Stored content injection in Oracle Applications Framework's Personalization component (Oracle E-Business Suite 12.2.3 through 12.2.15) allows a low-privileged authenticated attacker to place malicious content that executes when another user opens the personalized page, causing high confidentiality and integrity impact and possible scope change into other products. The attacker must hold valid credentials and convince a second user to interact with the page, so exploitation is neither self-contained nor unauthenticated. No public exploit code or CISA KEV entry was identified at time of analysis.
Unauthorized read and write access to critical data in Oracle E-Business Suite's Document Management and Collaboration (Attachments) component affects versions 12.2.3 through 12.2.15 and, because of a scope change, can extend to data and resources in other EBS products. A low-privileged authenticated attacker with HTTP access can trigger the flaw, but exploitation requires a different user-typically someone with higher privileges-to interact with attacker-supplied attachment content, so this behaves like a stored/second-order access-control or injection issue (CVSS 8.7; C:H/I:H/A:N) rather than a pre-auth remote compromise. No public exploit code or CISA KEV entry was identified in the available intelligence, and no EPSS score was supplied.
Low-privileged, network-positioned users of PeopleSoft Enterprise PeopleTools 8.61 through 8.63 can abuse the Test Framework component to cross a security boundary and obtain read/write access to critical PeopleTools data, but only if they can persuade another user to interact with attacker-supplied content. The issue is rated CVSS 8.7 with high confidentiality and integrity impact and no availability impact; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and no EPSS score was supplied.
Oracle HTTP Server 12.2.1.4.0 and 14.1.2.0.0 can be compromised by unauthenticated, remote attackers through the WebLogic Server Proxy Plug-in component, yielding high confidentiality and integrity impact and - because the CVSS vector carries a scope change (S:C) - potential knock-on impact to systems the plug-in fronts. Oracle rates the attack complexity as high ('difficult to exploit'), so the bug is not reliably repeatable against arbitrary targets and depends on conditions outside the attacker's control, but no authentication (PR:N) or user interaction (UI:N) is required once those conditions are met. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied with the source data.
Unauthenticated attackers with HTTP network access to a third-party web server (Apache HTTP Server, Microsoft IIS, or Oracle iPlanet) running the Oracle WebLogic Server Proxy Plug-in can bypass authentication and obtain read/write access to critical data reachable through the proxied WebLogic backend. The flaw affects plug-in versions 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0 and carries a CVSS 3.1 score of 8.7 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N). Oracle rates exploitation as difficult (AC:H), and no public exploit code or CISA KEV entry was identified in the provided intelligence at time of analysis; EPSS was not supplied.
Unauthenticated attackers with HTTP network access can abuse Oracle Access Manager's Authentication Engine (versions 12.2.1.4.0 and 14.1.2.1.0) to achieve full confidentiality and integrity compromise of OAM-accessible data, with scope change extending impact to federated downstream products. Oracle rates the issue 'difficult to exploit' (AC:H), meaning success hinges on non-trivial environmental or flow-specific conditions rather than a simple request, so this is a serious but conditional risk rather than a point-and-click exploit. No public exploit code or confirmed active exploitation was identified at time of analysis, and no CVE-level patch version is stated beyond Oracle's October 2026 Critical Patch Update advisory. EPSS: not provided.
Unauthenticated network attackers can potentially bypass authentication and read or modify critical data through the Oracle WebLogic Server Proxy Plug-in in supported 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0 deployments, although Oracle rates exploitation as difficult (AC:H) and the impact may extend to systems behind the proxy because of scope change. No public exploit identified at time of analysis, and no CISA KEV confirmation was provided, so internet-facing proxy plug-in installations should still be prioritized for review and patching.
Unauthenticated remote attackers can crash the logs management service on Advantech ADAM-3600 industrial RTUs/controllers by sending crafted input that triggers a NULL pointer dereference, denying access to that service until it is restarted. The CVSS:3.1 vector indicates network-reachable, low-complexity exploitation with no privileges or user interaction required, but impact is confined to availability - no code execution, data disclosure, or integrity loss is implied by the flaw itself. No public exploit code or confirmed active exploitation was identified at time of analysis, and practical risk is primarily gated by whether the device's logs management interface is exposed beyond a segmented OT/SCADA network.
Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0, specifically the SAP ERP+ component, exposes an unauthenticated HTTP attack surface that can lead to authentication bypass and unauthorized creation, deletion, modification, or access of critical connector data, with scope change potentially affecting connected systems. The issue is serious but constrained: exploitation is difficult (AC:H) and requires reachable HTTP access to a deployment that actually uses the SAP ERP+ connector. No public exploit identified at time of analysis, and no CISA KEV confirmation was supplied.
Stack-based buffer overflow in Advantech ADAM-3600 can let a remote attacker with administrative credentials execute arbitrary code on the RTU. The flaw is network-reachable and requires no user interaction, but exploitation depends on prior high-privilege access to the management interface and on network reachability, which is often constrained in segmented OT deployments. No public exploit was identified at time of analysis, and active exploitation is not confirmed by CISA KEV.
Cross-site WebSocket hijacking in Google Cloud Shell prior to 2026-07-22 lets an unauthenticated remote attacker hijack an active, authenticated Cloud Shell session and exfiltrate the user's OAuth access token. Exploitation requires the victim to have a live Cloud Shell session and to load an attacker-controlled page that issues a cross-origin WebSocket request, which is the user-interaction precondition reflected in the CVSS vector. Google remediated the hosted service server-side on 2026-07-22, and no public exploit was identified at time of analysis.
Stack-based buffer overflow in Advantech ADAM-3600's FileProcess::CheckDir path handling lets an authenticated attacker with high-privilege access supply a directory path longer than 1024 bytes and potentially achieve arbitrary code execution on the device. The flaw is network-reachable with low complexity and no user interaction once the attacker holds the required high-privilege credentials, but impact is confined to the device with no scope change. No public exploit was identified at the time of analysis, and exploitation is primarily constrained by the high-privilege authentication prerequisite.
Arbitrary code execution on Advantech ADAM-3600 devices is possible for remote attackers who already possess high-privilege credentials for the device's network-reachable management service. The flaw affects ADAM-3600 units exposed to the attacker's network and carries a high CVSS score, but exploitation is not pre-authentication and depends on valid administrative or operator access. No public exploit identified at time of analysis, and the risk is credible but not emergency-level because privileged credentials and network reachability are both required.
Heap out-of-bounds read in the NetX Secure TLS 1.3 Certificate-message parser of Eclipse ThreadX NetX Duo can be triggered by a malicious or man-in-the-middle TLS 1.3 server, crashing the connecting peer. The flaw is unauthenticated (CVSS PR:N) and reachable during the normal handshake, before certificate verification completes, but requires the victim device to act as a TLS client and connect to an attacker-controlled endpoint - an attacker cannot trigger it against an unsolicited listening service. Vendor/independent assessment rates impact as availability-only (CVSS 4.0 base 8.7; CVSS 3.1 AV:N/AC:L/PR:N/UI:N/A:H), and no public exploit code or CISA KEV active-exploitation entry was identified at time of analysis.
A four-byte malformed TLS 1.3 Certificate handshake header can drive the NetX Secure certificate parser in Eclipse ThreadX NetX Duo past the end of its session packet buffer, crashing the device or stack. The flaw is remotely reachable, unauthenticated, and requires no cryptographic validity or user interaction - the parser decrements the message length to skip a certificate_request_context byte without first confirming a byte exists, so a zero-length message wraps the unsigned length to 0xFFFFFFFF and renders the subsequent bounds check vacuous. Impact is bounded to availability (out-of-bounds read leading to fault/denial of service) per the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H vector, and no public exploit code or confirmed active exploitation was identified at time of analysis; the practical exposure limit is that the target must actually negotiate TLS 1.3 and enter the Certificate-message parsing path.
Unauthenticated remote attackers can cause a hang or frequently repeatable crash of Oracle Secure Backup 19.1.0.0.0 and 19.1.0.1.0 by reaching its TCP-exposed service, resulting in complete denial of service with a CVSS 3.1 base score of 8.6 and a scope change that may affect dependent products. This is a genuine high-priority availability risk for environments that run the affected product, but the signals are mixed: no public exploit or CISA KEV entry was provided in the available data, and practical exposure depends on whether the backup service is reachable from untrusted networks. Exploitation requires only network access, with no authentication and no user interaction per the assessed vector.
Oracle E-Business Suite Integrated SOA Gateway releases 12.2.3 through 12.2.15 expose the SOA Provider component to unauthenticated HTTP requests, allowing an attacker with network reachability to read critical data and potentially reach all data accessible through the gateway. The CVSS 3.1 score of 8.6 reflects a scope-changing, confidentiality-only impact (C:H/I:N/A:N) reachable without credentials or user interaction (AV:N/AC:L/PR:N/UI:N/S:C); no public exploit code or confirmed active exploitation was identified at time of analysis. Risk is driven primarily by exposure - only deployments whose SOA Gateway endpoint is reachable from the attacker's network position are at risk.
Oracle Outside In Technology 8.5.8 can expose sensitive data to unauthenticated remote attackers when a host application embedding the Outside In Clean Content SDK parses an attacker-supplied document, producing high confidentiality impact and a scope change into the hosting product. The vendor CVSS 3.1 score is 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), and no public exploit code or CISA KEV entry was identified at time of analysis.
Unauthenticated remote attackers can read critical data from Oracle JD Edwards EnterpriseOne Tools releases 9.2.0.0 through 9.2.26.5 through the component tracked as Object and Env Tech SEC, with the flaw classified as an authentication bypass affecting the HTTP-facing web tier. The CVSS 3.1 score of 8.6 reflects a network-reachable, low-complexity, no-privileges, no-user-interaction attack that is confidentiality-only but carries a scope change, so downstream systems trusting the Tools layer may also be exposed. No public exploit code or confirmed active exploitation was identified at time of analysis, but the exposure-based risk is high where the JD Edwards HTTP interface is internet-facing or reachable from untrusted segments.
Unauthenticated remote attackers can read sensitive data from Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 through the Fabric Layer over HTTP, with scope change potentially exposing data in connected Oracle products. The flaw is easily exploitable (CVSS 3.1 8.6, AV:N/AC:L/PR:N/UI:N/S:C/C:H) and is limited to confidentiality impact; no public exploit was identified in the provided intelligence at time of analysis.
High-severity confidentiality exposure in Oracle Outside In Technology 8.5.8, a document-parsing library embedded in third-party applications, lets unauthenticated remote attackers read critical data through HTTP requests. The CVSS 3.1 score is 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), reflecting low attack complexity, no user interaction, scope change, and high confidentiality impact with no integrity or availability effect. Exploitation realistically requires that the library's Outside In Core parsing path be reachable and fed attacker-supplied documents by the embedding product; no public exploit code or CISA KEV entry is identified at time of analysis.
Unauthenticated network attackers can compromise the Authentication Engine component of Oracle Access Manager 12.2.1.4.0 and 14.1.2.0.0 over HTTP, gaining high-confidentiality read access to data managed by the identity server plus limited ability to modify it and to degrade availability (CVSS 3.1 base 8.6, AV:N/AC:L/PR:N/UI:N). Because the vector carries PR:N and UI:N, no credentials, session, or victim interaction are needed - only network reachability to a vulnerable OAM deployment. No public exploit code or confirmed active exploitation was identified at time of analysis, so risk is driven by exposure: internet-facing or broadly reachable OAM instances should be treated as high priority and patched via Oracle's October 2026 Critical Patch Update, while internal-only deployments behind filtering proxies have materially lower reachability.
Stack-based buffer overflow in Advantech ADAM-3600 industrial remote I/O modules lets a high-privileged authenticated attacker execute arbitrary code on the device. Reaching the flaw requires operator-level credentials and invocation of a specific feature the vendor characterizes as non-functional, so the realistic attack surface is limited to insiders or attackers who have already compromised privileged access - the network vector and low attack complexity mean no user interaction is needed once those prerequisites are met. No public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS/KEV data was not provided.
Oracle Outside In Clean Content SDK 8.5.8, as embedded in Oracle Fusion Middleware and integrating products, can be made to create, modify, or delete critical data by unauthenticated remote attackers who can supply documents over HTTP to an application that parses them with the SDK. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N) indicates no authentication or user interaction, with scope change extending impact to the integrating product, although confidentiality and availability are unaffected. No public exploit identified at time of analysis, and no CISA KEV listing is provided.
Unauthenticated remote resource exhaustion in IBM QRadar SIEM allows a network-reachable attacker to degrade or take down the security monitoring platform without credentials or user interaction, per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, availability-only impact). The vendor scored the issue 8.6 with Scope:Changed, while our independent assessment treats scope as unchanged (7.5-equivalent), since no downstream component beyond the QRadar service itself is demonstrated; either way the practical effect is loss of SIEM visibility while the attack runs. No public exploit code or confirmed active exploitation was identified at time of analysis, and the affected version range is not disclosed in the supplied data - it must be confirmed against IBM advisory node 7292244 before exposure decisions are made.
Unauthenticated SOAP requests to the JD Edwards EnterpriseOne Tools Interoperability SEC component can expose critical data in versions 9.2.0.0 through 9.2.26.5, with a scope change that may extend impact to connected products. The CVSS 3.1 score is 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), and only confidentiality is affected; no public exploit identified at time of analysis. Risk is highest where the SOAP Interoperability service is deployed and reachable from untrusted networks.
Unauthenticated HTTP access to the Oracle SOA Suite Fabric Layer can expose critical data and, because of a scope change, may affect integrated products that trust SOA Suite. The flaw affects Oracle Fusion Middleware SOA Suite 12.2.1.4.0 and 14.1.2.0.0 and is rated CVSS 8.6 with confidentiality-only impact. No public exploit was identified at time of analysis.
Unauthenticated network access to the Generic REST interface in Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0 can expose critical data, with a CVSS 3.1 score of 8.6 and a scope change that may extend disclosed access to additional integrated products. The flaw is remotely exploitable over HTTP without credentials or user interaction, but impact is limited to confidentiality, with no integrity or availability effect. No public exploit code was identified at time of analysis; the main exposure driver is whether the connector's REST endpoint is reachable by an attacker.
Arbitrary OS command execution in multiple Atsumi Electric DVR models (ADX1004, ADX1008, ADX204, ADX404, ADX3004, ADX3008, ADX3016, ADX5004, ADX5008 and ADX2016) is enabled by an undocumented hidden function reachable by an administrator-level user, with high confidentiality, integrity and availability impact (CVSS 8.6 CVSS 4.0; assessed CVSS 3.1 vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Exploitation requires valid administrator credentials (PR:H) and network reachability to the management interface, but no user interaction and low attack complexity; no public exploit code or CISA KEV entry was identified at time of analysis. Risk is concentrated where admin passwords are default, weak or reused, or where the DVR management interface is exposed to untrusted networks.
Unauthenticated HTTP requests to the Analytics Web General component of Oracle Business Intelligence Enterprise Edition can drive the service into a hang or repeatable crash, giving a complete denial of service while also permitting limited reads and limited inserts/updates/deletes against a subset of BI EE data. The flaw is rated CVSS 3.1 8.6 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H) and affects releases 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0; Oracle characterizes it as easily exploitable by a remote attacker with network access and no credentials. There is no CISA KEV listing and no public exploit identified at time of analysis, so prioritization should be driven by internet or broad-network exposure of the analytics web tier rather than by observed attack activity.
A privileged, authenticated attacker who can reach the Advantech ADAM-3600 firmware upgrade function can upload a forged firmware image and achieve persistent compromise of the device. The issue is rated CVSS 4.0 8.6 (HIGH) with network reachability and high confidentiality, integrity, and availability impact, but exploitation requires high privileges (PR:H); no CISA KEV entry or public exploit code is identified in the supplied data.
Cross-session task access in the MCP TypeScript SDK (@modelcontextprotocol/sdk 1.24.0 through 1.31.0) allows any client sharing a single InMemoryTaskStore to list, read, and cancel other clients' experimental task records and results, an IDOR-style authorization bypass rated 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) with high confidentiality impact and low integrity/availability impact. The flaw is only reachable where an HTTP MCP server explicitly passes a shared taskStore to McpServer or Server and serves multiple sessions from it using the deprecated experimental tasks feature; stdio servers, stateless HTTP servers, and one-store-per-session deployments are not exposed, and 2.x packages are unaffected. There is no public exploit identified at time of analysis and no confirmed active exploitation; the vendor patched the SDK in 1.32.0 by binding each task to the session that created it.
Cross-site scripting in Unblu Spark's embedded co-browsing feature (7.0 through 7.57.7 and 8.0 through 8.39.2) allows an unauthenticated visitor to execute arbitrary JavaScript in the browser of an agent who joins the attacker's co-browsing session, with the script running in the agent's Agent Desk or Single Conversation Desk session context. Both on-premises and cloud deployments are affected, but mobile co-apping is not. Exploitation is conditional on live agent participation and rendering of attacker-supplied co-browsed HTML; no public exploit code or confirmed active exploitation is identified in the available data.
Authenticated low-privileged attackers with HTTP access can exploit Oracle iSupport in E-Business Suite 12.2.3 through 12.2.15 to create, delete, or modify critical Service Request data and cause partial denial of service, with scope change potentially affecting other EBS products. The flaw is easily exploitable (CVSS 8.5, AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L), and because iSupport is a customer-facing self-service portal, the required credentials may be broadly available. No public exploit was identified at the time of analysis.
Authenticated low-privileged attackers with HTTP access to Oracle Product Hub 12.2.3 through 12.2.15 can achieve takeover of the component, with scope change (S:C) extending impact to additional connected Oracle E-Business Suite products. The CVSS 3.1 base score is 8.5, but exploitation is rated difficult (AC:H) and requires a valid low-privileged account (PR:L) with no user interaction (UI:N). No public exploit code or confirmed active exploitation was identified in the available intelligence at time of analysis.
Full takeover of Oracle Essbase 21.8.3.0.0 is achievable by a low-privileged, authenticated attacker reaching the Essbase Web Platform over HTTP, with Oracle's scope-change rating (S:C) warning that a compromise may significantly impact additional products beyond Essbase itself. Oracle characterizes the flaw as difficult to exploit (AC:H), so success depends on conditions outside the attacker's control rather than being reliably repeatable, and the prior-authentication requirement (PR:L) is the main limiting factor. No public exploit was identified at time of analysis, and the issue is addressed through Oracle's October 2026 Critical Patch Update.
Oracle EDI Gateway in Oracle E-Business Suite 12.2.3 through 12.2.15 exposes critical EDI data to low-privileged network attackers via HTTP, allowing high confidentiality impact and limited integrity modification with a scope change that can affect additional connected Oracle products. Exploitation requires a valid low-privilege EBS/EDI Gateway account (PR:L) and network reachability to the EDI Gateway component; no public exploit or active exploitation is identified in the available intelligence. The CVSS 3.1 base score is 8.5, reflecting high confidentiality and low integrity impact.
Critical data exposure and limited data modification in Oracle Essbase 21.8.3.0.0's Web Platform are possible for an authenticated low-privileged attacker with HTTP network access. The CVSS 3.1 score is 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N), with scope change extending impact to additional products; no public exploit identified at time of analysis, and the supplied 'Authentication Bypass' tag conflicts with the vector's PR:L requirement.
ASUS Armoury Crate on Windows loads at least one dynamic-link library by name without a fully qualified path, so a local attacker who can write to a directory that precedes the legitimate library in the Windows DLL search order can plant a malicious DLL and have it loaded by a high-privilege Armoury Crate component, yielding arbitrary code execution at SYSTEM integrity. The flaw (CWE-427) is local-only: the attacker must already hold low-privileged code execution on the host (CVSS:4.0 AV:L/PR:L, independently assessed as CVSS:3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.5 CVSS 4.0 base) and must be able to write to the hijackable path; the payload then runs when the privileged process or service next starts, with no victim interaction required. Only machines with Armoury Crate installed are affected, and no public exploit code or confirmed active exploitation was identified at time of analysis, making this a credible but not emergency-tier hardening/patching priority for gaming laptops, desktops and ROG/TUF motherboard owners.
Eclipse ThreadX's Cortex-A7 MMU module port accepts a caller-supplied buffer range after validating only its first byte, so an authenticated local attacker who can execute code in a protected module can cause privileged dispatch code to read or write beyond the module's declared memory. The weakness sits in a shared range-check macro used by protected-module dispatchers that consume buffers or extra-parameter arrays, and exposure is limited to systems running the ThreadX Module Manager with memory-protected modules on that port. No public exploit identified at time of analysis, and the attack path is local rather than remote or unauthenticated.
Eclipse ThreadX firmware built with Module Manager and loadable modules enabled contains a use-after-free in txm_module_object_deallocate: a module can request release of a kernel object control block by address, and the manager frees it even if the kernel still references it. The object remains on its created list and, for threads or timers, on scheduler/timer lists, so the byte pool can reallocate the same memory while the kernel still uses it. Exploitation requires local low-privilege code execution inside a loaded module (PR:L, AV:L) and is not remotely reachable in default builds; no public exploit code was identified at time of analysis.
Authenticated low-privileged users with HTTP access to Oracle Partner Management can read, create, delete or modify critical data and cause a partial denial of service across Oracle E-Business Suite 12.2.3 through 12.2.15, with the scope-change rating (S:C) meaning the impact can extend beyond Partner Management into other EBS products (CVSS 3.1 base score 8.4: C:H/I:H/A:L). Oracle rates the flaw as difficult to exploit because success depends on conditions or timing the attacker does not fully control (AC:H), and no public exploit code or active exploitation has been identified at time of analysis. The practical limiting factors are the requirement for valid low-privilege credentials (PR:L) and network reachability to a deployed Partner Management / Internal Operations component; no user interaction is needed (UI:N).
Oracle Agile Engineering Data Management 6.2.1 contains an authenticated, high-complexity flaw in the Engineering Communication Interface that lets a low-privileged network attacker read or modify critical data, affect additional products through scope change, and cause partial denial of service. Exploitation requires a valid low-privileged account and HTTP access to the component; no public exploit identified at time of analysis. The CVSS 8.4 score reflects high confidentiality and integrity impact, but Oracle's 'difficult to exploit' rating and the authentication prerequisite reduce mass-exploitation risk.
Takeover of Oracle VM VirtualBox 7.2.20 is possible by a high-privileged attacker with access to the physical communication segment attached to the hardware running VirtualBox, per Oracle's October 2026 CPU. The Core component flaw has a CVSS 3.1 score of 8.4 (AV:A/AC:L/PR:H/UI:N/S:C) and can cross a scope boundary to affect additional products. No public exploit or CISA KEV listing was identified at time of analysis, and no EPSS score was supplied.
Takeover of Oracle Outside In Technology 8.5.8 is possible for an attacker who already has a local logon on the host running the Outside In Clean Content SDK, with high confidentiality, integrity, and availability impact and no additional authentication or user interaction required. The flaw is rated CVSS 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and no public exploit was identified at time of analysis; risk is concentrated where untrusted documents reach the Clean Content SDK on multi-user or otherwise locally exposed hosts.
Low-privileged local users with logon access to a JD Edwards EnterpriseOne Tools host can bypass authentication in the Monitoring and Diagnostics (SEC) component and gain read/write control over critical data. Affected releases are Tools 9.2.0.0 through 9.2.26.5; exploitation requires an existing interactive account on the server (CVSS vector AV:L/PR:L), so the realistic threat is insider abuse or an attacker operating after an initial foothold, not a remote mass-exploitation campaign. Impact is rated CVSS 8.4 because a scope change (S:C) lets the compromise spill into connected products and the underlying ERP data, though no public exploit code and no confirmed active exploitation were identified at time of analysis.
Oracle VM VirtualBox 7.2.16 carries a flaw in its Core component that lets a low-privileged user with local logon to the host read critical data accessible to VirtualBox and reliably hang or repeatedly crash the hypervisor, with a scope change (S:C) that points to a guest-to-host boundary escape rather than a mere guest-local bug. The vector (AV:L/AC:L/PR:L/UI:N) means exploitation is local and requires only a low-privileged account, no user interaction, and low attack complexity, so risk concentrates in multi-tenant hosts, VDI estates and developer machines where semi-trusted users can log on or drive a guest VM. No public exploit code has been identified at time of analysis, the issue is not confirmed actively exploited (no CISA KEV entry), no EPSS score was supplied, and the exact fixed build is not specified in the provided data - the Oracle Critical Patch Update (October 2026) advisory is the authoritative patch source.
Oracle Solaris 11.3 and 11.4 can be fully taken over by an attacker who can already log on to the host, through a flaw in the operating system's 'Utility' component. Exploitation yields high confidentiality, integrity and availability impact - effectively a complete loss of control of the Solaris system - but it requires a local foothold: the CVSS vector is AV:L, and our assessed vector (PR:L) indicates at least a low-privileged local account is needed, contrary to Oracle's PR:N labelling. No public exploit code has been identified at time of analysis and the CVE is not in CISA KEV; with low attack complexity and no user interaction, however, the step from local access to full compromise is short.
Local privilege escalation in IBM Sterling Connect:Direct for UNIX (6.3.0.0-6.3.0.7 and 6.4.0.0-6.4.0.6) allows an authenticated local attacker with a low-privileged account to gain elevated privileges through improper privilege management. The CVSS 3.1 score is 8.4 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N), reflecting high confidentiality and integrity impact to the host with scope change, but the attack is not remotely reachable. No public exploit was identified at the time of analysis, and exploitation requires an existing local foothold on a host running the affected Connect:Direct components, likely under elevated privileges.
The Eclipse ThreadX GUIX PNG decoder can be driven out of bounds by a crafted PNG that places a second IHDR chunk after IDAT, enabling memory corruption in applications that render attacker-supplied images. Any integration with the GUIX PNG decoder enabled is in scope, since the decoder is compiled in by default, and exploitation is local and requires user/application interaction to open the crafted file. No public exploit was identified at time of analysis; the reporter rates the issue 8.4, and the independent assessment treats it as a local, user-interaction-dependent memory-corruption flaw.