Unauthenticated information disclosure in Oracle REST Data Services' GraphQL component (versions 24.2.0 through 26.1.0) lets a remote attacker with HTTP access read a subset of data accessible through ORDS, with no credentials or user interaction required. Rated 5.3 by Oracle and carrying a matching assessed vector (AV:N/AC:L/PR:N/UI:N/C:L/I:N/A:N), the flaw is confined to confidentiality impact - no writes, no denial of service. Real-world exposure depends on whether the GraphQL endpoint is actually deployed and reachable; no public exploit code or confirmed active exploitation was identified at time of analysis.
Denial of service in Oracle JD Edwards EnterpriseOne General Ledger 9.2 allows an authenticated low-privileged attacker with network access over JDENET to hang or repeatedly crash the E1 Foundation component. The CVSS 3.1 score is 5.3 (Medium) with AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H, so exploitation is difficult and availability-only, with no confidentiality or integrity impact. No CISA KEV confirmation was provided, and no public exploit identified at time of analysis.
Authenticated low-privileged users can cause a hang or repeatable crash (complete denial of service) in Oracle MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1 and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1 by reaching the Server: Security: Encryption component over network protocols. Oracle rates exploitation as difficult (AC:H) and impact as availability-only (CVSS 3.1 base 5.3); no public exploit was identified at time of analysis.
Denial of service in Oracle MySQL Server and MySQL Cluster 26.7.0-26.7.1 allows a low-privileged authenticated attacker with network access to hang or repeatedly crash the service through flaws in MySQL client programs. The CVSS 3.1 score is 5.3 (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H), reflecting high attack complexity and availability-only impact. No public exploit was identified at time of analysis, and the narrow affected release branch limits exposure.
Denial of service in Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 can be triggered by a low-privileged authenticated attacker with HTTP network access to the Analytic Server component. Successful exploitation causes a hang or frequently repeatable crash, yielding complete availability impact with no confidentiality or integrity impact; the high attack complexity reflects conditions outside the attacker's full control. No public exploit code or active exploitation was identified at time of analysis, and deployments should prioritize patching and restricting Analytic Server exposure.
An unauthenticated, network-reachable integrity flaw in the Connection Handling component of Oracle MySQL Server and MySQL Cluster 26.7.0-26.7.1 allows remote attackers to perform unauthorized update, insert, or delete operations against a subset of database-accessible data. Rated CVSS 3.1 base 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), it requires only network access to the MySQL listener, with no confidentiality or availability impact and no special configuration preconditions. No public exploit code or confirmed active exploitation was identified at time of analysis, and the practical exposure is bounded by the narrow two-release affected range and the partial-integrity-only consequence.
ApostropheCMS releases prior to 4.34.0 can be made to reveal information about fields that a public REST API projection deliberately excludes, because search-membership and sort-ordering responses still behave differently depending on hidden searchable or sortable field values. Unauthenticated remote attackers who can query a publicly exposed piece or page type configured with publicApiProjection can therefore test candidate values one at a time, though the projection continues to filter all returned fields, so this is targeted inference rather than an unrestricted dump. The exposure is conditional on a specific configuration - an excluded field that remains searchable or sortable - and no public exploit code or confirmed active exploitation was identified at time of analysis.
Partial denial of service in Oracle Java SE 8u503/8u503-perf and Oracle GraalVM Enterprise Edition 21.3.19.1.1 is reachable by unauthenticated remote attackers (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, base score 5.3) who can supply crafted data into the CORBA component's APIs, typically through a CORBA/IIOP-based service or a web service that passes untrusted input to those APIs. The flaw cannot be triggered via untrusted Java Web Start applications or applets, so only server-side or service-side CORBA data paths are in scope; confidentiality and integrity are unaffected and the impact stops at a partial availability loss. No public exploit code or CISA KEV entry was identified at time of analysis, and the practical attack surface is narrow because CORBA is legacy and rarely network-exposed in modern Java deployments.
Partial denial of service in Oracle Java SE affects the Libraries component in 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, and 25.0.4.1, plus Oracle GraalVM for JDK 17.0.20.1/21.0.12.1 and GraalVM Enterprise Edition 21.3.19.1.1. An unauthenticated, network-positioned attacker can degrade availability only by supplying crafted input to an application that exposes the affected Libraries API, such as a web service; no confidentiality or integrity impact or code execution is expected. No public exploit code or CISA KEV confirmation was identified at time of analysis, and the issue is a moderate availability risk rather than an emergency remote-code-execution class flaw.
Unbounded recursive re-sanitization in sanitize-html 2.18.0 allows remote attackers to exhaust the Node.js call stack and crash the process by submitting HTML containing a disallowed <iframe> with deeply nested raw-text content. The flaw triggers only under the library defaults - <iframe> absent from allowedTags and disallowedTagsMode set to 'discard' - which means most unmodified deployments, including ApostropheCMS installations that route untrusted HTML through the sanitizer, are exposed. Impact is limited to availability (CVSS 5.3, A:L only, PR:N/AC:L/UI:N) with no confidentiality or integrity effect, and no public exploit code or CISA KEV active-exploitation entry was identified at time of analysis.
Oracle Siebel CRM Deployment (Server Infrastructure) versions 17.0 through 26.9 expose critical data to unauthenticated network attackers who can persuade another user to take an action, such as opening an attacker-supplied link or request. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) describes a high-complexity, confidentiality-only issue: no attacker credentials are required, but success depends on victim interaction and additional conditions outside the attacker's control, so unattended mass exploitation is unlikely. No public exploit identified at time of analysis; Oracle's October 2026 Critical Patch Update is the remediation reference.
Unauthenticated HTTP requests against the Updates Environment Management component in PeopleSoft Enterprise PeopleTools 8.61-8.63 can modify a limited subset of application data, producing low integrity impact with no confidentiality or availability effect. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, score 5.3) confirms that no privileges or user interaction are required, but practical exposure depends on whether the affected PeopleTools interface is network-reachable. No public exploit code or confirmed active exploitation was identified at time of analysis, so the risk is moderate rather than critical.
Unauthenticated remote attackers can achieve limited, unauthorized modification of data (insert/update/delete) in applications built on the JDK's Lightweight HTTP Server (com.sun.net.httpserver / jdk.httpserver module), affecting Oracle Java SE 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1 and 27, as well as Oracle GraalVM for JDK 17.0.20.1 and 21.0.12.1 and Oracle GraalVM Enterprise Edition 21.3.19.1.1. The flaw is rated CVSS 3.1 base 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), meaning no credentials, no user interaction and no special conditions beyond network reachability, but with impact confined to partial integrity - there is no confidentiality or availability impact and no scope change. Exploitation is only possible where an application actually exposes a reachable service built on this opt-in component and accepts attacker-supplied data through its APIs (for example a web service), not through Untrusted Java Web Start applications or applets, which Oracle explicitly excludes. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied; the practical risk is concentrated in deployments that use the built-in HTTP server as an internet-facing endpoint rather than in general-purpose JDK installations.
Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition can allow an unauthenticated, network-reachable attacker to cause unauthorized updates, inserts, or deletes of data accessible to affected Java Networking APIs. The issue is integrity-only (CVSS 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) and affects specific Oracle Java SE 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, and 27 releases, GraalVM for JDK 17.0.20.1 and 21.0.12.1, and GraalVM Enterprise Edition 21.3.19.1.1. Exploitation requires an application to feed attacker-controlled data into the Networking component server-side, not through untrusted Java Web Start applications or applets; this is a low-to-moderate priority issue despite the ubiquitous affected software. No public exploit identified at time of analysis.
Unauthenticated network attackers can cause limited integrity modification of data in Oracle Java SE and GraalVM deployments that pass attacker-controlled input to the Networking component, affecting specific 8u503, 11.0.32.1, 17.0.20.1, 21.0.12.1, and 25.0.4.1 releases. The CVSS 3.1 score is 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), meaning only partial unauthorized data updates, inserts, or deletes are possible, with no confidentiality or availability impact; exploitation is constrained by the need to reach the affected networking API path outside applet or Java Web Start contexts, such as through a web service. No public exploit code or CISA KEV entry was identified in the provided data, so there is no public exploit identified at time of analysis.
Remote attackers can cause limited unauthorized integrity modification of data accessible to Oracle Java SE’s Networking component in specific update releases (8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, and 27, plus listed GraalVM builds). Exploitation is unauthenticated (PR:N), requires no user interaction, and depends on attacker-controlled data reaching the Networking APIs-typically through an application web service-or on sandboxed Java Web Start or applet code running untrusted input; no public exploit identified at time of analysis.
Unauthenticated network attackers can make low-integrity changes to some data in Oracle Siebel CRM's Marketing component (Siebel Apps - Marketing, supported versions 17.0 through 26.9) over HTTP, per Oracle's October 2026 Critical Patch Update. The CVSS 3.1 score is 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), meaning no credentials, privileges, or user interaction are required, but the flaw is integrity-only with no confidentiality or availability impact. No public exploit code or CISA KEV entry was identified at time of analysis.
Unauthenticated HTTP access to Oracle REST Data Services Core (Oracle ORDS) versions 24.2.0 through 26.1.0 can allow unauthorized insert, update, or delete operations against some ORDS-accessible data. The CVSS 3.1 score is 5.3 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, so the issue is integrity-only, with no confidentiality or availability impact. No public exploit was identified at time of analysis and no CISA KEV confirmation was provided; risk is concentrated on ORDS HTTP endpoints reachable from untrusted networks.
Partial denial of service in Oracle Outside In Technology 8.5.8 (Outside In Clean Content SDK) allows unauthenticated remote attackers to degrade content parsing and conversion availability by supplying crafted input over HTTP. The CVSS 3.1 base score is 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), with no confidentiality or integrity impact, and no public exploit code or CISA KEV entry was identified at time of analysis. Because Outside In is an embedded SDK, actual exposure depends on whether a host application routes untrusted files or data into the Clean Content parser and exposes that path over HTTP.
DOM-based cross-site scripting in Cypht webmail 2.0.0 through 2.12.2 allows unauthenticated remote attackers to run arbitrary JavaScript inside a victim's authenticated webmail session by embedding a crafted payload in the alt text or URL of an external image in an HTML email. Exploitation is conditional: the operator must have enabled the non-default ALLOW_EXTERNAL_IMAGE_SOURCES option (which makes externalResources.js render a 'Source blocked' notice) and the victim must open the malicious message, so the CVSS 4.0 base score is 5.3 and the risk is moderate rather than urgent; no public exploit code or confirmed active exploitation was identified at time of analysis. Successful script execution lets the attacker read mailboxes, send email as the victim, or change account settings, but does not compromise the server host itself.
Confidentiality exposure in Oracle E-Business Suite Order Management (Transaction Entry component) affecting releases 12.2.3 through 12.2.15 lets a low-privileged, HTTP-reachable user read critical order and transaction data they should not be able to see. The CVSS 3.1 base score is 5.3 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N): a valid EBS account is required, no user interaction is needed, and Oracle itself describes the flaw as 'difficult to exploit,' so reliability is constrained by conditions outside the attacker's control. There is no integrity or availability impact, and no public exploit code exists - no public exploit identified at time of analysis - so risk is primarily relevant to environments with large populations of low-privileged EBS users or broad HTTP exposure of the Order Management tier.
Low-privileged authenticated users of the PeopleSoft Enterprise PeopleTools Portal (versions 8.61 through 8.63) can read data beyond their intended authorization scope, exposing critical or potentially all Portal-accessible data while leaving integrity and availability untouched. Exploitation requires a valid low-privileged account, network access to the Portal over HTTP, and favorable conditions outside the attacker's direct control (AC:H), so the practical barrier is credential possession rather than technical sophistication; the CVSS 3.1 base score is 5.3 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N). No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, keeping real-world urgency below what the confidentiality rating alone suggests.
Unauthorized access to sensitive data in Oracle Java SE (8u503/8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27), Oracle GraalVM for JDK (17.0.20.1, 21.0.12.1) and Oracle GraalVM Enterprise Edition (21.3.19.1.1) becomes possible when a Java client runtime executes attacker-supplied code inside the sandbox - typically a sandboxed Java Web Start application or applet loaded from the internet - and the JGSS component fails to enforce an intended security boundary. The CVSS 3.1 score is 5.3 (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N): reachable over the network by an unauthenticated attacker, but gated by required human interaction and explicitly rated difficult to exploit, with confidentiality-only impact and no integrity or availability effect. No public exploit code or CISA KEV entry is associated with this CVE at time of analysis, and realistic exposure is sharply limited because the vulnerable configuration (browser applets and Web Start) is deprecated and disabled or absent in most modern environments; server deployments running only administrator-installed trusted code are explicitly out of scope.
Unauthorized read access to critical report data is possible in Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 through the Report Distribution component, which can be reached over HTTP without credentials. Exploitation is deliberately constrained: Oracle rates it 'difficult to exploit' (AC:H) and the attacker must persuade a legitimate user other than themselves to perform an action (UI:R), so a successful attack yields confidentiality loss only, with no integrity or availability impact. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor CVSS 3.1 base score of 5.3 reflects the combination of high impact on confidentiality with substantial exploitation barriers.
Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 expose the Content Server component over HTTP in a way that can let an unauthenticated remote attacker reach critical document-management data, but only if a separate authorized user can first be induced into performing an action on the attacker's behalf (UI:R) and only when additional conditions outside the attacker's control are satisfied (AC:H). The CVSS 3.1 base score of 5.3 reflects confidentiality-only impact (C:H with no integrity or availability effect) against unchanged scope. No public exploit code and no confirmed active exploitation (CISA KEV) have been identified at time of analysis, and the mandatory victim interaction combined with high attack complexity substantially constrains reliable mass exploitation despite the network-reachable, unauthenticated vector; the issue is a moderate-priority patching item rather than an emergency.
Authenticated users of Fat Free CRM versions before 0.26.0 can edit or delete comments belonging to other users through an insecure direct object reference in the comments controller. Because comment IDs are sequential and enumerable, any logged-in account can send PUT or DELETE requests to /comments/:id and tamper with comments attached to contacts, accounts, leads, and opportunities it does not own, without needing an administrative role or any ownership relationship to the target record. Exploitation requires a valid account and a multi-user deployment; no public exploit code was identified at time of analysis, and the vendor has released version 0.26.0 to address the issue.
Low-privileged authenticated users can tamper with critical deployment data in Oracle Siebel CRM Deployment (Server Infrastructure) versions 17.0 through 26.9 via HTTP, although high attack complexity makes reliable exploitation difficult. The flaw affects integrity only, with no confidentiality or availability impact, and requires a valid account on the target instance. No public exploit code or CISA KEV entry was identified at time of analysis; CVSS 3.1 base score is 5.3.
Baserow before 2.3.0 exposes cross-workspace data disclosure through its unique_row_values field endpoint, which lacks an authorization check: any authenticated user can read distinct cell values from fields belonging to workspaces they do not belong to. Attackers enumerate sequential field IDs and pull up to 100 distinct unique values per field per request, which leaks bounded cell content rather than full rows or credentials. The flaw is rated moderate (assessed CVSS 3.1: 5.3, PR:L/UI:N, confidentiality-only), and no public exploit code or CISA KEV active-exploitation listing is associated with it at time of analysis; a vendor fix exists in Baserow 2.3.0.
Sharkord before 0.0.26 allows any authenticated server member to replace or remove the server logo without MANAGE_SETTINGS permission because the others.changeLogo tRPC mutation omits its permission check. The impact is limited to integrity of a server setting: the changed logo is published to every connected client, but there is no confidentiality or availability impact and the attacker must already hold a valid low-privilege account. No public exploit code was identified at time of analysis, and a vendor-released fix is available in Sharkord 0.0.26.
Integrity compromise in Oracle Siebel CRM Cloud Applications 22.3 through 26.9 lets an authenticated low-privileged attacker with HTTP network access to the Siebel Cloud Manager component create, delete, or modify critical data. Oracle rates this CVSS 5.3 and describes it as difficult to exploit because of high attack complexity, and the supplied intelligence shows no public exploit identified at time of analysis and no CISA KEV entry. User interaction is not required, but confidentiality and availability are unaffected, making this a moderate-severity, moderate-priority issue rather than an urgent one.
Integrity-only data tampering in Oracle JD Edwards EnterpriseOne Configurator 9.2 lets a low-privileged, authenticated attacker reach the Configuration Management component over HTTP and create, delete, or modify critical configuration data. Exploitation is constrained by high attack complexity (AC:H), meaning the attacker must satisfy conditions outside their direct control rather than issuing a single reliable request, and the impact is bounded to integrity - no confidentiality loss and no denial of service. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing); this is a moderate-severity, low-priority item despite being network-reachable.
Unauthenticated remote attackers with HTTP access to the Java-based Agent in Oracle Essbase 21.8.3.0.0 can read a subset of accessible data through an easily exploitable confidentiality flaw (CVSS 3.1 base 5.3). The issue is network-reachable, low-complexity, and requires no user interaction, but its impact is limited to low confidentiality with no integrity or availability effects. No public exploit identified at time of analysis; exposure is the main risk factor, so deployments that restrict the agent endpoint to trusted networks reduce reachability.
Oracle Essbase 21.8.3.0.0 exposes a confidentiality weakness through its WebLogic-based T3 and IIOP remote invocation listeners, letting network-reachable attackers bypass authentication and read a subset of the data the Essbase server can access. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 5.3) confirms no credentials or user interaction are needed, but impact is bounded to partial confidentiality with no integrity or availability effect. This is a moderate-severity issue rather than a top-tier priority; no public exploit code or confirmed active exploitation (CISA KEV) is identified in the available data, and exploitation depends on T3/IIOP being exposed rather than restricted to internal management networks.
Missing authorization in Memos before 0.27.0 lets any authenticated user enumerate ActivityService records and read activity metadata belonging to other users, including activity tied to private memos. The ListActivities and GetActivity API methods lack per-user authorization checks, and sequential activity IDs make it practical to page through creator IDs, timestamps, and memo-comment references. Exploitation requires a valid account but no elevated privileges; no public exploit code was identified at time of analysis.
Authenticated Modoboa users can delete DNS, MX, and blocklist monitoring alarms belonging to other domains in versions before 2.8.0 by submitting arbitrary alarm IDs to the POST /api/v2/alarms/bulk_delete/ endpoint. The issue is a moderate-severity insecure direct object reference (CWE-639): the pre-2.8.0 bulk-delete logic operates on any matching primary key instead of restricting deletion to alarms the caller is allowed to manage, and sequential IDs make other tenants’ alarms enumerable. No public exploit code or confirmed active exploitation was identified in the provided intelligence; the vendor-released fix is Modoboa 2.8.0.
Unauthenticated HTTP requests to the Siebel Cloud Manager component of Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.9) can return a limited subset of application data to any attacker who can reach that interface, producing a confidentiality-only impact rated CVSS 3.1 base 5.3. The vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) requires no credentials, no user interaction, and no special configuration, so real-world exposure is governed almost entirely by whether Cloud Manager is network-reachable rather than by privilege level. No public exploit code or confirmed active exploitation was identified at time of analysis, and Oracle addresses the flaw in its October 2026 Critical Patch Update advisory.
Unauthenticated HTTP access to Oracle ZFS Storage Appliance Kit 8.8 can expose a subset of appliance-accessible data, giving remote attackers a limited confidentiality-only impact rated CVSS 3.1 5.3. The flaw is network-reachable with low attack complexity and no privileges or user interaction required, but it does not affect integrity or availability, and only version 8.8 is listed as affected. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was provided; exploitation depends on reaching the appliance's HTTP management interface, so appliances confined to an isolated management network are materially less exposed.
An information-disclosure flaw in the helidon-webclient component of Oracle Helidon 4.0.0 through 4.5.5 and 27.0.0 lets remote attackers read a limited subset of Helidon-accessible data over HTTP without authenticating or interacting with a user. The impact is confined to confidentiality (CVSS 3.1 base score 5.3, C:L with no integrity or availability effect), so the realistic risk is leakage of application data rather than takeover or service disruption. No public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS/KEV data was not provided.
Unauthenticated HTTP access to the helidon-health component in Oracle Helidon 3.0.0-3.2.21, 4.0.0-4.5.5, and 27.0.0 can expose a limited subset of application-accessible data. The flaw is remotely exploitable with low complexity and no credentials or user interaction (CVSS 3.1: 5.3), but impact is confined to confidentiality with no integrity or availability effect. No public exploit code or confirmed active exploitation was identified in the available intelligence at time of analysis.
Unauthorized access to critical data in Oracle Java SE (8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, and 27), Oracle GraalVM for JDK (17.0.20.1 and 21.0.12.1), and Oracle GraalVM Enterprise Edition (21.3.19.1.1) is possible through the JGSS component, but only in client deployments that run sandboxed Java Web Start applications or applets loading untrusted code; servers running only trusted administrator-installed code are explicitly not affected. Oracle describes the flaw as difficult to exploit (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N), requiring no privileges but needing a victim to interact with the malicious application, and no public exploit was identified at time of analysis. Despite the low real-world priority, organizations still using applet or Web Start sandboxes should apply the October 2026 CPU.
Unauthenticated information disclosure in Oracle JD Edwards EnterpriseOne Orchestrator (E1 IOT Orchestrator Security) affects releases 9.2.0.0 through 9.2.26.5, allowing a network attacker to read critical data or effectively all Orchestrator-accessible data. Oracle scores it 5.3 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N): no attacker credentials are required, but the attack is rated difficult and depends on a legitimate user other than the attacker being induced to perform an action, and there is no integrity or availability impact. No public exploit code or confirmed active exploitation was identified at time of analysis, and the high attack complexity plus mandatory victim interaction substantially limit real-world exploitability for what is otherwise a confidentiality-only flaw.
Siebel Cloud Manager in Oracle Siebel CRM Cloud Applications 22.3 through 26.9 can be reached over HTTP by unauthenticated remote attackers and abused to update, insert, or delete selected data. The CVSS 3.1 score is 5.3 with integrity-only impact, no confidentiality or availability effect, and no user interaction required. No public exploit was identified at time of analysis.
Oracle Siebel CRM Cloud Applications 22.3 through 26.9 can expose critical data to an unauthenticated attacker who can reach the physical communication segment attached to the host running the Siebel Cloud Manager component, but Oracle rates the attack as difficult and high-complexity (CVSS 3.1: 5.3, AV:A/AC:H/PR:N/UI:N/C:H). The flaw is confidentiality-only and adjacent-network limited, so practical risk is moderate and lower priority than internet-facing issues. No public exploit identified at time of analysis and no CISA KEV entry is present.
Missing authorization in OpenCATS before 0.10.0 allows authenticated users holding EDIT or DELETE calendar access to modify or delete other users' calendar events by supplying arbitrary eventID values to CalendarUI::onEditEvent() and onDeleteEvent(), including events intended to be private to their owner. The flaw is an IDOR (CWE-639) that works against default configurations; no public exploit code was identified at time of analysis and there is no CISA KEV listing. It is rated CVSS 4.0 5.3 (Medium), with low integrity impact and no confidentiality or availability impact.
Missing authorization checks in the OpenCATS ajax/deleteActivity.php and ajax/editActivity.php endpoints allow any authenticated user holding READ-level access to edit or delete activity and pipeline history for candidates, contacts and companies by supplying an arbitrary activityID through GET or POST. Only versions before 0.10.0 are affected, and exploitation requires valid low-privilege credentials, so the practical exposure is limited to insiders or attackers who already hold an account. This is an integrity-only issue: no confidential data is disclosed and no denial of service is demonstrated; no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Certain ASUS router firmware exposes a critical function without authentication, allowing an attacker on the same adjacent network (LAN or Wi-Fi broadcast domain) to send crafted HTTP requests that disclose device identification information and force the router into a specific mode, potentially preventing self-recovery under abnormal conditions. The issue is medium severity (CVSS 5.3) because it requires adjacency and yields only low confidentiality, integrity, and availability impact; no public exploit code or confirmed active exploitation was identified at time of analysis, and affected models/firmware versions are not enumerated in the available data.
Oracle Agile Engineering Data Management 6.2.1 exposes critical data to unauthorized reads through its Engineering Communication Interface when an attacker is positioned on the physical communication segment serving the host. The flaw is unauthenticated (PR:N) and needs no user interaction (UI:N), but requires adjacency (AV:A) plus high attack complexity (AC:H), so it is only reachable by someone already on the local network segment rather than from the public Internet. Impact is confidentiality-only - no integrity or availability effect - and no public exploit has been identified at time of analysis; Oracle addressed it in its October 2026 Critical Patch Update.
Unauthenticated attackers positioned on the same physical or adjacent network segment as a JD Edwards EnterpriseOne Tools host can obtain critical data from the Monitoring and Diagnostics SEC component in versions 9.2.0.0 through 9.2.26.5, with impact limited to confidentiality. Exploitation is rated difficult - success depends on conditions outside the attacker's direct control and requires local segment presence rather than a routed or internet path - and no public exploit code has been identified at time of analysis; the CVSS 3.1 base score is 5.3 (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).
Information disclosure in the Search Framework component of Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 allows an unauthenticated attacker who already has a foothold on the physical/adjacent network segment hosting the PeopleSoft instance to read critical application data. The CVSS 3.1 score is 5.3 (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N), reflecting a confidentiality-only impact that requires adjacent-network positioning and conditions outside the attacker's direct control (high attack complexity), so the flaw is not reachable from the routable internet. No public exploit code was identified at time of analysis, there is no CISA KEV listing, and no EPSS score was supplied; despite the 'Authentication Bypass' tag in the source feed, the practical risk is moderate and not an urgent priority.
Local, low-privileged users on PeopleSoft Enterprise PeopleTools 8.61 through 8.63 can abuse the Test Framework component to read and alter portions of application data and to trigger a partial denial of service. The CVSS 3.1 score is 5.3, reflecting local access, low privileges, and low confidentiality/integrity/availability impact; no public exploit identified at time of analysis.