An out-of-bounds write in HarfBuzz 8.0.0 through 14.6.0 allows a crafted font containing an embedded WebAssembly module to write glyph-name bytes past the end of the module's linear memory and into host process memory, crashing or potentially corrupting the consuming application. The flaw only manifests in builds where the experimental WebAssembly shaping backend is compiled in (HAVE_WASM/WAMR support), which is disabled by default; the attacker must also precisely arrange the module's memory layout so the output buffer sits at the end of linear memory, and a victim must load and shape the malicious font. Per the available data there is confirmed active exploitation is not indicated and no public exploit code was identified at time of analysis; upstream fix code exists as a pull request but a tagged patched release was not independently confirmed, and the non-default build requirement plus the precise layout precondition keep practical risk below what the raw memory-corruption classification suggests.
Oracle E-Business Suite Applications DBA (AD Utilities) versions 12.2.3 through 12.2.15 can be taken over by a low-privileged attacker who already has local logon access to the infrastructure where the component runs and can induce a different person-typically an administrator or operator-to perform an action involving attacker-influenced input. Successful exploitation gives high confidentiality, integrity, and availability impact, and the CVSS 3.1 base score is 7.3 (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H). No public exploit code or confirmed active exploitation was identified at time of analysis, and the local vector plus required human interaction limit realistic exposure to insider or post-compromise scenarios.
Takeover of the Oracle E-Business Suite Applications DBA (AD Utilities) component is achievable by a low-privileged attacker who already holds a logon on the application-tier host running those utilities, in supported versions 12.2.3 through 12.2.15. The attacker cannot reach the flaw remotely or unauthenticated (AV:L/PR:L), and successful exploitation additionally depends on a different, higher-privileged person performing an action - typically a DBA or operator running an affected AD Utilities operation against attacker-influenced input (UI:R). Oracle rates the impact on confidentiality, integrity and availability as high (CVSS 3.1 base 7.3); no public exploit code or confirmed active exploitation was identified at time of analysis, and the practical risk is gated by shared access to the application tier and by privileged-operator behavior rather than being a drop-everything emergency.
High-privileged attackers with network access to the Oracle Mobile Field Service Admin UI can fully compromise the component - reading and altering data and disrupting availability - across Oracle E-Business Suite versions 12.2.3 through 12.2.15. Exploitation requires an already-authenticated administrative account (CVSS PR:H) and HTTPS access, but no user interaction and low attack complexity, so the practical threat is primarily from malicious insiders or attackers who have first stolen admin credentials. No public exploit code has been identified and the issue is not in CISA KEV; Oracle addressed it in the October 2026 Critical Patch Update.
Takeover of Oracle iSetup within Oracle E-Business Suite 12.2.3 through 12.2.15 is possible for an attacker who already holds high application privileges and can reach the iSetup web interface over HTTP. The issue is rated CVSS 7.2 with high confidentiality, integrity, and availability impact, but the PR:H precondition substantially narrows the realistic attacker population. No public exploit code or confirmed active exploitation is identified in the available data.
Takeover of Oracle EDI Gateway in Oracle E-Business Suite 12.2.3 through 12.2.15 is possible for high-privileged attackers who can reach the component over HTTP, with high confidentiality, integrity, and availability impact. The issue is network-reachable, low-complexity, and requires no user interaction, but the CVSS PR:H prerequisite means an attacker must already hold an administrative-level EDI Gateway account, so realistic risk is concentrated among malicious privileged insiders or attackers who have already obtained admin credentials. No public exploit code or confirmed active exploitation was identified at time of analysis.
High-privileged attackers with HTTP reachability to Oracle EDI Gateway in Oracle E-Business Suite 12.2.3 through 12.2.15 can fully take over the component, with high impact to confidentiality, integrity, and availability. Exploitation requires existing high application-level privileges (CVSS PR:H) and network access, so anonymous or low-privileged users cannot directly exploit it; realistic abuse is confined to privileged insiders or adversaries who already control a privileged EBS account. No public exploit code or CISA KEV entry is identified in the available intelligence at time of analysis.
IMAP command injection in Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 lets a remote authenticated attacker inject CRLF sequences into the _uid parameter of the mail/headers and mail/viewsource actions and execute arbitrary IMAP commands within their own webmail session. The flaw requires a valid Roundcube login (CVSS PR:L) and is exploitable in default configurations; it has high integrity impact but limited confidentiality impact, and no public exploit was identified at time of analysis. Vendor-released patches 1.6.20 and 1.7.5 address the 1.6 and 1.7 branches.
Oracle Siebel CRM Field Service (Smart Answer) versions 17.0 through 26.9 can be fully taken over by an authenticated, high-privileged attacker with HTTP access, with high confidentiality, integrity, and availability impact (CVSS 7.2). The vector requires existing high privileges (PR:H) and low complexity with no user interaction, so real-world exposure is concentrated in insider or post-compromise escalation scenarios rather than unauthenticated attacks. No CISA KEV confirmation and no public exploit identified at time of analysis.
Oracle Agile Product Lifecycle Management for Process 6.2.4 can be taken over through its Product Quality Management component by an attacker holding high-privilege credentials and network HTTP access. The CVSS 7.2 rating reflects high confidentiality, integrity, and availability impact, but the PR:H prerequisite confines practical exposure to malicious insiders or attackers who have already compromised a privileged account. No public exploit code or CISA KEV entry was identified at time of analysis, and Oracle addressed the issue in its October 2026 Critical Patch Update.
Oracle iProcurement's E-Content Manager Catalog component in Oracle E-Business Suite 12.2.3 through 12.2.15 exposes a high-privilege attack path: an authenticated attacker who already holds an elevated account can use HTTPS network access to take over the iProcurement application, with high confidentiality, integrity, and availability impact. CVSS 3.1 scores this 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), reflecting reliable exploitation once privileged credentials are obtained, with no user interaction required. No public exploit code or CISA KEV entry was identified in the provided intelligence, so the practical threat is a malicious or compromised privileged insider rather than an anonymous remote attacker.
Order Capture in Oracle E-Business Suite 12.2.3 through 12.2.15 can be taken over by a high-privileged attacker who already holds a valid EBS account and can reach the Internal Operations component over HTTP, yielding full confidentiality, integrity, and availability impact (CVSS 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Exploitation is straightforward once the privileged account exists - no user interaction is required and attack complexity is low - but the PR:H prerequisite means anonymous external attackers cannot reach the flaw, making this a conditional rather than top-tier risk. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, so the practical exposure depends on how widely privileged EBS accounts are distributed in the environment.
Takeover of Oracle Contract Lifecycle Management for Public Sector (the Award/PO component of Oracle E-Business Suite) is achievable by an attacker who already holds a high-privileged application account, with full loss of confidentiality, integrity and availability (CVSS 3.1 base 7.2). Only versions 12.2.3 through 12.2.15 are affected, and the attack is carried out over the network via HTTP with low complexity and no user interaction, so the practical barrier is the prerequisite of an existing highly privileged session rather than any technical obstacle. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, so risk is concentrated on privileged insiders, compromised administrator credentials, and environments where the CLM application is exposed to attackers who have already escalated.
Oracle Product Hub in Oracle E-Business Suite 12.2.3 through 12.2.15 can be fully taken over by an authenticated attacker who already holds high application privileges and can reach the Internal Operations component over HTTP. The flaw is rated CVSS 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), and the high-privilege prerequisite substantially limits realistic exposure to insiders, compromised privileged accounts, or post-authentication attack chains. No public exploit code or confirmed active exploitation was identified at time of analysis.
High-privilege users of Oracle MySQL Server and MySQL Cluster 26.7.0 through 26.7.1 can leverage a flaw in the Server: Optimizer component to take full control of the database instance, achieving complete compromise of confidentiality, integrity, and availability. The vulnerability is network-reachable and low-complexity (CVSS 3.1 base score 7.2, AV:N/AC:L/PR:H/UI:N), but is gated behind an existing administrative-level MySQL account, so realistic risk is concentrated in malicious-insider or post-credential-compromise scenarios rather than anonymous attack. No public exploit code or confirmed active exploitation was identified at time of analysis, and Oracle has published a Critical Patch Update advisory covering the fix.
Takeover of the Oracle EDI Gateway component in Oracle E-Business Suite 12.2.3 through 12.2.15 is possible for a high-privileged attacker who can reach the application over HTTP, with full confidentiality, integrity, and availability impact (CVSS 3.1 base 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). The critical qualifier is the PR:H prerequisite: the attacker must already hold an elevated EDI Gateway account, so this is not exploitable by unauthenticated or low-privileged users and realistic exposure is confined to trusted operators or adversaries who have already stolen such credentials. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied in the source data.
Any authenticated TYPO3 backend user can rewrite arbitrary page-record fields-including access permissions and configuration-when the AI Integration extension is active, because its backend write endpoint performs neither a permission check nor a field allowlist. The issue affects TYPO3 installations with typo3_ai_integration_extension installed and active and requires only a low-privileged backend session (CVSS 4.0 7.2 High; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L). No public exploit code or CISA KEV entry was identified at time of analysis.
High-privileged authenticated attackers can take over Oracle iProcurement 12.2.3 through 12.2.15 by sending crafted HTTP requests to the E-Content Manager Catalog component. The flaw is rated CVSS 7.2 with high confidentiality, integrity, and availability impact, but the PR:H vector means an attacker must already hold an elevated account on the E-Business Suite instance. No public exploit identified at time of analysis, and no KEV entry is provided.
Authenticated command injection in ArmorX Spam allows remote users with low-privilege accounts to submit crafted parameter input and cause malicious code to be uploaded to the server, with the assessed impact concentrated on integrity rather than confidentiality or availability. The CVSS 4.0 base score is 7.1 and the aligned CVSS 3.1 assessment is AV:N/AC:L/PR:L/UI:N/C:N/I:H/A:N, reflecting network reachability, low attack complexity, low privileges, and no user interaction. No public exploit identified at time of analysis, and no CISA KEV or EPSS data was provided; exposure depends on how broadly authenticated accounts are provisioned and whether the vulnerable interface is network-accessible.
High-privileged authenticated attackers can achieve unauthorized data manipulation and partial denial of service in Oracle Bills of Material (Oracle E-Business Suite 12.2.3-12.2.15) by exploiting a difficult-to-exploit flaw over HTTP, with scope change potentially affecting additional Oracle products. The vulnerability requires network access, high attack complexity (AC:H), and a high-privilege account (PR:H); no public exploit code or active exploitation has been identified at time of analysis. EPSS risk was not provided, but the CVSS 7.2 score reflects an integrity-heavy impact profile.
Unauthorized data modification and limited data disclosure in Oracle Helidon's helidon-grpc-server component affect versions 3.0.0 through 3.2.21, where unauthenticated HTTP/2 requests can update, insert, or delete some Helidon-accessible data and read a subset of it. The CVSS 3.1 base score is 7.2 with a scope change, meaning effects may extend to other products sharing the environment. No public exploit identified at time of analysis.
Cross-origin access controls in the helidon-cors component of Oracle Helidon 3.0.0 through 3.2.21 can be bypassed by unauthenticated remote attackers over HTTP, enabling limited unauthorized reads and inserts, updates, or deletes of Helidon-accessible data. Oracle rates the flaw 7.2 High (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N); the scope change means applications and downstream products relying on Helidon CORS may also be affected. No public exploit identified at time of analysis, and real-world CORS abuse may depend on an authenticated victim's browser being induced to make a cross-origin request, so confirm the practical prerequisites against the final Oracle advisory.
Heap-based buffer overflow in Raptor RDF Syntax Library 2.0.15 and 2.0.16 allows unauthenticated remote attackers to corrupt heap memory, crash applications, and potentially execute code by supplying Turtle, TriG, N-Triples, or N-Quads documents containing a literal language tag of 256 bytes or longer. Exploitation is not automatic: the target application or service must parse the attacker-supplied RDF document, consistent with UI:P/UI:R in the assessed vectors. No public exploit code was identified at time of analysis, and a vendor patch is available via upstream commit 361a803a72817ae771db2438277229e6541e1575; the provided data does not specify an exact fixed release version.
Authenticated, low-privileged users of Oracle Report Manager in Oracle E-Business Suite 12.2.3 through 12.2.15 can read all data reachable by the component and partially degrade its availability by sending HTTPS requests against the Internal Operations component. Oracle rates this 7.1 (C:H/I:N/A:L) with low attack complexity and no user interaction, so the practical barrier is the requirement for a valid EBS/Report Manager login rather than any technical complexity. No public exploit code or CISA KEV entry was identified at time of analysis, and the supplied data contains no EPSS score.
SQL injection in the Sgalinski Cookie Consent extension for TYPO3 allows authenticated backend users with access to the consent-history or statistics module to inject unvalidated sorting, grouping, and index options into a database query, enabling arbitrary database reads that can include backend and frontend password hashes. The issue is privilege-gated: it requires a backend account granted those specific module permissions and the review/statistics feature in use, and no public exploit code was identified at time of analysis.
Exposure of a configured OpenAI API key in TYPO3 10 and 11 backend pages allows any authenticated backend user, including low-privilege editors, to retrieve the credential and use it at the site operator's expense. The issue affects installations of the TYPO3 AI Integration extension that have an API key configured; default installs without a key and unauthenticated or frontend-only users are not exposed. No public exploit was identified at time of analysis, and no CISA KEV entry was provided.
Missing authorization in the JSON configuration import of the Sgalinski Cookie Consent extension for TYPO3 lets a non-administrator backend user who already has access to the module import settings that inject arbitrary scripts into the website frontend. The issue is CWE-862 and is scored 7.1, with the supplied vector requiring authenticated backend access (PR:L) and no user interaction. No public exploit or CISA KEV entry was identified at time of analysis.
Authenticated low-privileged users with HTTP access to the Interoperability SEC component of JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 can read critical application data beyond their intended authorization scope and trigger a partial denial of service, as addressed in Oracle's October 2026 Critical Patch Update. The CVSS 3.1 score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L) reflects high confidentiality impact and low availability impact, gated only by the need for a valid low-privilege account and reachable integration endpoints. No public exploit code or confirmed active exploitation (CISA KEV) was identified at the time of analysis, and the tag 'Authentication Bypass' indicates the weakness is an authorization/access-control gap rather than a pre-auth entry point.
Authenticated low-privilege attackers can read critical PeopleSoft Enterprise PeopleTools data and partially disrupt availability through the Portal component in versions 8.61 through 8.63. Exploitation requires network HTTP access and a valid low-privilege PeopleSoft account (PR:L), but no user interaction and low attack complexity make it straightforward once that foothold exists; there is no KEV confirmation or public exploit identified at time of analysis. The authentication prerequisite keeps this below top-tier priority, though risk is highest where the Portal is internet-exposed and low-privilege or self-service accounts are widely provisioned.
Authenticated low-privileged users can corrupt or delete critical data in Oracle Partner Management, a module of Oracle E-Business Suite, across versions 12.2.3 through 12.2.15 by sending crafted HTTP requests to the Internal Operations component. Successful exploitation yields high integrity impact plus a partial denial of service, while confidentiality is unaffected (CVSS 3.1 base 7.1, AV:N/AC:L/PR:L/UI:N). No public exploit code or confirmed active exploitation was identified at time of analysis, and Oracle addresses the flaw through its October 2026 Critical Patch Update, so this is a routine-but-important patch item rather than an emergency.
Oracle Partner Management, a module of Oracle E-Business Suite (versions 12.2.3 through 12.2.15), exposes an integrity and partial availability flaw in its Internal Operations component that a low-privileged authenticated user can reach over HTTPS. Successful exploitation lets that account create, delete, or modify critical Partner Management data and trigger a partial denial of service, with no user interaction and low attack complexity once a valid session is held. No public exploit code or CISA KEV entry was identified at time of analysis, so this is a credible mid-tier priority for EBS deployments rather than an emergency - the main gate is possession of valid low-privileged credentials.
Oracle Solaris 11.4 can be driven into a complete denial-of-service condition and made to expose a limited subset of accessible data by a low-privileged attacker who can reach the Services component over HTTP. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H) gives a 7.1 score: a valid low-privileged Solaris account is required, but no user interaction is needed and attack complexity is low, so exposure is greatest where low-level accounts are widely provisioned or the HTTP Services endpoint is reachable from untrusted networks. No public exploit identified at time of analysis, and there is no CISA KEV confirmation; this is a moderate-priority issue rather than a top-tier emergency, with Oracle's October 2026 Critical Patch Update as the fix reference.
Local file inclusion in ArmorX Spam allows remote attackers with a valid low-privilege authenticated session to traverse directories and cause PHP include/require statements to load files outside the intended path, exposing sensitive local data. The issue is network-reachable and low-complexity but requires authentication (PR:L); no public exploit identified at time of analysis, and no CISA KEV entry is present. The assessed impact is high confidentiality loss only, with no integrity or availability impact.
Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 allow a low-privileged attacker with HTTP access to the Fabric Layer to create, delete, or modify critical data and cause a partial denial of service. The CVSS 3.1 vector requires a valid low-privileged account (PR:L) but no user interaction, and confidentiality is not affected. No public exploit code or confirmed active exploitation was identified at time of analysis, so priority is driven by exposure of low-privilege SOA accounts and the HTTP interface.
An authenticated low-privileged user with HTTP network access to the Oracle Mobile Field Service Admin UI in Oracle E-Business Suite 12.2.3 through 12.2.15 can escalate beyond their intended permissions, gaining the ability to create, delete or modify critical data and to read a subset of otherwise restricted data (CVSS 3.1 base score 7.1, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N). The flaw is easy to trigger once an attacker holds any valid low-privilege EBS account, but that authentication prerequisite is the main limiting factor, and exposure is largely determined by whether the Admin UI is reachable from untrusted networks. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; Oracle addresses the issue through its Critical Patch Update of October 2026 (https://www.oracle.com/security-alerts/cpuoct2026.html), and EUVD (EUVD-2026-106067) corroborates the 12.2.3-12.2.15 affected range.
Authenticated low-privileged users can create, delete, or modify critical Oracle Sales Online data and read a subset of that data in Oracle E-Business Suite 12.2.3 through 12.2.15 via the Internal Operations component over HTTP. Rated CVSS 7.1 with high integrity and low confidentiality impact, this is a moderate-priority access-control weakness rather than a top-tier emergency; no public exploit was identified at time of analysis and it is not in CISA KEV. Exploitation requires a valid low-tier EBS account, so internet-facing deployments with broadly provisioned self-service users carry the widest realistic exposure.
Oracle Siebel CRM Deployment (Server Infrastructure component) versions 17.0 through 26.9 allow a low-privileged authenticated user with HTTP network access to read critical data and partially modify records they should not be able to touch, yielding a CVSS 3.1 score of 7.1 (C:H/I:L/A:N). The weakness is an authorization/access-control failure rather than an authentication bypass, so exploitation requires the attacker to already hold a valid low-privileged account; no user interaction is needed and attack complexity is low. No public exploit code or CISA KEV entry is associated with this CVE at time of analysis, so exposure is bounded by the number of provisioned accounts and whether the Siebel HTTP interface is reachable from untrusted networks.
Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 contain an improper access control weakness in the Fusion Middleware Fabric Layer that lets a low-privileged, network-positioned attacker read and partially modify data beyond their intended authorization. Exploitation is over HTTP, requires only a valid low-privilege account (PR:L) and no user interaction, yielding high confidentiality impact plus limited integrity impact for a CVSS 3.1 base score of 7.1 (High). No public exploit code or confirmed active exploitation was identified at time of analysis, though the low attack complexity and the prevalence of internet-facing SOA Suite consoles make exposed Fabric Layer endpoints an attractive target.
Oracle General Ledger 12.2.3 through 12.2.15 allows an authenticated low-privileged attacker with HTTP network access to create, delete, or modify critical ledger data, read a subset of data, and cause a hang or repeated crash. Exploitation is constrained by high attack complexity and the need for a valid E-Business Suite account, so it is not reliably repeatable against default deployments. No public exploit code or confirmed active exploitation was identified at time of analysis.
Oracle HCM Common Architecture, the shared framework layer within Oracle E-Business Suite 12.2.3 through 12.2.15, exposes an Internal Operations component reachable over HTTP that a low-privileged authenticated user can abuse to read and modify critical HCM data and to partially degrade service availability. The defect is rated CVSS 3.1 7.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L), with the High attack complexity reflecting a precondition or environmental state the attacker does not control, which keeps reliable exploitation difficult even though no victim interaction is needed. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; Oracle published the fix in its October 2026 Critical Patch Update, so priority is real but second-tier relative to unauthenticated, low-complexity flaws.
Oracle Solaris 11.4's Image Packaging System (IPS) can be induced to act on attacker-influenced package content delivered over HTTP, giving a network-positioned, unauthenticated attacker high confidentiality impact and limited integrity impact (CVSS 3.1: 7.1 High, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N). The attacker must either control or compromise the repository the host queries, or intercept cleartext HTTP package traffic, and exploitation still requires a Solaris operator to perform a package operation against that content - the UI:R condition is the decisive exposure limiter. Only Solaris 11.4 is listed as affected per Oracle's October 2026 CPU and ENISA EUVD; no public exploit code was identified in the provided intelligence at time of analysis.
Unauthenticated remote attackers can reach the Integration Broker component of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 over HTTP and, by persuading a legitimate user to open a crafted link or act on an attacker-supplied request, obtain unauthorized read access to critical PeopleTools data plus limited unauthorized insert/update/delete capability. The mandatory user-interaction prerequisite (CVSS UI:R) keeps the attack from being an interaction-free, automatable mass-exploitation vector, and the impact is bounded to confidentiality (HIGH) and integrity (LOW) with no availability effect, giving a CVSS 3.1 base score of 7.1. Exploitation status: no public exploit identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV).
Low-privileged authenticated users of Oracle Primavera Unifier 23.12.0 through 23.12.16 can create, delete, or modify critical Project Control data, and read a subset of application data, by sending HTTP requests to the Project Control component - no user interaction or special configuration is required. Scoring 7.1 on CVSS 3.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N), the practical barrier is obtaining a valid low-privilege account rather than defeating authentication, which bounds exposure to instances reachable over the network with loosely controlled account provisioning. No public exploit code was identified at time of analysis and the issue is not in CISA KEV; this is a genuine but mid-tier priority that warrants patching on the normal Oracle CPU cadence.
Authenticated low-privileged users can alter or delete critical data and read limited data in Oracle Commerce Platform 11.4.0 through its Dynamo Commerce Server HTTP interface. The assessed CVSS 7.1 vector shows low attack complexity and no user interaction, but exploitation requires a valid account (PR:L), so anonymous compromise is not supported by the available data. No public exploit code or CISA KEV entry is identified at time of analysis, making this a moderate-priority patching item rather than an emergency.
Takeover of the Siebel CRM Development component (Workflow) is achievable by a low-privileged authenticated attacker who can persuade a second user to interact with crafted Workflow content over HTTP; supported releases 25.12 through 26.9 are affected. Oracle rates this CVSS 3.1 base 7.1, but the vector (AC:H/PR:L/UI:R) stacks valid credentials, victim-driven social engineering, and high attack complexity, so it is a moderate-priority hardening item rather than an emergency. No public exploit code or active exploitation has been identified at time of analysis, and the issue is addressed through Oracle's Critical Patch Update program.
Unauthorized read of critical Oracle Purchasing data, plus limited insert/update/delete capability, is achievable by a low-privileged authenticated user of Oracle E-Business Suite 12.2.3 through 12.2.15 who can reach the Internal Operations component over HTTP and satisfy non-trivial preconditions (high attack complexity). Scope is changed, so a successful attack can ripple into other Oracle products sharing the EBS deployment rather than staying confined to Purchasing. No public exploit code has been identified at time of analysis and the issue is not known to be actively exploited, which keeps it a moderate-priority patching item worked through the normal Critical Patch Update cycle rather than an emergency.
Arbitrary file read in Dockhand before 1.0.46 lets authenticated non-admin users holding the stacks:edit permission read sensitive files such as /etc/shadow, /etc/passwd, .git/config credentials, and SSH keys through the path parameter of /api/system/files/content. The flaw is a CWE-863 authorization failure scored 7.1 (High) under CVSS 4.0, and exposure is limited by the requirement for a prior authenticated account with stacks:edit; reads are confined to files the Dockhand container process can access. No public exploit identified at time of analysis, and the vendor-released patch is version 1.0.46.
Unauthenticated attackers with access to the same layer-2 network segment as a MySQL Server or MySQL Cluster node running the Group Replication plugin can trigger a hang or frequently repeatable full crash (denial of service) and make limited unauthorized data changes, yielding a 7.1 CVSS score (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H). Exposure is narrow by design: the Group Replication plugin must be actively configured as part of a replication topology, which is not the default for standalone installations, and the attacker must sit on the adjacent broadcast domain or VLAN rather than reaching the host over the internet. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV; the practical risk is bounded far more by network adjacency and the non-default clustering configuration than by the raw score.
Oracle E-Business Suite releases 12.2.3 through 12.2.15 expose Installed Base records to any low-privileged application user who can reach the Data Provider UI component over HTTP, allowing broad reads of critical data plus limited unauthorized inserts, updates, and deletes (CVSS 3.1 base score 7.1, C:H/I:L/A:N). Exploitation requires only a valid EBS account (PR:L) and network reach to the module - no user interaction and no special conditions - so the practical exposure is highest where self-registered, partner, or contractor accounts exist or where the Installed Base UI is internet-facing. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, but Oracle CPU patches should be scheduled on a normal priority rather than deferred indefinitely, since the weakness is trivially triggerable once credentials are held.
Improper authorization in Oracle E-Business Suite iSupport (12.2.3 through 12.2.15) allows a low-privileged, authenticated user with HTTP network access to create, delete, or modify critical iSupport data and to read a limited subset of that data, yielding a CVSS 3.1 base score of 7.1 (C:L/I:H/A:N). Exploitation is considered easy (AC:L, UI:N) but is not pre-authentication: the attacker must already hold a valid low-privilege account, such as a registered self-service/customer user, despite the 'Authentication Bypass' tagging seen in intelligence feeds. No public exploit code or CISA KEV listing was identified at time of analysis, so this is a mid-to-high priority patching item rather than an emergency.