Unauthenticated network attackers can read and modify critical data in Oracle Mobile Field Service, the field-service module of Oracle E-Business Suite 12.2.3 through 12.2.15, by targeting the Admin UI over HTTP. Oracle rates the issue CVSS 3.1 7.4 with high confidentiality and integrity impact, but attack complexity is high, meaning successful exploitation depends on conditions outside the attacker's control. No public exploit code or CISA KEV entry was identified at time of analysis, so risk is concentrated on internet-reachable EBS instances that actually deploy this module.
Unauthenticated network attackers can read and modify critical data in Oracle Mobile Field Service within Oracle E-Business Suite 12.2.3 through 12.2.15 through the Admin UI, but exploitation is rated difficult because high attack complexity means success depends on server-state or environmental conditions outside the attacker's direct control. Oracle's October 2026 Critical Patch Update references remediation, and no public exploit code or CISA KEV entry was identified at time of analysis.
Unauthenticated network attackers can potentially read and modify critical data handled by Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0 through the LDAP Gateway component, with no user interaction required. Oracle rates the flaw as 'difficult to exploit' (CVSS 7.4, AC:H), meaning the attacker must satisfy preconditions outside their direct control before a reliable attack is possible; confidentiality and integrity of all connector-accessible data are both fully impacted, while availability is unaffected. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, so this is a genuine but second-tier priority that should be remediated in the normal Critical Patch Update cycle.
Unauthenticated, remote attackers can read and modify critical data in the Server Infrastructure component of Oracle Siebel CRM Deployment across supported versions 17.0 through 26.9, with a CVSS 3.1 base score of 7.4 (High) driven entirely by high confidentiality and integrity impact. Oracle rates the flaw as 'difficult to exploit' (AC:H), meaning success depends on conditions outside the attacker's control - server state, timing, or an unspecified precondition - which tempers the headline score and argues for a lower real-world priority than the 7.4 suggests; no public exploit code and no KEV listing were identified at time of analysis. Authentication and user interaction are not required (PR:N, UI:N), and the advisory metadata tags the issue as an authentication bypass, so exposure should be scoped by network reachability to the deployment server rather than by credential controls. The fix is delivered through Oracle's October 2026 Critical Patch Update.
Oracle JD Edwards EnterpriseOne Tools releases 9.2.0.0 through 9.2.26.5 expose an unauthenticated, network-reachable weakness in the Interoperability 'SEC' component that can let a remote attacker read, create, delete, or modify critical data over HTTPS, with no user interaction required and no availability impact. Oracle characterizes the flaw as 'difficult to exploit' (CVSS 3.1 7.4, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), meaning success depends on conditions outside the attacker's full control rather than a single deterministic request. No public exploit code has been identified at time of analysis, and the issue is addressed through the Oracle Critical Patch Update referenced in the advisory (October 2026).
Unauthenticated network attackers who can reach the Interoperability SEC component of JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 over TLS can read and modify critical business data, although Oracle rates the attack as difficult (AC:H) because an unspecified precondition must be satisfied. No public exploit code or confirmed active exploitation has been identified at time of analysis. Oracle's October 2026 Critical Patch Update advisory is the reference for remediation.
Unauthenticated attackers with network access to Oracle E-Business Suite's Shipping Execution module can bypass authentication in the Workflow Events component to read and modify critical shipping data. The flaw affects E-Business Suite 12.2.3 through 12.2.15 and carries a CVSS 3.1 base score of 7.4 with high confidentiality and integrity impact but no availability impact; the high attack complexity (AC:H) reflects difficult-to-satisfy exploitation preconditions rather than a lack of severity. No public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated network attackers can read and modify critical data in Oracle E-Business Suite's Mobile Application Server (MWA Terminal Server) versions 12.2.3 through 12.2.15, with a CVSS 3.1 score of 7.4. Oracle rates the issue difficult to exploit because of high attack complexity, and no public exploit code or CISA KEV active-exploitation signal was identified at time of analysis. Exposure is greatest where the MWA Terminal Server is reachable beyond trusted internal or warehouse-handheld networks.
Oracle MySQL Router 26.7.0 exposes an HTTPS-facing weakness (component Router: General) that can be attacked without credentials (PR:N, UI:N), letting a network-positioned adversary read and tamper with data the Router can reach - scored CVSS 7.4 with High confidentiality and integrity impact but no availability impact. Oracle characterizes exploitation as 'difficult' (AC:H), meaning success depends on timing, internal state, or non-default configuration rather than a single deterministic request, which tempers real-world risk despite the high impact rating. No public exploit code and no CISA KEV entry were identified at time of analysis, and no vendor fix version is documented in the available data beyond the October 2026 Oracle CPU reference.
Unauthorized reads and modifications of critical Primavera Unifier data are possible for unauthenticated, network-positioned attackers in versions 21.12.0 through 21.12.17, though exploitation is rated high-complexity (AC:H) and depends on conditions outside the attacker's control. The CVSS 3.1 score of 7.4 reflects high confidentiality and integrity impact with no availability impact. No public exploit identified at time of analysis; active exploitation is not confirmed.
Unauthenticated network attackers can read and modify critical data in Oracle Communications Billing and Revenue Management 15.x through the Platform component's TLS interface, but Oracle rates the issue difficult to exploit because success depends on high-complexity preconditions (AC:H). The flaw affects 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, and 15.2.0.0.0 with CVSS 3.1 score 7.4 (C:H/I:H/A:N); no public exploit identified at time of analysis. Internet-facing BRM Platform TLS endpoints are the primary risk multiplier.
Unauthenticated network attackers can read and modify critical data in Oracle Siebel CRM End User through the Portal Framework over HTTPS in versions 17.0 through 26.9. The CVSS 7.4 rating reflects high attack complexity, meaning successful exploitation depends on conditions outside the attacker's control and mass exploitation is less likely; no public exploit code or CISA KEV active exploitation has been identified at time of analysis. Confidentiality and integrity are affected, availability is not, and impact remains within Siebel CRM End User-accessible data.
Unauthenticated remote attackers who can reach the Siebel HTTP interface can read, create, delete, or modify critical data held in Oracle Siebel CRM Deployment versions 17.0 through 26.9, although Oracle rates the issue as difficult to exploit (AC:H), meaning successful abuse depends on conditions outside the attacker's direct control such as specific server configuration, state, or timing rather than a single deterministic request against a default install. Confidentiality and integrity of Deployment-accessible data are both fully compromised, while availability is unaffected and no scope change to other systems occurs. No public exploit code and no confirmed active exploitation were identified at time of analysis, so this is a genuine but second-tier priority to be scheduled alongside the October 2026 Oracle Critical Patch Update rather than treated as an emergency.
Unauthenticated network attackers can create, delete, modify, or read critical data in Oracle E-Business Suite iProcurement versions 12.2.3 through 12.2.15 by reaching the Internal Operations component over HTTPS. Oracle rates the issue difficult to exploit because of high attack complexity, meaning successful exploitation likely requires a specific server-side condition rather than a single deterministic request. No public exploit code or confirmed active exploitation was identified at time of analysis.
JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 exposes an Interoperability SEC weakness over JDENET that can let unauthenticated network attackers read and alter critical application data. Oracle describes exploitation as difficult, with high attack complexity as the main barrier, and no public exploit identified at time of analysis or confirmed active exploitation (CISA KEV). Availability is not affected, but confidentiality and integrity impacts are high.
Unauthenticated data tampering and disclosure in the Workflow Events component of Oracle Shipping Execution (Oracle E-Business Suite 12.2.3 through 12.2.15) can be triggered by a network attacker over HTTP, yielding full confidentiality and integrity impact on the module's accessible data with a CVSS 3.1 base score of 7.4. Oracle explicitly characterizes the flaw as difficult to exploit (AC:H), so a successful attack depends on conditions outside the attacker's control rather than a single crafted request, and there is no availability impact - the realistic risk is data disclosure and modification, not service disruption. No public exploit code or confirmed active exploitation was identified at time of analysis, and given the high attack complexity this is best treated as a genuine but second-tier priority addressed through the October 2026 Critical Patch Update.
Oracle Solaris 11.4 exposes a local attack path through its Plugins component in which an attacker who already holds high-privileged logon access must also obtain interaction from a different user, after which the attacker can read and modify critical Solaris data and potentially affect other products because the scope changes. CVSS 3.1 scores this at 7.4 with high confidentiality and integrity impact but no availability impact, making it serious for privileged local environments while remaining constrained by the PR:H and UI:R prerequisites. No public exploit was identified at time of analysis, and the Oracle October 2026 Critical Patch Update advisory is the available remediation reference.
Oracle WebLogic Server 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 contains a Core component flaw that unauthenticated network attackers can reach through the TLS listener, allowing limited read, update/insert/delete, and partial denial-of-service impact (CVSS 7.3). Oracle describes the issue as easily exploitable with no user interaction; exposure is greatest for internet-facing or broadly reachable WebLogic instances, while segmented admin/TLS interfaces materially reduce risk. No public exploit identified at time of analysis.
Ghostscript as shipped with Red Hat Enterprise Linux 8-and, per CPE data, RHEL 6, 7, 9, and 10-may allow an attacker to escape -dSAFER protections when it processes a crafted PostScript file, enabling file access outside permitted paths or command execution with the Ghostscript process's privileges. The root cause is that Red Hat's 9.25-to-9.27 rebase omitted the CVE-2019-14869 correction, leaving privileged .forceput operations in the .charkeys procedure insufficiently protected; the supplied CVSS base score is 7.3, while the independent assessment treats confidentiality and integrity impact as High (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L). No CISA KEV entry is present in the supplied data and no public exploit identified at time of analysis; practical risk is conditional on a service or pipeline actually processing untrusted PostScript/EPS with an affected RHEL build.
Oracle Essbase 21.8.3.0.0 exposes an HTTP-reachable Security component flaw that unauthenticated remote attackers can use to read a subset of data, modify or delete some records, and partially disrupt availability. CVSS 3.1 rates it 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), with no public exploit identified at time of analysis. The practical risk is highest where Essbase HTTP services are reachable from untrusted networks, because no authentication, user interaction, or special conditions are required.
Oracle Agile Engineering Data Management 6.2.1 contains a high-impact confidentiality and integrity flaw in its Install component that unauthenticated attackers can exploit only from an adjacent network segment, and only if a non-attacker user performs a triggering action. Successful exploitation could let an attacker create, delete, or modify critical data and read all EDM-accessible data, but the adjacent-network and user-interaction prerequisites keep real-world risk below the 7.3 CVSS score for most deployments. No public exploit code or confirmed active exploitation was identified at time of analysis.
An out-of-bounds write in HarfBuzz 8.0.0 through 14.6.0 allows a crafted font containing an embedded WebAssembly module to write glyph-name bytes past the end of the module's linear memory and into host process memory, crashing or potentially corrupting the consuming application. The flaw only manifests in builds where the experimental WebAssembly shaping backend is compiled in (HAVE_WASM/WAMR support), which is disabled by default; the attacker must also precisely arrange the module's memory layout so the output buffer sits at the end of linear memory, and a victim must load and shape the malicious font. Per the available data there is confirmed active exploitation is not indicated and no public exploit code was identified at time of analysis; upstream fix code exists as a pull request but a tagged patched release was not independently confirmed, and the non-default build requirement plus the precise layout precondition keep practical risk below what the raw memory-corruption classification suggests.
Oracle E-Business Suite Applications DBA (AD Utilities) versions 12.2.3 through 12.2.15 can be taken over by a low-privileged attacker who already has local logon access to the infrastructure where the component runs and can induce a different person-typically an administrator or operator-to perform an action involving attacker-influenced input. Successful exploitation gives high confidentiality, integrity, and availability impact, and the CVSS 3.1 base score is 7.3 (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H). No public exploit code or confirmed active exploitation was identified at time of analysis, and the local vector plus required human interaction limit realistic exposure to insider or post-compromise scenarios.
Takeover of the Oracle E-Business Suite Applications DBA (AD Utilities) component is achievable by a low-privileged attacker who already holds a logon on the application-tier host running those utilities, in supported versions 12.2.3 through 12.2.15. The attacker cannot reach the flaw remotely or unauthenticated (AV:L/PR:L), and successful exploitation additionally depends on a different, higher-privileged person performing an action - typically a DBA or operator running an affected AD Utilities operation against attacker-influenced input (UI:R). Oracle rates the impact on confidentiality, integrity and availability as high (CVSS 3.1 base 7.3); no public exploit code or confirmed active exploitation was identified at time of analysis, and the practical risk is gated by shared access to the application tier and by privileged-operator behavior rather than being a drop-everything emergency.
High-privileged attackers with network access to the Oracle Mobile Field Service Admin UI can fully compromise the component - reading and altering data and disrupting availability - across Oracle E-Business Suite versions 12.2.3 through 12.2.15. Exploitation requires an already-authenticated administrative account (CVSS PR:H) and HTTPS access, but no user interaction and low attack complexity, so the practical threat is primarily from malicious insiders or attackers who have first stolen admin credentials. No public exploit code has been identified and the issue is not in CISA KEV; Oracle addressed it in the October 2026 Critical Patch Update.
Takeover of Oracle iSetup within Oracle E-Business Suite 12.2.3 through 12.2.15 is possible for an attacker who already holds high application privileges and can reach the iSetup web interface over HTTP. The issue is rated CVSS 7.2 with high confidentiality, integrity, and availability impact, but the PR:H precondition substantially narrows the realistic attacker population. No public exploit code or confirmed active exploitation is identified in the available data.
Takeover of Oracle EDI Gateway in Oracle E-Business Suite 12.2.3 through 12.2.15 is possible for high-privileged attackers who can reach the component over HTTP, with high confidentiality, integrity, and availability impact. The issue is network-reachable, low-complexity, and requires no user interaction, but the CVSS PR:H prerequisite means an attacker must already hold an administrative-level EDI Gateway account, so realistic risk is concentrated among malicious privileged insiders or attackers who have already obtained admin credentials. No public exploit code or confirmed active exploitation was identified at time of analysis.
High-privileged attackers with HTTP reachability to Oracle EDI Gateway in Oracle E-Business Suite 12.2.3 through 12.2.15 can fully take over the component, with high impact to confidentiality, integrity, and availability. Exploitation requires existing high application-level privileges (CVSS PR:H) and network access, so anonymous or low-privileged users cannot directly exploit it; realistic abuse is confined to privileged insiders or adversaries who already control a privileged EBS account. No public exploit code or CISA KEV entry is identified in the available intelligence at time of analysis.
IMAP command injection in Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 lets a remote authenticated attacker inject CRLF sequences into the _uid parameter of the mail/headers and mail/viewsource actions and execute arbitrary IMAP commands within their own webmail session. The flaw requires a valid Roundcube login (CVSS PR:L) and is exploitable in default configurations; it has high integrity impact but limited confidentiality impact, and no public exploit was identified at time of analysis. Vendor-released patches 1.6.20 and 1.7.5 address the 1.6 and 1.7 branches.
Oracle Siebel CRM Field Service (Smart Answer) versions 17.0 through 26.9 can be fully taken over by an authenticated, high-privileged attacker with HTTP access, with high confidentiality, integrity, and availability impact (CVSS 7.2). The vector requires existing high privileges (PR:H) and low complexity with no user interaction, so real-world exposure is concentrated in insider or post-compromise escalation scenarios rather than unauthenticated attacks. No CISA KEV confirmation and no public exploit identified at time of analysis.
Oracle Agile Product Lifecycle Management for Process 6.2.4 can be taken over through its Product Quality Management component by an attacker holding high-privilege credentials and network HTTP access. The CVSS 7.2 rating reflects high confidentiality, integrity, and availability impact, but the PR:H prerequisite confines practical exposure to malicious insiders or attackers who have already compromised a privileged account. No public exploit code or CISA KEV entry was identified at time of analysis, and Oracle addressed the issue in its October 2026 Critical Patch Update.
Oracle iProcurement's E-Content Manager Catalog component in Oracle E-Business Suite 12.2.3 through 12.2.15 exposes a high-privilege attack path: an authenticated attacker who already holds an elevated account can use HTTPS network access to take over the iProcurement application, with high confidentiality, integrity, and availability impact. CVSS 3.1 scores this 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), reflecting reliable exploitation once privileged credentials are obtained, with no user interaction required. No public exploit code or CISA KEV entry was identified in the provided intelligence, so the practical threat is a malicious or compromised privileged insider rather than an anonymous remote attacker.
Order Capture in Oracle E-Business Suite 12.2.3 through 12.2.15 can be taken over by a high-privileged attacker who already holds a valid EBS account and can reach the Internal Operations component over HTTP, yielding full confidentiality, integrity, and availability impact (CVSS 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Exploitation is straightforward once the privileged account exists - no user interaction is required and attack complexity is low - but the PR:H prerequisite means anonymous external attackers cannot reach the flaw, making this a conditional rather than top-tier risk. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, so the practical exposure depends on how widely privileged EBS accounts are distributed in the environment.
Takeover of Oracle Contract Lifecycle Management for Public Sector (the Award/PO component of Oracle E-Business Suite) is achievable by an attacker who already holds a high-privileged application account, with full loss of confidentiality, integrity and availability (CVSS 3.1 base 7.2). Only versions 12.2.3 through 12.2.15 are affected, and the attack is carried out over the network via HTTP with low complexity and no user interaction, so the practical barrier is the prerequisite of an existing highly privileged session rather than any technical obstacle. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, so risk is concentrated on privileged insiders, compromised administrator credentials, and environments where the CLM application is exposed to attackers who have already escalated.
Oracle Product Hub in Oracle E-Business Suite 12.2.3 through 12.2.15 can be fully taken over by an authenticated attacker who already holds high application privileges and can reach the Internal Operations component over HTTP. The flaw is rated CVSS 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), and the high-privilege prerequisite substantially limits realistic exposure to insiders, compromised privileged accounts, or post-authentication attack chains. No public exploit code or confirmed active exploitation was identified at time of analysis.
High-privilege users of Oracle MySQL Server and MySQL Cluster 26.7.0 through 26.7.1 can leverage a flaw in the Server: Optimizer component to take full control of the database instance, achieving complete compromise of confidentiality, integrity, and availability. The vulnerability is network-reachable and low-complexity (CVSS 3.1 base score 7.2, AV:N/AC:L/PR:H/UI:N), but is gated behind an existing administrative-level MySQL account, so realistic risk is concentrated in malicious-insider or post-credential-compromise scenarios rather than anonymous attack. No public exploit code or confirmed active exploitation was identified at time of analysis, and Oracle has published a Critical Patch Update advisory covering the fix.
Takeover of the Oracle EDI Gateway component in Oracle E-Business Suite 12.2.3 through 12.2.15 is possible for a high-privileged attacker who can reach the application over HTTP, with full confidentiality, integrity, and availability impact (CVSS 3.1 base 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). The critical qualifier is the PR:H prerequisite: the attacker must already hold an elevated EDI Gateway account, so this is not exploitable by unauthenticated or low-privileged users and realistic exposure is confined to trusted operators or adversaries who have already stolen such credentials. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied in the source data.
Any authenticated TYPO3 backend user can rewrite arbitrary page-record fields-including access permissions and configuration-when the AI Integration extension is active, because its backend write endpoint performs neither a permission check nor a field allowlist. The issue affects TYPO3 installations with typo3_ai_integration_extension installed and active and requires only a low-privileged backend session (CVSS 4.0 7.2 High; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L). No public exploit code or CISA KEV entry was identified at time of analysis.
High-privileged authenticated attackers can take over Oracle iProcurement 12.2.3 through 12.2.15 by sending crafted HTTP requests to the E-Content Manager Catalog component. The flaw is rated CVSS 7.2 with high confidentiality, integrity, and availability impact, but the PR:H vector means an attacker must already hold an elevated account on the E-Business Suite instance. No public exploit identified at time of analysis, and no KEV entry is provided.
Authenticated command injection in ArmorX Spam allows remote users with low-privilege accounts to submit crafted parameter input and cause malicious code to be uploaded to the server, with the assessed impact concentrated on integrity rather than confidentiality or availability. The CVSS 4.0 base score is 7.1 and the aligned CVSS 3.1 assessment is AV:N/AC:L/PR:L/UI:N/C:N/I:H/A:N, reflecting network reachability, low attack complexity, low privileges, and no user interaction. No public exploit identified at time of analysis, and no CISA KEV or EPSS data was provided; exposure depends on how broadly authenticated accounts are provisioned and whether the vulnerable interface is network-accessible.
High-privileged authenticated attackers can achieve unauthorized data manipulation and partial denial of service in Oracle Bills of Material (Oracle E-Business Suite 12.2.3-12.2.15) by exploiting a difficult-to-exploit flaw over HTTP, with scope change potentially affecting additional Oracle products. The vulnerability requires network access, high attack complexity (AC:H), and a high-privilege account (PR:H); no public exploit code or active exploitation has been identified at time of analysis. EPSS risk was not provided, but the CVSS 7.2 score reflects an integrity-heavy impact profile.
Unauthorized data modification and limited data disclosure in Oracle Helidon's helidon-grpc-server component affect versions 3.0.0 through 3.2.21, where unauthenticated HTTP/2 requests can update, insert, or delete some Helidon-accessible data and read a subset of it. The CVSS 3.1 base score is 7.2 with a scope change, meaning effects may extend to other products sharing the environment. No public exploit identified at time of analysis.
Cross-origin access controls in the helidon-cors component of Oracle Helidon 3.0.0 through 3.2.21 can be bypassed by unauthenticated remote attackers over HTTP, enabling limited unauthorized reads and inserts, updates, or deletes of Helidon-accessible data. Oracle rates the flaw 7.2 High (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N); the scope change means applications and downstream products relying on Helidon CORS may also be affected. No public exploit identified at time of analysis, and real-world CORS abuse may depend on an authenticated victim's browser being induced to make a cross-origin request, so confirm the practical prerequisites against the final Oracle advisory.
Heap-based buffer overflow in Raptor RDF Syntax Library 2.0.15 and 2.0.16 allows unauthenticated remote attackers to corrupt heap memory, crash applications, and potentially execute code by supplying Turtle, TriG, N-Triples, or N-Quads documents containing a literal language tag of 256 bytes or longer. Exploitation is not automatic: the target application or service must parse the attacker-supplied RDF document, consistent with UI:P/UI:R in the assessed vectors. No public exploit code was identified at time of analysis, and a vendor patch is available via upstream commit 361a803a72817ae771db2438277229e6541e1575; the provided data does not specify an exact fixed release version.
Authenticated, low-privileged users of Oracle Report Manager in Oracle E-Business Suite 12.2.3 through 12.2.15 can read all data reachable by the component and partially degrade its availability by sending HTTPS requests against the Internal Operations component. Oracle rates this 7.1 (C:H/I:N/A:L) with low attack complexity and no user interaction, so the practical barrier is the requirement for a valid EBS/Report Manager login rather than any technical complexity. No public exploit code or CISA KEV entry was identified at time of analysis, and the supplied data contains no EPSS score.
SQL injection in the Sgalinski Cookie Consent extension for TYPO3 allows authenticated backend users with access to the consent-history or statistics module to inject unvalidated sorting, grouping, and index options into a database query, enabling arbitrary database reads that can include backend and frontend password hashes. The issue is privilege-gated: it requires a backend account granted those specific module permissions and the review/statistics feature in use, and no public exploit code was identified at time of analysis.
Exposure of a configured OpenAI API key in TYPO3 10 and 11 backend pages allows any authenticated backend user, including low-privilege editors, to retrieve the credential and use it at the site operator's expense. The issue affects installations of the TYPO3 AI Integration extension that have an API key configured; default installs without a key and unauthenticated or frontend-only users are not exposed. No public exploit was identified at time of analysis, and no CISA KEV entry was provided.
Missing authorization in the JSON configuration import of the Sgalinski Cookie Consent extension for TYPO3 lets a non-administrator backend user who already has access to the module import settings that inject arbitrary scripts into the website frontend. The issue is CWE-862 and is scored 7.1, with the supplied vector requiring authenticated backend access (PR:L) and no user interaction. No public exploit or CISA KEV entry was identified at time of analysis.
Authenticated low-privileged users with HTTP access to the Interoperability SEC component of JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 can read critical application data beyond their intended authorization scope and trigger a partial denial of service, as addressed in Oracle's October 2026 Critical Patch Update. The CVSS 3.1 score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L) reflects high confidentiality impact and low availability impact, gated only by the need for a valid low-privilege account and reachable integration endpoints. No public exploit code or confirmed active exploitation (CISA KEV) was identified at the time of analysis, and the tag 'Authentication Bypass' indicates the weakness is an authorization/access-control gap rather than a pre-auth entry point.
Authenticated low-privilege attackers can read critical PeopleSoft Enterprise PeopleTools data and partially disrupt availability through the Portal component in versions 8.61 through 8.63. Exploitation requires network HTTP access and a valid low-privilege PeopleSoft account (PR:L), but no user interaction and low attack complexity make it straightforward once that foothold exists; there is no KEV confirmation or public exploit identified at time of analysis. The authentication prerequisite keeps this below top-tier priority, though risk is highest where the Portal is internet-exposed and low-privilege or self-service accounts are widely provisioned.