Information disclosure in the Kubernetes Operator component of Oracle TimesTen In-Memory Database (22.1 through 22.1.40.0 and 26.1 through 26.1.1.2.0) lets a low-privileged authenticated attacker who can reach the operator's HTTPS endpoint read a limited subset of data the database exposes. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3) confirms that valid low-level credentials are a hard prerequisite - this is not exploitable by fully unauthenticated remote users - and that there is no integrity or availability impact. No public exploit code or confirmed active exploitation was identified at time of analysis, so severity is driven by exposure of the operator endpoint rather than by an imminent attack campaign.
Oracle Report Manager, a component of Oracle E-Business Suite (Internal Operations), exposes a subset of its data to unauthorized reading by a low-privileged, authenticated user who can reach the application over HTTPS. Versions 12.2.3 through 12.2.15 are affected; no public exploit code or confirmed active exploitation was identified at the time of analysis, and the CVSS 3.1 score of 4.3 reflects confidentiality-only impact with no integrity or availability effect. Because exploitation requires valid low-privileged credentials (PR:L) and low attack complexity with no user interaction, the practical risk is concentrated in environments where many low-trust accounts exist or where account provisioning is loosely controlled.
Authenticated low-privileged users of Oracle Agile Product Lifecycle Management for Process 6.2.4 can read a subset of application data they should not be able to access through the Product Quality Management component over HTTP. The issue is network-reachable, requires only valid low-privilege credentials with no user interaction, and is limited to a confidentiality impact (CVSS 3.1 base 4.3, PR:L) with no integrity or availability effect. No public exploit code or confirmed active exploitation was identified at time of analysis, so this is a patch-management item rather than an emergency.
An authenticated, low-privileged user with HTTP access to the Report Distribution component of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 can read a subset of application data they are not authorized to see, yielding a confidentiality-only impact rated CVSS 3.1 4.3. The weakness is easy to trigger (AC:L, no user interaction) but requires valid low-privileged credentials (PR:L), which is the primary limiting factor. No public exploit code has been identified at time of analysis, and no EPSS or CISA KEV signal was supplied with the source data, so this is assessed as a moderate-severity, low-real-risk issue by current signals.
Low-privilege information disclosure in Oracle REST Data Services 24.2.0 through 26.1.0 allows an authenticated user with network HTTP access to the ADP component to read a subset of ORDS-accessible data beyond their intended authorization scope. The flaw is remotely reachable and requires no user interaction, but it is gated behind a valid low-privileged account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base score 4.3) and causes only confidentiality impact - no write, integrity, or availability effect. Exploitation status: no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; this is a moderate-severity exposure that matters most where ADP is enabled and low-privilege accounts are broadly issued.
Oracle MySQL Connector/J 26.7.0 mishandles data during client-side connection handling, allowing an attacker who controls or influences the JDBC server endpoint to force unauthorized insert, update or delete operations on some connector-accessible data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) shows no credentials are required and the path is network-reachable, but a person other than the attacker must initiate the connection, and confidentiality and availability are unaffected - keeping this a moderate-to-low real-world priority. No public exploit code or CISA KEV entry was identified at time of analysis.
Unauthorized read access to a subset of connector-accessible data in Oracle MySQL Connector/Net 26.7.0 can be triggered by an unauthenticated network attacker who convinces a victim to perform a connection action. The CVSS 3.1 base score is 4.3 with confidentiality-only impact (UI:R), and no public exploit identified at time of analysis, so real-world priority is low. Only version 26.7.0 is listed as affected in the supplied EUVD data.
Siebel CRM Marketing (Oracle Siebel CRM, component Siebel Apps - Marketing) versions 17.0 through 26.9 can be manipulated by an unauthenticated network attacker who convinces a victim to interact with crafted HTTP content, resulting in limited unauthorized update, insert, or delete access to Marketing data. The assessed CVSS 3.1 score is 4.3 with integrity-only impact (I:L) and no confidentiality or availability impact, and the user-interaction requirement (UI:R) confines realistic exploitation to social-engineering scenarios rather than autonomous mass exploitation. No public exploit identified at time of analysis, and no KEV or EPSS data was supplied.
Information disclosure in ApostropheCMS prior to 4.34.0 lets any authenticated user, including low-privileged editors, query the slugTaken API to learn whether a given slug exists across all document types and visibility levels, including private pages, drafts, and archived content. The endpoint returns only a boolean, so the exposure is limited to slug existence rather than document contents, giving a CVSS 3.1 score of 4.3; no public exploit code has been identified at time of analysis, and the issue is fixed in 4.34.0.
Oracle WebCenter Content 12.2.1.4.0 (Content Server component) permits an authenticated low-privileged attacker with HTTP network access to perform unauthorized update, insert, or delete operations against a subset of accessible data, with no confidentiality or availability impact. The flaw is low complexity and needs no user interaction, but exploitation requires a valid low-privileged account; no public exploit code or confirmed active exploitation was identified at time of analysis. This is a moderate-severity, low-priority issue rather than an urgent one.
Unauthorized data modification in Oracle REST Data Services 24.2.0 through 26.1.0 allows a low-privileged, authenticated attacker with HTTP network access to the ADP component to insert, update, or delete some ORDS-accessible data, with no confidentiality or availability impact. Although some source tags call this an authentication bypass, the authoritative CVSS vector requires PR:L, so exploitation requires an existing valid low-privilege account and cannot be performed by a fully unauthenticated attacker. No public exploit identified at time of analysis, and no KEV status is present in the supplied intelligence.
Oracle Siebel CRM's Marketing component (Siebel Apps - Marketing, supported versions 17.0 through 26.9) permits unauthenticated network attackers to perform unauthorized insert, update, or delete operations on a limited subset of Marketing-accessible data, provided the attacker first convinces a legitimate user to perform some interaction (CVSS 3.1 base 4.3, AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N). Confidentiality and availability are unaffected and the integrity impact is scored LOW, so the practical risk is low-to-moderate: the attack cannot succeed autonomously and depends entirely on victim participation, typically a crafted link or page reached over HTTP. No public exploit code was identified and there is no confirmed active exploitation (not in CISA KEV) at time of analysis. The issue is addressed through Oracle's October 2026 Critical Patch Update.
Partial denial of service in Oracle BI EE 12.2.1.4.0 is a low-priority, authenticated-only availability issue affecting the BI Foundation component. A low-privileged attacker who already holds an account and can reach the service over HTTP can degrade availability, but the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L, score 4.3) shows no confidentiality or integrity impact and no scope change. There is no public exploit identified at time of analysis and no CISA KEV confirmation in the supplied data.
A low-privileged authenticated user with network reachability to the JDENET service can degrade availability of Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5, producing a partial denial of service against the affected component (Business Logic Infra SEC). The issue scores CVSS 3.1 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L), so there is no confidentiality or integrity impact and no privilege escalation - only a limited availability effect against the tooling itself. There is no public exploit identified at time of analysis and no CISA KEV listing; this is a genuine but low-priority issue that requires prior authentication and is best handled through the scheduled Oracle Critical Patch Update cycle.
Broken access control in ApostropheCMS's pages REST API (all versions prior to 4.34.0) allows an authenticated editor-level user who knows a document _id to read the full content of admin-only pages and privileged fields via the getOne endpoint, which skips the viewRole and viewPermission enforcement that the getAll endpoint correctly applies. Exploitation requires an authenticated account with at least editor privileges plus knowledge of the target page's _id, giving a confidentiality-only impact (CVSS 4.3, AV:N/AC:L/PR:L/UI:N/C:L/I:N/A:N). No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (not in CISA KEV); the vendor-released patch is 4.34.0.
Authenticated low-privileged users can read a subset of Oracle Business Intelligence Enterprise Edition data they are not authorized to see in versions 8.2.0.0.0 and 26.01.0.0.0, through the Analytics Server component exposed over HTTP. The flaw is easily triggered once an attacker holds any valid low-privilege account (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3), and it grants no write, integrity, or availability impact. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, so real-world priority is moderate-to-low and driven mainly by the population of low-privilege accounts on internet- or partner-reachable BI deployments.
A low-privileged authenticated user with network access to the Majel Mobile Service component of Oracle Business Intelligence Enterprise Edition can read a subset of BI-accessible data without authorization, affecting versions 8.2.0.0.0 and 26.01.0.0.0. The flaw is easily triggered over HTTP with no user interaction and low attack complexity, but its impact is confined to partial confidentiality loss (CVSS 3.1 base score 4.3, AV:N/AC:L/PR:L/UI:N/C:L/I:N/A:N). No public exploit code or confirmed active exploitation was identified at time of analysis, and the practical risk is moderated by the requirement for a valid low-privileged account and the read-only nature of the exposure.
Oracle BI Publisher 12.2.1.4.0 allows a low-privileged authenticated attacker with HTTPS network access to read a limited subset of data exposed through the BI Platform Security component, rated CVSS 4.3. The issue is not anonymously exploitable because the assessed vector requires PR:L, and impact is limited to confidentiality with no write or availability effect. No public exploit code was identified at time of analysis, and the vendor advisory is Oracle's October 2026 Critical Patch Update.
Unauthenticated remote attackers can trick a logged-in Siebel CRM End User into an action that results in unauthorized insert, update, or delete of a limited subset of that user's accessible data in the Open UI component (versions 17.0 through 26.9). The attack is delivered over HTTP with low complexity, but requires victim interaction (UI:R) and affects only integrity - confidentiality and availability are untouched, keeping the CVSS 3.1 base score at 4.3. No public exploit code or confirmed active exploitation was identified at time of analysis, and the mandatory human-interaction prerequisite plus the narrowly scoped write-only impact make this a low-priority item relative to other Siebel issues.
Unauthenticated HTTP traffic against Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 can leak a limited subset of application data through the Web Runtime SEC component, but only if a victim is first persuaded to interact with attacker-controlled content (UI:R), so there is no self-contained server-side exploitation path. CVSS 3.1 scores it 4.3 with confidentiality-only impact (C:L) and no effect on integrity or availability. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and it is rated a genuinely low-priority issue despite the network-reachable, unauthenticated vector. Oracle addresses it in the October 2026 Critical Patch Update.
Post-authentication integrity tampering in Oracle Primavera P6 Enterprise Project Portfolio Management (Web Access component) allows a low-privileged user with ordinary HTTP/HTTPS reachability to update, insert, or delete data they should not be permitted to modify across the 21.12, 22.12, 23.12, 24.12, and 25.12 release trains. The flaw is low complexity with no user interaction required, but it is gated behind a valid low-tier account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base 4.3), so it is a post-login authorization gap rather than a remote unauthenticated compromise; confidentiality and availability are unaffected. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); metadata tags label it 'Authentication Bypass', but the assessed vector indicates the practical risk is unauthorized modification of project data by an already-authenticated low-privilege user.
Oracle Essbase 21.8.3.0.0 has a Security-component flaw that allows a low-privileged authenticated attacker with HTTP network access to read a limited subset of Essbase data; the only impacted dimension is confidentiality, giving CVSS 3.1 score 4.3. Exploitation is low-complexity and requires no user interaction, but it is not open to fully unauthenticated outsiders because a valid low-privileged account is needed. No public exploit code or confirmed active exploitation was identified at time of analysis, and the supplied advisory does not name any affected version other than 21.8.3.0.0.
An out-of-bounds read in Apple's image-handling code across iOS/iPadOS, macOS, tvOS, visionOS, and watchOS can cause unexpected process termination when a maliciously crafted image is processed. All platform releases prior to version 27 are affected; the flaw is fixed in iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27. Attackers must convince a victim to open, preview, or render the crafted image (CVSS UI:R, PR:N), and the impact is bounded to a crash (A:L only, C:N/I:N) - no public exploit code or active exploitation has been identified at time of analysis, and CISA SSVC rates exploitation as none and automatable as no, making this a low-priority availability issue.
Apple iOS, iPadOS, macOS, tvOS, visionOS, and watchOS before version 27 contain an out-of-bounds write in image handling that can terminate the affected app when it processes a maliciously crafted image. The flaw is remotely reachable without authentication but requires victim interaction to open, preview, or render the image, and the assessed impact is availability-only (CVSS 4.3, UI:R, A:L). No public exploit identified at time of analysis; EPSS is 0.15% (4th percentile), CISA SSVC exploitation is none, and vendor fixes are available in version 27.
Parsing a maliciously crafted binary in Apple Xcode prior to version 27 can terminate the IDE unexpectedly, giving an attacker who convinces a developer to open a booby-trapped file a denial-of-service primitive against the developer's workstation. The flaw is an input-validation weakness (CWE-20) in Xcode's binary-parsing path and requires user interaction - the victim must actively load the crafted artifact - with impact limited to application availability (A:L only, no confidentiality, integrity, or code-execution consequences). Independent signals agree on low priority: EPSS is 0.15% (3rd percentile), CISA SSVC records exploitation as none and automatable as no, there is no KEV listing, and no public exploit code has been identified at time of analysis. Note that the supplied base vector (AV:N) is more permissive than our assessed local attack vector (AV:L); the practical threat model is social engineering a developer into opening the file rather than a remotely reachable service.
Out-of-bounds read in Qt's qt5compat module can cause undefined behavior and application crash when QBinaryJson::fromBinaryData() processes a malformed binary JSON header. Only applications linked against the deprecated qt5compat compatibility module and explicitly using that legacy parser are exposed; a local, unauthenticated attacker must get a crafted file to the victim and the victim must open or process it. No public exploit identified at time of analysis, and the issue is assessed as low-to-moderate priority with availability impact only.
Out-of-bounds read in Adobe Acrobat for Edge can disclose sensitive memory contents when a user opens a maliciously crafted PDF or visits attacker-controlled web content in Microsoft Edge. Default Edge installations that use the Acrobat/PDF rendering component are affected; exploitation requires user interaction (UI:R) and no privileges (PR:N), but impact is limited to confidentiality (C:L) with a CVSS base score of 4.3. No public exploit identified at time of analysis.
An authenticated server-side request forgery (CWE-918) exists in ApostropheCMS's @apostrophecms/ai-helper package versions 1.0.0-beta.10 through 1.0.0-beta.12, fixed in 1.0.0-beta.13. An editor holding image-generation capability can persist a base64 AI image record that has no stored provider URL, then send a PATCH accept request with an attacker-chosen Host header; because the deployment has no configured global base URL, the server derives the fetch origin from that header and issues an outbound GET to an attacker-selected host, port, and HTTP origin. Impact is bounded - the request path is fixed to the uploads directory, and stored-provider or absolute-storage configurations are unaffected - yielding a modest CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) rating; no public exploit code or active exploitation was identified at time of analysis.
ApostropheCMS versions prior to 4.33.0 expose an exist-in-locale API that answers localized existence checks without applying document-level view or edit authorization, letting an authenticated low-privilege user confirm whether restricted or draft-mode documents exist in a given locale and obtain their localized identifiers. Exploitation requires a valid low-privilege account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) and works against default configurations, but only discloses existence metadata - not document content - and cannot modify or delete anything, so this is a genuine but low-priority issue. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; the vendor-released patch is version 4.33.0.
ApostropheCMS before 4.33.0 enables an authenticated editor to alter sibling page ordering under a restricted parent without create authorization on that parent, but only when the nested arrangement already exists. This CWE-639 IDOR-class flaw has a CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), reflecting low integrity impact, no confidentiality or availability impact, and the editor credential prerequisite. No public exploit identified at time of analysis, and no CISA KEV active exploitation is indicated in the provided data.
Missing authorization in WP User Manager through 2.9.25 lets an authenticated low-privilege user manipulate other users' state on a WordPress site, with integrity-only impact and no confidentiality or availability loss. The CVSS 3.1 score is 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), and exploitation requires a valid account such as a self-registered subscriber; no public exploit was identified at time of analysis and no CISA KEV entry is present in the supplied data.
Limited data disclosure and partial denial of service in Oracle Applications Manager (Oracle E-Business Suite) allow a low-privileged authenticated attacker with HTTP network access to the Diagnostics component to read a subset of accessible data and degrade availability. Affected releases are 12.2.3 through 12.2.15; Oracle rates exploitation as difficult (AC:H) and the CVSS 3.1 score is 4.2, so this is a low-priority issue. No public exploit code or CISA KEV entry is identified in the supplied intelligence.
Low-privileged, authenticated users of PeopleSoft Enterprise PeopleTools 8.61 and 8.62 can exploit the Portal component over HTTP to read a limited portion of accessible data and trigger a partial denial of service, but successful exploitation is difficult because it depends on conditions outside the attacker's direct control (AC:H). The vulnerability requires valid low-privileged credentials and network access; it does not permit integrity modification or full availability loss, and scope remains unchanged. No public exploit has been identified at time of analysis, and no EPSS or KEV data was provided in the intelligence.
Oracle REST Data Services 24.2.0 through 26.1.0 contains a Core-component flaw that lets a low-privileged authenticated attacker with HTTP network access obtain limited read and write access to a subset of ORDS-accessible data. The CVSS 3.1 score is 4.2 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N), with high attack complexity and no availability impact; no public exploit was identified at time of analysis. Oracle's October 2026 Critical Patch Update is the vendor remediation reference.
Authenticated low-privileged users of Oracle REST Data Services (ORDS) 24.2.0 through 26.1.0 can, in specific non-default or timing-dependent conditions, read a subset of ORDS-accessible data and perform unauthorized INSERT, UPDATE or DELETE operations against it through the Core component over HTTP. There is no availability impact and no unauthenticated path - the attacker must already hold a valid low-privilege account (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N, 4.2), and the high attack-complexity rating reflects constraints outside the attacker's control. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and this is a genuinely low-priority issue despite being network-reachable. Only confidentiality and integrity of a limited data subset are at risk, so triage should focus on whether untrusted or semi-trusted users can reach ORDS endpoints.
Oracle REST Data Services (ORDS) versions 24.2.0 through 26.1.0 contain a difficult-to-exploit flaw in the Core component that allows a low-privileged authenticated attacker with HTTP network access to read a limited subset of ORDS-accessible data and to perform unauthorized inserts, updates, or deletes. Exploitation requires an existing low-privileged account and depends on conditions outside the attacker's sole control, materially limiting real-world risk; the CVSS 3.1 base score is 4.2. No public exploit code or confirmed active exploitation was identified at time of analysis.
Limited confidentiality and integrity compromise in PeopleSoft Enterprise PeopleTools 8.62 Search Framework requires a victim to interact with attacker-supplied content before unauthenticated network attackers can read or modify a subset of application data. The issue is rated difficult to exploit (AC:H) and does not affect availability; no public exploit code has been identified at time of analysis. The supplied intelligence does not report active exploitation in CISA KEV.
Unauthorized data modification, limited data disclosure and partial denial of service in Oracle PeopleSoft Enterprise HCM Global Payroll Switzerland 9.2 require an attacker who already holds high-privileged logon access to the infrastructure where the component executes. The CVSS 3.1 score of 4.2 (AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) reflects a local-only attack path with no user interaction and no unauthenticated or remote vector, so the realistic threat actor is a malicious insider or someone who has already achieved privileged compromise on the application or process-scheduler host. No public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis, which keeps operational priority low.
Local privilege-misuse weakness in the Updates Environment Management component of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 lets an attacker who already holds a high-privileged account and interactive logon on the PeopleTools host read a limited subset of application data, insert/update/delete some records, and degrade availability enough to cause a partial denial of service. Because the CVSS vector is AV:L with PR:H, the practical risk is confined to malicious insiders or attackers who have already compromised an administrative account on the server; no user interaction is needed. There is no CISA KEV listing and no public exploit identified at time of analysis, and the vendor addressed the flaw in the October 2026 Critical Patch Update.
A local-privilege flaw in the UNIX implementation of the E1 Dev Platform Tech component of Oracle JD Edwards EnterpriseOne Tools (supported versions 9.2.0.0 through 9.2.26.5) lets a high-privileged attacker who already holds logon access to the host make unauthorized updates, inserts, or deletions, read a subset of data, and trigger a partial denial of service. The CVSS 3.1 score is 4.2 (AV:L/PR:H with low confidentiality, integrity, and availability impact), and no public exploit code or confirmed active exploitation was identified at time of analysis. Real-world risk is therefore narrow: exploitation is confined to insiders or attackers who have already compromised a privileged account on the UNIX server running the product.
Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 contains a WebLogic-component weakness that allows an unauthenticated attacker with access to the physical communication segment to achieve limited unauthorized read and write access to some PeopleTools data. Exploitation is Oracle-rated difficult and depends on race or protocol-state conditions outside the attacker's control, so the 4.2 MEDIUM score reflects low-to-moderate practical risk. Available intelligence did not identify public exploit code or confirmed active exploitation, and no CISA KEV entry or EPSS score was supplied.
Local, low-privileged users on Oracle Solaris 11.4 can abuse the bundled X Window System component to gain limited unauthorized read and write access to data outside their own scope, plus a partial denial-of-service condition, provided they can convince a second, different user to interact with attacker-influenced X content. The attack surface is narrow: the vector is strictly local (AV:L) with high attack complexity (AC:H) and a required human-interaction step performed by a victim other than the attacker, yielding a CVSS 3.1 score of 4.2. No public exploit code was identified at time of analysis and the issue has not been added to CISA KEV, so practical risk is concentrated in multi-user Solaris hosts where untrusted local accounts coexist with interactive graphical sessions; single-user or tightly access-controlled deployments face negligible exposure.
Oracle Siebel CRM Cloud Applications (22.3 through 26.9) exposes a confidentiality-only weakness in the Siebel Cloud Manager component that lets an attacker who already holds high-privileged logon access to the host infrastructure read critical or potentially all application-accessible data. The vector is local-only with high attack complexity and no user interaction (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N, base score 4.1), so realistic exposure is limited to privileged insiders or attackers who have already compromised the underlying host rather than external actors. No public exploit code or confirmed active exploitation was identified at time of analysis, and the defect is addressed in Oracle's October 2026 Critical Patch Update advisory.
Local high-privileged attackers can read critical data from Siebel CRM Cloud Applications 22.3 through 26.9 by exploiting a flaw in the Siebel Cloud Manager component. The issue is rated CVSS 4.1 with a local, high-complexity, high-privilege vector (AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N), so it is not remotely exploitable and requires an attacker who already has logon access to the infrastructure hosting the product. No public exploit code or CISA KEV entry was identified in the supplied intelligence, and no EPSS score was provided.
Local information disclosure in Oracle Outside In Technology 8.5.8 allows an attacker who already holds a logon to the host to read a restricted subset of data accessible to the Outside In PDF Export SDK, with no integrity or availability impact. The flaw sits in the PDF Export SDK component of Oracle Fusion Middleware and is rated CVSS 3.1 base 4.0 (AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), reflecting low confidentiality impact only and a hard dependency on local access. No public exploit code has been identified at time of analysis and the issue is not known to be actively exploited; practical risk is limited to environments where applications embed the SDK to convert attacker-influenced documents on shared or insufficiently segmented hosts.
Certificate chain validation in Go Toolchain 1.26.x before 1.26.10 and 1.27.x before 1.27.3 can return chains that include a small set of intermediate CA certificates the Go security team has decided to distrust, so an unauthenticated remote attacker who can intercept TLS traffic and present a certificate chaining through one of those intermediates could impersonate a trusted endpoint. This is a defensive trust-store and verification change in crypto/x509 Verify rather than a code-execution flaw; the assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, and no public exploit, KEV entry, EPSS score, or CWE is provided. Upgrade to Go 1.27.3 or 1.26.10 and rebuild to apply the chain filter.
Denial-of-service condition in the InnoDB component of MySQL Server and MySQL Cluster can let a high-privileged attacker who already has local logon to the database host hang or repeatedly crash the service, but only with high attack complexity and human interaction from another person. Affected releases include MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1. This is a genuinely low-priority issue despite affecting ubiquitous software; no public exploit identified at time of analysis, and the local-access, high-privilege, user-interaction, and high-complexity prerequisites sharply limit real-world exploitation.
Limited unauthorized read and modification of accessible data affects Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition through a difficult-to-exploit local flaw in the Utility component. Affected releases include Java SE 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, and 27; GraalVM for JDK 17.0.20.1 and 21.0.12.1; and GraalVM Enterprise Edition 21.3.19.1.1. Exploitation requires prior local logon access, is assessed as high-complexity, and has no public exploit identified at time of analysis, making this a low-to-moderate priority despite the platform's criticality.
TLS server authentication in Mozilla::CA (Perl) before 20261020 is undermined because the bundled CA store trusts 'emSign ECC Root CA - G3', a root whose subordinate intermediates circulate with publicly known private keys. Perl clients such as LWP and HTTP::Tiny that actually resolve their trust anchors from this bundle - typically minimal containers or Windows-style setups where OpenSSL's default system store is missing, or deployments that override CA selection through configuration or environment variables - will accept a forged certificate from an attacker who can intercept or redirect TLS traffic, allowing impersonation of arbitrary HTTPS endpoints. Assessed as CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, exposure is gated on the man-in-the-middle position and on the client genuinely using the Mozilla::CA bundle rather than the OS trust store; no KEV entry or public exploit code was identified in the available data at time of analysis, and EPSS scoring was not supplied.
Denial of service in Pillow's EPS decoder: when an application opens an untrusted Encapsulated PostScript file and rasterizes it through Ghostscript with load(scale=N) for N greater than 1, Pillow multiplies the file-declared pixel count by N and passes that geometry to gs as -g width x height without ever calling Image._decompression_bomb_check() on the scaled size, so Ghostscript renders N² times the operator's MAX_IMAGE_PIXELS budget and writes the full raw PNM to a temp file before the limit is enforced. A roughly 100-byte EPS declaring 9000x9000 (81 Mpx, just under the 89,478,485-pixel default) is accepted by Image.open() and, at scale 2, makes each request render 18000x18000 = 324 Mpx and produce a 972 MB temporary file, with 2.2 GB at scale 3 and 8.6 GB at scale 4. Affected packages are pip/Pillow from 2.3.0 through 12.3.0 (fixed in 13.0.0); exploitation requires Ghostscript to be installed and the application to call EpsImageFile.load() with a fixed integer scale above 1 on untrusted input, and severity is bounded because the multiplier is chosen by the application rather than the file, so this adds a constant factor to a no-timeout Ghostscript DoS that such applications already permit. No public exploit code was identified at time of analysis, and no CVSS vector, EPSS score, or CISA KEV entry is available in the supplied data, so standard prioritization signals are missing and cannot be cited as confirmed.