Local takeover in Oracle Autonomous Health Framework 26.3 through 26.8 allows an authenticated low-privileged user with logon to the host to compromise the AHF Instant Diagnostic Replay component, with high confidentiality, integrity, and availability impact. Oracle rates this CVSS 3.1 at 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and the assessment emphasizes that it is local, not remotely exploitable, and requires a pre-existing host account. No public exploit identified at time of analysis.
A sandbox escape in Apple iOS and iPadOS (versions prior to 27) and macOS (versions prior to 27) allows a malicious app already running inside the app sandbox to break out of that containment by winning a timing-sensitive race condition that Apple's added validation is designed to close. The CVSS 3.1 base score of 7.8 (AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) reflects that the attacker must have local code execution as an installed app and must reliably win a narrow, non-deterministic race, but success grants high-confidentiality, high-integrity and high-availability impact beyond the sandbox boundary (scope change). No public exploit code or confirmed active exploitation is identified at time of analysis; Apple has released fixes in iOS 27, iPadOS 27, and macOS Golden Gate 27, so this is a high-priority patch-soon issue rather than an emergency.
Opening a crafted document through Oracle Outside In Technology 8.5.8 can let an unauthenticated local attacker seize control of the affected runtime, with high impact across confidentiality, integrity and availability (CVSS 3.1 score 7.8). Because the flaw sits in the Outside In Core parsing component, the practical attack path is delivery of a malicious file that a victim then opens or processes on the host - the attacker cannot trigger it remotely and must rely on user interaction. Only version 8.5.8 is listed as affected; no public exploit code or confirmed active exploitation was identified at time of analysis, and the vulnerability is addressed in Oracle's October 2026 Critical Patch Update.
Local attackers who can log on to the infrastructure hosting JD Edwards EnterpriseOne Tools can exploit a flaw in the Deployment SEC component to achieve full takeover of the product, but only if they can persuade another user to perform an action on attacker-controlled input. The vulnerability affects versions 9.2.0.0 through 9.2.26.5 and carries a CVSS 3.1 base score of 7.8 with high impacts to confidentiality, integrity, and availability. No public exploit code or active exploitation has been identified at time of analysis, and the required host access plus user interaction make this a high-severity but not opportunistic remote threat, favoring insider or post-compromise scenarios.
Takeover of JD Edwards EnterpriseOne Tools (Installation Security component, supported versions 9.2.0.0 through 9.2.26.5) is achievable by an attacker who already holds a logon on the host where the tooling executes, provided a second person - an operator or administrator - is tricked into a user-interaction step such as opening or processing attacker-supplied content. Successful exploitation yields high confidentiality, integrity and availability impact (CVSS 3.1 base 7.8, AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), but the combination of a local attack vector plus a mandatory human victim makes this a high-severity rather than high-urgency issue at this moment. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and no EPSS score was supplied with the source data.
Local attackers who already hold logon access to the host running Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 can achieve full takeover of the application through its Installation Security component, provided a legitimate operator is induced to perform an interactive step such as running an installer or configuration action. The 7.8 High CVSS 3.1 score (AV:L/AC:L/PR:N/UI:R) reflects high confidentiality, integrity and availability impact with no application-level credentials required, but the local-access and victim-interaction prerequisites confine realistic exploitation to insider or post-foothold scenarios rather than remote mass exploitation. No public exploit code and no CISA KEV entry were identified at time of analysis, so this sits well below network-facing criticals in prioritization.
Stormshield Network Security (SNS) can accept forged update and license files because a logic error in its signature verification routine bypasses authenticity checks. A local attacker must rely on user interaction: an administrator must obtain a malicious file from a source other than the official MyStormshield servers or not use SNS automatic verification, then apply it to the appliance. No public exploit was identified at time of analysis, and the risk is neutralized when updates and licenses are retrieved only from MyStormshield with automatic SNS verification enabled.
Local privilege escalation in Oracle Solaris 11.4 can let a low-privileged attacker with an existing logon compromise the host, with high confidentiality, integrity, and availability impact. The flaw is in the Utility component and has a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); no public exploit has been identified at time of analysis. Exposure is limited to systems where untrusted users can obtain local interactive access.
A high-severity local privilege escalation and takeover flaw exists in the Installation Security component of Oracle JD Edwards EnterpriseOne Tools (versions 9.2.0.0 through 9.2.26.5). An attacker who already holds interactive logon access to the host running EnterpriseOne Tools and low-level credentials can exploit the component to gain full control of the application, with complete confidentiality, integrity, and availability impact (CVSS 3.1 base 7.8, AV:L/PR:L/AC:L/UI:N). No public exploit code or confirmed active exploitation was identified at time of analysis, and the requirement for pre-existing local access plus valid credentials is the primary limiting factor on real-world risk.
Local privilege escalation in Oracle E-Business Suite's Application Object Library (DB Privileges component) allows a low-privileged user who can log on to the host where the library executes to take over the affected EBS instance, with high confidentiality, integrity, and availability impact (CVSS 3.1 base score 7.8). All supported releases from 12.2.3 through 12.2.15 are affected. No public exploit code or confirmed active exploitation was identified at time of analysis, and the local-plus-authenticated prerequisite confines realistic risk to insiders and post-compromise lateral movement rather than direct external attack.
Out-of-bounds heap write in Eclipse FileX allows an attacker who can supply a malformed FAT image to corrupt heap memory during fault-tolerant log replay, with the write position and value under attacker control. On embedded layouts where the FX_MEDIA driver callback is within reach, this can redirect the instruction pointer and yield code execution; the CVSS 3.1 score is 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting a local path that requires the victim to mount attacker-controlled media. No public exploit code or CISA KEV entry was identified at time of analysis, and practical exposure is limited to builds with FileX fault tolerance enabled that mount untrusted FAT images.
Low-privileged authenticated users of Oracle Essbase 21.8.3.0.0 can exploit the Security component over HTTP to obtain unauthorized access to critical data, potentially extending beyond Essbase because of a scope change. The assessed CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N: no user interaction is needed, but the attacker must already hold a valid low-privilege account and network access to the Essbase service. No public exploit was identified at time of analysis, and the 'Authentication Bypass' tag should not be read as allowing fully unauthenticated access given PR:L.
Oracle Essbase 21.8.3.0.0 exposes critical data to any holder of a valid low-privilege account, who can reach the Security component over HTTP and read information far beyond their intended authorization - up to all data the Essbase instance can access. The scope-change rating means the disclosure is not confined to Essbase itself and can extend into other connected Oracle products, making this an elevated-priority integrity-of-confidentiality issue rather than a CVSS-inflated one. Exploitation requires authenticated network access (CVSS PR:L, AV:N, AC:L, UI:N), so the practical barrier is obtaining or abusing a low-privilege account; no public exploit code has been identified at time of analysis and the flaw is not in CISA KEV.
Sensitive data exposure in Oracle E-Business Suite Integrated SOA Gateway 12.2.3 through 12.2.15 allows a low-privileged authenticated remote attacker to read critical data accessible through the SOA Provider component, with a scope change that can affect additional products. The issue is rated CVSS 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) and is easily exploitable once the gateway is deployed and reachable over HTTP. No public exploit code or confirmed active exploitation was identified in the provided intelligence at time of analysis.
Authenticated low-privileged users of Oracle E-Business Suite can read critical Oracle Capacity data-and potentially data in other linked EBS products-through HTTP requests to the Internal Operations component in versions 12.2.3 through 12.2.15. Exploitation is low-complexity and needs no user interaction, but it requires a valid EBS account (PR:L) and network access; no public exploit identified at time of analysis, making this a mid-to-high priority issue rather than an emergency.
Authenticated low-privilege users can read critical Oracle Capacity data-and, because of a scope change, potentially data from other Oracle E-Business Suite products on the same deployment-in Oracle Capacity 12.2.3 through 12.2.15. The flaw is remotely reachable over HTTP with low attack complexity and no user interaction, but it is not unauthenticated: the attacker must already hold valid EBS credentials. No public exploit code is identified in the supplied intelligence at time of analysis, and the CVSS 3.1 score is 7.7 with confidentiality-only impact.
Oracle Trusted Answer Search 26.1 exposes an information-disclosure flaw in its Application expert UI component that lets an attacker with an existing low-privilege account reach critical data over HTTP without any user interaction. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, base 7.7) confirms the attack is network-reachable and low-complexity, but it is not pre-authentication: a valid low-privileged login is the primary barrier, notwithstanding the 'Authentication Bypass' tag applied by the reporter. Because of the scope change (S:C), a successful exploit can expose confidential data belonging to other Oracle products reachable from the same deployment, so the blast radius is larger than the search component alone; no public exploit code or confirmed active exploitation was identified at time of analysis.
Oracle REST Data Services (ORDS) versions 24.2.0 through 26.2.2 expose a confidentiality-only flaw in the Core component that lets a low-privileged, network-positioned user read data well beyond their intended authorization boundary. Because the CVSS vector carries a scope change (S:C) alongside high confidentiality impact, an attacker with valid low-level ORDS credentials can reach critical data and potentially affect other Oracle products reachable through the same deployment, though integrity and availability are untouched and exploitation requires an existing account (PR:L) rather than being fully unauthenticated despite the 'Authentication Bypass' tag. No public exploit code or CISA KEV confirmation was available at time of analysis, and the primary reference is Oracle's October 2026 Critical Patch Update advisory. Note that the 7.7 score reflects confidentiality exposure only; the practical risk is meaningful but not a drop-everything emergency.
Oracle Database Server's RDBMS component (versions 23.4.0 through 23.26.3) lets a low-privileged database account holding the near-universal Create Session privilege read critical data - potentially all RDBMS-accessible data - over Oracle Net, and the scope-change rating means the impact can extend to other Oracle products sharing the instance. Oracle's October 2026 Critical Patch Update is the referenced fix; no public exploit code or CISA KEV entry was identified at time of analysis, and the CVSS 7.7 score reflects a confidentiality-only impact (C:H/I:N/A:N) that requires an authenticated session (PR:L).
Oracle Project Contracts versions 12.2.3 through 12.2.15 expose critical data to any user holding a valid low-privileged E-Business Suite account, because the Internal Operations component fails to adequately restrict what that account can read over HTTP. Successful exploitation gives high-confidentiality read access to Project Contracts data and, due to a scope change in the assessed vector, can extend to data in other Oracle products reachable from the same suite; integrity and availability are unaffected. Exploitation requires authentication (CVSS PR:L) and no user interaction, making it low-complexity for an insider or anyone who has obtained a mundane EBS credential - no public exploit code and no confirmed active exploitation were identified at time of analysis, and Oracle addresses the flaw through its October 2026 Critical Patch Update.
Path-validation bypass in launch-editor before 2.14.2 on Windows allows unauthenticated remote attackers to pass a crafted file:line:column argument that resolves to an existing parent directory and slips past the library's filename-existence check. The bypass does not by itself execute code; it becomes an OS command injection risk only when chained with the separately described Windows percent-expansion flaw, and exploitation requires user interaction plus a reachable launch-editor-middleware endpoint such as a Vite dev server. No public exploit was identified at time of analysis, and the issue is fixed in 2.14.2.
Oracle Common Applications 12.2.3 through 12.2.15 contains a Role Summary flaw that a high-privileged, authenticated attacker with HTTP network access can exploit to gain unauthorized read and write access to critical data, with scope change extending impact to additional Oracle products. Oracle rates exploitation as difficult (AC:H), and success depends on conditions beyond the attacker's control; no public exploit identified at time of analysis.
Low-privileged authenticated users of Oracle Essbase 21.8.3.0.0 can reach beyond their assigned privilege boundary through the Security component over HTTP and read critical data they should not be able to see, including data exposed in downstream products because the vulnerability crosses a security scope boundary. Oracle scores this 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N): confidentiality-only, with no integrity or availability impact, and exploitation requires a valid low-privileged account rather than being unauthenticated. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, so risk is concentrated in internet- or network-reachable Essbase deployments where low-level credentials are broadly distributed.
Oracle Essbase 21.8.3.0.0 contains a confidentiality flaw in its Security component that lets a low-privileged, authenticated attacker reach critical data over the HTTP interface, with CVSS 3.1 scoring it 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N). Because the scope is changed, the exposure can extend past the Essbase instance to products wired into it, so stolen data may include far more than the attacker's own account should see. Our assessment rates this a genuine mid-tier priority rather than an emergency: the deciding constraint is that a valid low-privilege Essbase account is required, so no public exploit code or confirmed active exploitation was identified at time of analysis.
Credential theft in multi-tenant Red Hat StreamsHub Console for Apache Kafka and Streams for Apache Kafka 2/3 deployments is possible because the operator trusts a namespace field supplied in a Console custom resource. An authenticated tenant with permission to create Console CRs (PR:L) can point spec.kafkaClusters[].credentials.kafkaUser.namespace at a victim namespace, causing the cluster-wide-privileged operator to read that namespace’s KafkaUser Secret-SASL credentials or TLS private keys-and write the plaintext into a Secret in the attacker’s namespace. CVSS 3.1 scores this 7.7 with scope changed and high confidentiality impact; no public exploit identified at time of analysis, so risk is concentrated in multi-tenant clusters where untrusted users can create Console resources.
Authenticated low-privileged users of Oracle Product Hub 12.2.3 through 12.2.15 can abuse the Item Catalog component over HTTP to obtain broad unauthorized read access to critical Product Hub data, limited insert/update/delete capabilities, and a partial denial of service, with the scope change extending impact into other Oracle E-Business Suite products. The CVSS 3.1 base score is 7.7 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L), but the high attack complexity means exploitation depends on conditions outside the attacker's control and is difficult to carry out reliably. No public exploit code has been identified and there is no confirmation of active exploitation (no CISA KEV listing) at time of analysis. An EPSS score was not provided, so no probabilistic exploitation estimate can be cited.
Authenticated denial-of-service with limited data disclosure and modification in Oracle Shipping Execution affects Oracle E-Business Suite deployments running 12.2.3 through 12.2.15. A low-privileged attacker holding a valid EBS account can reach the Workflow Events component over HTTP and, only when specific non-default conditions line up (AC:H), hang or repeatedly crash the Shipping Execution module while reading and modifying a subset of its data; the scope-change flag means integrated EBS products can also be impacted. CVSS 3.1 scores this 7.7 with availability as the dominant impact, and while the flaw is difficult to exploit, no public exploit code or confirmed active exploitation (no CISA KEV listing) has been identified at time of analysis.
Oracle Essbase 21.8.3.0.0 exposes critical data through its Build component to an authenticated low-privileged attacker with HTTP network access. The flaw is easily exploitable (AC:L, no user interaction), can cross a scope boundary to affect additional products, and has a high confidentiality impact with no integrity or availability effect. No public exploit code or CISA KEV entry was identified at time of analysis, so this is a mid-tier priority rather than an emergency.
Cross-client message leakage in the MCP TypeScript server SDK (@modelcontextprotocol/server 2.0.0 through 2.2.0) lets unauthenticated remote clients that share an HTTP endpoint receive another client's JSON-RPC responses and notifications, because the transport correlates replies to a connection by JSON-RPC `id` alone while SDK clients routinely number requests from 0 and produce colliding ids. Exposure requires a specific deployment pattern: a stateless Streamable HTTP transport (sessionIdGenerator undefined) reused across requests, or a single McpServer/Server instance shared across requests or sessions - exactly the pattern the pre-fix README examples for the hono, express, fastify and node middleware packages demonstrated. Stdio servers, createMcpHandler() with a per-call server factory, and @modelcontextprotocol/sdk 1.26.0+ are not affected; the issue is rated 7.7 (AV:N/AC:H/PR:N/UI:N) and no public exploit code has been identified at time of analysis.
Memory-exhaustion denial of service in Apache CouchDB 3.5.2 and earlier allows any unauthenticated remote client to crash or hang the database by submitting a gzip-encoded HTTP request body that chttpd decompresses without any upper size bound. Impact is limited to availability - no data disclosure or modification - and the only practical prerequisite is network reachability of the CouchDB HTTP interface (typically 5984/6984), with no account, privileges, or victim interaction required. No public exploit code or confirmed active exploitation was identified at time of analysis; Apache has released CouchDB 3.5.3 to fix the issue, and instances sitting behind a proxy or WAF that caps request body size are substantially less exposed.
Path traversal in uTox through 0.18.1 lets an already-accepted Tox friend write files to arbitrary locations on a victim's machine when the non-default auto-accept file-transfer option is enabled, by sending a filename that is an absolute path or contains ../ sequences. The unsafe name is passed straight to native_autoselect_dir_ft() in src/utox.c without validation, so an attacker can overwrite shell startup files or plant crafted .ftinfo resume records that ft_find_resumeable() later parses, ultimately abusing FILE pointers to write /proc/self/mem and achieve code execution. Exploitation is gated by two preconditions - the sender must be a trusted contact and auto-accept must be turned on - matching the AT:P attack requirement in the 7.7 High CVSS 4.0 vector; no public exploit code and no confirmed active exploitation were identified at time of analysis, and vendor fixes are available via pull requests 1602 and 1603.
Authenticated low-privileged users can compromise Oracle Report Manager in Oracle E-Business Suite versions 12.2.3 through 12.2.15 over HTTPS, gaining high confidentiality impact plus limited integrity and availability impact (CVSS 7.6). The flaw is in the Internal Operations component and requires only a valid low-tier account, low attack complexity, and no user interaction; no public exploit code was identified at time of analysis.
Oracle Shipping Execution, a module of Oracle E-Business Suite, exposes an Internal Operations component that permits a low-privileged authenticated user with HTTP access to read, modify, and partially disrupt shipping data across supported releases 12.2.3 through 12.2.15. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/C:H/I:L/A:L, 7.6) reflects a high confidentiality impact with limited integrity and availability effects, and no public exploit code or confirmed active exploitation was identified at time of analysis. The main barrier to abuse is the requirement for a valid low-privilege EBS session (PR:L), so exposure is greatest where the EBS web tier is broadly reachable or where low-privilege accounts are easy to obtain.
Authenticated users of Oracle E-Business Suite's Capacity module (component: Internal Operations) in versions 12.2.3 through 12.2.15 can exploit this flaw over HTTP with low attack complexity and no user interaction to read critical Capacity data, perform limited unauthorized inserts/updates/deletes, and cause a partial denial of service within that module. The CVSS 3.1 score is 7.6 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L, meaning the attacker must already hold a valid low-privileged EBS account, but no further privilege escalation or victim interaction is required. Oracle addresses it through its Critical Patch Update program; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and scope is unchanged so the compromise does not extend beyond Capacity-accessible data.
Oracle Capacity in Oracle E-Business Suite 12.2.3 through 12.2.15 lets a low-privileged authenticated user read critical data, make limited unauthorized data changes, and cause partial denial of service through crafted HTTP requests to the Internal Operations component. No public exploit was identified at time of analysis, and this is not an anonymous authentication bypass despite the supplied tag; the PR:L vector means attackers need valid EBS credentials. The practical risk is therefore highest for insider threats or attackers who have already compromised a low-privileged EBS account.
Oracle E-Business Suite Assets 12.2.3 through 12.2.15 exposes a low-privileged, authenticated attacker with HTTP access to the Internal Operations component to cause a hang or repeatable crash (complete denial of service) while also reading a subset of Assets data and modifying, inserting, or deleting some of it. With a CVSS 3.1 base score of 7.6 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H), the flaw is easily triggered once valid credentials exist but is constrained by the authentication requirement and the Assets module scope. No public exploit code or CISA KEV entry was identified in the provided intelligence, so this is a genuine but moderate-priority issue rather than a confirmed actively exploited emergency.
Oracle Trusted Answer Search 26.1 contains a high-severity Application expert UI flaw (CVSS 7.6) that allows a low-privileged authenticated attacker to submit crafted content over HTTP; when another user views that content, the attacker can gain unauthorized read access to critical data and limited insert/update/delete access, with the impact crossing a scope boundary. The attack is gated by valid low-privileged credentials and required victim interaction, so broad opportunistic exploitation is less likely; no public exploit identified at time of analysis.
Unauthorized access to and modification of Installed Base data in Oracle E-Business Suite 12.2.3 through 12.2.15 is possible for a low-privileged authenticated attacker who convinces another user to interact with a crafted request over HTTP. The CVSS 3.1 score is 7.6 with scope change (S:C), high confidentiality impact, and low integrity impact, meaning connected Oracle products beyond Installed Base may also be affected. No public exploit was identified at time of analysis, and the assessed risk is to prioritize patching rather than treat as an emergency.
Unauthenticated network attackers can cause a hang or frequently repeatable crash of PeopleSoft PeopleTools 8.61-8.63 and obtain limited read and write access to accessible data by inducing a legitimate user to interact with a crafted HTTP-delivered page or link. Oracle rates the issue easily exploitable once that human interaction occurs, with a CVSS 3.1 score of 7.6. No public exploit identified at time of analysis, making this a credible but second-tier priority.
Credential disclosure in the A2A Java SDK Android HTTP client versions 1.3.0.Final and 1.3.1.Final allows unauthenticated remote attackers to leak a configured API key or token to a different authority when a synchronous POST follows a cross-authority redirect. The root cause is a default followRedirects=true that overrides the disabled-redirect setting in AndroidA2AHttpClient.createConnection(), and AuthInterceptor-injected nonstandard headers (X-API-Key, API-Key, X-Auth-Token, X-Authentication) are retained by Android's repackaged OkHttp across redirects even though standard Authorization headers are stripped. No public exploit identified at time of analysis; the vendor-released patch is 1.3.2.Final, which sets the default to false.
Heap-based buffer overflow in the Advantech ADAM-3600 remote terminal unit allows a network-reachable attacker who already holds high-privilege authenticated access to the device to corrupt heap memory and potentially achieve arbitrary code execution. The CVSS 4.0 vector (AV:N/AC:H/PR:H/UI:N, high confidentiality/integrity/availability impact) and the independent CVSS 3.1 assessment agree this is a post-authentication flaw requiring privileged credentials plus non-trivial heap grooming or a specific input path, so exploitation is not a trivial pre-auth network takeover. No public exploit code or CISA KEV entry is present in the available intelligence, and exploitation has not been confirmed in the wild; exact vulnerable firmware ranges are not specified in the input and must be scoped from the Advantech security advisory.
Unauthenticated denial of service in ApostropheCMS versions prior to 4.33.0, where the Rich Text CSV conversion route stages multipart uploads in the system temporary directory before validating the file extension and fails to delete rejected files, allowing repeated large uploads to exhaust temp-disk capacity. Affected deployments are those with the default route network-reachable; no authentication is needed, only the ordinary public CSRF cookie issued to anonymous clients. Per the assessed vector (CVSS 3.1 AV:N/AC:L/PR:N/UI:N, availability-only impact), this is a genuine but moderate-severity availability issue rather than a top-tier emergency, since disruption requires sustained repeated uploads and depends on temp-partition size and co-tenancy; no public exploit code or CISA KEV active-exploitation status was identified at time of analysis.
Server-side request forgery in Bulwark Webmail before 1.9.2 lets unauthenticated remote attackers read internal HTTP or HTTPS responses-potentially including cloud metadata-by rebinding a caller-supplied hostname between the DNS validation step and the socket connection. The flaw affects the unauthenticated POST /api/fetch-ical endpoint and, in authenticated paths, JMAP login and TOTP token-exchange flows, and can return up to 10 MB of a loopback, private, link-local, or metadata response. No public exploit code or active exploitation has been identified at time of analysis; the vendor-released patch in 1.9.2 validates the resolved address inside the socket lookup and adds authentication to the iCal fetch endpoint.
Memory exhaustion in the Moov signedxml Go library (versions prior to 1.4.1) allows unauthenticated remote attackers to crash a service by submitting crafted XML that passes through exclusive canonicalization during ValidateReferences. Each nested element causes the library to copy the entire accumulated namespace map, so a modest document with deep nesting and many unused xmlns prefixes balloons to gigabytes of allocation and terminates the process. The flaw does not bypass signature verification and only affects availability; no public exploit code was identified at time of analysis, and the project shipped a fix in v1.4.1 that caps in-scope namespaces at 8192 and replaces whole-map copying with push/pop scope deltas.
Unauthenticated remote attackers who can reach the Siebel CRM Integration EAI HTTP interface can cause a hang or repeatedly crash the integration component, producing a complete denial of service against that service. All supported versions from 17.0 through 26.9 are affected, and the CVSS 3.1 score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), with impact limited to availability and no confidentiality or integrity effect. No public exploit code or confirmed active exploitation was identified at time of analysis, so realistic risk depends primarily on whether the EAI endpoint is exposed beyond trusted internal networks.
Unauthenticated remote attackers can crash or repeatedly hang Oracle MySQL Server and MySQL Cluster through network-accessible protocol interactions, causing a complete denial of service. Affected releases include MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1. CVSS 3.1 score is 7.5 with availability-only impact; no public exploit was identified at time of analysis, and Oracle's October 2026 Critical Patch Update advisory is the vendor patch reference.
Unauthenticated denial of service in Oracle Global Lifecycle Management NextGen OUI Framework (the NextGen Installer component) lets a remote attacker who can reach the product's HTTP endpoint hang or repeatedly crash it, wiping out availability of the installer/lifecycle-management service. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (base 7.5), so no credentials, user interaction, or special attacker-side setup are needed - the practical constraint is exposure, since installer endpoints are typically internal or short-lived rather than permanently internet-facing. There are no confidentiality or integrity impacts, so the flaw cannot be chained into data theft or code execution on its own; no public exploit code was identified at time of analysis, and no EPSS or CISA KEV signal was supplied. Affected releases are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 14.1.2.1.0 and 15.1.1.0.0.
Denial of service in the markdown-it Markdown parser (npm package markdown-it) affects versions 14.1.0 through 14.3.2 and 15.0.0 through 15.0.2, where a single link reference definition whose label or title is never closed causes quadratic-time parsing under default options. Unauthenticated remote attackers who can get attacker-controlled Markdown processed by the library can burn CPU proportional to the square of the input size - roughly 3.6 seconds at 200 KB, 18 seconds at 400 KB, and 74 seconds at 800 KB - with impact confined to availability (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5). Proof-of-concept code is published in the upstream advisory, and no active exploitation has been reported (not listed in CISA KEV); the vendor has released fixed versions 14.3.3 and 15.0.3.
Oracle Outside In Technology 8.5.8 (Outside In Clean Content SDK) can be driven into a hang or repeatable crash by a crafted document delivered over HTTP, giving remote unauthenticated attackers a complete denial of service against the affected parsing engine. The CVSS 3.1 score is 7.5 with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, so no credentials or user interaction are required, but the impact is confined to availability - no data disclosure or code execution results. Exploitation depends on a host application actually routing attacker-supplied files into the SDK's parsing path, so exposure is limited to deployments with document upload, conversion, content-cleaning, or inspection features; there is no CISA KEV listing, no public exploit code noted in the available data, and no EPSS score was supplied, so no active exploitation is confirmed at time of analysis.
Denial of service in Oracle Outside In Technology 8.5.8 allows unauthenticated remote attackers to hang or repeatedly crash the Outside In Clean Content SDK by supplying crafted documents over HTTP. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms a low-complexity network attack with availability-only impact, although real exposure depends on whether a host application exposes document ingestion to untrusted senders. No public exploit code or CISA KEV entry was provided at time of analysis.