Successful exploitation of Oracle Sourcing 12.2.3 through 12.2.15 can allow a low-privileged authenticated attacker with HTTP network access to take over the Auctions component, causing high confidentiality, integrity, and availability impact. Oracle rates the issue difficult to exploit because attack complexity is high, meaning additional conditions outside the attacker's direct control must be satisfied beyond sending crafted requests. No public exploit code or CISA KEV entry was identified at time of analysis, so the practical risk is constrained by the valid-account prerequisite and the high-complexity barrier.
Takeover of Oracle E-Business Suite's Bills of Material module (versions 12.2.3 through 12.2.15) is possible for a low-privileged attacker who can reach the 'Internal Operations' component over HTTP, but the high attack complexity makes this a genuine second-tier priority rather than an emergency. Exploitation requires a valid EBS account and conditions beyond the attacker's control, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Takeover of the Oracle HCM Common Architecture component is possible in Oracle E-Business Suite releases 12.2.3 through 12.2.15, where a low-privileged attacker with HTTP network access to the Internal Operations functionality can achieve full compromise of the component with high confidentiality, integrity and availability impact. Exploitation is constrained: the attacker must already hold valid low-privilege EBS credentials (PR:L) and the attack carries high complexity (AC:H), meaning success depends on conditions outside the attacker's direct control such as timing, configuration or application state, and no end-user interaction is required (UI:N). No public exploit code was identified and the issue is not confirmed actively exploited (not in CISA KEV) at time of analysis; EPSS was not provided, so risk is concentrated on internet-exposed EBS deployments where low-privilege or self-service accounts are widely provisioned.
Oracle E-Business Suite's HCM Common Architecture component (Internal Operations) in versions 12.2.3 through 12.2.15 can be compromised by a low-privileged attacker with network HTTP access, allowing full takeover of the component with high confidentiality, integrity, and availability impact (CVSS 3.1 base 7.5). Exploitation is gated by high attack complexity - Oracle describes it as 'difficult to exploit' - meaning conditions outside the attacker's direct control (such as a specific application state, configuration, or timing condition) must align, and the attacker must already hold a valid low-privileged EBS account (PR:L, not unauthenticated). There is no public exploit code and no confirmed active exploitation (not in CISA KEV) at time of analysis, but internet-exposed EBS portals enlarge the pool of potential low-privileged attackers who could attempt it.
Takeover of Oracle Bills of Material in Oracle E-Business Suite 12.2.3 through 12.2.15 is possible for a low-privileged authenticated attacker with network HTTP access to the Internal Operations component. The flaw is explicitly difficult to exploit (AC:H) and requires no user interaction, but successful exploitation would fully compromise confidentiality, integrity, and availability. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Authenticated low-privileged users can compromise Oracle General Ledger 12.2.3 through 12.2.15 over HTTP, with successful exploitation potentially leading to takeover of the General Ledger component. The CVSS 3.1 score is 7.5, reflecting high confidentiality, integrity, and availability impact, but Oracle rates the attack as difficult to exploit because it requires high attack complexity in addition to valid credentials. No public exploit code or active exploitation is identified at time of analysis, and remediation is available through Oracle's October 2026 Critical Patch Update.
Authenticated takeover of the Pasta component in Oracle E-Business Suite 12.2.3 through 12.2.15 is achievable by a low-privileged user who already holds a valid account and can reach the Internal Operations HTTP interface, although Oracle rates the attack as difficult to carry out (CVSS 3.1 base score 7.5, AV:N/AC:H/PR:L/UI:N). Successful exploitation fully compromises confidentiality, integrity, and availability of the Pasta component, but the AC:H rating means success depends on non-trivial preconditions such as specific application state, timing, or a particular configuration rather than a single straightforward request. No public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis, and the mandatory authentication gate makes opportunistic internet-wide scanning and exploitation improbable.
Oracle One-to-One Fulfillment in Oracle E-Business Suite 12.2.3 through 12.2.15 exposes a Java Server Issues flaw that a low-privileged, network-positioned attacker could use to take over the component, with high confidentiality, integrity, and availability impact (CVSS 3.1 base 7.5). Exploitation is rated difficult (AC:H) and requires an authenticated low-privileged account plus HTTP access; no public exploit identified at time of analysis. Oracle's October 2026 Critical Patch Update is the referenced remediation source.
Authenticated low-privileged users of Oracle Communications Unified Inventory Management (7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0, 8.0.1) can leverage the Security component over HTTP to achieve full takeover of the application, with high confidentiality, integrity and availability impact scored at CVSS 3.1 base 7.5. Exploitation is explicitly rated difficult (AC:H) by Oracle and requires valid low-privileged credentials (PR:L) reachable over the network, so this is not a remote-unauthenticated attack. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and no EPSS score was supplied; given the credential prerequisite, the high attack complexity and the typically internal placement of UIM, this is a genuine but second-tier priority compared with internet-facing, unauthenticated Oracle flaws.
Full takeover of Oracle Product Lifecycle Analytics 3.6.1 is possible for a low-privileged authenticated attacker who can reach the application over the network and deliver a SQL-based attack against its Installation Issues component, with high confidentiality, integrity, and availability impact. Oracle rates the issue difficult to exploit (AC:H) and assigns CVSS 3.1 score 7.5; exploitation requires valid credentials (PR:L) and favorable conditions beyond the attacker's direct control. No CISA KEV entry or public exploit code is identified in the provided intelligence, so this should be handled on the normal Oracle CPU cadence rather than as an emergency.
Authenticated low-privileged attackers can achieve takeover of PeopleSoft Enterprise PeopleTools 8.61-8.63 by reaching the SQR component over HTTP, although Oracle rates the flaw as difficult to exploit because of high attack complexity (AC:H). The CVSS 3.1 score is 7.5 with high confidentiality, integrity, and availability impact, and exploitation requires valid low-privileged credentials (PR:L) but no user interaction (UI:N). No public exploit identified at time of analysis, and no CISA KEV confirmation was provided, so risk is concentrated in environments that expose SQR over HTTP and allow low-privileged accounts.
Takeover of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 is possible through its Business Interlink component, where a low-privileged network attacker who can reach the integration endpoint over HTTP could achieve full confidentiality, integrity, and availability impact. Exploitation is constrained by high attack complexity and the need for valid authenticated access (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H; 7.5), and no public exploit identified at time of analysis, with no KEV or POC signal in the provided intelligence.
Unauthenticated remote attackers with HTTP access to the Enterprise Infrastructure SEC component of Oracle JD Edwards EnterpriseOne Tools (releases 9.2.0.0 through 9.2.26.5) can tamper with application data, based on the vendor's CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, base 7.5). The flaw is scored for high integrity impact only - attackers cannot read confidential data or disrupt availability - but no privileges or user interaction are required, making the integrity of EnterpriseOne business records the sole but significant exposure. No public exploit code or confirmed active exploitation was identified at time of analysis, and the primary practical limit on exposure is whether the EnterpriseOne Tools HTTP interface is reachable from untrusted networks.
Oracle Outside In PDF Export SDK 8.5.8 (part of Oracle Fusion Middleware) can be fully compromised - confidentiality, integrity, and availability all high - when a third-party application that embeds the SDK processes a maliciously crafted document. The vulnerability is unauthenticated and network-reachable over HTTP, but Oracle rates it difficult to exploit and it requires a human other than the attacker to trigger parsing of the malicious file, so practical exposure depends entirely on whether a reachable service feeds untrusted documents into the PDF Export component. No public exploit code or confirmed active exploitation was identified at time of analysis; the 7.5 score reflects the high impact and the AC:H/UI:R preconditions rather than demonstrated weaponization.
Takeover of Oracle Agile PLM 9.3.6 is possible through its Application Server component, where an unauthenticated network attacker who persuades a legitimate user to interact with crafted HTTP content can achieve high confidentiality, integrity, and availability impact. Oracle rates this 7.5 (High) with CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, and the high attack complexity plus required user interaction make automated mass exploitation unlikely. No public exploit has been identified at time of analysis.
Memory exhaustion in Cloudflare Pingora's HTTP/2 server (versions before 0.8.1) lets a single remote, unauthenticated client drive the process into OOM termination by abusing HPACK header compression and HTTP/2 flow control. Because the h2 crate defaults were left in place, an attacker can emit tiny 1-byte indexed references to an almost-empty header and multiply them into hundreds of thousands of decoded header fields per stream, across an unbounded number of concurrent streams on one connection, exhausting memory (CVSS 3.1: 7.5, AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:H, CWE-770). The reporter demonstrated a lone connection getting a Pingora process capped at 2 GiB OOM-killed; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the barrier to entry is low for any internet-facing service that terminates h2 or h2c without explicit limits, while Cloudflare CDN customers were unaffected because its internal Pingora services do not front HTTP/2 clients.
Crashing or hanging Oracle Outside In Technology 8.5.8's Clean Content SDK is possible for unauthenticated remote attackers who can get a crafted document into an application that embeds the library, yielding availability-only impact at CVSS 7.5. Because the flaw lives in a document-parsing SDK rather than a standalone network service, real exposure depends entirely on whether a document-upload, conversion, or content-extraction feature is reachable over HTTP. No public exploit code or confirmed active exploitation was identified at time of analysis, so this is a bounded denial-of-service risk rather than a compromise or escalation threat.
MySQL Server and MySQL Cluster in the 8.4, 9.7 and 26.7 branches (plus Cluster 8.0.x) ship a mysqldump client that can be subverted by an attacker-controlled, malicious, or man-in-the-middle MySQL endpoint, letting an attacker who can influence the server a victim dumps from take over the client host with full confidentiality, integrity and availability impact (CVSS 7.5, C:H/I:H/A:H). The trust boundary is inverted: the victim must actively launch mysqldump against the hostile endpoint, which is why Oracle scores it AC:H and UI:R despite no credentials being needed against the attacker's own endpoint (PR:N). No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied, so real-world exploitation is currently unproven rather than observed.
Takeover of MySQL Server and MySQL Cluster is possible for unauthenticated network attackers able to reach the Server: Replication component, but Oracle rates the flaw difficult to exploit and success requires human interaction from a person other than the attacker. Affected releases are MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. CVSS 3.1 scores it 7.5 with high confidentiality, integrity and availability impact; no public exploit identified at time of analysis and no CISA KEV entry appears in the provided intelligence.
Unauthenticated LDAP requests to the LDAP Gateway in Oracle IDM Connector 12.2.1.4.0 and 14.1.2.1.0 can expose critical connector-accessible data, giving remote attackers a confidentiality-only read primitive rated CVSS 7.5. The flaw is network-reachable and requires no credentials or user interaction, but exploitation depends on the gateway being deployed and accessible over LDAP. No public exploit code or CISA KEV entry was identified at time of analysis, so risk is bounded by network exposure rather than by confirmed active exploitation.
Unauthenticated data disclosure in PeopleSoft FIN Common Objects Argentina 9.1 allows network attackers using Oracle Net to read critical or complete application data. The Integration component flaw requires only network reachability to the Oracle Net endpoint, with no credentials or user interaction, and its impact is limited to confidentiality. No public exploit code or CISA KEV entry was identified at time of analysis, and exposure is sharply reduced where Oracle Net is restricted to trusted internal segments.
Unauthenticated network attackers can read critical data from Oracle Siebel CRM Integration's Open Integration component in versions 25.12 through 26.9 over HTTP, with CVSS 3.1 base score 7.5 reflecting high confidentiality impact and no integrity or availability impact. Exploitation requires only that the integration HTTP endpoint be reachable, since the assessed vector is PR:N/UI:N with low attack complexity. No public exploit was identified at time of analysis, and there is no CISA KEV confirmation of active exploitation.
Unauthenticated network attackers can read critical data from Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 via the Oracle Net communication layer (CVE-2026-91308), which Oracle rates as easily exploitable and assigns CVSS 3.1 7.5 HIGH. The flaw is a confidentiality-only authentication bypass in the Installation Security component: PR:N/UI:N with C:H, while integrity and availability are unaffected. No CISA KEV entry or public exploit code was identified in the supplied intelligence at time of analysis, so risk is highest where the Oracle Net listener is reachable from untrusted networks.
Unauthenticated network attackers can access critical data in JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 by exploiting an Installation Security flaw reachable over Oracle Net. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:N/A:N) describes a low-complexity confidentiality-only issue with no integrity or availability impact. No public exploit code was identified at time of analysis, and the primary exposure constraint is whether Oracle Net/listener access is reachable from untrusted networks.
Unauthenticated HTTP requests against the Acollect component of Oracle Agile PLM 2.6 can return critical product-lifecycle data, letting any network-positioned attacker read everything the application can access without credentials or user interaction. The impact is confidentiality-only (C:H/I:N/A:N) at CVSS 7.5, so the flaw enables bulk data disclosure rather than tampering or disruption, and exploitation becomes trivial the moment the HTTP interface is reachable. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, but with PR:N/AC:L characteristics, internet-facing or partner-exposed instances should be treated as high-priority exposure.
Code execution in Advantech ADAM-3600 can be achieved by an authenticated attacker with high privileges who supplies crafted input to the device's logs settings functionality, triggering a stack-based buffer overflow. The flaw is network-reachable but requires valid administrative or operator access and high attack complexity, so real-world risk is moderate-priority and concentrated in OT environments where the management interface is exposed or privileged credentials are compromised. No public exploit code or confirmed active exploitation was identified at time of analysis, and Advantech's security advisory should be consulted for fixed firmware.
Oracle Payroll in Oracle E-Business Suite 12.2.3 through 12.2.15 can be taken over by a low-privileged, authenticated attacker who reaches the Internal Operations component over HTTP, although Oracle rates exploitation as difficult because success depends on conditions outside the attacker's control. The CVSS 7.5 vector shows high confidentiality, integrity, and availability impact, but no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV) are present in the supplied intelligence, making this a genuine but second-tier priority. Organizations not running EBS 12.2.x with the Payroll module are not affected.
Authenticated low-privileged attackers with HTTP network access can compromise Oracle Payroll in Oracle E-Business Suite 12.2.3 through 12.2.15 through a high-complexity flaw in the Internal Operations component, potentially achieving takeover with high confidentiality, integrity, and availability impact. Exploitation requires a valid low-privileged account and non-default preconditions (AC:H), and no public exploit was identified at time of analysis. The vendor rates the issue difficult to exploit, making it a genuine but second-tier priority compared with unauthenticated or actively exploited EBS flaws.
Oracle Payroll in Oracle E-Business Suite 12.2.3 through 12.2.15 can be taken over by a low-privileged, authenticated attacker who can reach the component's Internal Operations interface over HTTP. Oracle describes the issue as difficult to exploit (AC:H) despite high confidentiality, integrity, and availability impact, and the CVSS 3.1 base score is 7.5. No public exploit code or confirmed active exploitation is identified at time of analysis, so the realistic threat profile is a motivated authenticated insider or an attacker who has already obtained low-privileged EBS credentials.
Oracle Capacity in Oracle E-Business Suite 12.2.3 through 12.2.15 can be taken over by a low-privileged, authenticated attacker who reaches the Internal Operations component over HTTP, with high confidentiality, integrity, and availability impact (CVSS 7.5). Exploitation is rated difficult (AC:H) because it depends on non-default preconditions that are not publicly documented. No public exploit identified at time of analysis, and no CISA KEV entry or EPSS score was supplied; defenders should prioritize instances exposing the Capacity module to untrusted networks and verify the October 2026 Oracle CPU guidance.
Oracle Essbase 21.8.3.0.0 can be hung or repeatedly crashed by unauthenticated remote attackers who can reach the Security component over TCP, producing a complete denial of service with no confidentiality or integrity impact. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5), so no credentials or user interaction are required according to the supplied assessment. No public exploit identified at time of analysis, and no CISA KEV entry is present; exposure is highest for internet-reachable or broadly accessible Essbase deployments.
Full application takeover of Oracle Agile Product Lifecycle Management for Process 6.2.4 is possible through its Product Quality Management component, with high confidentiality, integrity, and availability impact. The attack path requires network access to the HTTP interface and valid low-privileged credentials, and Oracle rates exploitation as difficult (AC:H), so risk is concentrated in exposed, access-controlled deployments where an attacker already has a foothold. No public exploit was identified at time of analysis; this is a genuine but second-tier priority rather than an emergency patch item.
Takeover of Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 is possible for authenticated low-privileged attackers with network access via HTTP, according to Oracle's October 2026 Critical Patch Update. The Content Portal Suite component flaw is rated CVSS 7.5 with high attack complexity and no user interaction, giving high confidentiality, integrity, and availability impact; it is serious but not top-tier urgent. No public exploit was identified at time of analysis, and no CISA KEV entry was provided.
Authenticated attackers with only low privileges can achieve full takeover of Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 through the Fabric Layer over HTTP, with high impact to confidentiality, integrity, and availability. Exploitation is rated difficult (CVSS AC:H) because specific conditions outside the attacker's control must align, and a valid low-privileged SOA Suite account is required (PR:L). No public exploit code or CISA KEV entry was identified in the available intelligence at time of analysis.
Takeover of Oracle Outside In Technology 8.5.8 can occur when a victim-side application processes a crafted document through the Outside In PDF Export SDK. The flaw is network-reachable but requires human interaction and high attack complexity, and no public exploit has been identified at time of analysis. This is a moderate-priority issue concentrated in deployments that feed untrusted files into Outside In.
Oracle PeopleSoft PeopleTools 8.61 through 8.63 can be fully taken over by an unauthenticated attacker who has access to the same physical or adjacent network segment as the host running the PsAdmin component. The flaw is rated CVSS 7.5 with high confidentiality, integrity and availability impact, but exploitation is explicitly difficult (AC:H) and requires network adjacency (AV:A), so it is not reachable from arbitrary internet locations; no public exploit code has been identified and it is not confirmed actively exploited (no CISA KEV listing). Oracle addressed it in the October 2026 Critical Patch Update, so priority should be moderate - patch on a normal cycle and treat segment isolation as the main exposure control.
Unauthenticated attackers positioned on the same physical network segment as a JD Edwards EnterpriseOne Tools host can potentially achieve full takeover of the product (confidentiality, integrity and availability all High) by exploiting a flaw in the Installation Security component of supported releases 9.2.0.0 through 9.2.26.5. The vendor-supplied CVSS 3.1 vector (AV:A/AC:H/PR:N/UI:N) means exploitation is not possible from the internet and is further gated by high attack complexity, so real-world priority is materially lower than the 7.5 base score suggests. No public exploit code, CISA KEV entry, or EPSS score was present in the available intelligence at time of analysis, and Oracle addresses the issue through its October 2026 Critical Patch Update advisory.
Stormshield Network Security's Autoupdate routine can accept unauthenticated dynamic data files because of a logic error in its signature-verification check, allowing an adjacent-network attacker who interposes on the update channel to undermine the integrity of dynamic content. Exploitation requires that Autoupdate be in use and that the attacker can supply or tamper with update files reaching the appliance, with no credentials or user interaction needed but high attack complexity due to the need to interpose on or race the update fetch. No public exploit code or CISA KEV active-exploitation signal was identified at time of analysis.
Java sandbox boundary flaw in Oracle Java SE 8u503 and 8u503-perf client deployments can let a low-privileged local attacker obtain high confidentiality and integrity impact, with scope change to additional products, but only in legacy sandboxed Java Web Start or applet scenarios that execute untrusted code. The 7.5 HIGH score is tempered by the local attack vector, high attack complexity, and required low-privileged logon; server deployments running only trusted administrator-installed code are explicitly out of scope. No public exploit identified at time of analysis, and exploitation is not confirmed in CISA KEV.
A low-privileged attacker with a local logon to the infrastructure hosting Oracle VM VirtualBox 7.2.20 can achieve full takeover of the hypervisor, consistent with a guest-to-host escape profile, provided a person other than the attacker performs an action on the VM and additional high-complexity conditions are met. Successful exploitation yields high confidentiality, integrity and availability impact and, because of the scope change, can significantly affect products beyond VirtualBox itself, including the host and co-hosted workloads. Oracle scores this 7.5 High; no public exploit code and no confirmed active exploitation have been identified at time of analysis, and the local-only vector plus mandatory second-party interaction substantially limit real-world exposure.
Denial of service in the MCP TypeScript SDK affects HTTP-reachable servers running @modelcontextprotocol/sdk 1.3.0 through 1.31.0 or @modelcontextprotocol/server 2.0.0 through 2.2.0, allowing unauthenticated remote attackers to exhaust Node.js heap memory with a single tools/call request containing very large arrays or records. The default 4 MiB request-size limit is large enough to carry an exhausting payload, causing the process to abort with a JavaScript heap out-of-memory error. Vendor patches are available in 1.32.0 and 2.3.0, but the new maxToolInputElements guard is opt-in and disabled by default; no public exploit code was identified at time of analysis, and stdio-only servers are not affected.
Unauthenticated HTTP requests to ApostropheCMS import-export module routes before version 3.7.0 can force the server to initialize uploads, store chunks, and perform temporary processing, consuming disk, memory, and processing resources and degrading availability; ApostropheCMS core prior to 4.33.0 bundles the vulnerable module. The flaw is rated CVSS 7.5 with availability-only impact, requires the import-export module to be installed and its routes network-reachable, and has no public exploit identified at time of analysis.
Unauthenticated task-read disclosure in the A2A Java SDK before 1.3.0.Final lets any network caller retrieve another caller's task status, context ID, message history, and artifacts by supplying a task ID. The default no-argument InMemoryTaskStore constructor leaves authorizationProvider null, so InMemoryTaskStore.get(String taskId) returns stored tasks without any owner or caller check unless a TaskAuthorizationProvider is wired through the AuthorizationRequestHandlerDecorator - a wiring that manual DefaultRequestHandler.builder().build() setups and integrations such as Spring commonly skip. Because the default/reference transport endpoints also perform no authentication, the exposure is reachable without an account in multi-caller deployments; exploitation additionally requires the attacker to know or guess a valid task ID, and no public exploit code has been identified at time of analysis.
Unauthenticated remote attackers can exhaust Eclipse ioFog Controller 3.8.0 through 3.9.1 by sending small JSON bodies to POST, PUT, or PATCH routes that perform template substitution, stalling or aborting the control-plane process before bearer-token and RBAC checks run. The bearer check does not reject missing or invalid tokens and the DoS rate limit covers only login routes, so a reachable templating route is enough to disrupt the agent API and in-process WebSocket relays. No public exploit was identified at time of analysis, and the impact is limited to availability with no confidentiality or integrity effect; reporting is consistent with a genuine, impact-limited availability threat.
Unauthenticated information disclosure in Apache Cocoon can expose diagnostic interfaces, cache-triggering operations, verbose debug logging, and profile information to any user who can reach those endpoints; all versions are affected. The project is retired and no vendor fix is planned, so exposure is limited to deployments that leave diagnostic/debug endpoints accessible beyond trusted networks. No public exploit code or CISA KEV entry was identified at time of analysis.
Authorization bypass in OpenChoreo (1.0.0 through 1.0.5, 1.1.0 through 1.1.6, and 1.2.0 through 1.2.4) lets an authenticated user holding workflowrun:update on one project or component rewrite the ownership labels of a different WorkflowRun in the same namespace. Because the PUT .../workflowruns/{runName} handler derives its authorization hierarchy from the openchoreo.dev/project and openchoreo.dev/component labels in the request body while loading the target run from the URL path, an attacker who names a victim run in the path and submits labels for a scope they control is subsequently treated as authorized to read build logs and Kubernetes events, delete the run, modify pending spec.workflow.parameters, or drive the run into a permanent ComponentValidationFailed state. CVSS 3.1 scores this 7.4 with scope change (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L), but exposure is limited to deployments where multiple projects or components share a single namespace; it is not anonymously reachable and not cross-tenant, and no public exploit code was identified at time of analysis. Vendor-released patches exist in 1.0.6, 1.1.7, and 1.2.5.
Unauthenticated remote attackers can corrupt or destroy data and trigger repeatable crashes of MySQL Server and MySQL Cluster through the Server: Replication component, affecting Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1 and Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Oracle rates it 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H), explicitly calling it difficult to exploit, so success likely hinges on specific replication state, timing or race conditions rather than a single crafted request, and there is no confidentiality impact - the exposure is unauthorized creation, deletion or modification of critical data plus a hang or frequently repeatable full denial of service. No public exploit code or confirmed active exploitation was identified at time of analysis, and this is best treated as a genuine but second-tier priority concentrated on database nodes whose ports are network-reachable.
Oracle Agile Product Lifecycle Management for Process 6.2.4 exposes an unauthenticated HTTP attack surface in its Product Quality Management component that permits high-impact confidentiality and integrity compromise, with CVSS 3.1 scored at 7.4 (HIGH). Per Oracle's advisory, exploitation is rated difficult (AC:H) because success requires conditions outside the attacker's control, but no privileges (PR:N) or user interaction (UI:N) are needed once those conditions align, and there is no availability impact. No EPSS score, CISA KEV listing, or public exploit code was identified at time of analysis, so exposure is driven by whether the PLM HTTP interface is reachable from untrusted networks rather than by observed attack activity.
Unauthenticated, remote exploitation of the Oracle Concurrent Processing component in Oracle E-Business Suite 12.2.3 through 12.2.15 can expose and corrupt critical application data, with high confidentiality and integrity impact but no availability impact. Oracle characterizes the flaw as difficult to exploit (CVSS:3.1 AV:N/AC:H/PR:N/UI:N, base score 7.4) because success depends on conditions outside the attacker's control, such as a specific application state or timing, rather than a single deterministic HTTP request. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied, so triage priority should be driven mainly by whether the EBS web tier is reachable from untrusted networks.
Unauthenticated network attackers can read and modify critical data in Oracle Mobile Field Service (Oracle E-Business Suite) versions 12.2.3 through 12.2.15 through the Admin UI over HTTP, with no user interaction required. Oracle rates attack complexity as high ("difficult to exploit"), indicating specific preconditions constrain reliable exploitation. No public exploit identified at time of analysis.