Memory corruption in Google Chrome's Picture-in-Picture component before 156.0.8078.47 enables a remote attacker to potentially execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. The flaw is remotely reachable with no privileges but requires user interaction, consistent with CVSS 3.1 score 8.8 and vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H; code execution remains confined to the sandbox unless chained with a separate sandbox escape. Vendor patches are available in Chrome 156.0.8078.47, and no public exploit code or CISA KEV listing was identified in the provided data at time of analysis.
Memory corruption in the Extensions component of Google Chrome prior to 156.0.8078.47 lets a remote attacker who convinces a victim to open a crafted HTML page execute arbitrary code inside the browser sandbox. The flaw is unauthenticated (PR:N) and reaches default configurations, but exploitation is not zero-click - user interaction (UI:R) is mandatory, and by Google's own description the resulting code execution is contained within the renderer sandbox, so full host compromise would require chaining with a separate sandbox-escape bug. Google rates the issue as Chromium security severity Medium despite the 8.8 CVSS, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Use-after-free in the Extensions component of Google Chrome prior to 156.0.8078.47 lets a remote attacker who convinces a user to open a crafted HTML page execute arbitrary code within the renderer sandbox. The CVSS 3.1 base score of 8.8 reflects high confidentiality and integrity impact, but per Google (Chromium severity: Medium) code execution is contained inside the sandbox, so host compromise requires chaining a separate sandbox-escape flaw; no authentication is needed but user interaction is mandatory. No public exploit code or confirmed active exploitation was identified at time of analysis, and users on auto-updating channels are remediated without manual action.
Memory corruption in Google Chrome's Interstitials component (versions prior to 156.0.8078.47) can allow remote attackers to execute arbitrary code inside the browser sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction and no authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), and the unchanged scope indicates that host compromise would require chaining with a separate sandbox escape. No public exploit code has been identified at time of analysis, and Google has released a fixed version.
Improper input validation in the Input component of Google Chrome before 156.0.8078.47 allows remote attackers to potentially execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page; no authentication or non-default configuration is required, though user interaction is required to open the page. The vendor has released a patch in Chrome 156.0.8078.47. At time of analysis there is no CISA KEV listing or public exploit code identified, and because code execution is described as contained within the sandbox, standalone host compromise would require an additional sandbox-escape vulnerability.
Remote code execution confined to Chrome's renderer sandbox can be triggered in Google Chrome desktop builds prior to 156.0.8078.47 when a victim opens a crafted HTML page that drives a use-after-free in the Media component. Exploitation is unauthenticated over the network but requires user interaction (CVSS:3.1/PR:N/UI:R), and because code execution stays 'inside the sandbox' per the vendor description, host compromise requires chaining a separate sandbox escape - which is why Google rated the issue Chromium severity Low even though NVD scored it 8.8 while our own assessment lands at C:L/I:L/A:L. No public exploit code or CISA KEV listing was identified at time of analysis, and the flaw is addressed by the vendor's 156.0.8078.47 stable release.
Memory corruption in Google Chrome's Compositing component allows unauthenticated remote attackers to execute arbitrary code inside the renderer sandbox by convincing a victim to open a crafted HTML page in desktop versions prior to 156.0.8078.47. User interaction is mandatory, and successful exploitation is confined to the sandbox, so host compromise would require chaining a separate sandbox-escape vulnerability. No public exploit was identified at the time of analysis, and Google has released a patched version; the 8.8 CVSS score contrasts with Chromium's Medium severity rating because of the sandbox confinement.
Memory corruption in the OptimizationGuide component of Google Chrome versions prior to 156.0.8078.47 lets a remote, unauthenticated attacker who convinces a victim to load a crafted HTML page potentially achieve arbitrary code execution - but only within the browser's sandbox. Chrome-side exploitation requires user navigation (UI:R), so it is not a fully automatic drive-by, and escaping to the host OS would need a separate sandbox-escape chain; the CVSS 3.1 vector scores 8.8 because of high confidentiality, integrity, and availability impact. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch (156.0.8078.47) is available.
Google Chrome builds prior to 156.0.8078.47 carry an input-validation flaw in an exposed API that allows a remote, unauthenticated attacker to achieve arbitrary code execution inside the renderer sandbox when a victim simply loads a crafted HTML page. Exploitation hinges entirely on the user-interaction requirement (UI:R): the victim must open attacker-controlled HTML in a vulnerable, default-configured Chrome, and the resulting code execution stays inside the browser's renderer sandbox (S:U), so host-level compromise would additionally require chaining an unrelated sandbox-escape bug that is not part of this CVE. Although the base score reaches 8.8, no public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis, and Chromium's own rating for the issue is only Medium, so real-world priority sits below what the numeric score suggests. Vendor-released patch: 156.0.8078.47.
Memory corruption in Google Chrome's Sensor component prior to version 156.0.8078.47 allows a remote attacker to potentially execute arbitrary code inside the browser sandbox when a victim renders a crafted HTML page. The flaw is rated CVSS 3.1 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) - network reachable, low complexity, no privileges required, but contingent on one user action (opening the page) - and Google classifies it as Chromium security severity Medium. Because the corruption occurs in the sandboxed renderer, any code execution is confined there; achieving host-level compromise would require the attacker to additionally chain a separate sandbox-escape bug. No public exploit code has been identified at the time of analysis, and the issue was fixed by the Chrome stable channel update.
Memory corruption in Google Chrome's DevTools component before version 156.0.8078.47 lets a remote attacker who convinces a victim to open a crafted HTML page potentially execute arbitrary code within the browser sandbox. The flaw requires user interaction and no authentication; while the CVSS base score is 8.8, Google rates it Low severity, and code execution is scope-limited to the sandbox, so host compromise would require a separate sandbox escape. No public exploit was identified at time of analysis, and a vendor patch is available.
Improper input validation in Google Chrome's password-handling component before 156.0.8078.47 allows a remote attacker to run arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page. The issue is unauthenticated from the attacker's perspective (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) but depends entirely on user interaction - the target must actively navigate to the attacker-controlled page in a vulnerable desktop Chrome build. Chromium itself rated the flaw 'Low' because the resulting execution stays confined to the sandbox (S:U), meaning host-level compromise would require chaining a separate sandbox-escape vulnerability; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Memory corruption in the HTML handling component of Google Chrome prior to 156.0.8078.47 lets a remote attacker trigger a buffer-related fault and potentially execute arbitrary code, though strictly inside the renderer sandbox. Affected users are those running Chrome builds older than 156.0.8078.47 across desktop platforms; exploitation requires the victim to open a crafted HTML page (UI:R) and needs no credentials or prior privileges. Google rates the issue Low on its Chromium severity scale despite the 8.8 CVSS, and no public exploit code or confirmed active exploitation was identified at time of analysis; the practical ceiling on impact is the sandbox boundary, so host compromise would need a separate sandbox-escape chained in.
Use-after-free in Google Chrome's API layer allows a remote, unauthenticated attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page in versions prior to 156.0.8078.47. CVSS 3.1 is 8.8 (High) with UI:R, while Chromium rates it Medium because code execution remains confined to the sandbox and host compromise requires a separate sandbox escape. No public exploit was identified at time of analysis, and the vendor has released Chrome 156.0.8078.47 as the fix.
Improper input validation in Chrome's Extensions component allows a remote, unauthenticated attacker to achieve arbitrary code execution inside the renderer sandbox in Google Chrome desktop builds prior to 156.0.8078.47, triggered when a victim renders a crafted HTML page (CVSS 3.1: 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Exploitation is not zero-click: the UI:R metric and the 'crafted HTML page' wording confirm the user must actively visit or load attacker-controlled content, and the resulting code execution is contained within the browser sandbox unless chained with a separate sandbox-escape flaw. No public exploit code has been identified at the time of analysis, there is no CISA KEV listing, and EPSS is low at 0.30% (22nd percentile), so real-world priority is moderate even though vendor-released patch 156.0.8078.47 is available.
Authentication bypass in Cruise Control (Red Hat Streams for Apache Kafka 2.x and 3.x) lets adjacent-network attackers reach all 15 administrative REST endpoints without credentials by abusing exact-path Jetty security constraints and servlet path normalization. The CVSS 3.1 score is 8.8 (AV:A/AC:L/PR:N/UI:N), but in AMQ Streams the Strimzi operator NetworkPolicy limits Cruise Control port 9090 to operator pods, so realistic exposure requires that policy to be absent, disabled, or misconfigured. No public exploit was identified at time of analysis.
Oracle JD Edwards EnterpriseOne Tools (Installation Security component) versions 9.2.0.0 through 9.2.26.5 can be taken over by a remote, unauthenticated attacker who convinces another user to interact with attacker-supplied content delivered over HTTP, yielding high confidentiality, integrity and availability impact (CVSS 3.1 base 8.8). The mandatory victim interaction (UI:R) means delivery depends on social engineering rather than a direct server-side hit, which limits automated mass exploitation. No public exploit code or confirmed active exploitation was identified at time of analysis, so this is a credible high-priority item rather than a drop-everything emergency; the fix ships in Oracle's October 2026 Critical Patch Update.
Low-privileged authenticated attackers can achieve full takeover of Oracle Data Integrator 12.2.1.4.0 and 14.1.2.0.0 by sending SQL against the Dictionary Repository component over the network. Exploitation requires a valid low-privilege ODI account but no user interaction and only low attack complexity, with high confidentiality, integrity, and availability impact (CVSS 8.8). No public exploit identified at time of analysis, and no CISA KEV status was supplied.
Full takeover of MySQL Server and MySQL Cluster is possible for unauthenticated attackers who can reach the Group Replication communication segment, affecting MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1 plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. The flaw is in the Server: Group Replication GCS component and yields high confidentiality, integrity and availability impact (CVSS 8.8, AV:A/AC:L/PR:N/UI:N). Exploitation is limited to deployments running Group Replication and to attackers on the adjacent physical communication segment; no public exploit was identified at time of analysis and CISA KEV status is not indicated.
Authenticated, high-privilege users of the Advantech ADAM-3600 industrial edge gateway can exploit a command injection flaw in the device’s command-handling functionality to execute arbitrary OS commands with root privileges, achieving full device compromise. The network-reachable flaw has a CVSS 4.0 score of 8.6 (PR:H, UI:N, AC:L) and, per the independent assessment, is not accessible to anonymous remote attackers because valid administrative credentials or a privileged session are required. No public exploit was identified at the time of analysis, and the device’s usual placement inside segmented OT/ICS networks limits exposure, although the exact vulnerable interface and affected firmware versions were not specified.
Origin-policy bypass in Google Chrome before 156.0.8078.47 can let a remote attacker use a crafted HTML page to make unauthorized cross-origin accesses after the victim visits the page. The flaw is a missing authorization check in Chrome's Animation component (CWE-862); it affects default installations and requires user interaction, with no authentication needed. There is no evidence of active exploitation and no public exploit identified at time of analysis; EPSS is 0.24% (14th percentile), and Google has released 156.0.8078.47 as the fixed build.
Improper access control in Google Chrome's ComputePressure component allows a remote, unauthenticated attacker to bypass web origin policy in any build prior to 156.0.8078.47 by getting a victim to open a crafted HTML page. Impact scoring conflicts across sources: the published vector claims 8.8 with high confidentiality and integrity impact, while our own assessment rates it confidentiality-only and low (C:L/I:N/A:N), so the realistic worst case is a limited cross-origin information leak rather than full compromise. No public exploit code has been identified at time of analysis and EPSS sits at 0.24% (14th percentile); the mandatory user interaction keeps mass automation unlikely, which is why it is prioritized for remediation this week rather than treated as an emergency.
Oracle BI Publisher versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0 can be taken over by unauthenticated remote attackers who persuade a victim to interact with a crafted HTTP-delivered resource in the BI Platform Security component. The CVSS 3.1 score is 8.8 with high confidentiality, integrity, and availability impact, but exploitation requires human interaction (UI:R) and network reachability to the BI Publisher endpoint. No public exploit code or CISA KEV confirmation was identified at time of analysis.
Improper access control in the V8 JavaScript engine of Google Chrome builds prior to 156.0.8078.47 lets a remote attacker who convinces a user to load a crafted HTML page potentially bypass web origin policy, compromising the confidentiality and integrity of data across origins. Exploitation needs no credentials (PR:N) but does require user interaction, so unattended mass exploitation is bounded. No public exploit code or CISA KEV entry is present in the supplied data; EPSS is low at 0.23% (14th percentile), and the priority decision is this_week rather than emergency.
Adjacent-network attackers can exploit an installation-security weakness in JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.4 to take over the product, provided a person other than the attacker performs a required interaction; no authentication is needed and the scope change means connected products may also be affected. The CVSS 3.1 score is 8.8, but exploitation is constrained by the AV:A adjacency requirement and UI:R human interaction. No public exploit identified at time of analysis and no CISA KEV entry is present in the available data.
Memory corruption in ANGLE, the graphics translation layer built into Google Chrome, allows a remote attacker to read memory from the browser process when a victim renders a crafted HTML page on any build prior to 156.0.8078.47. Exploitation needs user interaction (the victim must load the page) but no credentials, and the disclosed impact is a confidentiality breach via memory disclosure rather than confirmed code execution, so the independent assessment scores it AV:N/AC:L/PR:N/UI:R/C:H/I:N/A:N rather than the vendor-supplied 8.8 with full integrity and availability impact. Chrome's own severity rating is Medium, EPSS is 0.22% (11th percentile), and no public exploit code has been identified at time of analysis; Google has released a fix in the 156.0.8078.47 stable channel update.
A stack-based buffer overflow in Apple's Bluetooth stack lets an attacker who controls a Bluetooth device already paired with the target run arbitrary code on the device, with high impact to confidentiality, integrity, and availability. Affected are default Bluetooth-enabled configurations of iOS/iPadOS before 26.7 and 27, macOS Sequoia before 15.8, macOS Tahoe before 26.7, macOS Golden Gate before 27, and visionOS before 27; Apple fixed the flaw through improved input validation in iOS 26.7/27, iPadOS 26.7/27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, and visionOS 27. Exploitation requires a pre-existing pairing and proximity within Bluetooth radio range (CVSS AV:A, PR:N, UI:N), which rules out untargeted internet-scale attacks; EPSS is 0.19% (8th percentile), CISA SSVC records Exploitation: none and Automatable: no, and no public exploit code has been identified at time of analysis.
Memory corruption in Google Chrome's Extensions component lets remote, unauthenticated attackers read memory inside the browser sandbox when a victim loads a crafted HTML page in any build prior to 156.0.8078.47. Exploitation is not zero-click: it requires the user to open the attacker-controlled page (UI:R), and the demonstrated impact is confined to information disclosure within the sandbox rather than code execution or sandbox escape, which is why Chromium rated it Medium severity despite a nominal 8.8 base score. There is no public exploit identified at time of analysis and EPSS is low at 0.18% (8th percentile), while Google has shipped a fixed release in the Stable channel.
Hard-coded credentials in IBM Verify Identity Access 11.0.3.1 and IBM Security Verify Access 10.0.9.3 appliances can let an attacker in physical or adjacent-network proximity gain elevated privileges, with CVSS 3.1 score 8.8 reflecting high confidentiality, integrity, and availability impact. The CVSS vector indicates no privileges or user interaction are required (PR:N/UI:N), but the adjacent-network attack vector limits exposure to attackers who can reach the appliance locally or on an adjacent segment. No public exploit code or confirmed active exploitation was identified at time of analysis.
Oracle Secure Backup 19.1.0.0.0 and 19.1.0.1.0 can be taken over by an authenticated, low-privileged attacker who already has a local logon to the host, with scope change potentially affecting other products on that infrastructure. Exploitation is straightforward once local access exists (AV:L/AC:L/PR:L/UI:N/S:C), but it is not remotely reachable without a prior foothold; no public exploit was identified at time of analysis. This is a credible high-priority issue but not an emergency drop-everything item.
Apple Xcode before version 27 fails to enforce library validation on certain bundled binaries, allowing a malicious app already running inside Xcode's sandbox to load untrusted libraries and break out of that sandbox (CVSS 8.8, scope-changed, high confidentiality/integrity/availability impact). Exploitation is strictly local: an attacker must first get code executing on the macOS host - for example through a trojanized developer tool, plugin, or dependency - and the flaw then provides sandbox escape and privilege escalation rather than initial access. Apple addressed the issue by enforcing library validation, shipping the fix in Xcode 27 (available from https://support.apple.com/en-us/149040); no public exploit code and no confirmed active exploitation were identified at time of analysis.
Arbitrary code execution in Apple Safari and WebKit-based components on iOS/iPadOS, macOS, and visionOS can occur when a user processes maliciously crafted web content, due to a type confusion flaw corrected with improved state management. Safari, iOS/iPadOS, macOS, and visionOS versions prior to 27 are affected, while Safari 27, iOS/iPadOS 27, macOS Golden Gate 27, and visionOS 27 contain the fix. The CVSS 3.1 score of 8.8 reflects a network-reachable, low-complexity, unauthenticated attack that requires user interaction (visiting hostile content); no public exploit was identified at time of analysis.
PEAK-System PCAN Windows CAN device drivers and the PEAK-System Device Driver Setup package contain an output-buffer validation flaw in the PCAN diagnostic call, where the driver writes its diagnostic output record without confirming the caller-supplied buffer is large enough. A local user with existing privileges who can reach the driver interface and supplies an undersized buffer can trigger memory corruption that crashes the driver or service, degrading availability; there is no disclosed path to code execution, data disclosure, or integrity loss. The CISA ICS advisory (ICSA-26-293-01) covers this issue, no public exploit code or confirmed active exploitation was identified at time of analysis, and the flaw carries a moderate EPSS-style risk profile given its local attack vector and privileges required.
Local denial of service in the PEAK-System PCAN Windows CAN device driver can be triggered when a record list contains a malformed record: although the parser rejects the record, the processing loop still advances its processed-bytes counter, desynchronizing parsing and producing an out-of-bounds write (CWE-787). The issue affects PEAK-System Device Driver Setup and PCAN Windows CAN device drivers distributed through HMS Networks, and exploitation requires local access with low privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). No public exploit was identified at time of analysis, and there is no CISA KEV confirmation; the assessed impact is availability loss, such as a driver or system crash, rather than code execution or data compromise.
Local denial-of-service in PEAK-System PCAN Windows CAN device drivers and Device Driver Setup packages allows a low-privileged local user who can open the driver device to supply a receive-record count exceeding the caller-supplied output buffer length, causing an insufficiently bounded copy and potentially crashing the driver or system. The flaw is local only (AV:L) and affects Windows hosts with the PEAK PCAN driver installed; no public exploit was identified at time of analysis, and the assessed impact is availability only, with no confirmed confidentiality or integrity impact.
Locally exploitable denial-of-service in PEAK-System PCAN Windows CAN device drivers can crash the driver or system when a crafted type 0x4030 processing path selects or returns an object pointer that is dereferenced without validation. Affected systems are Windows hosts running the PEAK-System PCAN Windows CAN device drivers or PEAK-System Device Driver Setup, and exploitation requires local access plus low-level privileges (CVSS 5.5, AV:L/PR:L/UI:N, A:H). No public exploit was identified at time of analysis and no KEV confirmation is present in the provided data; the expected impact is availability loss, not remote compromise or confirmed data theft.
Broken authorization in SolarWinds Observability Self-Hosted allows an authenticated low-privileged user to access and modify information beyond their assigned permissions, with high confidentiality and integrity impact (CVSS 8.8). The flaw is network-reachable and requires only a valid low-privilege session, not pre-authentication, so a compromised or over-provisioned account is sufficient. No public exploit code or confirmed active exploitation was identified in the provided intelligence at time of analysis.
Cross-site request forgery in the WordPress VikRentCar plugin through 1.4.8 can make a logged-in privileged user-typically a WordPress administrator-submit unintended VikRentCar actions when tricked into visiting attacker-controlled content. The supplied CVSS 3.1 score is 8.8 (AV:N/AC:L/PR:N/UI:R), but the authoritative assessment constrains realistic impact to integrity only (C:N/I:L/A:N) because the attacker cannot read responses and must rely on victim interaction. No CISA KEV entry or public exploit code was identified in the provided data.
Denial of service in the Eclipse ThreadX NetX Duo Web add-on's HTTP server, which mishandles a `Content-Length` underflow while processing a `PUT` request and ends up dereferencing and freeing an uninitialized pointer. The flaw is reachable by an unauthenticated remote client with a single malformed request (CVSS 4.0 AV:N/AC:L/AT:N/PR:N/UI:N), making the realistic outcome a crash of the HTTP service or the whole device (VC:N/VI:L/VA:H) rather than code execution or data exposure. Only deployments that have compiled in and network-exposed the Web add-on's HTTP server are affected; devices running NetX Duo without that component are not exposed, and no public exploit code was identified at time of analysis.
Unauthenticated SQL injection in TYPO3 File Manager allows remote attackers to read database contents through crafted file-search terms, per the CVSS vector's PR:N/UI:N conditions. The extension wraps the search term in quotes but escapes only LIKE wildcards, so an unescaped quote can break out of the quoted value across every searchable field. Impact is confidentiality-only per the independent assessment, and no public exploit is identified at time of analysis; the TYPO3 advisory is the reference for affected and fixed releases.
High-privileged attackers who can reach Oracle Siebel CRM's Deployment Server Infrastructure over HTTP can create, delete, or modify critical data and read all data accessible through that component, with the scope change (S:C) meaning successful exploitation can also affect other connected Oracle products beyond Siebel CRM. Supported releases 17.0 through 26.9 are affected; Oracle rates the flaw CVSS 3.1 8.7 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N), with confidentiality and integrity fully compromised but no availability impact. The pre-existing administrative privilege requirement (PR:H) is the principal limiting factor, making malicious insiders or already-compromised admin accounts the realistic threat actors; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV.
High-privileged SOAP access to Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0 can be abused to read and modify critical connector data, with scope change extending impact to additional Oracle Fusion Middleware products. The flaw is easily exploitable once an attacker already holds high privileges in the product (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N, 8.7) and requires network reachability to the Connectors and Connector Server component; no public exploit was identified at time of analysis.
SQL injection in YS-infoware BA-Workflow allows authenticated remote attackers with low privileges to read, modify, and delete arbitrary database contents. The CPE wildcard indicates all product versions are affected, and exploitation requires only a valid low-privilege session with no user interaction. No public exploit code was identified at time of analysis.
SQL injection in YS-infoware BA-Workflow lets authenticated remote attackers execute arbitrary SQL statements, enabling them to read, modify, and delete database contents. The issue is rated CVSS 8.7 and affects BA-Workflow deployments matching the version-agnostic CPE supplied by TW-CERT; exploitation requires a valid BA-Workflow account, which limits exposure to users who can authenticate. No public exploit code was identified at time of analysis, and the product's limited deployment base makes this a credible but second-tier priority rather than a broadly urgent Internet-wide threat.
SQL injection in BA-Workflow (YS-infoware) allows authenticated remote attackers with low privileges to inject arbitrary SQL statements and read, modify, or delete database contents. The CVSS 4.0 score is 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N), reflecting network reachability, low complexity, no attack requirements, low-privilege authentication, no user interaction, and high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis.
Oracle Trusted Answer Search 26.1 can allow a low-privileged authenticated attacker with network access to the Application expert UI to create, delete, modify, or read critical data after another user is induced to interact with attacker-supplied content. The CVSS 3.1 score is 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N), reflecting high confidentiality and integrity impact and possible scope change to additional products, with no availability impact. No public exploit code or CISA KEV entry was identified at time of analysis, and exploitation requires both an existing low-privileged account and a separate human victim.
Authenticated remote code execution affects Uniong WebITR: a low-privilege user (CVSS PR:L) can forge serialized data using a hard-coded cryptographic key, bypass integrity validation, and trigger insecure deserialization (CWE-502) to run arbitrary code on the server. The network-reachable flaw has high confidentiality, integrity, and availability impact and requires no user interaction. No public exploit code or CISA KEV entry was identified in the provided intelligence at time of analysis.
Incorrect privilege assignment in the CICD-toolchain-for-serverless-applications IAM policy (versions 1.0.7 through 1.0.10) lets an authenticated user who can push to the application source repository escalate privileges beyond the application stack inside the same AWS account. Because the CloudFormation deployment role is not scoped to the application's own resources, an attacker-supplied application template processed by the toolchain pipeline can read or modify unrelated IAM role policies, Secrets Manager secrets, and SSM parameters. Exploitation is gated on repository push rights (CVSS PR:L) and on the pipeline actually deploying the crafted template; no public exploit code and no confirmed active exploitation were identified at time of analysis, and AWS has released 1.0.11 to close the path.
Authorization bypass in Cloudflare Pingora before 0.9.0 can occur only in a chained HTTP/1 deployment where Pingora forwards to a downstream HTTP/1 intermediary that honors Connection-nominated headers and the origin trusts a header Pingora adds, such as X-Forwarded-For. A remote, unauthenticated attacker can use the client Connection header to nominate that trusted header; because the vulnerable HTTP/1 upstream path fails to strip hop-by-hop or nominated headers, the intermediary may remove it and bypass IP-based authorization. No public exploit was identified at time of analysis, Cloudflare CDN customers are explicitly unaffected, and 0.9.0+ default policy removes these headers, so the issue is conditional rather than broadly exploitable.
Authenticated low-privileged users of the Siebel Life Sciences Web UI in Oracle Siebel CRM versions 17.0 through 26.9 can exploit a scope-changing flaw over HTTP to read and modify critical data beyond their own authorization boundary, but only if they can persuade another user to interact with the attack. The CVSS 3.1 score is 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N), with high confidentiality and integrity impact and no availability impact. No public exploit was identified at time of analysis, and there is no CISA KEV entry.