Unauthorized creation, deletion, or modification of critical Marketing data is possible in Oracle Siebel CRM 17.0 through 26.9 when a low-privileged attacker has local logon to the infrastructure hosting the Siebel Apps - Marketing component. The assessed vector is local-only and high-complexity, requires prior authentication, and causes integrity impact only, with no confidentiality or availability effect. No public exploit code or active exploitation was identified at time of analysis.
Local denial of service in Oracle Solaris 11.4 allows an authenticated low-privileged user with logon access to the host to cause a hang or frequently repeatable crash of the operating system by targeting the Services component. The issue is availability-only, requires local access and high attack complexity, and Oracle describes it as difficult to exploit; no public exploit code was identified at time of analysis. With a CVSS 3.1 base score of 4.7, it is most relevant to shared or multi-user Solaris systems exposed to untrusted local accounts.
Local low-privileged users on a host running Oracle Communications Billing and Revenue Management 15.x can exploit a high-complexity flaw in the Platform component to obtain unauthorized read access to confidential data managed by the application. Only deployments on 15.0.0.0.0, 15.0.1.0.0.0, 15.1.0.0.0 and 15.2.0.0.0 are affected, and the CVSS 3.1 score is 4.7 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N), with no integrity or availability impact. Exploitation requires an attacker to already hold a valid low-privileged logon to the underlying infrastructure and to satisfy conditions outside their direct control (AC:H); there is no public exploit identified at time of analysis and the issue is not in CISA KEV, so realistic exposure is largely limited to insiders or attackers who have already compromised the host.
Oracle Java SE (Libraries component) can be induced to improperly allow modification of critical or otherwise protected data, giving an attacker an integrity-only impact across JDK 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1 and 27, plus Oracle GraalVM for JDK 17.0.20.1 / 21.0.12.1 and GraalVM Enterprise Edition 21.3.19.1.1. Although the CVSS vector shows PR:N (no privileges required), exploitation is heavily constrained: the attacker must already have local logon access to the host running Java (AV:L), the attack is difficult to reproduce (AC:H), and it requires a user other than the attacker to interact with the malicious content (UI:R), yielding a 4.7 base score with no confidentiality or availability impact. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; real exposure is largely limited to deployments that execute untrusted code through Java APIs (for example a web service feeding data into the Libraries APIs) or legacy sandbox-dependent Java Web Start / applet scenarios. The third-party 'Authentication Bypass' tag should be treated with caution - the assessed vector describes a local, human-triggered integrity bug, not a remote authentication bypass.
The Python filelock library (versions 3.22.0 through 4.2.0) can admit two simultaneous lock holders because its SoftFileLock, MarkerSoftFileLock and SoftFileLease classes mishandle stale-marker breaking when the underlying filesystem recycles a freed inode number. A local attacker with write access to the lock directory who wins a narrow race - freeing their own marker after the stale read, while an honest contender creates a live successor on the reused inode whose modification time is not newer than the saved observation - can cause the honest holder's live marker to be deleted, producing a mutual-exclusion failure with integrity impact. Exploitation requires a local, authenticated account on a shared host, a filesystem that reuses inode numbers (ext4 is named in the advisory), and the non-default soft lock classes; attack complexity is high and no public exploit code was identified at time of analysis, and the issue is not in CISA KEV. The vendor-released patch is 4.2.1.
Denial-of-service in Apple operating systems prior to version 27 can be triggered by an attacker in physical proximity through an out-of-bounds write that corrupts memory. The flaw affects iOS and iPadOS, macOS Golden Gate, tvOS, visionOS, and watchOS, with impact limited to availability (CVSS 4.6, AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H); no code execution, data disclosure, or integrity loss is assessed. No public exploit was identified at time of analysis, and CISA SSVC rates exploitation as none and automatable as no.
Stored cross-site scripting in SolarWinds Observability Self-Hosted allows authenticated users to store malicious JavaScript that is later rendered and executed in the browsers of other authenticated users who visit the affected page. Exploitation requires a valid low-privileged account and a second user who interacts with the stored content, so impact is generally limited to session-level actions and data exposure, with greater risk when the victim holds administrative privileges. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has published the Orion Platform 2026.4 release update plus secure-configuration guidance.
Eclipse GUIX multi-line text view rendering can read one byte past the end of an application text buffer when the displayed string ends with a carriage return, and that over-read can cascade into an index overrun and a spurious text row. The issue is local and requires user interaction: an attacker must influence text rendered in a GUIX multi-line text view and a user must view that widget; impact is limited to low confidentiality and availability effects, with no public exploit identified at time of analysis. It is a low-to-moderate priority memory-safety bug in Eclipse ThreadX GUIX rather than a remotely triggerable or code-execution issue.
Symlink following in virtualenv's safe_delete() deletion-error handler (all versions prior to 21.14.9) lets a local attacker widen the permissions of a victim-owned file located outside the environment being created or removed. When removal of an entry inside a read-only directory fails, the handler reads mode bits with os.lstat() and then calls os.chmod() on the same path, which resolves symlinks - so a planted link causes S_IWUSR to be added to an out-of-scope target the victim owns and can chmod, provided that target starts out non-writable. Exploitation requires local access, a specific read-only-directory/symlink filesystem layout, a genuine deletion failure and the victim actually running virtualenv, so practical risk is low; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV.
Symlink-following file writes in virtualenv before 21.14.9 let a second, unprivileged local account redirect generated environment files outside the requested tree (CWE-59). When the destination contains a pre-planted dangling symlink or an extra hard link at paths such as pyvenv.cfg, activation scripts, .gitignore, CACHEDIR.TAG, import-hook .pth files, or bin/ interpreter files, virtualenv creation writes constrained generated text through the link with the invoking user's permissions, producing limited integrity and availability impact outside the environment. Exploitation requires local access, a separate hostile account able to write into the destination, and timing against the victim's creation run (CVSS 3.1 AV:L/AC:H/PR:L, base 4.5); no public exploit was identified at time of analysis and the issue is not in CISA KEV. Affected users should upgrade to 21.14.9.
Path traversal in PyPA virtualenv's seed-package cleanup lets a local, low-privileged attacker delete files outside the target environment when a destination directory is reused and already contains distribution metadata planted by another account. Affected are virtualenv releases prior to 21.14.9 that use the embedded app-data seeding path; during environment creation, PipInstall._uninstall_previous_version() trusts top_level.txt and RECORD entries and joins them to site-packages without verifying containment, so relative traversal, absolute paths, or symlinked parent directories reach outside the environment root. Impact is limited to integrity and availability of files the invoking user can already delete (assessed C:N/I:L/A:L), exploitation requires a prior foothold to plant the metadata and a re-run against the same destination, and fresh environments or creation with --clear never enter the vulnerable path; no public exploit code was identified at time of analysis and the issue is not in CISA KEV.
Symlink-following during environment creation in PyPA virtualenv versions prior to 21.14.9 allows a second local account to redirect writes into a pre-planted directory symlink (or Windows junction) so that interpreter creation, seed installation, and activation generation land outside the requested destination. Only the invoking user's own creation run is affected, the attacker must already control a local account and have planted the link where the executable, library, or package directory will be built, and arbitrary attacker-chosen bytes at the target are not established, which is why the assessed impact is limited (CVSS 4.5, AV:L/AC:H/PR:L). Default (non---clear) creation is the vulnerable path, since --clear wipes the planted tree first; no public exploit code was identified at time of analysis and the issue is not tied to confirmed active exploitation. Upgrade to 21.14.9 to close it.
Local, high-complexity data manipulation and partial denial of service in Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 (Porting component) requires an attacker to already hold logon access to the host running PeopleTools and to induce a non-attacker user to perform a triggering action. Successful exploitation yields low-level unauthorized read plus insert/update/delete access to a subset of PeopleTools data and a partial availability impact (CVSS 3.1 base 4.5, AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L). No public exploit code or confirmed active exploitation was identified in the supplied intelligence, and the local-access plus victim-interaction prerequisites keep real-world risk low to moderate.
A local low-privilege user on Oracle Solaris 11.4 can abuse a flaw in the X Window System component to read and modify a subset of system data and cause a partial denial of service. Exploitation requires an interactive logon to the affected host and is gated by high attack complexity, meaning success depends on winning a race or hitting a specific non-deterministic runtime state, and the impact stays capped at partial confidentiality, integrity, and availability loss with no privilege escalation. No public exploit code or confirmed active exploitation was identified at time of analysis, and the CVSS 3.1 base score of 4.5 reflects the significant practical barriers to abuse.
PeopleSoft PeopleTools 8.61 through 8.63 allows a low-privileged user with local logon access to the PeopleTools host to read and modify limited application data and cause a partial denial of service. Exploitation is rated difficult (CVSS 4.5, AV:L/AC:H/PR:L) and requires an established account plus local access, so risk is mainly from insiders or attackers already on the server. No public exploit was identified at time of analysis, and Oracle has published an October 2026 Critical Patch Update advisory covering the issue.
Local, low-privileged users with logon access to hosts running Oracle E-Business Suite Production Scheduling 12.2.3 through 12.2.15 can update, insert, or delete some Production Scheduling data, read a subset of that data, and cause a partial denial of service. The CVSS 3.1 score is 4.5 with AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L, meaning exploitation requires an existing local authenticated foothold and depends on high-complexity conditions outside the attacker's direct control. No public exploit was identified at time of analysis, EPSS was not provided, and there is no CISA KEV confirmation of active exploitation.
A difficult-to-exploit denial-of-service flaw in Oracle MySQL's Server: Replication component lets a high-privileged, network-connected database user hang or repeatedly crash MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1, as well as MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Because the CVSS vector requires PR:H credentials and high attack complexity (AC:H), only authenticated administrators or accounts with replication-level privileges can trigger it, and no confidentiality or integrity impact results - availability only, at a base score of 4.4. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied with the source data.
High-privileged database users can hang or repeatedly crash Oracle MySQL Server and MySQL Cluster by sending crafted requests over network-reachable protocols. The flaw affects MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1; exploitation requires high privileges and is rated difficult (AC:H), with impact limited to availability. No public exploit code or CISA KEV entry is identified at time of analysis, so priority is low except where untrusted or excessive high-privileged access exists.
Denial of service in Oracle MySQL Server and MySQL Cluster's RAPID (HeatWave analytics) component affects MySQL Server 9.7.0-9.7.3 and 26.7.0-26.7.1 and MySQL Cluster 9.7.0-9.7.3 and 26.7.0-26.7.1. A network-based attacker who already holds high database privileges can, under difficult-to-satisfy conditions, hang or repeatedly crash the server, causing complete availability loss while confidentiality and integrity remain unaffected. No public exploit code or active exploitation is identified in the provided intelligence, and the high privilege and high complexity prerequisites keep real-world priority low-to-moderate.
Denial of service in Oracle MySQL Server and MySQL Cluster 9.7.0-9.7.3 and 26.7.0-26.7.1 lets a high-privileged, network-positioned attacker trigger a hang or repeatable crash in the Server: Components Services component. The CVSS 3.1 score is 4.4 (AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H), reflecting availability-only impact and a demanding attack path that requires an existing high-privilege database account plus non-trivial timing or state conditions. No public exploit code or confirmed active exploitation was identified in the provided intelligence.
High-privileged database users can cause a hang or frequently repeatable crash in the InnoDB storage engine of affected MySQL Server and MySQL Cluster releases over network-reachable MySQL protocols. The issue is scored CVSS 4.4 with PR:H and AC:H, and impacts availability only; exploitation requires an already privileged account and Oracle describes it as difficult to exploit. No public exploit was identified at time of analysis.
High-privileged authenticated users with network access can cause a hang or repeatable crash of Oracle MySQL Server or MySQL Cluster through a flaw in the InnoDB component, resulting in complete denial of service while confidentiality and integrity remain unaffected. The issue affects MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1. Oracle rates exploitation as difficult (AC:H) and requiring high privileges (PR:H); no public exploit identified at time of analysis.
Authenticated high-privilege users with network access can trigger a hang or frequently repeatable crash in MySQL Server or MySQL Cluster through a flaw in the InnoDB component, causing a denial-of-service condition in affected 8.4.x, 9.7.x, and 26.7.x MySQL Server releases and in MySQL Cluster 8.0.x, 8.4.x, 9.7.x, and 26.7.x deployments. Exploitation is difficult because of high attack complexity, and the impact is limited to availability with no confidentiality or integrity effect. No public exploit code or CISA KEV entry is identified at time of analysis.
Confidentiality exposure in Oracle GoldenGate 23.4 through 23.26.2.0.0 allows a high-privileged, authenticated attacker with HTTP access to the Admin Client Executable to read critical data. Oracle rates exploitation as difficult (AC:H) and the vector is confidentiality-only, so practical risk is low and limited to insiders or holders of compromised privileged credentials; no public exploit was identified at time of analysis.
Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 exposes an insufficiently protected Panel Processor component that a low-privileged authenticated user can abuse over HTTP, but only with a high degree of timing/conditions (AC:H) and only if a separate victim user interacts with attacker-influenced panel content (UI:R). Successful exploitation yields limited read access plus partial ability to update, insert or delete PeopleSoft data, and because the scope is changed (S:C) the impact can extend to integrated downstream products; base CVSS 3.1 is 4.4, making this a medium-severity issue that ranks as a low real-world priority. There is no public exploit code identified at time of analysis and no confirmed active exploitation (CISA KEV).
PeopleSoft Enterprise PeopleTools 8.61 and 8.62 expose the Process Scheduler component to a low-privileged attacker with HTTP network access who can persuade a separate user to interact with crafted content, resulting in limited read and write access to PeopleTools data and possible impact on connected products through scope change. The assessed CVSS 3.1 vector is AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N for a base score of 4.4, so this is not an unauthenticated autonomous attack: it requires a valid low-privileged account, victim interaction, and high-complexity conditions. Supplied intelligence shows no CISA KEV active exploitation and no public exploit identified at time of analysis; Oracle's October 2026 CPU advisory is the vendor reference.
Sensitive data exposure in PeopleSoft Enterprise PeopleTools 8.61 through 8.63 allows a high-privileged attacker with local logon to the application-server host to read critical PeopleSoft data via the Application Server - JRE component. The CVSS 3.1 score is 4.4 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N), and no public exploit code or confirmed active exploitation is identified in the supplied intelligence.
Local authorization bypass in Apple macOS lets an app that already has admin privileges bypass entitlement checks and modify the System Keychain, affecting versions before macOS Sequoia 15.8 and macOS Tahoe 26.7. The flaw is local-only and requires high privileges (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N), so realistic risk is mainly post-compromise or malicious-admin tooling; EPSS is 0.15% (4th percentile), no public exploit or CISA KEV activity was identified, and Apple has released fixed versions.
Oracle Net Services in Oracle Database Server can be hung or repeatedly crashed by a high-privileged attacker who already has local logon access to the database host, resulting in a complete denial of service for that component. The issue affects Oracle Net Services in Oracle Database Server 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3 and scores CVSS 3.1 4.4, with availability-only impact. No public exploit has been identified at time of analysis, and the high local privilege prerequisite substantially limits real-world risk.
InnoDB in Oracle MySQL Server and MySQL Cluster can be forced into a hang or repeatable crash by a high-privileged attacker who already has logon access to the database host, producing a local denial-of-service condition. The affected releases are MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1. No public exploit has been identified at time of analysis, and the local attack vector plus high-privilege requirement makes this a low-to-moderate priority issue constrained to privileged insiders or already-compromised privileged accounts.
Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 contains a flaw in its LDAP component that lets a low-privileged user who already has a logon on the host where PeopleTools runs read, update, insert, or delete a limited subset of application data. The attack is local (AV:L), requires valid low-privileged credentials (PR:L), needs no user interaction, and yields only partial confidentiality and integrity impact with no availability effect, giving it a CVSS 3.1 base score of 4.4. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, so real-world priority is moderate-to-low and hinges on whether an attacker can first obtain local authenticated access to the PeopleTools server.
virtualenv 21.14.8 and 21.14.9 can leave a newly created Python environment pointing at temporary app-data seed packages that virtualenv deletes once environment creation finishes, so pip and other seeded packages effectively depend on a cache path the environment owner no longer controls. Reaching this state requires a non-default local configuration: symlink seeding must be turned on through the VIRTUALENV_SYMLINK_APP_DATA environment variable or a virtualenv.ini configuration file (the command-line --symlink-app-data flag is already suppressed for transient app-data), combined with transient app-data such as VIRTUALENV_OVERRIDE_APP_DATA pointing at an unusable cache. Impact is local only and needs an authenticated low-privileged account plus a specific setup and passive user interaction, which is why the score is only 4.4 (CVSS 4.0) and severity is low-to-moderate; no public exploit code was identified at time of analysis, and the flaw is fixed in 21.14.10.
virtualenv before 21.14.9 can propagate permissive filesystem modes from its app-data cache into newly created environments when the COPY seeder is used, allowing a local attacker with a separate account to alter and execute seeded package code such as pip/__init__.py as the environment owner. Exploitation requires a shared multi-user POSIX host, a cache already populated under a permissive umask, a traversable destination parent, and the victim later creating and running an environment; the attacker cannot force the earlier umask. No public exploit code or CISA KEV entry was identified at time of analysis.
PeopleSoft Enterprise FIN Inventory Brazil 9.1 allows a low-privileged user with local logon access to the infrastructure running the Inventory component to modify or delete some accessible inventory data and to cause a partial denial of service. The CVSS 3.1 score is 4.4 with a local attack vector, low privileges required, no user interaction, and only low integrity and availability impact; confidentiality is unaffected. No public exploit was identified at time of analysis, and this is not reported as confirmed actively exploited (CISA KEV).
Local tampering and partial denial of service against the Integration component of Oracle PeopleSoft Enterprise FIN Manufacturing Brazil 9.1 requires only a low-privileged authenticated logon on the host where the application runs. An attacker meeting that precondition can perform unauthorized insert, update, or delete operations on data reachable through the integration interfaces and degrade availability of the module, with no confidentiality impact (CVSS 3.1 base 4.4, AV:L/PR:L/UI:N). There is no public exploit identified at time of analysis and the flaw is not in CISA KEV; the mandatory local logon plus the narrow scope of a single Brazil localization release keeps this a low-to-moderate priority item.
PeopleSoft Enterprise FIN Product Configurator Brazil 9.1 permits a low-privileged user who already has local logon access to the host to tamper with some Product Configurator data and degrade availability, with no confidentiality impact (CVSS 4.4). The exposure is limited to sites running the Brazil localization of the FIN Product Configurator and requires both local access and pre-existing credentials, so there is no remote or unauthenticated path. No public exploit code has been identified and the flaw is not in CISA KEV; this is a low-to-moderate priority issue, not a high-urgency one.
Local low-privileged users who can log on to a host running PeopleSoft Enterprise FIN General Ledger Brazil 9.1 can tamper with General Ledger data and degrade service availability, with integrity and partial denial-of-service impact but no confidentiality exposure (CVSS 3.1 base score 4.4). The flaw is easily triggered once an attacker already holds valid credentials on the hosting infrastructure, since exploitation requires local access (AV:L) and low privileges (PR:L) with no user interaction; the Brazil-specific GL localization is a narrow deployment, which limits exposure. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the issue is addressed through Oracle's October 2026 Critical Patch Update.
Information disclosure in SolarWinds Patch Manager lets local users access sensitive data that can be used to escalate privileges on the host. The vendor CVSS vector requires local access and high privileges, but the independent assessment notes that a lower-privileged local account may be sufficient; because there is no remote vector, the issue is low-to-moderate priority. No public exploit identified at time of analysis and no CISA KEV entry is indicated in the provided data.
Authenticated low-privileged users can cause a partial denial of service in Oracle Identity Manager's Connector Framework by sending crafted HTTP requests to exposed OIM endpoints. The issue affects Oracle Fusion Middleware Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 and carries a CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L), meaning availability-only impact with no confidentiality or integrity loss. No public exploit was identified at time of analysis, and the authentication prerequisite keeps this a low-priority concern for most environments.
Partial denial of service in Oracle MySQL Connector/J 26.7.0 can occur when an application using the JDBC driver is induced to communicate with an attacker-controlled or attacker-influenced server endpoint over a supported protocol; the flaw is client-side and requires human interaction, with availability-only impact. The CVSS 3.1 score is 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L), and no public exploit code or CISA KEV entry was identified at time of analysis.
Cross-project information disclosure in the OpenStack Cinder Block Storage API (v3.3 'List messages' endpoint) lets any authenticated project-scoped user holding the 'member' or 'reader' role retrieve non-expired user messages that belong to other tenants, leaking resource UUIDs from across the deployment. Every Cinder release from 9.0.0 onward is affected out of the box (fixed in 26.3.1; 27.0.0, 28.0.0 and 29.0.0 remain vulnerable in the published affected range), and no non-default configuration is required to trigger it - the exposure window is simply bounded by message_ttl (default 30 days) and message_reap_interval (default 24 hours). Impact is confidentiality-only and moderate: the response does not carry project_id, so an attacker must independently correlate each leaked UUID to its owning project before it becomes actionable, and the accompanying message text is sanitized generic Action/Detail strings by design. No public exploit code or CISA KEV entry was identified at time of analysis.
Limited information disclosure in MySQL Router 26.7.0 allows a remote, unauthenticated attacker to read a subset of Router-accessible data, but only if a user other than the attacker is induced to interact with attacker-controlled HTTPS content (UI:R). The CVSS 3.1 score is 4.3, and no public exploit code or active exploitation has been identified at time of analysis, so this is a moderate-severity issue best handled in a normal patch cycle rather than as an emergency.
Low-privileged authenticated users of Oracle Agile Engineering Data Management 6.2.1 can read a limited subset of application data through the Engineering Communication Interface component over HTTP. The flaw carries a CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), meaning confidentiality-only impact with no ability to modify or disrupt the system, and exploitation requires a valid low-privileged account rather than anonymous access. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, making this a moderate, low-priority item relative to other Oracle Supply Chain fixes.
Authenticated low-privileged users with network reachability to MySQL Server or MySQL Cluster 9.7.0-9.7.3 and 26.7.0-26.7.1 can exploit a flaw in the Server: Connection Handling component to read a limited subset of data the account can already access. The issue is medium severity (CVSS 3.1 base 4.3, PR:L, confidentiality-only) and is not confirmed actively exploited (no CISA KEV listing); no public exploit identified at time of analysis. Because valid credentials are mandatory and impact is read-only, this is routine patching rather than an emergency.
Authenticated low-privileged users with HTTPS access to MySQL Router 26.7.0 can read a subset of the data the Router exposes, resulting in limited information disclosure rated CVSS 4.3 (confidentiality-only). The requirement for a pre-existing low-privilege credential (PR:L) is the key limiting factor and prevents anonymous remote exploitation, and there is no public exploit code identified at time of analysis. Risk is low-to-moderate and does not represent an urgent priority outside environments where Router management interfaces are broadly network-exposed.
Low-privileged authenticated users of Oracle Enterprise Manager Base Platform 13.5 and 24.1 can read a limited subset of platform data through the Metadata Plugin component exposed over HTTP (CVSS 3.1 score 4.3). Exploitation requires a valid low-privileged Enterprise Manager account and network reachability to the console, so this is not an unauthenticated attack, and impact is confined to confidentiality. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Moderate-severity information disclosure in Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 allows an authenticated low-privileged attacker with HTTP network access to the Portal component to read a limited subset of PeopleTools-accessible data. The CVSS 3.1 score is 4.3 with confidentiality-only impact and no user interaction, and exploitation is constrained by the need for a valid low-privileged session. No public exploit identified at time of analysis, and no CISA KEV entry was provided.
Oracle Essbase 21.8.3.0.0 contains a Security-component flaw that allows an authenticated low-privileged user with HTTP network access to cause a partial denial of service. The CVSS 3.1 score is 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L), so only availability is lightly affected and no confidentiality or integrity impact is possible; the required account is the main limiting factor. No public exploit code was identified at time of analysis, and no CISA KEV entry is present.
Oracle BI EE 26.01.0.0.0 permits a low-privileged authenticated attacker with HTTP access to the Visual Analyzer component to read a subset of accessible data, with no user interaction and low attack complexity. This is a confidentiality-only, moderate-to-low priority issue (CVSS 3.1 4.3) that requires a valid low-privileged session per PR:L, so it is not a pre-authentication bypass. No public exploit identified at time of analysis.
Oracle WebCenter Content: Imaging versions 12.2.1.4.0 and 14.1.2.0.0 contain a low-severity confidentiality flaw in the Core component exposed through SOAP. An attacker who already holds valid low-privileged credentials and can reach the SOAP interface can read a subset of Imaging data they should not access (CVSS 4.3), with no write or denial-of-service impact. No public exploit code has been identified at time of analysis.