Access-control bypass in Oracle Siebel CRM Deployment 17.0 through 26.9 allows an authenticated local low-privileged user on the Siebel host to read or modify critical data through the Server Infrastructure component. The CVSS 3.1 vector requires local access and a valid low-privileged logon (AV:L/PR:L/UI:N), with high confidentiality and integrity impact but no availability impact. No public exploit code or CISA KEV activity was identified at time of analysis, and EPSS was not supplied.
Oracle IDM Connector 12.2.1.4.0 and 14.1.2.1.0 contains a locally exploitable flaw in its Generic REST component that lets an attacker with an existing low-privileged logon on the connector host read, create, delete, or modify critical connector-accessible data (CVSS 3.1 base 7.1; C:H/I:H). The vector is AV:L/PR:L/UI:N, so exploitation is not remote or unauthenticated; the 'Authentication Bypass' tag is inconsistent with the PR:L requirement and should be verified against Oracle's advisory. No public exploit code or CISA KEV entry was identified at time of analysis.
Local low-privileged users with logon access to hosts running Oracle E-Business Suite Applications DBA 12.2.3 through 12.2.15 can abuse the AD Utilities component to read, create, delete, or modify critical application data. The assessed CVSS 3.1 score is 7.1 High with AV:L/PR:L/UI:N and high confidentiality and integrity impact, while availability is unaffected; exploitation requires an existing local account and no user interaction. No public exploit code or confirmed active exploitation was identified at time of analysis.
A local privilege-escalation weakness in the Enterprise Infrastructure SEC component of Oracle JD Edwards EnterpriseOne Tools (9.2.0.0 through 9.2.26.5) lets an attacker who already holds a valid low-privileged logon on the host where the Tools run read and modify critical application data, delivering a high confidentiality and integrity impact with no availability effect (CVSS 3.1 base 7.1). Because exploitation is local (AV:L) and requires authenticated low-privileged access (PR:L), it is primarily a post-compromise or insider-abuse risk rather than an internet-facing one; no public exploit code and no confirmed active exploitation were identified at time of analysis. The vendor notes the issue is easily exploitable once such access exists, so any shared or multi-tenant host running an unpatched Tools version should be treated as exposed to its own low-privileged users.
Caller-influenced prompt text in virtualenv's bash activation script prior to 21.14.9 can be re-expanded by bash as executable shell syntax, so a crafted --prompt value (or an environment name feeding it) can run arbitrary commands in the victim's shell when the environment is activated and the prompt is drawn. The flaw is local and interaction-dependent: the attacker must first supply the prompt string, the victim must source bin/activate under bash and cause a redraw, and bash must be in a state that re-expands PS1 (promptvars enabled, POSIX mode, or an older BASH_COMPAT level) - zsh and POSIX shells such as dash are not affected. The project shipped a fix in 21.14.9 via upstream PR #3418 and commit 5f48d711; there is no EPSS score, no CISA KEV listing, and no public exploit identified at time of analysis, and the CVSS 4.0 vector (7.1, AV:L/AC:H/AT:P/PR:N/UI:A) reflects that high preconditions bar.
A code injection flaw in PyPA virtualenv before 21.14.9 lets attacker-influenced non-ASCII characters in the xonsh prompt or environment destination path break out of a generated Python literal and inject statements into activate.xsh. Exploitation is highly conditional: it requires the xonsh shell, the script being read under a legacy multibyte codec such as GBK or Big5 via $XONSH_ENCODING, attacker control over the prompt or path data, and the victim actively sourcing the generated script, so realistic risk is moderate rather than urgent. The issue is fixed in 21.14.9, which writes prompt and path literals as ASCII escapes; no public exploit code was identified at time of analysis.
Oracle Identity Manager Connector (LDAP Gateway component) in versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged user who already has interactive logon to the connector host to read, create, delete, or modify all data reachable through the LDAP Gateway, per Oracle's October 2026 Critical Patch Update. The 7.1 score reflects high confidentiality and integrity impact with no availability impact (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), so exploitation is straightforward but strictly gated behind existing local access and low-level privileges, making this a bounded insider or post-compromise risk rather than a remote threat. No public exploit code and no confirmed active exploitation were identified at time of analysis.
filelock's SQLite-backed ReadWriteLock (versions 3.20.4 through 4.2.0) can be tricked into overwriting or unlinking the side files SQLite keeps next to a locked database, and - when a writable hot journal is also present - into writing attacker-chosen content into that database. This is a genuine but conditional local-privilege issue rather than a widespread remote threat: it requires an existing low-privileged local account with rename/write access in a non-sticky parent directory at or above the database path, and it is a timing-sensitive race that does not apply when every parent directory is owned by the locking account or root and is either non-group/other-writable or carries the sticky bit. No public exploit identified at time of analysis and no CISA KEV entry; vendor-released patch: 4.2.1.
Stored cross-site scripting in the Stormshield Network Security (SNS) captive/enrollment portal lets an attacker on the adjacent network submit a crafted user-creation request whose payload is persisted and later rendered in the administrator's management interface when the enrollment record is validated. No prior authentication is required to submit the request, but the payload stays dormant until an administrator manually opens and validates it, so successful exploitation depends on a privileged human action (UI:R) at high attack complexity (AC:H); script execution in the administrator's session can yield high confidentiality and integrity impact with scope change into the management UI. Exploitation also requires that the captive portal be enabled and configured to accept user self-enrollment requests. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor's CVSS 3.1 score of 7.1 (High) overstates practical urgency once the vector is decomposed.
Authenticated users with view-draft access can permanently break request handling across the entire ApostropheCMS Node.js process by sending a piece-type REST GET request whose `project` query contains an exclusion key such as `constructor.prototype.hasOwnProperty`. The malicious key reaches the SQLite, PostgreSQL, or multipostgres adapter's `unsetNestedField` helper, which walks the dotted path into `Object.prototype` and deletes a shared runtime method - surviving beyond the request and requiring a process restart to recover. Exploitation requires a logged-in account (every editing role has view-draft; guestApiAccess reduces this to any logged-in user) and a SQL-backed adapter with a matching document; installations on the default MongoDB adapter are not affected. No public exploit code or KEV-listed active exploitation was identified at time of analysis.
Authenticated users on Moodle instances running the Configurable Reports block before 5.3.0 can read restricted SQL reports containing user and grade data by supplying arbitrary report IDs to the block_configurable_reports_get_report_data web service. The CWE-863 authorization bypass occurs because a failed check_permissions call adds only a warning and still returns the full report table, so any valid logged-in account can access reports without the required permissions when Moodle web services are enabled. Exploitation requires a valid login but no elevated role, impact is read-only confidentiality loss, and no public exploit identified at time of analysis.
Heap-based out-of-bounds write in the Eclipse ThreadX GUIX binary resource (font) loader: a font page header declaring first_glyph greater than last_glyph underflows the glyph count (CWE-190), the count-times-record-size allocation multiply then wraps to a small value, and the load pass writes attacker-controlled glyph records past the end of the undersized buffer. Exploitation requires the target embedded application to load an attacker-supplied or tampered GUIX binary font resource - the assessed vector is local (AV:L) with high attack complexity and required user/application interaction - so realistic exposure is limited to devices that parse externally sourced or updatable GUIX resources rather than fixed build-time font assets; no public exploit code or confirmed active exploitation was identified at time of analysis. Successful corruption can yield code execution, data disclosure, or denial of service in the GUIX process context (CVSS 4.0 base 7.1).
Denial of service and limited data access in MySQL Cluster 26.7.0 and 26.7.1 can be triggered by an unauthenticated attacker with TCP network access to the Cluster: General component. A successful attack can hang or repeatedly crash the cluster (complete availability loss) and expose or modify a subset of cluster-accessible data, with CVSS 3.1 score 7.0. The high attack complexity and the typical deployment of MySQL Cluster on segmented internal networks reduce practical exposure; no public exploit was identified at time of analysis.
Unauthenticated HTTP requests into Oracle Helidon 4.0.0 through 4.5.5 and 27.0.0 can be shaped to create, delete, or modify critical application data through the helidon-common-mapper component, with secondary limited read access and a partial denial-of-service effect. Oracle scores it 7.0 with high attack complexity (AC:H), meaning the attacker must satisfy conditions outside their direct control before a crafted request succeeds, so this is a serious but not trivially repeatable flaw. No public exploit code identified at time of analysis, and no EPSS score was provided with the available data.
Oracle Java SE (8u503/8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, and 27), GraalVM for JDK 17.0.20.1/21.0.12.1, and GraalVM Enterprise Edition 21.3.19.1.1 contain a moderate-priority, difficult-to-exploit flaw in the 2D component that unauthenticated remote attackers can reach through APIs processing attacker-supplied data. Successful exploitation can repeatedly hang or crash the JVM (complete denial of service) and may allow limited unauthorized reads and updates of accessible data. No public exploit code or CISA KEV entry was identified at time of analysis; Oracle addresses the issue in its October 2026 Critical Patch Update.
Local privilege escalation in Oracle Applications DBA (the AD Utilities component of Oracle E-Business Suite) affects versions 12.2.3 through 12.2.15 and lets a low-privileged user who already holds an interactive logon on the database/application tier host elevate to full control of the Applications DBA tooling, with high confidentiality, integrity and availability impact (CVSS 3.1 base 7.0). Exploitation is gated: the vector is AV:L/AC:H/PR:L/UI:N, so the attacker must first obtain a local account on the infrastructure where AD Utilities runs and must satisfy conditions Oracle describes as 'difficult to exploit', making this primarily an insider or post-compromise escalation risk rather than an external attack path. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Local privilege escalation in Oracle E-Business Suite Applications DBA (AD Utilities) versions 12.2.3 through 12.2.15 allows an attacker who already has a low-privileged logon on the host to take over the Applications DBA component, with high confidentiality, integrity, and availability impact. Exploitation is rated difficult (AC:H) and requires authenticated local access (PR:L) with no user interaction; no public exploit identified at time of analysis.
Full compromise of Oracle PeopleSoft Enterprise PeopleTools 8.61-8.63 is achievable through its SQR reporting component, but only under narrow conditions: the attacker must already hold a logon account on the host where PeopleTools executes and must induce a different user to perform an action. Oracle scores this 7.0 High (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H), with high attack complexity and a human-interaction requirement that make it a moderate-priority issue rather than an urgent, mass-exploitation threat. No public exploit code or confirmed active exploitation was identified at time of analysis, and PR:N indicates that no PeopleSoft application authentication is needed once local host access has been obtained.
Local takeover of Oracle Application Testing Suite 13.3.0.1 via its OpenScript component allows an authenticated low-privileged user with logon access to the host to compromise the application, with high confidentiality, integrity, and availability impact. Exploitation is difficult (AC:H, described by Oracle as 'difficult to exploit') and requires local access plus a valid low-privileged account, making this a genuine-but-moderate-priority issue rather than a top-tier emergency. No public exploit code or CISA KEV entry was identified at time of analysis.
Local, low-privileged attackers with logon access to the host running Oracle Agile Engineering Data Management 6.2.1 can exploit the Engineering Communication Interface to achieve full takeover of the product, with high impact to confidentiality, integrity, and availability. Exploitation requires authenticated local access and high attack complexity, which limits reliability, and no public exploit code has been identified at time of analysis. This is a high-severity but non-remote issue confined to version 6.2.1.
Oracle Inventory Management 12.2.3 through 12.2.15 can be fully taken over by an authenticated low-privileged attacker who can log on locally to the infrastructure running Oracle E-Business Suite, through a high-complexity flaw in the Internal Operations component. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.0) reflects mandatory local access and conditions outside the attacker's control, so exploitation is difficult and Oracle labels it accordingly. No public exploit code or CISA KEV entry was identified in the supplied intelligence at time of analysis, and no EPSS score was provided.
Product takeover is possible in Oracle Payroll 12.2.3 through 12.2.15, where a low-privileged attacker who can log on locally to the infrastructure hosting the application can exploit a difficult-to-control condition to fully compromise Payroll confidentiality, integrity, and availability. The CVSS 3.1 score is 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), confirming authentication with low privileges is required and that the attack is not network-reachable. No public exploit code or confirmed active exploitation was identified at time of analysis.
Takeover of Oracle BI EE 12.2.1.4.0 is possible for an authenticated, low-privileged attacker who already has local logon to the infrastructure hosting the BI Foundation component, though high attack complexity makes reliable exploitation dependent on conditions beyond the attacker's control. The issue carries CVSS 3.1 base score 7.0 with full confidentiality, integrity, and availability impact, but it is not remotely or unauthenticated exploitable. No public exploit is identified at time of analysis, so risk is concentrated on hosts where semi-trusted users hold local accounts.
Stored cross-site scripting in Stormshield Network Security’s captive/enrollment portal allows an unauthenticated remote attacker to submit a certificate-creation request containing a persistent payload that executes when an administrator opens and validates the pending request. The flaw is rated CVSS 7.0 (High) by the vendor, while the independent assessment scores it AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N because exploitation depends on the portal being reachable and on administrator validation of the attacker’s specific request. No public exploit identified at time of analysis, and the provided intelligence does not confirm active exploitation (CISA KEV).
Integer overflow in the Eclipse ThreadX module manager lets a loaded module under-allocate an object-pool block and corrupt the adjacent byte-pool block. When a module calls txm_module_object_allocate with an object_size near ULONG_MAX, the manager's unchecked addition of its fixed 16-byte private header wraps, so the pool serves a block smaller than the header and the subsequent header write spills past its end into the neighbouring allocation. The issue is locally exploitable by a low-privileged attacker who already has code running inside a loaded module, affects only builds that compile in and use the ThreadX module subsystem, requires no user interaction, and no public exploit code was identified at time of analysis (no CISA KEV listing was provided).
CPU exhaustion in Perl Crypt::Age versions before 0.004 lets remote, unauthenticated attackers force repeated X25519 scalar multiplications by supplying age files with an unbounded number of recipient stanzas. Each 98-byte stanza costs one scalar multiplication, HKDF, and ChaCha20-Poly1305 open per configured identity during decrypt, decrypt_file, or decrypt_filehandle, and the header MAC cannot be checked until a successful unwrap. No public exploit code or CISA KEV entry is identified at time of analysis; impact is confined to availability (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/A:H), with the highest realistic risk in automated or service-side decryption of untrusted age files.
Denial of service in @angular/router versions 21.2.0 through 21.2.24 and 22.0.0 through 22.2.0 allows unauthenticated remote attackers to crash Node.js SSR workers by exhausting the V8 old-space heap. The signal-based RouterLink refactor introduced a computed _urlTree signal that pins each rendered link's UrlTree, and with queryParamsHandling 'merge' or 'preserve' every link copies the request's parsed query parameters, so heap retention scales with link count times parsed query-dictionary size and oversized query strings amplify consumption by orders of magnitude per in-flight request. No public exploit code or KEV entry was identified at time of analysis, and no CVSS or EPSS data was supplied; exploitation is further gated on SSR being enabled, long query strings reaching Node behind the edge proxy, and overlapping concurrent renders.
Crafted auxiliary outlet URL segments force @angular/router to build duplicate ActivatedRouteSnapshot trees during route recognition, exhausting the Node.js heap and terminating the SSR worker process. Only applications using on-demand Server-Side Rendering on Node.js/V8 with an empty-path route (path: "") or a named-outlet route are exposed; client-side SPAs and build-time prerendering are explicitly unaffected, and exploitation further depends on request lines reaching Node without an edge proxy rejecting parenthesized outlet groups and on worker heaps small enough to exhaust (roughly 128 MiB to 1 GiB containers or serverless instances). A single request or a small number of concurrent requests can trigger a fatal JavaScript heap out-of-memory crash, and when matched routes declare canMatch guards or resolvers even a short URL amplifies backend load; no public exploit code was identified at time of analysis and there is no CISA KEV confirmation of active exploitation.
Denial of service in Crass before 1.0.7 can be triggered when an application parses attacker-controlled CSS containing a scientific-notation number with an excessively large exponent, causing disproportionate CPU and memory consumption and possibly a crash. The library itself requires no authentication, user interaction, or special configuration once untrusted CSS reaches the parser, but exposure depends entirely on whether the consuming application exposes a CSS-parsing path to untrusted input; applications that only parse trusted or static CSS are not realistically exposed. No public exploit code, EPSS score, or CISA KEV listing was provided, so no public exploit identified at time of analysis and there is no confirmed active exploitation signal.