Low-privileged local users on Oracle Solaris 11.4 can abuse the X Window System component to modify or delete some accessible data, read a subset of Solaris data, and cause a partial denial of service. The CVSS 3.1 score is 5.3 with the vector AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, so an attacker must already hold a valid interactive login on the host, no victim interaction is required, and the issue cannot be reached remotely. No public exploit has been identified at time of analysis, and exposure is limited to Solaris 11.4 systems where an attacker already has a local account.
A local, low-privileged user (PR:L) who can rename files in a shared, non-sticky-bit lock directory can abuse the Python filelock package's SoftFileLock, MarkerSoftFileLock, or SoftFileLease marker-restore path in versions 4.1.0 through 4.2.0 to make the lock owner hard-link one of its own files into the lock directory, exposing file contents and causing limited integrity impact. The race is high-complexity and timing-dependent, requires a second local account plus a non-default shared-directory configuration, and no public exploit code has been identified at the time of analysis. All signals point to a genuinely low operational priority despite the MEDIUM 5.3 CVSS.
Unauthenticated information disclosure in ApostropheCMS prior to 4.33.0 lets remote attackers probe the REST endpoint GET /api/v1/<piece-type>/:_id/locales (and the equivalent page route) to determine whether an arbitrary document _id exists and which locales it is published in. The route omits the publicApiCheckAsync gate that other read routes enforce, so the read-API's intended gating is bypassed by default with no special configuration, though only existence and locale metadata leak - not document contents - leaving confidentiality impact Low and integrity/availability unaffected. There is no public exploit code or confirmed active exploitation at time of analysis, and the practical risk is reconnaissance value (enumerating valid IDs and site localization footprint) rather than data theft.
Froxlor 0.10.0 through 2.3.14 does not enforce the main-domain deletion restriction in the SubDomains.delete API command, allowing any authenticated customer to delete a reseller- or admin-provisioned main domain by supplying its id. This can orphan vhost, DNS, and subdomain records and push subdomains_used below zero, granting extra subdomain allowance. The vendor fixed the missing authorization check in 2.3.15; no public exploit was identified at time of analysis.
An authorization bypass in the Froxlor hosting control panel (versions 0.10.0 through 2.3.14) lets an authenticated reseller read any administrator's full account record through the Admins.get API command by pairing their own loginname with another admin's numeric id. The flaw is an OR-based identity check in lib/Froxlor/Api/Commands/Admins.php: a mismatched id/loginname pair still passed the privilege gate, while the subsequent database query was driven by the numeric id alone, exposing contact email addresses, IP allow-lists, resource limits, internal notes, and login history for arbitrary admins. Impact is read-only information disclosure of administrator metadata from a low-privileged account (no modification is possible), no public exploit code was identified at time of analysis, and the issue is fixed in Froxlor 2.3.15.
Missing authorization in SparkyFitness before 0.17.0 allows any authenticated user to delete other users' food variants through the DELETE /api/foods/food-variants/:id endpoint, destroying serving and nutrition data attached to publicly shared foods. The flaw is exploitable by low-privileged account holders (PR:L) who harvest variant IDs from the public food read endpoints; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV. Impact is limited to data integrity and availability (no confidentiality loss, no code execution or privilege escalation), and realistically only matters on multi-user deployments where foods are shared publicly.
Authenticated low-privileged users of Xen Orchestra before 6.9.0 can modify other accounts' stored preferences - deleting the preferences.otp TOTP secret to silently strip two-factor authentication, corrupting it to lock the victim out, or overwriting stored xsCredentials and sshKeys - because the xo-server user.set API method accepted an arbitrary target user id without verifying ownership. The flaw is a CWE-639 authorization bypass (CVSS 5.3, PR:L, no user interaction) reachable over the network, with integrity and availability impact confined to other users' preference data and no confidentiality impact; no public exploit code has been identified at time of analysis.
Insecure direct object reference in Modoboa before 2.8.0 lets any authenticated user holding a valid mailbox POST to /api/v2/armessages/ with another user's mbox value, injecting attacker-controlled auto-reply subject and body into that victim's settings or breaking their auto-reply management through MultipleObjectsReturned errors. Exploitation requires a low-privileged account (CVSS PR:L) and no user interaction; impact is limited to integrity and availability of auto-reply configuration with no disclosure of mailbox data and no privilege escalation, making this a medium-severity authorization flaw. No public exploit code was identified at time of analysis and the issue is not in CISA KEV; version 2.8.0 contains the vendor fix. Upstream Modoboa was informed via GitHub issue 3945, with the fix shipped in commit e0a4e3b9.
An insecure direct object reference (CWE-639) in Blinko through 1.8.8 lets any authenticated user read and modify tags belonging to other accounts by supplying arbitrary tag IDs to the tag tRPC router procedures fullTagNameById, updateTagIcon, and updateTagOrder. Because tag IDs are sequential in the backing Prisma database, a low-privileged logged-in attacker can enumerate IDs to disclose private note topics (tag names) and tamper with other users' tag icons and ordering. Impact is bounded to tag metadata rather than note bodies and is only meaningful on shared multi-user deployments; no public exploit identified at time of analysis, and the vendor has published an upstream fix in PR #1171.
Missing authorization in Sharkord versions before 0.0.8 allows any authenticated member to call the others.updateSettings tRPC mutation without the MANAGE_SETTINGS permission, enabling tampering with server-wide configuration such as join passwords, registration toggles, upload limits, and plugin loading. The issue affects default deployments because the vulnerable code path simply omits the permission check, though exploitation requires a valid member account and is therefore limited to authenticated users rather than unauthenticated outsiders. At the time of analysis, no public exploit code was identified, and the vendor has released a patch in version 0.0.8.
Missing authorization in Magepeople's Bus Ticket Booking with Seat Reservation plugin through 5.9.7 allows unauthenticated remote attackers to perform certain privileged actions that should require proper capability checks, with impact limited to low-integrity changes. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, so no credentials or user interaction are required, but confidentiality and availability are not affected. No public exploit code or confirmed active exploitation was identified in the provided data at time of analysis.
Missing authorization in Arraytics Booktics through 1.0.30 lets unauthenticated remote attackers reach a plugin endpoint that should be access-controlled, exposing limited data (CVSS 5.3). The issue is CWE-862 and affects WordPress sites with the plugin active; no public exploit identified at time of analysis.
Missing authorization (CWE-862) in the Castos Seriously Simple Podcasting WordPress plugin through 3.17.0 lets unauthenticated remote attackers reach functionality that should be capability-gated, per the CVSS vector (PR:N/UI:N) on default configurations. The practical consequence is limited to low-level confidentiality disclosure - unauthorized read access to plugin-controlled data - with no integrity or availability impact. Exploitation is trivially reachable but low-impact, so this is a moderate-priority exposure rather than a site-takeover risk; no public exploit code or active exploitation (CISA KEV) is identified at time of analysis, and an EPSS score was not supplied with the source data.
LearnPress before 4.4.10 permits authenticated instructors to tamper with other instructors' courses, quizzes, and questions through legacy lp-ajax editor actions. The handlers verify a generic editor nonce but do not perform a per-object ownership or capability check, so an instructor can reuse their own nonce with another object's id to change content, alter quiz answers, or trash questions; confidentiality is not exposed per the assessed vector. The vendor has released version 4.4.10, no public exploit identified at time of analysis, and practical risk is limited to multi-instructor sites where another instructor's content is available to target.
OpenCATS before 0.10.0 allows any authenticated low-privilege user to view EEO demographic reports without holding the canSeeEEOInfo permission, exposing aggregate ethnicity, veteran, gender and disability statistics. Exploitation is a simple direct invocation of the customizeEEOReport and generateEEOReportPreview actions in ReportsUI::handleRequest(); no exploit code beyond the public advisory and GitHub issue is needed, but a valid session is mandatory (PR:L) and no public exploit tooling is confirmed. This is a genuine but low-severity information-disclosure issue, not a high-priority emergency - EPSS and KEV data were not provided and no public exploit was identified at time of analysis.
Missing authorization in the import module of OpenCATS (all versions before 0.10.0) allows any authenticated user holding only READ-level access to invoke the import revert action and mass-delete previously imported candidate, company, and contact records. Exploitation requires valid low-privilege credentials, network access to the web interface, and the existence of a prior import whose importID can be supplied; no administrative rights or user interaction are needed. The vendor has released 0.10.0 with an access-level check in ImportUI::handleRequest(); no public exploit code was identified at time of analysis and the issue is not in CISA KEV.
Authenticated users with only READ-level access in OpenCATS before 0.10.0 can create, rename, delete, and populate saved lists they do not own through the modules/lists/ajax endpoints. The flaw is a missing authorization check (CWE-862) in newList.php, editListName.php, deleteList.php, and addToLists.php, allowing low-privilege accounts to tamper with saved lists site-wide. Impact is limited to integrity because the endpoints do not expose list contents, and no public exploit code was identified in the provided intelligence at time of analysis.
OpenCATS before 0.10.0 permits any authenticated user, including read-only accounts, to invoke ajax/testEmailSettings.php without the required site-administrator authorization and send a fixed test email through the server's configured SMTP relay with an attacker-supplied From address. The assessed CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N (5.3, medium), reflecting mandatory authentication, no confidentiality or availability impact, and limited integrity impact from spoofed outbound mail; the SMTP relay must already be configured for delivery. No public exploit code was identified at time of analysis, and the vendor-released 0.10.0 update contains the authorization fix.
Out-of-bounds heap read in the Eclipse ThreadX USBX host stack can be triggered when a malicious USB device presenting the MTP/PTP class is attached and the host performs ordinary object enumeration, causing adjacent heap memory to be disclosed to the application or an unmapped-page fault that crashes the host. The issue is physically gated: an unauthenticated attacker needs physical access, and the target must be running USBX in USB host mode with MTP/PTP support enabled and must enumerate the crafted device. Vendor scoring is CVSS 4.0 5.2 (Medium); no public exploit was identified at time of analysis, and impact is limited to low confidentiality loss plus possible denial of service, with no integrity impact or code execution.
DOM-based cross-site scripting in LIFF SDK 2.20.0 through 2.31.0 allows unauthenticated remote attackers (CVSS PR:N) to execute arbitrary JavaScript in the origin of a LIFF application's endpoint when a victim opens a specially crafted URL in an external browser, which can disclose JavaScript-accessible authentication tokens or application data and permit unauthorized actions under the victim's session. Exploitation is not drive-by: it demands that the targeted user actively open the attacker-supplied link, and the vulnerable code path is specific to the external-browser context rather than the in-app LINE client, so real-world exposure is materially narrower than a plain network attack vector implies. Only two vendor references were supplied (the LINE security advisory page and GitHub advisory GHSA-wppr-qmp4-w627); no public exploit code and no active exploitation were identified at time of analysis.
Reflected cross-site scripting in the VPL (Virtual Programming Lab) activity module for Moodle before 5.0.0 lets an attacker execute arbitrary JavaScript inside the browser session of a teacher or grader who holds the mod/vpl:similarity capability. The payload is delivered through the unencoded filename1/filename2 parameters of similarity/diff.php, which the plugin concatenates into the page's HTML header without escaping, so the script runs when the privileged user opens a crafted link. Because exploitation requires that user interaction and confines impact to the victim's own session rather than the Moodle server, severity is moderate (CVSS 5.1); no public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is fully resolved in the 5.0.0 release.
An out-of-bounds write in GNU UnRTF, the command-line RTF-to-HTML/text converter, can crash the process when a user converts a maliciously crafted RTF file, producing a denial-of-service condition. The flaw affects UnRTF releases tracked under the generic GNU Project CPE (no fixed version range is enumerated in the source data) and is reachable without authentication, but requires the victim to open or process the attacker-supplied RTF file. No public exploit code or confirmed active exploitation is identified at time of analysis, and the realistic impact is limited to loss of availability of the conversion process rather than code execution or data disclosure.
Denial of service in Oracle Solaris 11.4's Services component can be triggered by an attacker who already holds an interactive local logon, causing a hang or frequently repeatable crash of the affected host. The CVSS 3.1 vector is AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, meaning exploitation is local rather than remote, does not require credentials beyond the local logon, needs no user interaction, and depends on specific runtime conditions that make reliable success difficult. No public exploit code or CISA KEV entry was identified at time of analysis, and impact is confined to availability on the single affected system.
Improper authorization in @e2e-dev/github before 0.4.1 lets anyone who can comment on a pull request hijack the CI test report comment that the reporter manages. Because findComment and upsertComment in packages/github/src/post.ts match a comment purely by the tool's predictable first-line marker and never verify who wrote it, an attacker can pre-seed a marker-bearing comment so results land in their own comment and edit failures into passes, or post a decoy that causes the genuine report to be suppressed. The flaw requires an authenticated, low-privileged GitHub user (PR:L) and that the CI workflow actually runs to update the report (UI:P), and impact is limited to the integrity of report comments - no code execution or secret exposure; no public exploit code was identified at time of analysis, and 0.4.1 fixes the issue by checking the comment author against the token's account.
Stored cross-site scripting in react-admin before 5.15.5 lets an authenticated attacker with low-privilege write access to URL-type record fields execute JavaScript in an administrator's session when the administrator clicks a rendered UrlField or FileField link. The vulnerable components emitted javascript: URI values as clickable hrefs, including obfuscated variants using mixed case, leading control characters, or embedded tabs and newlines, while exploitation depends on administrator click interaction and attacker influence over stored URL data. CVSS 4.0 base score is 5.1, no public exploit identified at time of analysis, and upgrading to 5.15.5 renders unsafe URLs as plain text.
Blind server-side request forgery in Eclipse PIA allows an approved OIDC identity provider to force PIA's token-verification flow to fetch an arbitrary host and port, including plaintext HTTP, from PIA's network position. The issue is in verify_token (pia/oidc.py), which follows jwks_uri from a trusted issuer's discovery document without parsing it as a URL, comparing it to the issuer origin, or requiring HTTPS, and the fetch is triggered by an unauthenticated POST /v1/upload/sbom that is then rejected with 401. Because the response is not reflected to the attacker, impact is limited to outbound GET reconnaissance/interaction; exploitation requires a high-privileged position controlling a registered per-project Jenkins issuer under https://ci.eclipse.org/<project>/oidc (PR:H), and no public exploit was identified at time of analysis.
Authenticated low-privileged users of Oracle Essbase 21.8.3.0.0 can exploit a Security component access-control weakness over HTTP to read a limited subset of data they should not be able to access, and because the CVSS vector sets scope change (S:C), exposed data may extend to additional integrated products. The flaw is rated CVSS 3.1 5.0 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N), so exploitation requires a valid low-privilege account and network reachability to the HTTP interface; no user interaction is needed and complexity is low. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
An authenticated low-privileged user of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 can exploit the Query component over HTTP to read a limited subset of application data, with scope change potentially exposing data in integrated products. Oracle rates this information-disclosure issue at CVSS 3.1 base 5.0; no public exploit was identified at time of analysis, and remediation is available through Oracle's October 2026 Critical Patch Update.
Low-privileged authenticated users can read a subset of data accessible through Oracle REST Data Services 24.2.0 through 26.1.0 by sending crafted HTTP requests to a Core endpoint. The issue is rated CVSS 3.1 5.0 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N), so exploitation requires a valid low-privilege account and network reachability, with no user interaction; the scope change means disclosed data may extend to integrated products. No public exploit code or confirmed active exploitation was identified at time of analysis.
Low-privileged users with valid Essbase credentials can read a subset of data they should not be able to access through the Security component of Oracle Essbase 21.8.3.0.0 over HTTP, with the scope change flag indicating that disclosed data may extend into additional connected products. The issue is rated CVSS 5.0 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) - moderate severity and not high priority, because the authentication prerequisite means the attacker must already hold a low-level account, pointing to insider or post-compromise scenarios rather than anonymous internet exploitation. No public exploit code was identified and the flaw is not in CISA KEV; the primary exposure for defenders is unpatched Essbase deployments reachable over HTTP from untrusted networks.
Oracle Essbase 21.8.3.0.0 contains an access-control weakness in its Security component that lets an authenticated low-privileged user reach data beyond their intended authorization boundary over HTTP, exposing a limited subset of readable data (CVSS 3.1 base 5.0, AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N). Because the scope is changed, the disclosed data can flow into other products integrated with Essbase, so real-world impact depends on deployment topology. No public exploit code has been identified at time of analysis and the issue is not known to be actively exploited; Oracle addresses it in its October 2026 Critical Patch Update.
An information-disclosure flaw in Oracle Essbase's Security component (affecting release 21.8.3.0.0) lets a low-privileged account holder reach the server over HTTP and read a subset of Essbase-accessible data they should not see. Because the CVSS scope is changed (S:C), the exposed data can extend beyond Essbase into other dependent products, though integrity and availability are unaffected (I:N/A:N); the requirement for a valid account (PR:L) keeps the barrier to entry moderate. At time of analysis there is no public exploit identified, and the vendor has published an advisory in its October 2026 Critical Patch Update.
Oracle SOA Suite Fabric Layer in versions 12.2.1.4.0 and 14.1.2.0.0 contains a difficult-to-exploit authenticated flaw that lets a low-privileged attacker with HTTPS network access read and modify limited SOA Suite data and cause partial denial of service. The CVSS 3.1 score is 5.0 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L), so exploitation requires a valid low-privileged account and a specialized condition rather than a reliable single request. No public exploit was identified at time of analysis, and impact is bounded to partial confidentiality, integrity, and availability effects.
Trusted Answer Search 26.1 contains a PL/SQL package flaw that a locally logged-on, low-privileged attacker can trigger only with high attack complexity and human interaction from another user, yielding limited read/write access and partial denial of service with possible scope change to additional products. No public exploit was identified at time of analysis, and the CVSS 3.1 base score is 5.0.
Local credential disclosure in cockpit-machines, the Cockpit web module for managing libvirt/KVM virtual machines on Red Hat Enterprise Linux 9 and 10, exposes a guest VM's VNC console password to other unprivileged users on the same host. When an operator saves VNC console settings, the configured password is handed to an underlying system utility as a command-line argument, so any local user able to inspect another user's process entries can read the secret during that brief window. Exploitation requires an already-authenticated local account (PR:L), a host without hidepid-style process hiding, and a concurrent victim save action (UI:R); no public exploit code exists and the flaw is not in CISA KEV.
Information disclosure in cockpit-machines on Red Hat Enterprise Linux 9 and 10 lets a local unprivileged user capture RHSM authentication tokens from the command line of a short-lived image-retrieval helper process when cross-user process inspection is enabled. The attacker needs a local shell account and a concurrent image-retrieval operation by another user; stolen tokens can be used against RHSM resources only until they expire. This is a moderate-risk, low-urgency issue with no public exploit identified at time of analysis, and it does not provide remote access, code execution, or integrity/availability impact.
Denial of service in MySQL Server and MySQL Cluster lets an attacker who already holds high database privileges crash or repeatedly hang the service by sending crafted input that exercises the Server: Optimizer component. The affected releases are MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1; the CVSS vector confirms network reachability, low attack complexity, no user interaction, and an availability-only impact, but the PR:H prerequisite sharply limits who can exploit it. No public exploit identified at time of analysis, and no CISA KEV entry is present in the supplied data, so this is a moderate availability risk rather than a broad unauthenticated remote attack.
Denial of service in Oracle MySQL Server and MySQL Cluster lets a high-privileged, network-connected database user hang or repeatedly crash the server by exercising the Server: Optimizer component. Only MySQL Server 8.4.0 through 8.4.12, 9.7.0 through 9.7.3 and 26.7.0 through 26.7.1, plus MySQL Cluster 8.0.0 through 8.0.49 and the 8.4.x, 9.7.x and 26.7.x branches, are affected; the CVSS 3.1 score is 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H), reflecting an availability-only impact. The decisive constraint is the PR:H prerequisite - an unprivileged or read-only account cannot trigger it, so the realistic threat is an insider or an actor who already holds a privileged database credential; no public exploit code and no confirmed active exploitation were identified at time of analysis. Exploitation condition: authenticated session as a high-privileged MySQL user with network reachability to the listener over a supported protocol, submitting crafted input that reaches the optimizer; no user interaction is required and complexity is low, so the crash is reliably repeatable once that access exists.
A high-privileged, authenticated user can crash MySQL Server or MySQL Cluster or hang it repeatedly through crafted queries that abuse the Server: Optimizer component, causing complete denial of service with no data disclosure or modification. Affected builds are MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. The CVSS 3.1 score is 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H); the decisive limiter is the PR:H requirement, so an unauthenticated or low-privileged attacker cannot trigger it, and no public exploit code or KEV-listed active exploitation was identified at time of analysis.
Denial of service in Oracle MySQL Server and MySQL Cluster allows an authenticated, high-privilege attacker with network access to hang or repeatedly crash the database service. The flaw is in the Server: Replication component and affects MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1. Exploitation requires PR:H credentials but is low-complexity and needs no user interaction; only availability is impacted, and no public exploit identified at time of analysis.
Denial of service in Oracle MySQL Server and MySQL Cluster's InnoDB component affects authenticated users holding high database privileges; an attacker with network access can cause a hang or frequently repeatable crash (complete DOS) of the MySQL Server or MySQL Cluster instance. The issue is rated CVSS 3.1 base 4.9 with availability-only impact and affects MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1 plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1. No public exploit identified at time of analysis, and exploitation requires the high-privilege prerequisite, confining realistic risk to insiders, compromised admin/service credentials, or multi-tenant deployments where untrusted parties hold high DB privileges.
Denial of service in Oracle MySQL Server and MySQL Cluster allows a high-privileged attacker with network access to hang or repeatedly crash the database service. Affected ranges include MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1; exploitation requires HIGH database privileges (CVSS PR:H) over multiple standard protocols. The issue has a CVSS 3.1 base score of 4.9 with availability-only impact, and no public exploit was identified at time of analysis.
Denial of service in Oracle MySQL Server and MySQL Cluster can be triggered by a high-privileged, network-positioned attacker against the InnoDB component, causing a hang or frequently repeatable crash of the database service. Affected releases are MySQL Server 9.7.0 through 9.7.3 and 26.7.0 through 26.7.1, plus the matching MySQL Cluster versions; CVSS 3.1 score is 4.9 with availability-only impact. Exploitation requires an authenticated session with high MySQL privileges (PR:H), and no public exploit or CISA KEV entry is identified in the available data.
A denial-of-service flaw in the Optimizer component of MySQL Server and MySQL Cluster lets a high-privileged, network-connected database account hang or repeatedly crash the server, with CVSS 3.1 base score 4.9 (availability-only). Affected releases are MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1 and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Exploitation requires an authenticated session using a highly privileged account (PR:H) over MySQL's supported protocols, so the realistic threat is insiders or attackers who already hold privileged credentials; no public exploit code or confirmed active exploitation was identified at time of analysis.
Denial of service in Oracle MySQL Server and MySQL Cluster lets an attacker who already holds high-privilege database credentials hang or repeatedly crash the server through the Server: Optimizer component, reachable over the network via multiple protocols. Affected builds are MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. The CVSS 3.1 base score is 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H), reflecting availability-only impact with no disclosure or modification of data; no public exploit code or confirmed active exploitation was identified at time of analysis, and the PR:H prerequisite means realistic abuse comes from a malicious or compromised privileged account rather than anonymous external attackers.
Denial of service in Oracle MySQL Server and MySQL Cluster can be triggered by an authenticated, high-privileged attacker sending queries that exercise the Server: Optimizer component, resulting in a hang or repeatable crash of the database service. Affected releases include MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1. The CVSS 3.1 base score is 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H); the high-privilege prerequisite limits exposure to insiders or compromised accounts, and no public exploit has been identified at time of analysis.
A denial-of-service flaw in the Oracle MySQL Server Optimizer also affects MySQL Cluster, allowing a high-privileged attacker with network access to hang or repeatedly crash the server (CVSS 3.1 base 4.9, availability-only). Affected releases are MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1. Exploitation requires an authenticated session holding HIGH database privileges (CVSS PR:H), which sharply limits exposure; no public exploit code or confirmed active exploitation was identified at time of analysis.
Authenticated high-privileged users can crash or hang MySQL Server and MySQL Cluster 9.7.0-9.7.3 and 26.7.0-26.7.1 through malformed input handled by the Server: GIS component, causing a denial of service with no confidentiality or integrity impact. Exploitation requires network access and a privileged database account, so realistic risk is concentrated in trusted-insider or already-compromised-credential scenarios; no public exploit identified at time of analysis.
Denial of service in Oracle MySQL Server (8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1) and MySQL Cluster (8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1) allows a high-privileged, network-positioned attacker to hang or repeatedly crash the database service, but only on deployments running Group Replication, since the defect sits in the Server: Group Replication GCS component and standalone instances never reach the vulnerable code path. Oracle scores it CVSS 3.1 4.9 (AV:N/AC:L/PR:H/UI:N, availability-only), so the realistic threat is a privileged insider, a stolen administrative account, or a multi-tenant clustered environment rather than an anonymous internet attacker. No public exploit code or active exploitation was identified at time of analysis, keeping this a genuine but low-priority availability issue rather than an emergency.
High-privileged MySQL accounts can crash or hang the database engine through the Server: Clone Plugin component, giving a complete denial of service against MySQL Server and MySQL Cluster deployments. The flaw carries a CVSS 3.1 base score of 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H), meaning the attacker must already hold a high-privilege MySQL account and network reachability to the database, but once those preconditions are met the crash is low-complexity, requires no user interaction, and is easily repeatable. Affected builds are MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1; no public exploit identified at time of analysis. Realistic exposure is largely confined to insiders, compromised privileged accounts, or post-compromise lateral movement rather than anonymous internet attackers.