface (and, per the CVSS vector, holds high/admin privileges) crash or execute code on the router by supplying an oversized redirct_url parameter to /rzgl.asp. Publicly available exploit code exists, so the vulnerability is trivially reproducible, although no CISA KEV listing or confirmed in-the-wild campaign is reported. The device is a legacy D-Link gateway, and no vendor patch or advisory was found in the supplied references.
Authenticated remote code execution in GitLab Enterprise Edition (Advanced Search / Elasticsearch indexing) allows a user with project-import rights to overflow a Unicode conversion buffer by importing a specially crafted Git project export, resulting in arbitrary command execution on the GitLab server. All EE versions from 12.3 through 19.1.8, plus 19.2 before 19.2.6 and 19.3 before 19.3.2, are affected under configurations where Advanced Search is enabled. Publicly available exploit code exists and the HackerOne report is referenced, making this a high-priority patching target for internet- or partner-exposed GitLab EE instances, though exploitation requires an authenticated account and a non-default Elasticsearch-backed search configuration.
Authenticated users of GitLab CE/EE can read CI/CD variables that are scoped to environments they are not entitled to, because the environment scope pattern matcher fails to validate scope input correctly. The flaw affects all versions from 15.7 up to 19.1.7, 19.2.5, and 19.3.1, with fixes in 19.1.8, 19.2.6, and 19.3.2. Public exploit code exists (referenced via a HackerOne report), the issue carries a CVSS of 7.7 with a confidentiality-only, scope-changed profile, and there is no CISA KEV listing indicating confirmed active exploitation at time of analysis.
Semaphore UI through 2.19.12 fails to enforce project-level resource permissions on GET and HEAD requests in its GetMustCanMiddleware, letting any authenticated user holding only the low-privileged guest or task_runner role read every project's environment records. Those environment records store plaintext secrets, credentials, and passwords used to reach managed infrastructure, so a read-only account can effectively harvest the keys to the entire estate. Publicly available exploit code exists (tracked by VulnCheck, issue #4150), the flaw is rated 7.1 with a network attack vector and low privileges required, and no CISA KEV listing has been observed at time of analysis.
Ar
OS command injection in the Lite-On FlexFi 5G radio products FF-RFI079I4 and FF-RFI078I4 allows anyone who can authenticate to the device's M-Plane (NETCONF) management interface to run arbitrary operating-system commands with the privileges of the management service, leading to full compromise of the radio unit. Affected firmware is version 02.01.15 and earlier; Lite-On has released a fix. EPSS is low (1.03%, 62nd percentile) and CISA's SSVC rates exploitation as 'none' with automatable 'no', so this is currently a targeted-risk rather than a mass-exploitation issue, with no public exploit identified at time of analysis.
Arbitrary command execution in the npm TypeScript package praisonai (versions 1.5.1 through 1.7.1) allows an attacker who can influence the string passed to the exported shell() helper to break out of its read-only allowlist by prefixing an approved command and appending a second one with shell chaining syntax such as 'echo ok; <payload>'. Because utility-tools.ts validates only the first whitespace-delimited token and then hands the complete original string to Node's child_process.exec(), the injected command runs with the PraisonAI process privileges. The flaw is fixed in 1.7.2; the advisory includes a deterministic local proof-of-value, and there is no CISA KEV listing or EPSS data indicating active exploitation at time of analysis.
Oracle Business Intelligence Enterprise Edition (8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0) exposes an unauthenticated, network-reachable flaw in the Analytics Web General component that lets an attacker read and tamper with critical data and degrade service availability, with the impact extending beyond the vulnerable product itself (scope change). Oracle rates it 8.9 but flags it as difficult to exploit, meaning the high attack complexity — not missing credentials or user interaction — is the main barrier. No public exploit code and no CISA KEV listing were identified at time of analysis.
Approval bypass in PraisonAI's TypeScript agent loop (npm package 'praisonai' 1.4.0 through 1.7.1) causes executable tool handlers to run inside generateText() before the onToolCall approval callback is consulted, so a tool that the application policy rejects has already performed its file, shell, API, or data-modifying side effects. Applications that treat onToolCall as a human or policy approval boundary can therefore be steered — typically by prompt injection through untrusted model input — into executing denied operations, while the library still reports finishReason 'tool_rejected'. The vendor fixed the ordering flaw in 1.7.2; a deterministic local proof-of-concept exists, EPSS is only ~0.44% (37th percentile) and the issue is not in CISA KEV.
Memory corruption via use-after-free in Microsoft Edge (Chromium-based) lets a remote attacker run arbitrary code at elevated privilege in the browser and ultimately on the host, provided the victim opens attacker-controlled content. Microsoft scores it 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), so no credentials are needed but a single user visit is — a classic one-click browser exploitation pattern rather than a zero-click worm. The intelligence feed contains no EPSS score, no CISA KEV listing, and no public exploit reference, so at time of analysis this is a high-severity but not yet observed-exploited issue.
We need to produce JSON with fields. Need to be careful about "opole" in risk_assessment only, once, lowercase, natural prose, not a factual claim about who is affected. Something like "even a mid-sized municipal IT team in opole would likely..." Hmm it's a hypothetical illustrative reference, must not be presented as factual claim about who is affected. I'll phrase: "for instance, even a mid-sized IT team in opole..." That's hypothetical illustration. Should be fine. Keep once. Data: CVE-2026-69486, Microsoft Edge Chromium-based heap buffer overflow, CVSS 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CWE-122. Patch available from vendor. Affected versions EUVD: Microsoft Edge (Chromium-based) 1.0.0.0 <153.0.4234.32. Reference MSRC. Tags include "Google" which is likely a mislabeled tag — Edge is Chromium-based, but "Google" tag on a Microsoft Edge CVE? Could be mislabeled. Hmm. The tag "Google" might refer to Google Chrome/Chromium? The CVE is Microsoft Edge. Flag mislabeled_tag "Google" with suggested "microsoft" or maybe "chromium"? Actually tags include "Microsoft" already. The "Google" tag is probably wrong vendor for a Microsoft Edge vulnerability — although Chromium is Google's project. Is it clearly wrong? Edge is Chromium-based, so a Google tag is arguably not strictly wrong but for vendor tagging it's mislabeled — the affected product is Microsoft Edge. Confidence medium? The instruction says only emit flag when clearly wrong and verifiable. Hmm, "Google" tag on Microsoft Edge CVE — Edge is built on Chromium (Google's open source project). But the vendor is Microsoft. I'd say medium confidence mislabeled_tag. Alternatively don't flag. Given the editorial note mentions nothing about tags. I think emitting one flag with medium confidence is acceptable: target "Google", suggested null or "microsoft"? Suggested is correct/canonical slug if known: "microsoft" already exists in tags. Maybe suggested null since "Google" isn't the right vendor and Microsoft is alread
Type confusion in Chrome's CacheStorage implementation in builds prior to 153.0.8010.47 lets a remote, unauthenticated attacker execute arbitrary code inside the browser's renderer sandbox when a victim loads a crafted HTML page. The bug is rated High by Chromium and 8.8 by NVD (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), but it is a renderer-level compromise rather than a sandbox escape, so host impact requires chaining a second vulnerability. No CISA KEV listing and no public exploit code were identified at time of analysis, and no EPSS score was supplied in the input data.
Use-after-free in Chrome's DOM implementation allows a remote attacker to execute arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page in Chrome versions prior to 153.0.8010.47. The flaw carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and is rated High by Chromium security severity; a vendor patch is available and no public exploit code or CISA KEV entry was identified at time of analysis.
Remote code execution inside the renderer sandbox affects Google Chrome desktop builds prior to 153.0.8010.47, caused by a type confusion flaw in the browser's compositing pipeline (CWE-843) that is reachable from a crafted HTML page. An attacker needs only to convince a user to load the page: the CVSS 3.1 vector is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), so no credentials or privileges are required, but user interaction is mandatory. Google rates the issue Chromium security severity High and has shipped a fixed stable-channel build; no public exploit code or CISA KEV listing appears in the supplied intelligence, and no EPSS score was provided, so the current exploitation picture is best described as patch-now-but-not-known-exploited.
A use-after-free in Google Chrome's Internals component allows a remote attacker to potentially execute arbitrary code outside the browser sandbox when a victim opens a crafted HTML page, affecting all Chrome builds prior to 153.0.8010.47 on desktop. Exploitation requires user interaction (visiting the page) but no authentication or elevated privileges, and Google rates the Chromium security severity as Critical. Vendor-released patch: 153.0.8010.47. There is no public exploit code identified at time of analysis and no confirmed actively exploited (CISA KEV) status, though the SSVC framework assigns total technical impact.
Type confusion in Google Chrome's ServiceWorker implementation before version 153.0.8010.47 allows a remote attacker to achieve arbitrary code execution inside the renderer sandbox by getting a user to open a crafted HTML page. The flaw carries a CVSS base score of 8.8 (AV:N/AC:L/PR:N/UI:R), the classic memory-corruption profile for Chrome renderer bugs, and Google rated it High in its Chromium severity scheme. A vendor patch shipped in the 153.0.8010.47 stable release, and there is no public exploit code identified and no CISA KEV entry at time of analysis, so this is a prioritise-and-patch issue rather than a confirmed active campaign.
Authenticated low-privileged attackers who can reach the SQL-facing surface of Oracle Hyperion Financial Management 11.2.26.0.000 can achieve complete takeover of the application. Oracle's advisory rates this 8.8 with full confidentiality, integrity, and availability impact, and the flaw is described as easily exploitable with no user interaction required. At the time of analysis there is no public exploit code, no CISA KEV listing, and no EPSS score in the supplied intelligence, so this should be treated as a high-severity, patch-now issue rather than a known active campaign.
Oracle Hyperion Financial Management 11.2.26.0.000 can be fully taken over by an authenticated, low-privileged attacker who reaches the application over the network via HTTP and exploits a flaw in its Security component. Oracle's advisory rates it 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), describing it as easily exploitable with complete loss of confidentiality, integrity and availability. No EPSS score, CISA KEV entry, or public proof-of-concept was supplied in the available intelligence, so active exploitation is unconfirmed; the only vendor reference is the Oracle Critical Security Patch Update advisory.
A low-privileged attacker with network access over HTTP can fully compromise Oracle Hyperion Financial Management 11.2.26.0.000, achieving complete loss of confidentiality, integrity, and availability of the application (CVSS 3.1 base 8.8). The defect resides in the product's Security component and requires only a valid low-privileged account, with no user interaction, making it straightforward to automate once an attacker has a foothold. There is no public exploit identified at time of analysis and no CISA KEV listing, but Oracle's Critical Security Patch Update advisory is the authoritative source for the fix.
Low-privileged authenticated attackers with HTTP network access can exploit the Security component of Oracle Hyperion Financial Management 11.2.26.0.000 to fully take over the application, with high impact to confidentiality, integrity and availability. Oracle scores the flaw 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation is low-complexity once a valid low-privilege account exists, and a fix is published through Oracle's Critical Patch Update process. No public exploit code or CISA KEV entry has been identified at the time of analysis, and no EPSS score was supplied.
Authenticated low-privileged attackers with HTTP access can fully compromise Oracle Hyperion Financial Management 11.2.26.0.000 through a flaw in the product's Security component, gaining complete control of confidentiality, integrity and availability (CVSS 8.8). The issue is easily exploitable once a valid account exists — low complexity, no user interaction — and results in takeover of the HFM application rather than a limited data leak. No EPSS score, CISA KEV entry, or public exploit code was present in the supplied intelligence, so active exploitation is not confirmed and no public exploit code was identified at time of analysis.
A flaw in the Security component of Oracle Hyperion Financial Management 11.2.26.0.000 lets a low-privileged attacker who can reach the service over the network take full control of the application via SQL-based manipulation. Oracle's Critical Security Patch Update rates it 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning complete loss of confidentiality, integrity and availability with no user interaction. There is no CISA KEV listing and no public exploit code identified at time of analysis, so the immediate driver is the fully-compromised-outcome severity for any internet- or partner-exposed HFM deployment, not observed attacks.
Authenticated low-privileged attackers with HTTP access to Oracle Hyperion Financial Management 11.2.26.0.000 can fully compromise the application through a flaw in its Security component, gaining complete control over confidentiality, integrity and availability of the platform. Oracle rates this 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and describes it as 'easily exploitable', meaning a valid low-privilege account is the main barrier rather than technical complexity. No public exploit code, EPSS score, or CISA KEV listing was provided in the intelligence feed, so exploitation status is 'no public exploit identified at time of analysis' — but the low attack complexity and the sensitivity of financial consolidation data make this a priority for internet- or intranet-exposed HFM deployments.
Unauthenticated attackers positioned on a network segment adjacent to an Oracle Hyperion Financial Management server can fully compromise the application, resulting in complete loss of confidentiality, integrity and availability (CVSS 3.1 base 8.8). Only version 11.2.26.0.000 is identified as affected, and Oracle's September 2026 Critical Patch Update advisory is the sole reference. No public exploit code, EPSS score, or CISA KEV listing is present in the available data, so active exploitation is not confirmed.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets an authenticated low-privileged attacker reach the application over HTTP and escalate to full takeover of the HFM instance, with high impact to confidentiality, integrity and availability. The vulnerability is trivially automatable (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8), meaning any valid low-rights account becomes a stepping stone to administrative control of the financial consolidation platform. Exploitation status at time of analysis: no public exploit identified and no CISA KEV listing; no EPSS score or CWE classification was supplied with the source data.
Local privilege escalation in Oracle Hyperion Financial Management 11.2.26.0.000 lets an attacker who already holds a valid low-privileged logon on the host running the application take over the product, with a scope change indicating the compromise can extend to interconnected systems. Successful exploitation yields full confidentiality, integrity and availability impact — this is a takeover-class flaw, not merely an information leak. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; no EPSS score was provided with the record.
Low-privileged attackers with HTTP network access can fully compromise Oracle Hyperion Financial Management 11.2.26.0.000 through a flaw in its Security component, achieving high impact to confidentiality, integrity, and availability (CVSS 8.8). The vulnerability is easily exploitable with no user interaction, and successful exploitation can result in complete takeover of the HFM application and the financial consolidation data it manages. At time of analysis there is no public exploit code identified and the issue is not listed in CISA KEV, though the low attack complexity means weaponization risk is meaningful; Oracle addressed it in its April 2026 Critical Patch Update advisory.
Oracle Hyperion Financial Management 11.2.26.0.000 can be taken over by a low-privileged attacker who can reach the application's HTTP interface, because the Security component does not properly restrict what an authenticated but unprivileged session can do. Successful exploitation yields full compromise of confidentiality, integrity and availability of the HFM application, meaning an attacker could read, alter or destroy financial consolidation data and gain administrative control of the deployment. The flaw is rated 8.8 on CVSS 3.1; no public exploit code or CISA KEV listing was present in the source data at time of analysis, so this is currently a patch-now, monitor-for-exploitation issue rather than a confirmed actively exploited one.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a security-component flaw that lets a low-privileged, network-connected user take full control of the application over HTTP. Per the vendor's CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8), exploitation requires only a valid low-privilege account and no user interaction, but delivers complete compromise of confidentiality, integrity and availability. There is no public exploit code or CISA KEV entry in the supplied intelligence at time of analysis; the only consolidated signal is Oracle's own security alert, and separate risk scores (EPSS) were not provided.
Authenticated low-privileged attackers with HTTP access to Oracle Contract Lifecycle Management for Public Sector (part of Oracle E-Business Suite, V16) can escalate their privileges and achieve full takeover of the Contract Lifecycle Management application, affecting confidentiality, integrity and availability of contract data (CVSS 8.8, AV:N/AC:L/PR:L/UI:N). The flaw sits in the "ECC For Award and IDV" component, which is exposed over the web and requires only an ordinary user account rather than administrative rights. At time of analysis there is no public exploit code identified and the issue has not been added to CISA KEV, but Oracle rates it "easily exploitable," so patching on the vendor's published patch-update timeline is the priority.
Low-privileged attackers holding a valid Oracle E-Business Suite account can take over the Oracle Purchasing module (versions 12.2.3 through 12.2.15) by sending crafted HTTP requests to the application's web interface, with high impact to confidentiality, integrity and availability (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N). No user interaction or elevated privilege is needed beyond a basic authenticated session, making the flaw trivially automatable once credentials exist. At time of analysis there is no public exploit code identified and the issue is not listed in CISA KEV; no EPSS score was supplied in the source data. Oracle has published a Critical Security Patch Update advisory (September 2026) covering the affected releases.
Any low-privileged, authenticated user with HTTP access to the Oracle Contract Lifecycle Management for Public Sector module (Award/PO component) of Oracle E-Business Suite 12.2.13 through 12.2.15 can fully take over the application, with high impact to confidentiality, integrity and availability. The flaw is trivially reachable over the network with no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8), meaning a compromised or malicious internal account is enough to reach contract and award data and to manipulate application state. At time of analysis there is no public exploit identified and no CISA KEV listing, so the immediate risk is driven by the large installed base of EBS and the low skill barrier implied by the vector; Oracle has published a Critical Security Patch Update advisory covering the fix.
Full takeover of Oracle Product Hub within Oracle E-Business Suite 12.2.3 through 12.2.15 is achievable by a low-privileged attacker who can reach the module's HTTP interface, with CVSS 8.8 reflecting high confidentiality, integrity, and availability impact across the whole affected application. Exploitation requires only a valid low-privileged EBS session and network access to HTTP — no user interaction and no administrative privileges. No public exploit code or CISA KEV entry was identified at time of analysis, and Oracle's Critical Security Patch Update at oracle.com/security-alerts/cspusep2026.html is the only patch reference provided.
Authenticated attackers holding a low-privileged Oracle E-Business Suite account can fully take over the Bills of Material module in versions 12.2.3 through 12.2.15, achieving high impact against confidentiality, integrity, and availability (CVSS 3.1 base 8.8, vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw lives in the module's Setup Workbench component and needs only HTTP reachability plus a valid low-privilege login — no victim interaction — making it a strong privilege-escalation stepping stone for anyone with a foothold in the EBS environment. Oracle documents the issue in its September 2026 Critical Security Patch Update advisory; no public exploit code, EPSS score, or CISA KEV entry accompanies this record, so active exploitation is unconfirmed and no public exploit was identified at time of analysis.
We need to produce JSON. Let's analyze. CVE-2026-83479: Oracle E-Business Suite, Oracle Contracts, component Internal Operations, supported versions 12.2.14-12.2.15. CVSS 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Low privileged attacker with network access via HTTP. Takeover of Oracle Contracts. No KEV, no POC, no EPSS given. CWE N/A. Tags: "Information Disclosure", "Oracle". Note the tag "Information Disclosure" is likely mislabeled because impacts are C/I/A high and takeover — not just info disclosure. Hmm, but data_quality_flags: mislabeled_tag for "Information Disclosure"? The tag is wrong given full confidentiality/integrity/availability impact and takeover. But is it "clearly wrong and verifiable"? The description says takeover with C:H/I:H/A:H, so "Information Disclosure" is a mislabel. But be careful—Oracle advisories often have a "Remote Exploit without Auth" etc. The tag is likely auto-derived. I think it's reasonable to flag "Information Disclosure" as mislabeled. Confidence medium maybe high. Suggested: maybe "oracle-e-business-suite" — no, suggested is correct slug for the tag; for mislabeled tags suggested could be null or correct tag. For mislabeled_tag, suggested = correct/canonical slug if known, else null. Could suggest "oracle" already present, or "privilege-escalation"? The tag taxonomy likely uses CWEs/vendors. I'd say suggested: null with reason. Also missing tag? "Oracle E-Business Suite" maybe. Product is Oracle E-Business Suite. Missing tag could be "oracle-e-business-suite"? Hmm, the existing tag is "Oracle". Maybe missing "oracle-e-business-suite". Might be too speculative. I'll include mislabeled_tag for Information Disclosure, and maybe a missing_tag for "oracle-e-business-suite"? The instructions: emit missing_tag ONLY when tag is unambiguously implied by references or product identity. Product identity is Oracle E-Business Suite; that's unambiguous. Hmm but the vendor tag "Oracle" exists. Adding "oracle-e-business-suite" seems plausi
Component takeover in Oracle E-Business Suite's Demand Signal Repository (supported releases 12.2.3 through 12.2.15) lets an authenticated, low-privileged attacker reachable over HTTP (PR:L, network vector) seize control of the affected module, with full confidentiality, integrity and availability impact (CVSS 3.1 base 8.8). The flaw sits in the Internal Operations component of the Demand Signal Repository and requires no user interaction, making it straightforward to trigger once a valid low-privilege session or role is obtained. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the Oracle Critical Security Patch Update advisory is the only authoritative reference and no EPSS score was supplied, so real-world exploitation likelihood is unquantified. Oracle E-Business Suite operators running the affected module should treat the corresponding Critical Patch Update as the remediation path.
Application takeover of the Document Management and Collaboration module in Oracle E-Business Suite 12.2.3 through 12.2.15 is achievable by any authenticated low-privileged user with HTTP access, with high confidentiality, integrity and availability impact. Oracle rates the flaw 8.8 (AV:N/AC:L/PR:L/UI:N) because the attack is simple, needs no user interaction, and defeats the authorization boundary around the module's internal operations. No public exploit code or CISA KEV entry is identified at time of analysis, but the low privilege bar combined with broad enterprise EBS deployment makes this a patch-now item.
Low-privileged attackers with HTTPS network access can fully compromise the Internal Operations component of Oracle Complex Maintenance, Repair and Overhaul (CMRO) in Oracle E-Business Suite versions 12.2.3 through 12.2.15, achieving complete confidentiality, integrity, and availability impact on the affected module. The flaw carries a CVSS 3.1 base score of 8.8 and requires only an authenticated network session (PR:L) with no user interaction, making it a straightforward lateral escalation for any user holding a valid low-privilege EBS account. At time of analysis there is no public exploit code, no CISA KEV listing, and no EPSS data provided, so risk is driven by the exposed attack surface of internet- or intranet-reachable EBS deployments rather than confirmed active exploitation.
Oracle Product Hub, a module of Oracle E-Business Suite, contains a flaw in its Internal Operations component that lets a low-privileged attacker with HTTP network access take over the Product Hub application. Supported releases 12.2.3 through 12.2.15 are affected, and successful exploitation yields high confidentiality, integrity and availability impact across the module. No public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis, though Oracle treats this class of flaw as remotely exploitable and easily abused, making prompt patching of internet- or intranet-exposed E-Business Suite deployments important.
Oracle JDeveloper 12.2.1.4.0 and 14.1.2.0.0 contain a flaw in the Fusion Middleware Security Framework component that lets a low-privileged attacker who can reach the IDE over HTTP achieve a full takeover of the product, with high confidentiality, integrity, and availability impact. Oracle rates it 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so exploitation needs a valid low-privilege account but no user interaction or elevated privilege. There is no public exploit code identified and no CISA KEV listing at time of analysis, and no EPSS score was supplied, so the immediate operational risk is driven mainly by exposure of JDeveloper HTTP services rather than by observed exploitation.
Full compromise of Oracle Coherence is achievable by low-privileged attackers who can reach the Coherence Core HTTP interface, affecting versions 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 of the Oracle Fusion Middleware product. Successful exploitation gives complete loss of confidentiality, integrity and availability — Oracle describes the outcome as "takeover of Oracle Coherence" — with a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N). No public exploit code has been identified at time of analysis, the flaw is not listed in CISA KEV, and no EPSS score was supplied with the source data, so the practical urgency currently rests on the size of the exposed Coherence estate rather than on observed exploitation.
Oracle Coherence, Oracle's in-memory data grid shipped as part of Fusion Middleware, can be fully taken over by a low-privileged attacker who can reach the cluster over the network in versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. The flaw sits in the Core component and is rated by Oracle as easily exploitable — CVSS 3.1 base 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) — with confidentiality, integrity and availability all fully impacted, meaning compromise of the Coherence cluster rather than a narrow data leak. No EPSS score, CISA KEV entry or public exploit code was provided with this record; the only authoritative source is Oracle's Critical Security Patch Update advisory, so treat exploitation status as unconfirmed (no public exploit identified at time of analysis).
Oracle Database Server's RDBMS engine can be fully compromised by any database account holding the CREATE DATABASE LINK privilege, affecting releases 19.3–19.32, 21.3–21.23 and 23.4.0–23.26.3. The flaw is reachable over Oracle Net with no user interaction and yields complete confidentiality, integrity and availability impact (CVSS 8.8, AV:N/AC:L/PR:L/UI:N), i.e. full takeover of the RDBMS rather than a narrow data leak. Oracle has published a fix through its security advisory referenced by NVD; no public exploit code, EPSS score or CISA KEV entry was supplied, so there is no evidence of active exploitation at time of analysis.
Oracle Identity Manager (OIM) releases 12.2.1.4.0 and 14.1.2.1.0, shipped as part of Oracle Fusion Middleware, contain a flaw in the Security component that lets an attacker holding a low-privileged account reach the application over HTTP and take full control of the identity platform. Oracle rates it 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting complete loss of confidentiality, integrity and availability with no user interaction required. No public exploit code or CISA KEV entry was available at time of analysis, so exploitation is assessed as plausible but not yet observed in the wild.
Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Oracle Diagnostics Interfaces). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Manager. Successful attacks of this vulnerability can result in takeover of Oracle Applications Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).