Oracle Common Applications 12.2.3 through 12.2.15 contains a Role Summary flaw that a high-privileged, authenticated attacker with HTTP network access can exploit to gain unauthorized read and write access to critical data, with scope change extending impact to additional Oracle products. Oracle rates exploitation as difficult (AC:H), and success depends on conditions beyond the attacker's control; no public exploit identified at time of analysis.
Low-privileged authenticated users of Oracle Essbase 21.8.3.0.0 can reach beyond their assigned privilege boundary through the Security component over HTTP and read critical data they should not be able to see, including data exposed in downstream products because the vulnerability crosses a security scope boundary. Oracle scores this 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N): confidentiality-only, with no integrity or availability impact, and exploitation requires a valid low-privileged account rather than being unauthenticated. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, so risk is concentrated in internet- or network-reachable Essbase deployments where low-level credentials are broadly distributed.
Oracle Essbase 21.8.3.0.0 contains a confidentiality flaw in its Security component that lets a low-privileged, authenticated attacker reach critical data over the HTTP interface, with CVSS 3.1 scoring it 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N). Because the scope is changed, the exposure can extend past the Essbase instance to products wired into it, so stolen data may include far more than the attacker's own account should see. Our assessment rates this a genuine mid-tier priority rather than an emergency: the deciding constraint is that a valid low-privilege Essbase account is required, so no public exploit code or confirmed active exploitation was identified at time of analysis.
Credential theft in multi-tenant Red Hat StreamsHub Console for Apache Kafka and Streams for Apache Kafka 2/3 deployments is possible because the operator trusts a namespace field supplied in a Console custom resource. An authenticated tenant with permission to create Console CRs (PR:L) can point spec.kafkaClusters[].credentials.kafkaUser.namespace at a victim namespace, causing the cluster-wide-privileged operator to read that namespace’s KafkaUser Secret-SASL credentials or TLS private keys-and write the plaintext into a Secret in the attacker’s namespace. CVSS 3.1 scores this 7.7 with scope changed and high confidentiality impact; no public exploit identified at time of analysis, so risk is concentrated in multi-tenant clusters where untrusted users can create Console resources.
Authenticated low-privileged users of Oracle Product Hub 12.2.3 through 12.2.15 can abuse the Item Catalog component over HTTP to obtain broad unauthorized read access to critical Product Hub data, limited insert/update/delete capabilities, and a partial denial of service, with the scope change extending impact into other Oracle E-Business Suite products. The CVSS 3.1 base score is 7.7 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L), but the high attack complexity means exploitation depends on conditions outside the attacker's control and is difficult to carry out reliably. No public exploit code has been identified and there is no confirmation of active exploitation (no CISA KEV listing) at time of analysis. An EPSS score was not provided, so no probabilistic exploitation estimate can be cited.
Authenticated denial-of-service with limited data disclosure and modification in Oracle Shipping Execution affects Oracle E-Business Suite deployments running 12.2.3 through 12.2.15. A low-privileged attacker holding a valid EBS account can reach the Workflow Events component over HTTP and, only when specific non-default conditions line up (AC:H), hang or repeatedly crash the Shipping Execution module while reading and modifying a subset of its data; the scope-change flag means integrated EBS products can also be impacted. CVSS 3.1 scores this 7.7 with availability as the dominant impact, and while the flaw is difficult to exploit, no public exploit code or confirmed active exploitation (no CISA KEV listing) has been identified at time of analysis.
Oracle Essbase 21.8.3.0.0 exposes critical data through its Build component to an authenticated low-privileged attacker with HTTP network access. The flaw is easily exploitable (AC:L, no user interaction), can cross a scope boundary to affect additional products, and has a high confidentiality impact with no integrity or availability effect. No public exploit code or CISA KEV entry was identified at time of analysis, so this is a mid-tier priority rather than an emergency.
Cross-client message leakage in the MCP TypeScript server SDK (@modelcontextprotocol/server 2.0.0 through 2.2.0) lets unauthenticated remote clients that share an HTTP endpoint receive another client's JSON-RPC responses and notifications, because the transport correlates replies to a connection by JSON-RPC `id` alone while SDK clients routinely number requests from 0 and produce colliding ids. Exposure requires a specific deployment pattern: a stateless Streamable HTTP transport (sessionIdGenerator undefined) reused across requests, or a single McpServer/Server instance shared across requests or sessions - exactly the pattern the pre-fix README examples for the hono, express, fastify and node middleware packages demonstrated. Stdio servers, createMcpHandler() with a per-call server factory, and @modelcontextprotocol/sdk 1.26.0+ are not affected; the issue is rated 7.7 (AV:N/AC:H/PR:N/UI:N) and no public exploit code has been identified at time of analysis.
Memory-exhaustion denial of service in Apache CouchDB 3.5.2 and earlier allows any unauthenticated remote client to crash or hang the database by submitting a gzip-encoded HTTP request body that chttpd decompresses without any upper size bound. Impact is limited to availability - no data disclosure or modification - and the only practical prerequisite is network reachability of the CouchDB HTTP interface (typically 5984/6984), with no account, privileges, or victim interaction required. No public exploit code or confirmed active exploitation was identified at time of analysis; Apache has released CouchDB 3.5.3 to fix the issue, and instances sitting behind a proxy or WAF that caps request body size are substantially less exposed.
Path traversal in uTox through 0.18.1 lets an already-accepted Tox friend write files to arbitrary locations on a victim's machine when the non-default auto-accept file-transfer option is enabled, by sending a filename that is an absolute path or contains ../ sequences. The unsafe name is passed straight to native_autoselect_dir_ft() in src/utox.c without validation, so an attacker can overwrite shell startup files or plant crafted .ftinfo resume records that ft_find_resumeable() later parses, ultimately abusing FILE pointers to write /proc/self/mem and achieve code execution. Exploitation is gated by two preconditions - the sender must be a trusted contact and auto-accept must be turned on - matching the AT:P attack requirement in the 7.7 High CVSS 4.0 vector; no public exploit code and no confirmed active exploitation were identified at time of analysis, and vendor fixes are available via pull requests 1602 and 1603.
Authenticated low-privileged users can compromise Oracle Report Manager in Oracle E-Business Suite versions 12.2.3 through 12.2.15 over HTTPS, gaining high confidentiality impact plus limited integrity and availability impact (CVSS 7.6). The flaw is in the Internal Operations component and requires only a valid low-tier account, low attack complexity, and no user interaction; no public exploit code was identified at time of analysis.
Oracle Shipping Execution, a module of Oracle E-Business Suite, exposes an Internal Operations component that permits a low-privileged authenticated user with HTTP access to read, modify, and partially disrupt shipping data across supported releases 12.2.3 through 12.2.15. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/C:H/I:L/A:L, 7.6) reflects a high confidentiality impact with limited integrity and availability effects, and no public exploit code or confirmed active exploitation was identified at time of analysis. The main barrier to abuse is the requirement for a valid low-privilege EBS session (PR:L), so exposure is greatest where the EBS web tier is broadly reachable or where low-privilege accounts are easy to obtain.
Authenticated users of Oracle E-Business Suite's Capacity module (component: Internal Operations) in versions 12.2.3 through 12.2.15 can exploit this flaw over HTTP with low attack complexity and no user interaction to read critical Capacity data, perform limited unauthorized inserts/updates/deletes, and cause a partial denial of service within that module. The CVSS 3.1 score is 7.6 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L, meaning the attacker must already hold a valid low-privileged EBS account, but no further privilege escalation or victim interaction is required. Oracle addresses it through its Critical Patch Update program; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and scope is unchanged so the compromise does not extend beyond Capacity-accessible data.
Oracle Capacity in Oracle E-Business Suite 12.2.3 through 12.2.15 lets a low-privileged authenticated user read critical data, make limited unauthorized data changes, and cause partial denial of service through crafted HTTP requests to the Internal Operations component. No public exploit was identified at time of analysis, and this is not an anonymous authentication bypass despite the supplied tag; the PR:L vector means attackers need valid EBS credentials. The practical risk is therefore highest for insider threats or attackers who have already compromised a low-privileged EBS account.
Oracle E-Business Suite Assets 12.2.3 through 12.2.15 exposes a low-privileged, authenticated attacker with HTTP access to the Internal Operations component to cause a hang or repeatable crash (complete denial of service) while also reading a subset of Assets data and modifying, inserting, or deleting some of it. With a CVSS 3.1 base score of 7.6 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H), the flaw is easily triggered once valid credentials exist but is constrained by the authentication requirement and the Assets module scope. No public exploit code or CISA KEV entry was identified in the provided intelligence, so this is a genuine but moderate-priority issue rather than a confirmed actively exploited emergency.
Oracle Trusted Answer Search 26.1 contains a high-severity Application expert UI flaw (CVSS 7.6) that allows a low-privileged authenticated attacker to submit crafted content over HTTP; when another user views that content, the attacker can gain unauthorized read access to critical data and limited insert/update/delete access, with the impact crossing a scope boundary. The attack is gated by valid low-privileged credentials and required victim interaction, so broad opportunistic exploitation is less likely; no public exploit identified at time of analysis.
Unauthorized access to and modification of Installed Base data in Oracle E-Business Suite 12.2.3 through 12.2.15 is possible for a low-privileged authenticated attacker who convinces another user to interact with a crafted request over HTTP. The CVSS 3.1 score is 7.6 with scope change (S:C), high confidentiality impact, and low integrity impact, meaning connected Oracle products beyond Installed Base may also be affected. No public exploit was identified at time of analysis, and the assessed risk is to prioritize patching rather than treat as an emergency.
Unauthenticated network attackers can cause a hang or frequently repeatable crash of PeopleSoft PeopleTools 8.61-8.63 and obtain limited read and write access to accessible data by inducing a legitimate user to interact with a crafted HTTP-delivered page or link. Oracle rates the issue easily exploitable once that human interaction occurs, with a CVSS 3.1 score of 7.6. No public exploit identified at time of analysis, making this a credible but second-tier priority.
Credential disclosure in the A2A Java SDK Android HTTP client versions 1.3.0.Final and 1.3.1.Final allows unauthenticated remote attackers to leak a configured API key or token to a different authority when a synchronous POST follows a cross-authority redirect. The root cause is a default followRedirects=true that overrides the disabled-redirect setting in AndroidA2AHttpClient.createConnection(), and AuthInterceptor-injected nonstandard headers (X-API-Key, API-Key, X-Auth-Token, X-Authentication) are retained by Android's repackaged OkHttp across redirects even though standard Authorization headers are stripped. No public exploit identified at time of analysis; the vendor-released patch is 1.3.2.Final, which sets the default to false.
Heap-based buffer overflow in the Advantech ADAM-3600 remote terminal unit allows a network-reachable attacker who already holds high-privilege authenticated access to the device to corrupt heap memory and potentially achieve arbitrary code execution. The CVSS 4.0 vector (AV:N/AC:H/PR:H/UI:N, high confidentiality/integrity/availability impact) and the independent CVSS 3.1 assessment agree this is a post-authentication flaw requiring privileged credentials plus non-trivial heap grooming or a specific input path, so exploitation is not a trivial pre-auth network takeover. No public exploit code or CISA KEV entry is present in the available intelligence, and exploitation has not been confirmed in the wild; exact vulnerable firmware ranges are not specified in the input and must be scoped from the Advantech security advisory.
Unauthenticated denial of service in ApostropheCMS versions prior to 4.33.0, where the Rich Text CSV conversion route stages multipart uploads in the system temporary directory before validating the file extension and fails to delete rejected files, allowing repeated large uploads to exhaust temp-disk capacity. Affected deployments are those with the default route network-reachable; no authentication is needed, only the ordinary public CSRF cookie issued to anonymous clients. Per the assessed vector (CVSS 3.1 AV:N/AC:L/PR:N/UI:N, availability-only impact), this is a genuine but moderate-severity availability issue rather than a top-tier emergency, since disruption requires sustained repeated uploads and depends on temp-partition size and co-tenancy; no public exploit code or CISA KEV active-exploitation status was identified at time of analysis.
Server-side request forgery in Bulwark Webmail before 1.9.2 lets unauthenticated remote attackers read internal HTTP or HTTPS responses-potentially including cloud metadata-by rebinding a caller-supplied hostname between the DNS validation step and the socket connection. The flaw affects the unauthenticated POST /api/fetch-ical endpoint and, in authenticated paths, JMAP login and TOTP token-exchange flows, and can return up to 10 MB of a loopback, private, link-local, or metadata response. No public exploit code or active exploitation has been identified at time of analysis; the vendor-released patch in 1.9.2 validates the resolved address inside the socket lookup and adds authentication to the iCal fetch endpoint.
Memory exhaustion in the Moov signedxml Go library (versions prior to 1.4.1) allows unauthenticated remote attackers to crash a service by submitting crafted XML that passes through exclusive canonicalization during ValidateReferences. Each nested element causes the library to copy the entire accumulated namespace map, so a modest document with deep nesting and many unused xmlns prefixes balloons to gigabytes of allocation and terminates the process. The flaw does not bypass signature verification and only affects availability; no public exploit code was identified at time of analysis, and the project shipped a fix in v1.4.1 that caps in-scope namespaces at 8192 and replaces whole-map copying with push/pop scope deltas.
Unauthenticated remote attackers who can reach the Siebel CRM Integration EAI HTTP interface can cause a hang or repeatedly crash the integration component, producing a complete denial of service against that service. All supported versions from 17.0 through 26.9 are affected, and the CVSS 3.1 score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), with impact limited to availability and no confidentiality or integrity effect. No public exploit code or confirmed active exploitation was identified at time of analysis, so realistic risk depends primarily on whether the EAI endpoint is exposed beyond trusted internal networks.
Unauthenticated remote attackers can crash or repeatedly hang Oracle MySQL Server and MySQL Cluster through network-accessible protocol interactions, causing a complete denial of service. Affected releases include MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1. CVSS 3.1 score is 7.5 with availability-only impact; no public exploit was identified at time of analysis, and Oracle's October 2026 Critical Patch Update advisory is the vendor patch reference.
Unauthenticated denial of service in Oracle Global Lifecycle Management NextGen OUI Framework (the NextGen Installer component) lets a remote attacker who can reach the product's HTTP endpoint hang or repeatedly crash it, wiping out availability of the installer/lifecycle-management service. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (base 7.5), so no credentials, user interaction, or special attacker-side setup are needed - the practical constraint is exposure, since installer endpoints are typically internal or short-lived rather than permanently internet-facing. There are no confidentiality or integrity impacts, so the flaw cannot be chained into data theft or code execution on its own; no public exploit code was identified at time of analysis, and no EPSS or CISA KEV signal was supplied. Affected releases are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 14.1.2.1.0 and 15.1.1.0.0.
Denial of service in the markdown-it Markdown parser (npm package markdown-it) affects versions 14.1.0 through 14.3.2 and 15.0.0 through 15.0.2, where a single link reference definition whose label or title is never closed causes quadratic-time parsing under default options. Unauthenticated remote attackers who can get attacker-controlled Markdown processed by the library can burn CPU proportional to the square of the input size - roughly 3.6 seconds at 200 KB, 18 seconds at 400 KB, and 74 seconds at 800 KB - with impact confined to availability (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5). Proof-of-concept code is published in the upstream advisory, and no active exploitation has been reported (not listed in CISA KEV); the vendor has released fixed versions 14.3.3 and 15.0.3.
Oracle Outside In Technology 8.5.8 (Outside In Clean Content SDK) can be driven into a hang or repeatable crash by a crafted document delivered over HTTP, giving remote unauthenticated attackers a complete denial of service against the affected parsing engine. The CVSS 3.1 score is 7.5 with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, so no credentials or user interaction are required, but the impact is confined to availability - no data disclosure or code execution results. Exploitation depends on a host application actually routing attacker-supplied files into the SDK's parsing path, so exposure is limited to deployments with document upload, conversion, content-cleaning, or inspection features; there is no CISA KEV listing, no public exploit code noted in the available data, and no EPSS score was supplied, so no active exploitation is confirmed at time of analysis.
Denial of service in Oracle Outside In Technology 8.5.8 allows unauthenticated remote attackers to hang or repeatedly crash the Outside In Clean Content SDK by supplying crafted documents over HTTP. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms a low-complexity network attack with availability-only impact, although real exposure depends on whether a host application exposes document ingestion to untrusted senders. No public exploit code or CISA KEV entry was provided at time of analysis.
A denial-of-service flaw in Oracle Outside In Clean Content SDK 8.5.8 (part of Oracle Fusion Middleware) lets remote attackers crash or hang the parsing engine by submitting a malformed document. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, A:H), no authentication or user interaction is required once a crafted file reaches the parser, but the real gate is deployment exposure: the SDK is a library, so only services that ingest and convert untrusted documents are meaningfully reachable. Impact is availability-only - complete denial of service with no confidentiality or integrity loss; no public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated network attackers can cause a complete denial of service-hang or repeatable crash-against Oracle Solaris 11.4 by reaching an HTTP-handling service that routes into the vulnerable Kernel component. The flaw is rated CVSS 7.5 with availability-only impact (C:N/I:N/A:H) and, per the vector, requires no privileges or user interaction; it cannot be used for data theft or code execution. No public exploit or CISA KEV entry is identified in the provided data, so the practical risk is bounded by whether the exposed HTTP service is reachable from untrusted networks.
Unauthenticated network attackers can cause a hang or frequently repeatable crash of Oracle Solaris 11.4 by reaching the Kernel component through an HTTP-exposed path, producing a complete denial of service with no confidentiality or integrity impact. The CVSS 3.1 score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), and no public exploit code or CISA KEV entry was identified at time of analysis. Practical exposure is limited to systems where the vulnerable HTTP-handling path is reachable from untrusted networks.
Denial of service in Oracle Outside In Technology 8.5.8 allows unauthenticated, network-accessible attackers to hang or repeatedly crash the Outside In Core document parsing/conversion path, producing complete availability loss for applications that expose those functions over HTTP. The flaw is an embedded SDK issue, so real-world exposure is limited to products that pass untrusted files into Outside In for preview or conversion; confidentiality and integrity are unaffected. No public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated remote attackers can hang or repeatedly crash services that embed Oracle Outside In Technology 8.5.8 (Outside In Core) by delivering a crafted malformed document to its file-parsing engine, producing a CVSS 7.5 availability-only denial of service (AV:N/AC:L/PR:N/UI:N/A:H, no confidentiality or integrity impact). Because Outside In is a parsing SDK rather than a network service, real exposure is limited to applications that expose its document-conversion/filtering functionality to attacker-supplied files over HTTP; deployments that only process trusted internal documents are not practically reachable. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied in the feed data, so the practical risk is bounded to availability disruption of document-processing pipelines.
Unauthenticated attackers able to reach an Oracle Service Bus HTTP listener can hang or repeatedly crash the Core component in versions 12.2.1.4.0 and 14.1.2.0.0, producing a complete denial of service (CVSS 3.1: 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Triggering it demands no credentials, no user interaction and little complexity, so the real gating factor is network exposure - internet-facing or partner-reachable Service Bus instances are the ones at risk, while segmented internal deployments are materially harder to hit. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; Oracle ships fixes through its October 2026 Critical Patch Update.
Unauthenticated network attackers can cause MySQL Router 26.7.0 to hang or repeatedly crash, resulting in complete denial of service for the routing tier. The CVSS 3.1 score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), with availability-only impact and no effect on confidentiality or integrity. No public exploit code or confirmed active exploitation was identified at time of analysis, and exposure is reduced where Router listeners are firewalled from untrusted networks.
Denial of service in Oracle Helidon 4.0.0 through 4.5.5 and 27.0.0 can let a network attacker hang or repeatedly crash a Helidon process through the helidon-webclient-http2 component, with CVSS 3.1 score 7.5 reflecting availability-only impact. The issue is unauthenticated and requires no user interaction, but it is bounded: the application must actually use the HTTP/2 WebClient path and be able to reach or be reached by a malicious HTTP/2 peer. No public exploit code or CISA KEV entry is identified in the available data, so this is a serious but conditional availability risk rather than confirmed active exploitation.
Oracle BI Publisher exposes sensitive data to unauthenticated network attackers through its Web Server component, affecting versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. Successful exploitation yields complete confidentiality impact over HTTP with no user interaction, matching a CVSS 7.5 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. No public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated data disclosure in the Oracle Mobile Field Service Admin UI component of Oracle E-Business Suite 12.2.3 through 12.2.15 allows any attacker who can reach the HTTP interface to read critical data without credentials or user interaction. Oracle rates it 7.5 (High) with a confidentiality-only profile (C:H, I:N, A:N), so exploitation yields data exposure rather than modification or disruption, and the practical exposure depends almost entirely on whether the Admin UI is internet-facing or segmented. No public exploit code or confirmed active exploitation was identified at time of analysis; Oracle's October 2026 CPU advisory is the reference for fixes.
Unauthenticated SQL injection in the EventON - Subscriber WordPress plugin (all versions up to and including 1.4.5) allows remote attackers to append arbitrary SQL clauses to the plugin's existing database queries through the 'email' parameter, enabling extraction of sensitive data such as user credentials, password hashes, and other site secrets. The defect is a classic CWE-89 input-handling failure - the parameter is neither escaped nor bound via prepared statements - and scores 7.5 with high confidentiality impact but no integrity or availability effect, reflecting a read-only exfiltration path. No public exploit code or confirmed active exploitation was identified at time of analysis, although the unauthenticated network vector, low attack complexity, and absence of user interaction make the flaw an attractive target for automated scanning against any internet-facing site with the add-on active.
Unauthenticated remote attackers can read critical data from Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 over HTTP, with the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N, base 7.5) indicating a low-complexity, no-prerequisites confidentiality breach with no integrity or availability impact. The flaw is classified by the reporter under an authentication-bypass tag, meaning access controls on a WebCenter Sites interface can be sidestepped rather than brute-forced, exposing all data the application can reach. No public exploit code was identified at time of analysis and the CVE is not in CISA KEV, so there is no confirmed active exploitation, though the combination of unauthenticated network reachability and high confidentiality impact makes this a genuine priority for internet-facing deployments rather than an inflated score.
Unauthenticated HTTP requests to Oracle WebCenter Sites can disclose critical content and site data in versions 12.2.1.4.0 and 14.1.2.0.0 because of an authentication bypass, rated CVSS 7.5 with confidentiality-only impact. Exploitation requires only network reachability to the WebCenter Sites interface - no credentials or user interaction - but the flaw does not permit data modification or service disruption. No public exploit code and no CISA KEV entry were identified at time of analysis.
Unauthenticated remote attackers can read critical data from Oracle Siebel CRM Deployment (Server Infrastructure component) in supported versions 17.0 through 26.9 via HTTP, with low attack complexity and no user interaction, yielding a CVSS 3.1 score of 7.5 (High) and confidentiality-only impact. No public exploit identified at time of analysis, and no CISA KEV active exploitation is reported. Remediate by applying Oracle's October 2026 Critical Patch Update referenced in the vendor advisory.
Unauthenticated remote attackers can read critical data from Oracle Siebel CRM Deployment (Server Infrastructure component) in supported versions 17.0 through 26.9 by sending HTTP requests, due to an authentication bypass flaw (CVSS 3.1 base score 7.5). The vulnerability is network-reachable with low complexity and no user interaction, but impacts only confidentiality (C:H/I:N/A:N), so it enables data disclosure rather than data modification, denial of service, or code execution. No public exploit code or active exploitation (CISA KEV) was identified at time of analysis; exposure is limited to deployments whose Siebel HTTP endpoint is reachable from the attacker's network position.
Unauthenticated information disclosure in JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 allows a network attacker to read critical data through the Installation Security component, with a CVSS 3.1 base score of 7.5. The flaw is low complexity and requires no credentials or user interaction, but impact is limited to confidentiality, with no integrity or availability effect. No public exploit was identified at time of analysis, and practical risk is concentrated on instances reachable over HTTP from an attacker's network position because JD Edwards EnterpriseOne is typically an internally deployed ERP.
Unauthenticated HTTP access to the Oracle SOA Suite Fabric Layer can disclose critical data in Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0. The flaw is network-reachable with low complexity and requires no privileges or user interaction (CVSS 3.1 base 7.5, confidentiality-only), and no public exploit code was identified at time of analysis. Real-world exposure is limited to deployments whose SOA Suite HTTP interface is reachable by untrusted networks.
Information disclosure in Oracle Solaris 11.4's Image Packaging System (IPS) allows unauthenticated remote attackers with HTTP network access to read critical data or all data accessible to the system; CVSS 3.1 is 7.5 with confidentiality-only impact. Oracle's October 2026 CPU identifies the affected component and version, but no public exploit code or CISA KEV entry is present in the supplied intelligence, so there is no public exploit identified at time of analysis. Exposure is limited to deployments where the IPS/pkg HTTP interface is reachable by untrusted networks.
Unauthenticated remote attackers can disclose critical data from Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 by reaching the Authentication Engine over HTTP; the issue is rated CVSS 7.5 with high confidentiality impact and no integrity or availability effect. Exploitation requires only network reachability to the OAM authentication endpoint, making internet-exposed or broadly reachable deployments the priority. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied.
Unauthenticated network attackers can obtain unauthorized read access to critical data accessible through Oracle MySQL Connector/Python 26.7.0, the only affected release. Rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N, confidentiality-only), the flaw is remotely reachable at low complexity without privileges or user interaction, but impact is bounded to data disclosure and to deployments where the connector is network-exposed. No public exploit code or confirmed active exploitation was identified at time of analysis; Oracle's October 2026 Critical Patch Update is the reference advisory.
Unauthenticated, network-reachable attackers can access critical or all Oracle Shipping Execution data in Oracle E-Business Suite versions 12.2.3 through 12.2.15 by targeting the Workflow Events component over HTTP. The flaw is rated 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), with high confidentiality impact and no integrity or availability impact; no public exploit code or CISA KEV entry was identified at time of analysis. Exposure is limited mainly by whether the EBS web tier is reachable from untrusted networks.