Oracle Agile Product Lifecycle Management for Process 6.2.4 allows a low-privileged authenticated user to read a subset of data and to update, insert, or delete records through the Supply Chain Relationship Management component over HTTP, provided a different user first interacts with attacker-supplied content. The scope-change rating means successful exploitation can also affect other products integrated with Agile PLM, although confidentiality and integrity impacts are individually rated low and availability is unaffected. No public exploit identified at time of analysis, and the CVE is not flagged as actively exploited in the provided KEV data, so this medium-severity CVSS 5.4 issue fits routine patch-cycle handling rather than emergency response.
Oracle Agile Product Lifecycle Management for Process 6.2.4 carries a medium-severity flaw (CVSS 3.1 base 5.4) in its Product Quality Management component that allows a low-privileged, authenticated attacker to deliver crafted HTTP content and, once a different user interacts with it, obtain unauthorized read access plus limited insert, update, or delete access to PLM data. The changed scope rating (S:C) means a successful attack can extend beyond the PLM application into other integrated Oracle Supply Chain products, although the combination of mandatory credentials and required victim interaction keeps practical exploitability modest. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Oracle REST Data Services (ORDS) versions 24.2.0 through 26.1.0 contain an ADP-component security flaw that is tagged Authentication Bypass but, per the assessed vector, requires a low-privileged authenticated attacker and a separate user's interaction over HTTP. Successful exploitation can read and modify a limited subset of ORDS-accessible data, and the scope change means affected downstream products may also be impacted; there is no availability impact. CVSS 3.1 is 5.4 (medium), and no public exploit has been identified at time of analysis.
Oracle REST Data Services 24.2.0 through 26.1.0 contains a moderate-severity Database Actions flaw that lets an authenticated low-privileged attacker with network access and a victim's interaction alter or read limited data, with scope change potentially affecting additional products. Exploitation requires the attacker to hold a valid low-privileged ORDS account and persuade a separate, typically higher-privileged user to view or render attacker-supplied content; it is not an unauthenticated drive-by. No public exploit was identified at time of analysis, and Oracle has published a CPU advisory for the affected range.
Firefox clients that cannot refresh Mozilla's OneCRL revocation list over RemoteSettings may continue to trust TLS certificates chained to compromised eMudhra intermediate CAs, allowing an attacker positioned on the network path to intercept HTTPS sessions with limited confidentiality and integrity impact. The issue is resolved in Firefox 158.0.1, Firefox ESR 153.5.1 and Firefox ESR 115.43.1 by bundling the updated block list directly into the binary, so the revocation applies even when RemoteSettings is disabled by policy or unreachable. No public exploit code or confirmed active exploitation was identified, and the independent assessment rates this as a low-to-moderate defense-in-depth gap (AC:H) rather than an emergency: the attacker must already hold a compromised eMudhra intermediate certificate and control the victim's traffic path, while default installations were already protected by the 17 October RemoteSettings push.
Authenticated low-privileged attackers with network access to Oracle BI Publisher's Security component can read a subset of data and perform unauthorized inserts, updates, or deletes on some accessible data in versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. The CVSS 3.1 base score is 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), with no availability impact and no user interaction required. At time of analysis, no public exploit identified; exploitation requires valid low-privileged credentials and HTTP access to the affected component.
Server-side request forgery in IBM ContextForge MCP Gateway 0.1.0 through 1.0.5 lets users who hold an authenticated account with gateway-creation privileges direct arbitrary HTTP POST requests at internal network services, localhost-bound daemons, and cloud metadata endpoints (AWS IMDSv1, GCP, Azure). The flaw is reachable only through the OAuth client-credentials gateway registration flow, where the oauth_config.token_url parameter is used without the SSRF validation that already guards the gateway.url field; the gateway then immediately POSTs form-encoded client credentials to the attacker-named URL and, when the reply fails OAuth token parsing, reflects up to 256 characters of the response body in an HTTP 502 error. Exploitation requires valid low-privileged credentials (PR:L) and returns only limited/blind data, no public exploit code was identified at time of analysis, there is no CISA KEV listing, and EPSS is 0.18% (7th percentile) - a moderate, low-priority issue rather than an emergency.
Sandbox restrictions in Oracle Java SE 8u503, Oracle JavaFX 21.0.12/25.0.4/27, and Oracle GraalVM Enterprise Edition 21.3.19.1.1 can be bypassed by untrusted code that a victim loads through Java Web Start or Java applets, letting an unauthenticated network attacker read and modify some accessible data. The CVSS 3.1 score is 5.4 with UI:R, and the flaw does not affect server deployments that run only trusted code; no public exploit identified at time of analysis (not in CISA KEV).
A use-after-free memory-safety flaw in Apple's media file processing affects iOS/iPadOS, macOS, tvOS, visionOS, and watchOS builds prior to the fixed releases (iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8 / Tahoe 26.7 / Golden Gate 27, tvOS 27, visionOS 27, watchOS 27). Processing a maliciously crafted media file can cause unexpected app termination or corruption of process memory; the assessed outcome is limited to availability and partial integrity impact, with no confirmed code execution or data disclosure. Apple addressed the issue through improved memory management, and there is no public exploit identified at time of analysis, with a low EPSS score (0.17%) consistent with the required user interaction (CVSS vector AV:N/AC:L/PR:N/UI:R) and constrained impact.
Oracle BI Publisher's Web Service API exposes limited read and write access to a low-privileged account holder who can persuade another user to interact with a crafted request, and the scope change means connected Oracle products may also be affected. Only versions 8.2.0.0.0 and 26.01.0.0.0 are listed as affected, and exploitation is constrained by the need for valid credentials plus victim interaction. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
A type-confusion logic flaw (CWE-843) in Apple's WebKit rendering engine can be triggered when a user loads maliciously crafted web content, causing unexpected behavior with limited confidentiality and availability impact. The bug affects Safari, visionOS, and watchOS builds prior to version 27 on all platforms, and is fixed by the vendor's 27-series releases; exploitation requires the victim to render an attacker-controlled page (UI:R) but no credentials (PR:N). Risk is moderate and low-urgency: EPSS is 0.16% (5th percentile), there is no CISA KEV listing and no public exploit code identified at time of analysis, and impact is capped at low confidentiality/availability with no integrity effect or confirmed reliable code execution.
The import-export module of ApostropheCMS, in versions prior to 3.7.0, allows an authenticated user who has been granted import access to a document type to supply an object or query operator where a scalar update-key value is expected, so the generated import query matches an existing document the attacker did not deliberately select. Because the normal findForEditing permission filter still applies and the matched document is not attacker-controlled, the overwrite is limited to content the user already has generic edit rights over - there is no bypass into protected or arbitrary content. Both import access and edit permission on the affected type are prerequisites, and only import-export releases below 3.7.0 are affected; no public exploit has been identified at time of analysis.
Stored cross-site scripting in ApostropheCMS versions before 4.34.0 allows an authenticated content editor to break out of an inline style attribute and add executable HTML attributes when a project-defined free-form widget style field is rendered. Published content viewed by visitors or an affected draft viewed by a higher-privileged user can trigger the injected attributes; the issue requires a non-default inline style field and victim interaction, and no public exploit was identified at time of analysis. The CVSS 5.4 rating reflects changed scope with limited confidentiality and integrity impact.
Stored cross-site scripting in ApostropheCMS before 4.34.0 allows an authenticated user with content-edit rights to persist arbitrary HTML inside a color field and have it execute in another user's browser when the value is rendered. The flaw exists because the field's TinyColor validation accepts any value that merely contains a valid rgb()/hsl() color, so an attacker can supply a legitimate color prefix followed by crafted markup; the payload reaches the generated wrapper's style attribute when a widget style color field is rendered inline without a selector. Exploitation requires a valid editor account and a victim who later views the affected page (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, 5.4), and no public exploit code or active exploitation has been identified at time of analysis. The issue is fixed in version 4.34.0.
Information disclosure in Mozilla Firefox versions prior to 158.0.1 stems from uninitialized memory handling in the cubeb Audio/Video component, allowing a remote attacker who convinces a user to load attacker-controlled media to read small, non-targeted memory fragments. The flaw is rated CVSS 5.4 with a required user-interaction gate (UI:R) and no authentication prerequisite (PR:N), and no public exploit code was identified at time of analysis. Upgrading to Firefox 158.0.1 removes the condition.
Stored HTML injection in the TYPO3 Fluid Form extension (typo3_fluid-form_by_coding.ms) lets unauthenticated remote attackers submit form values that are rendered unescaped in the HTML summary email sent to the site operator. The issue is medium severity (CVSS 5.3, CWE-79) and requires the extension's HTML summary-email notification feature to be enabled with a publicly reachable form; impact is limited to the recipient opening the email, where active scripting is typically suppressed, and no public exploit identified at time of analysis.
Unauthenticated remote attackers can exhaust server-side temporary storage on ApostropheCMS sites running the @apostrophecms/form add-on prior to 1.5.5, because the form submission route writes unbounded multipart uploads to temporary disk before any form validation or authentication is performed and enforces no upload size, count, or rate limits. Repeated anonymous POSTs to an exposed form route let an attacker fill temp storage and degrade or disrupt form handling and other co-hosted services; the rated vector is AV:N/AC:L/PR:N/UI:N with impact limited to availability (5.3, Medium), and no public exploit code has been identified at time of analysis. It is not recorded as confirmed actively exploited (CISA KEV), but the low skill floor and lack of prerequisites make it a realistic nuisance-to-availability risk for any site exposing a form built with the add-on.
Mozilla Thunderbird builds prior to 158.0.1 that authenticate to POP3 or SMTP servers using NTLM (and, for the crash path, GSSAPI) accept a server-supplied challenge without verifying it is valid base64, allowing a malicious or man-in-the-middle server to make the client embed uninitialized heap contents in its NTLM response and disclose that memory back to the attacker; a challenge composed solely of base64 padding instead drives an out-of-bounds read that crashes the client. Only accounts explicitly configured for NTLM/GSSAPI authentication are exposed, and the attacker must control the mail server endpoint or hold an on-path position, so realistic risk is confined to targeted or interception scenarios; there is no public exploit identified at time of analysis and CISA's SSVC assessment records no observed exploitation and no automatable path. Disclosed memory is limited in scope (low confidentiality impact) and the crash is a localized denial-of-service for the affected client session, consistent with a moderate-to-low priority rating.
Authenticated importers in ApostropheCMS can crash the Node.js process by submitting a crafted tar archive to the @apostrophecms/import-export module prior to 3.7.0. The archive entry's normalized destination is aimed at a directory while evading a literal parent-path substring check, causing a write-stream filesystem error that is not handled and terminates the process. This is an authenticated denial-of-service issue (CVSS 4.0 base 5.3; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:N/C:N/I:N/A:L) with no public exploit identified at time of analysis, no KEV listing, and no EPSS score provided; the source establishes a static primitive but not controlled arbitrary file read or write.
Partial denial of service in Oracle Java SE (8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27), Oracle JavaFX (21.0.12, 25.0.4, 27), Oracle GraalVM for JDK (17.0.20.1, 21.0.12.1) and Oracle GraalVM Enterprise Edition (21.3.19.1.1) is reachable by unauthenticated remote attackers who can get attacker-controlled image data into the ImageIO component, either through a web service or API that decodes supplied data or through sandboxed Web Start/applet code loading untrusted content. Impact is confined to availability - a partial denial of service (CVSS 3.1 5.3, AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:L) with no confidentiality or integrity effect. No public exploit code or confirmed active exploitation was identified at time of analysis, and exposure is limited to JVMs that actually parse untrusted images.
Partial denial of service in Oracle Siebel CRM's Siebel Apps - Marketing component can be triggered by unauthenticated, remote attackers who deliver SMTP traffic to the Marketing email-processing interface on versions 17.0 through 26.9. Oracle scores this CVSS 3.1 at 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), so impact is bounded to availability of the Marketing module with no confidentiality, integrity, or scope change. No public exploit code or confirmed active exploitation was identified at time of analysis, and instances that do not expose the Marketing SMTP interface to untrusted networks are not reachable.
Partial denial of service in Oracle Java SE and Oracle GraalVM JDK occurs when the JSSE component processes attacker-supplied TLS data reachable over the network. Affected releases include Java SE 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1 and 25.0.4.1, plus GraalVM for JDK 17.0.20.1/21.0.12.1 and GraalVM Enterprise Edition 21.3.19.1.1. Unauthenticated remote attackers can cause only a partial availability impact (CVSS 5.3, A:L); no public exploit was identified at time of analysis.
A reachable JAXP (Java API for XML Processing) parsing path in Oracle Java SE 8u503, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1 and 27, plus GraalVM for JDK 17.0.20.1/21.0.12.1 and GraalVM Enterprise Edition 21.3.19.1.1, can be driven by crafted XML to degrade availability, yielding a partial denial of service (CVSS 5.3, AV:N/AC:L/PR:N/UI:N, A:L only). Exploitation is bounded by reachability: it requires that the target expose a JAXP-backed interface to attacker-supplied XML, such as a web service, REST/SOAP endpoint, or any component parsing externally sourced documents with the JDK's default XML stack. No public exploit code or confirmed active exploitation was identified at the time of analysis, and the issue carries no confidentiality or integrity impact - this is a moderate, availability-only flaw that does not warrant emergency out-of-band patching.
Partial denial of service in Oracle Helidon 4.0.0 through 4.5.5 and 27.0.0 is reachable by unauthenticated remote attackers through the helidon-webclient-http1 HTTP/1.1 client component, with CVSS 3.1 base score 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). The practical exposure is an application that uses Helidon WebClient to make outbound HTTP/1.1 requests to a server whose responses an attacker can control or influence, such as a third-party API, redirect target, or SSRF-reachable endpoint; purely inbound-facing servers that never use the WebClient toward untrusted hosts are less exposed. Impact is limited to partial availability loss, and no public exploit identified at time of analysis.
Improperly encoded CAPTCHA response tokens let remote attackers disrupt reCAPTCHA and hCaptcha verification in ApostropheCMS deployments that run the Form add-on before 1.5.5, login-recaptcha before 1.2.1, or login-hcaptcha before 1.3.0. Submitting a token containing '&' plus extra key=value pairs injects parameters into the server-side siteverify request, forcing verification failures that break CAPTCHA-gated forms and logins and enabling automated bypass probing; the vendor assessment confirms no secret disclosure and no proven CAPTCHA bypass. No public exploit has been identified at time of analysis, and CISA KEV or EPSS data does not elevate this above a low-priority, denial-of-service-style nuisance for sites that have a vulnerable add-on installed with CAPTCHA actively enabled.
Missing authorization in the Sgalinski Cookie Consent extension for TYPO3 allows any authenticated backend user, regardless of role or module permissions, to read cookie-consent history and statistics for any site in the installation. The exposure is limited to confidentiality of consent data and requires valid backend credentials, so it is primarily an insider or post-compromise risk rather than an unauthenticated attack path. No public exploit code or confirmed active exploitation was identified at time of analysis.
Authorization bypass in the TYPO3 'analytics' backend module lets any authenticated backend user who has module access open the analytics dashboard of any site in a multi-site installation, exposing read-only analytics data across site boundaries (CWE-639). The issue is a moderate IDOR-class flaw scored CVSS 4.0 5.3 and assessed at CVSS 3.1 5.3 with PR:L, and there is no public exploit identified at time of analysis. Single-site installations see no additional disclosure because there is only one site to view.
Authenticated TYPO3 backend users can retrieve analytics data for sites they have page access to because the analytics extension's AJAX routes do not verify access to the related backend module or dashboard widget. This affects TYPO3 installations where the analytics extension is installed and active; exploitation requires valid backend credentials, and no public exploit code or active exploitation was identified at time of analysis, keeping risk low-to-moderate.
Stored cross-site scripting in sanitize-html before 2.18.0 occurs only when the sanitizer is configured with a non-default nonTextTags option that includes noscript; default configurations and other default nonTextTags elements are not affected. In ApostropheCMS, an authenticated low-privilege content author can submit crafted HTML that survives sanitization and executes when a victim later views it in a scripting-enabled browser, yielding limited client-side impact (assessed CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N; CVSS 4.0 base 5.3, Medium). No public exploit was identified at time of analysis.
ApostropheCMS before 4.33.0 can expose single-use bearer session tokens in cross-host or cross-locale session-migration redirect URLs, letting a low-privileged remote attacker who captures and redeems an unconsumed token before the legitimate client does adopt the associated session. The same token-in-URL pattern affects @apostrophecms/passport-bridge before 1.6.1 in its cross-locale authentication flow. This is a moderate-severity CWE-598 session-handling flaw (assessed CVSS:3.1 5.3, AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L), with no public exploit identified at time of analysis and no CISA KEV confirmation.
Oracle Essbase 21.8.3.0.0's Java Based Agent can expose a limited subset of accessible data to an unauthenticated network attacker over TCP. The CVSS 3.1 base score is 5.3 with a confidentiality-only impact (C:L; no integrity or availability impact), and the assessed vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. No public exploit was identified at time of analysis, and practical risk is concentrated in deployments that expose the Essbase agent port and hold sensitive data in the readable subset.
An unauthenticated information-disclosure flaw in the Security component of Oracle Essbase 21.8.3.0.0 allows a remote attacker with HTTP network access to read a limited subset of data the application can access, without requiring credentials or user interaction. Confidentiality impact is partial (C:L) with no integrity or availability effect, giving a CVSS 3.1 base score of 5.3. No public exploit code or confirmed active exploitation was identified at time of analysis; the practical risk is concentrated on internet-reachable or weakly segmented Essbase HTTP deployments.
Unauthenticated remote attackers with HTTP access to the Oracle Agile PLM Web Client can read a limited subset of application data in version 9.3.6, a confidentiality-only exposure rated CVSS 3.1 base score 5.3 (AV:N/AC:L/PR:N/UI:N/C:L). The flaw is specific to Agile PLM 9.3.6 and does not affect integrity or availability, so the impact is bounded to information disclosure rather than data tampering or service outage. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and real-world risk is driven mainly by whether the Web Client is internet-facing or reachable from untrusted network segments.
Unauthenticated network attackers can read a subset of Oracle Secure Backup data through the product's NDMP daemon in versions 19.1.0.0.0 and 19.1.0.1.0, rated CVSS 3.1 5.3 (AV:N/AC:L/PR:N/UI:N/C:L/I:N/A:N). No public exploit code or CISA KEV entry was identified at time of analysis, and practical risk is concentrated in environments where the NDMP TCP service is reachable from untrusted networks; the flaw does not allow writes, service disruption, or privilege escalation.
Unauthenticated HTTP access to the eProcurement component in PeopleSoft Enterprise FIN Common Objects Brazil 9.1 can disclose a subset of accessible data, with no integrity or availability impact. The issue is remotely exploitable with low complexity and no user interaction (CVSS 3.1 base 5.3), and exposure is limited to deployments of the Brazilian financials localization module that expose eProcurement over the network. No public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated information disclosure in Oracle Siebel CRM Cloud Applications 22.3 through 26.9 allows network attackers to read a limited subset of data through the Siebel Cloud Manager component over HTTP. Oracle rates the flaw as easily exploitable with CVSS 5.3 and confidentiality-only impact; no public exploit identified at time of analysis, and no CISA KEV status was supplied.
Unauthenticated HTTP access to the Siebel Cloud Manager component of Oracle Siebel CRM Cloud Applications 22.3 through 26.9 can expose a limited subset of application data. The flaw is rated CVSS 3.1 5.3 with low confidentiality impact and no integrity or availability impact, and exploitation requires only network reachability to the affected component. No public exploit was identified at time of analysis, and there is no CISA KEV confirmation of active exploitation.
Unauthenticated information disclosure in Oracle JD Edwards EnterpriseOne Orchestrator (supported releases 9.2.0.0 through 9.2.26.5) lets any party able to reach the Orchestrator over HTTP read a subset of Orchestrator-accessible data without credentials, privileges, or user interaction (CVSS 3.1 base 5.3, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). The flaw sits in the E1 IOT Orchestrator Security component and is best characterized as an access-control/authentication bypass that yields confidentiality-only impact - no integrity or availability effect - so the practical exposure is bounded to whatever data the reachable endpoint returns. Exploitation requires only network reachability, making risk dominated by whether the Orchestrator tier is internet-exposed or reachable from untrusted segments; no public exploit code has been identified at time of analysis and there is no CISA KEV confirmation of active exploitation. Oracle addresses the issue in its October 2026 Critical Patch Update.
Information disclosure in Oracle WebCenter Portal (Runtime Tools component) allows unauthenticated, network-positioned attackers to read a subset of accessible data from versions 12.2.1.4.0 and 14.1.2.0.0. The CVSS 3.1 score is 5.3 with AV:N/AC:L/PR:N/UI:N, indicating low-complexity remote exploitation without credentials or user interaction, but impact is limited to confidentiality (C:L) with no integrity or availability effect. No public exploit code was identified at time of analysis, and exploitation requires the portal's HTTP interface to be reachable.
Oracle Java SE Networking component exposes a read-only information disclosure in versions 21.0.12.1, 25.0.4.1, and 27, where crafted data supplied to affected Networking APIs can leak a subset of JVM-accessible data. Unauthenticated remote attackers need only network reachability to an application that forwards untrusted input into those APIs, with no user interaction and low attack complexity (CVSS 3.1: 5.3, AV:N/AC:L/PR:N/UI:N/C:L). No public exploit and no confirmed active exploitation were identified at time of analysis; the practical risk is bounded by whether a deployed service actually exposes the vulnerable Networking code path.
Unauthenticated remote access to JAAS APIs in specific Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition releases can disclose a limited subset of accessible data; the issue is rated CVSS 3.1 base 5.3 with confidentiality-only impact. Affected builds are Java SE 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, and 27, GraalVM for JDK 17.0.20.1 and 21.0.12.1, and GraalVM Enterprise Edition 21.3.19.1.1. Exploitation requires reachable JAAS APIs that process attacker-supplied data, with a narrower legacy path through sandboxed Web Start or applet code; no public exploit was identified at time of analysis.
Unauthenticated information disclosure in the Oracle Engineering module (Change Management component) of Oracle E-Business Suite 12.2.3 through 12.2.15 allows a remote attacker with HTTP reachability to read a limited subset of application data. The flaw carries a CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), meaning no credentials or user interaction are required, but confidentiality impact is partial and there is no modification or availability effect. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; realistic exposure depends almost entirely on whether the EBS web tier is internet-facing or confined to an internal network. Oracle addresses it in the October 2026 Critical Patch Update.
Oracle Agile EDM 6.2.1 exposes a subset of application data through its Engineering Communication Interface to unauthenticated attackers who can reach the component over HTTP. The CVSS 3.1 score is 5.3 with a network, low-complexity, PR:N/UI:N vector, but impact is limited to confidentiality with no integrity or availability effect. No public exploit has been identified at time of analysis, and the main practical exposure is limited to eDM/PLM instances reachable from untrusted networks.
Unauthenticated network attackers can read a subset of data from Oracle Utilities Network Management System (NMS) via its HTTPS interface, affecting versions 2.4.0.1.0 through 25.12.0.0.2. The flaw is rated CVSS 3.1 base 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), so it exposes only limited confidentiality with no code execution, data modification, or service disruption; Oracle addresses it in the October 2026 Critical Patch Update. No public exploit code or confirmed active exploitation was identified at time of analysis, and real-world exposure is constrained because NMS is typically deployed on segmented utility/OT networks rather than the public internet.
Unauthenticated information disclosure in Oracle Utilities Network Management System lets a remote attacker read a limited subset of application data through the System Wide component's HTTPS interface, with no credentials or user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 5.3). Only deployments on 2.6.0.1.0 through 2.6.0.1.12, 2.6.0.2.0 through 2.6.0.2.10, and 25.12.0.0.0 through 25.12.0.0.2 are affected, and the impact is confined to confidentiality - no data modification or service disruption is possible. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; EPSS data was not supplied, so real-world urgency is driven mainly by whether the NMS HTTPS interface is reachable from untrusted networks.
Information disclosure in Oracle Helidon's WebSocket component affects versions 4.0.0-4.5.5 and 27.0.0, allowing unauthenticated remote attackers with HTTP access to read a limited subset of Helidon-accessible data. The CVSS 3.1 score is 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), reflecting partial confidentiality impact with no integrity or availability impact. No public exploit code or CISA KEV entry was identified at time of analysis, making this a moderate-severity exposure rather than a top-tier emergency.
Unauthenticated information exposure in Oracle Helidon 4.0.0 through 4.5.5 can let network attackers read a limited subset of Helidon-accessible data over HTTP when applications use the helidon-security-providers-google-login component. The flaw is rated CVSS 5.3 with confidentiality-only impact, and deployments that do not configure this optional Google-login security provider are not affected. No CISA KEV status or public exploit code was included in the supplied intelligence, so no public exploit identified at time of analysis.
Unauthorized read access to a subset of data in Oracle Siebel CRM Deployment's Siebel Management Console (versions 17.0 through 26.9) is achievable by unauthenticated remote attackers over HTTP, according to CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (base 5.3). No public exploit code or CISA KEV entry is identified at time of analysis, and impact is confined to confidentiality with no integrity or availability effect; real-world risk depends on whether the administrative console is exposed beyond trusted management networks.
Unauthenticated information disclosure in Oracle PeopleSoft PeopleTools 8.61-8.63 allows remote attackers to read a subset of accessible data over HTTP through the Test Framework component (CVSS 3.1 base 5.3, AV:N/AC:L/PR:N/UI:N/C:L). No public exploit identified at time of analysis; CISA KEV status is not indicated, and no EPSS score was provided.
Unauthenticated information disclosure in Oracle REST Data Services (ORDS) 24.2.0 through 26.1.0 allows a network attacker to read a limited subset of ORDS-accessible data through the ADP component over HTTP. Oracle scores it CVSS 3.1 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), and no public exploit was identified at time of analysis. Internet-facing ORDS instances with ADP reachable are most exposed, while internal-only deployments behind VPN or proxy are materially lower risk.