Authenticated low-privileged users can corrupt or delete critical data in Oracle Partner Management, a module of Oracle E-Business Suite, across versions 12.2.3 through 12.2.15 by sending crafted HTTP requests to the Internal Operations component. Successful exploitation yields high integrity impact plus a partial denial of service, while confidentiality is unaffected (CVSS 3.1 base 7.1, AV:N/AC:L/PR:L/UI:N). No public exploit code or confirmed active exploitation was identified at time of analysis, and Oracle addresses the flaw through its October 2026 Critical Patch Update, so this is a routine-but-important patch item rather than an emergency.
Oracle Partner Management, a module of Oracle E-Business Suite (versions 12.2.3 through 12.2.15), exposes an integrity and partial availability flaw in its Internal Operations component that a low-privileged authenticated user can reach over HTTPS. Successful exploitation lets that account create, delete, or modify critical Partner Management data and trigger a partial denial of service, with no user interaction and low attack complexity once a valid session is held. No public exploit code or CISA KEV entry was identified at time of analysis, so this is a credible mid-tier priority for EBS deployments rather than an emergency - the main gate is possession of valid low-privileged credentials.
Oracle Solaris 11.4 can be driven into a complete denial-of-service condition and made to expose a limited subset of accessible data by a low-privileged attacker who can reach the Services component over HTTP. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H) gives a 7.1 score: a valid low-privileged Solaris account is required, but no user interaction is needed and attack complexity is low, so exposure is greatest where low-level accounts are widely provisioned or the HTTP Services endpoint is reachable from untrusted networks. No public exploit identified at time of analysis, and there is no CISA KEV confirmation; this is a moderate-priority issue rather than a top-tier emergency, with Oracle's October 2026 Critical Patch Update as the fix reference.
Local file inclusion in ArmorX Spam allows remote attackers with a valid low-privilege authenticated session to traverse directories and cause PHP include/require statements to load files outside the intended path, exposing sensitive local data. The issue is network-reachable and low-complexity but requires authentication (PR:L); no public exploit identified at time of analysis, and no CISA KEV entry is present. The assessed impact is high confidentiality loss only, with no integrity or availability impact.
Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 allow a low-privileged attacker with HTTP access to the Fabric Layer to create, delete, or modify critical data and cause a partial denial of service. The CVSS 3.1 vector requires a valid low-privileged account (PR:L) but no user interaction, and confidentiality is not affected. No public exploit code or confirmed active exploitation was identified at time of analysis, so priority is driven by exposure of low-privilege SOA accounts and the HTTP interface.
An authenticated low-privileged user with HTTP network access to the Oracle Mobile Field Service Admin UI in Oracle E-Business Suite 12.2.3 through 12.2.15 can escalate beyond their intended permissions, gaining the ability to create, delete or modify critical data and to read a subset of otherwise restricted data (CVSS 3.1 base score 7.1, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N). The flaw is easy to trigger once an attacker holds any valid low-privilege EBS account, but that authentication prerequisite is the main limiting factor, and exposure is largely determined by whether the Admin UI is reachable from untrusted networks. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; Oracle addresses the issue through its Critical Patch Update of October 2026 (https://www.oracle.com/security-alerts/cpuoct2026.html), and EUVD (EUVD-2026-106067) corroborates the 12.2.3-12.2.15 affected range.
Authenticated low-privileged users can create, delete, or modify critical Oracle Sales Online data and read a subset of that data in Oracle E-Business Suite 12.2.3 through 12.2.15 via the Internal Operations component over HTTP. Rated CVSS 7.1 with high integrity and low confidentiality impact, this is a moderate-priority access-control weakness rather than a top-tier emergency; no public exploit was identified at time of analysis and it is not in CISA KEV. Exploitation requires a valid low-tier EBS account, so internet-facing deployments with broadly provisioned self-service users carry the widest realistic exposure.
Oracle Siebel CRM Deployment (Server Infrastructure component) versions 17.0 through 26.9 allow a low-privileged authenticated user with HTTP network access to read critical data and partially modify records they should not be able to touch, yielding a CVSS 3.1 score of 7.1 (C:H/I:L/A:N). The weakness is an authorization/access-control failure rather than an authentication bypass, so exploitation requires the attacker to already hold a valid low-privileged account; no user interaction is needed and attack complexity is low. No public exploit code or CISA KEV entry is associated with this CVE at time of analysis, so exposure is bounded by the number of provisioned accounts and whether the Siebel HTTP interface is reachable from untrusted networks.
Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 contain an improper access control weakness in the Fusion Middleware Fabric Layer that lets a low-privileged, network-positioned attacker read and partially modify data beyond their intended authorization. Exploitation is over HTTP, requires only a valid low-privilege account (PR:L) and no user interaction, yielding high confidentiality impact plus limited integrity impact for a CVSS 3.1 base score of 7.1 (High). No public exploit code or confirmed active exploitation was identified at time of analysis, though the low attack complexity and the prevalence of internet-facing SOA Suite consoles make exposed Fabric Layer endpoints an attractive target.
Oracle General Ledger 12.2.3 through 12.2.15 allows an authenticated low-privileged attacker with HTTP network access to create, delete, or modify critical ledger data, read a subset of data, and cause a hang or repeated crash. Exploitation is constrained by high attack complexity and the need for a valid E-Business Suite account, so it is not reliably repeatable against default deployments. No public exploit code or confirmed active exploitation was identified at time of analysis.
Oracle HCM Common Architecture, the shared framework layer within Oracle E-Business Suite 12.2.3 through 12.2.15, exposes an Internal Operations component reachable over HTTP that a low-privileged authenticated user can abuse to read and modify critical HCM data and to partially degrade service availability. The defect is rated CVSS 3.1 7.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L), with the High attack complexity reflecting a precondition or environmental state the attacker does not control, which keeps reliable exploitation difficult even though no victim interaction is needed. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; Oracle published the fix in its October 2026 Critical Patch Update, so priority is real but second-tier relative to unauthenticated, low-complexity flaws.
Oracle Solaris 11.4's Image Packaging System (IPS) can be induced to act on attacker-influenced package content delivered over HTTP, giving a network-positioned, unauthenticated attacker high confidentiality impact and limited integrity impact (CVSS 3.1: 7.1 High, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N). The attacker must either control or compromise the repository the host queries, or intercept cleartext HTTP package traffic, and exploitation still requires a Solaris operator to perform a package operation against that content - the UI:R condition is the decisive exposure limiter. Only Solaris 11.4 is listed as affected per Oracle's October 2026 CPU and ENISA EUVD; no public exploit code was identified in the provided intelligence at time of analysis.
Unauthenticated remote attackers can reach the Integration Broker component of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 over HTTP and, by persuading a legitimate user to open a crafted link or act on an attacker-supplied request, obtain unauthorized read access to critical PeopleTools data plus limited unauthorized insert/update/delete capability. The mandatory user-interaction prerequisite (CVSS UI:R) keeps the attack from being an interaction-free, automatable mass-exploitation vector, and the impact is bounded to confidentiality (HIGH) and integrity (LOW) with no availability effect, giving a CVSS 3.1 base score of 7.1. Exploitation status: no public exploit identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV).
Low-privileged authenticated users of Oracle Primavera Unifier 23.12.0 through 23.12.16 can create, delete, or modify critical Project Control data, and read a subset of application data, by sending HTTP requests to the Project Control component - no user interaction or special configuration is required. Scoring 7.1 on CVSS 3.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N), the practical barrier is obtaining a valid low-privilege account rather than defeating authentication, which bounds exposure to instances reachable over the network with loosely controlled account provisioning. No public exploit code was identified at time of analysis and the issue is not in CISA KEV; this is a genuine but mid-tier priority that warrants patching on the normal Oracle CPU cadence.
Authenticated low-privileged users can alter or delete critical data and read limited data in Oracle Commerce Platform 11.4.0 through its Dynamo Commerce Server HTTP interface. The assessed CVSS 7.1 vector shows low attack complexity and no user interaction, but exploitation requires a valid account (PR:L), so anonymous compromise is not supported by the available data. No public exploit code or CISA KEV entry is identified at time of analysis, making this a moderate-priority patching item rather than an emergency.
Takeover of the Siebel CRM Development component (Workflow) is achievable by a low-privileged authenticated attacker who can persuade a second user to interact with crafted Workflow content over HTTP; supported releases 25.12 through 26.9 are affected. Oracle rates this CVSS 3.1 base 7.1, but the vector (AC:H/PR:L/UI:R) stacks valid credentials, victim-driven social engineering, and high attack complexity, so it is a moderate-priority hardening item rather than an emergency. No public exploit code or active exploitation has been identified at time of analysis, and the issue is addressed through Oracle's Critical Patch Update program.
Unauthorized read of critical Oracle Purchasing data, plus limited insert/update/delete capability, is achievable by a low-privileged authenticated user of Oracle E-Business Suite 12.2.3 through 12.2.15 who can reach the Internal Operations component over HTTP and satisfy non-trivial preconditions (high attack complexity). Scope is changed, so a successful attack can ripple into other Oracle products sharing the EBS deployment rather than staying confined to Purchasing. No public exploit code has been identified at time of analysis and the issue is not known to be actively exploited, which keeps it a moderate-priority patching item worked through the normal Critical Patch Update cycle rather than an emergency.
Arbitrary file read in Dockhand before 1.0.46 lets authenticated non-admin users holding the stacks:edit permission read sensitive files such as /etc/shadow, /etc/passwd, .git/config credentials, and SSH keys through the path parameter of /api/system/files/content. The flaw is a CWE-863 authorization failure scored 7.1 (High) under CVSS 4.0, and exposure is limited by the requirement for a prior authenticated account with stacks:edit; reads are confined to files the Dockhand container process can access. No public exploit identified at time of analysis, and the vendor-released patch is version 1.0.46.
Unauthenticated attackers with access to the same layer-2 network segment as a MySQL Server or MySQL Cluster node running the Group Replication plugin can trigger a hang or frequently repeatable full crash (denial of service) and make limited unauthorized data changes, yielding a 7.1 CVSS score (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H). Exposure is narrow by design: the Group Replication plugin must be actively configured as part of a replication topology, which is not the default for standalone installations, and the attacker must sit on the adjacent broadcast domain or VLAN rather than reaching the host over the internet. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV; the practical risk is bounded far more by network adjacency and the non-default clustering configuration than by the raw score.
Oracle E-Business Suite releases 12.2.3 through 12.2.15 expose Installed Base records to any low-privileged application user who can reach the Data Provider UI component over HTTP, allowing broad reads of critical data plus limited unauthorized inserts, updates, and deletes (CVSS 3.1 base score 7.1, C:H/I:L/A:N). Exploitation requires only a valid EBS account (PR:L) and network reach to the module - no user interaction and no special conditions - so the practical exposure is highest where self-registered, partner, or contractor accounts exist or where the Installed Base UI is internet-facing. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, but Oracle CPU patches should be scheduled on a normal priority rather than deferred indefinitely, since the weakness is trivially triggerable once credentials are held.
Improper authorization in Oracle E-Business Suite iSupport (12.2.3 through 12.2.15) allows a low-privileged, authenticated user with HTTP network access to create, delete, or modify critical iSupport data and to read a limited subset of that data, yielding a CVSS 3.1 base score of 7.1 (C:L/I:H/A:N). Exploitation is considered easy (AC:L, UI:N) but is not pre-authentication: the attacker must already hold a valid low-privilege account, such as a registered self-service/customer user, despite the 'Authentication Bypass' tagging seen in intelligence feeds. No public exploit code or CISA KEV listing was identified at time of analysis, so this is a mid-to-high priority patching item rather than an emergency.
Access-control bypass in Oracle Siebel CRM Deployment 17.0 through 26.9 allows an authenticated local low-privileged user on the Siebel host to read or modify critical data through the Server Infrastructure component. The CVSS 3.1 vector requires local access and a valid low-privileged logon (AV:L/PR:L/UI:N), with high confidentiality and integrity impact but no availability impact. No public exploit code or CISA KEV activity was identified at time of analysis, and EPSS was not supplied.
Oracle IDM Connector 12.2.1.4.0 and 14.1.2.1.0 contains a locally exploitable flaw in its Generic REST component that lets an attacker with an existing low-privileged logon on the connector host read, create, delete, or modify critical connector-accessible data (CVSS 3.1 base 7.1; C:H/I:H). The vector is AV:L/PR:L/UI:N, so exploitation is not remote or unauthenticated; the 'Authentication Bypass' tag is inconsistent with the PR:L requirement and should be verified against Oracle's advisory. No public exploit code or CISA KEV entry was identified at time of analysis.
Local low-privileged users with logon access to hosts running Oracle E-Business Suite Applications DBA 12.2.3 through 12.2.15 can abuse the AD Utilities component to read, create, delete, or modify critical application data. The assessed CVSS 3.1 score is 7.1 High with AV:L/PR:L/UI:N and high confidentiality and integrity impact, while availability is unaffected; exploitation requires an existing local account and no user interaction. No public exploit code or confirmed active exploitation was identified at time of analysis.
A local privilege-escalation weakness in the Enterprise Infrastructure SEC component of Oracle JD Edwards EnterpriseOne Tools (9.2.0.0 through 9.2.26.5) lets an attacker who already holds a valid low-privileged logon on the host where the Tools run read and modify critical application data, delivering a high confidentiality and integrity impact with no availability effect (CVSS 3.1 base 7.1). Because exploitation is local (AV:L) and requires authenticated low-privileged access (PR:L), it is primarily a post-compromise or insider-abuse risk rather than an internet-facing one; no public exploit code and no confirmed active exploitation were identified at time of analysis. The vendor notes the issue is easily exploitable once such access exists, so any shared or multi-tenant host running an unpatched Tools version should be treated as exposed to its own low-privileged users.
Caller-influenced prompt text in virtualenv's bash activation script prior to 21.14.9 can be re-expanded by bash as executable shell syntax, so a crafted --prompt value (or an environment name feeding it) can run arbitrary commands in the victim's shell when the environment is activated and the prompt is drawn. The flaw is local and interaction-dependent: the attacker must first supply the prompt string, the victim must source bin/activate under bash and cause a redraw, and bash must be in a state that re-expands PS1 (promptvars enabled, POSIX mode, or an older BASH_COMPAT level) - zsh and POSIX shells such as dash are not affected. The project shipped a fix in 21.14.9 via upstream PR #3418 and commit 5f48d711; there is no EPSS score, no CISA KEV listing, and no public exploit identified at time of analysis, and the CVSS 4.0 vector (7.1, AV:L/AC:H/AT:P/PR:N/UI:A) reflects that high preconditions bar.
A code injection flaw in PyPA virtualenv before 21.14.9 lets attacker-influenced non-ASCII characters in the xonsh prompt or environment destination path break out of a generated Python literal and inject statements into activate.xsh. Exploitation is highly conditional: it requires the xonsh shell, the script being read under a legacy multibyte codec such as GBK or Big5 via $XONSH_ENCODING, attacker control over the prompt or path data, and the victim actively sourcing the generated script, so realistic risk is moderate rather than urgent. The issue is fixed in 21.14.9, which writes prompt and path literals as ASCII escapes; no public exploit code was identified at time of analysis.
Oracle Identity Manager Connector (LDAP Gateway component) in versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged user who already has interactive logon to the connector host to read, create, delete, or modify all data reachable through the LDAP Gateway, per Oracle's October 2026 Critical Patch Update. The 7.1 score reflects high confidentiality and integrity impact with no availability impact (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), so exploitation is straightforward but strictly gated behind existing local access and low-level privileges, making this a bounded insider or post-compromise risk rather than a remote threat. No public exploit code and no confirmed active exploitation were identified at time of analysis.
filelock's SQLite-backed ReadWriteLock (versions 3.20.4 through 4.2.0) can be tricked into overwriting or unlinking the side files SQLite keeps next to a locked database, and - when a writable hot journal is also present - into writing attacker-chosen content into that database. This is a genuine but conditional local-privilege issue rather than a widespread remote threat: it requires an existing low-privileged local account with rename/write access in a non-sticky parent directory at or above the database path, and it is a timing-sensitive race that does not apply when every parent directory is owned by the locking account or root and is either non-group/other-writable or carries the sticky bit. No public exploit identified at time of analysis and no CISA KEV entry; vendor-released patch: 4.2.1.
Stored cross-site scripting in the Stormshield Network Security (SNS) captive/enrollment portal lets an attacker on the adjacent network submit a crafted user-creation request whose payload is persisted and later rendered in the administrator's management interface when the enrollment record is validated. No prior authentication is required to submit the request, but the payload stays dormant until an administrator manually opens and validates it, so successful exploitation depends on a privileged human action (UI:R) at high attack complexity (AC:H); script execution in the administrator's session can yield high confidentiality and integrity impact with scope change into the management UI. Exploitation also requires that the captive portal be enabled and configured to accept user self-enrollment requests. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor's CVSS 3.1 score of 7.1 (High) overstates practical urgency once the vector is decomposed.
Authenticated users with view-draft access can permanently break request handling across the entire ApostropheCMS Node.js process by sending a piece-type REST GET request whose `project` query contains an exclusion key such as `constructor.prototype.hasOwnProperty`. The malicious key reaches the SQLite, PostgreSQL, or multipostgres adapter's `unsetNestedField` helper, which walks the dotted path into `Object.prototype` and deletes a shared runtime method - surviving beyond the request and requiring a process restart to recover. Exploitation requires a logged-in account (every editing role has view-draft; guestApiAccess reduces this to any logged-in user) and a SQL-backed adapter with a matching document; installations on the default MongoDB adapter are not affected. No public exploit code or KEV-listed active exploitation was identified at time of analysis.
Authenticated users on Moodle instances running the Configurable Reports block before 5.3.0 can read restricted SQL reports containing user and grade data by supplying arbitrary report IDs to the block_configurable_reports_get_report_data web service. The CWE-863 authorization bypass occurs because a failed check_permissions call adds only a warning and still returns the full report table, so any valid logged-in account can access reports without the required permissions when Moodle web services are enabled. Exploitation requires a valid login but no elevated role, impact is read-only confidentiality loss, and no public exploit identified at time of analysis.
Heap-based out-of-bounds write in the Eclipse ThreadX GUIX binary resource (font) loader: a font page header declaring first_glyph greater than last_glyph underflows the glyph count (CWE-190), the count-times-record-size allocation multiply then wraps to a small value, and the load pass writes attacker-controlled glyph records past the end of the undersized buffer. Exploitation requires the target embedded application to load an attacker-supplied or tampered GUIX binary font resource - the assessed vector is local (AV:L) with high attack complexity and required user/application interaction - so realistic exposure is limited to devices that parse externally sourced or updatable GUIX resources rather than fixed build-time font assets; no public exploit code or confirmed active exploitation was identified at time of analysis. Successful corruption can yield code execution, data disclosure, or denial of service in the GUIX process context (CVSS 4.0 base 7.1).
Denial of service and limited data access in MySQL Cluster 26.7.0 and 26.7.1 can be triggered by an unauthenticated attacker with TCP network access to the Cluster: General component. A successful attack can hang or repeatedly crash the cluster (complete availability loss) and expose or modify a subset of cluster-accessible data, with CVSS 3.1 score 7.0. The high attack complexity and the typical deployment of MySQL Cluster on segmented internal networks reduce practical exposure; no public exploit was identified at time of analysis.
Unauthenticated HTTP requests into Oracle Helidon 4.0.0 through 4.5.5 and 27.0.0 can be shaped to create, delete, or modify critical application data through the helidon-common-mapper component, with secondary limited read access and a partial denial-of-service effect. Oracle scores it 7.0 with high attack complexity (AC:H), meaning the attacker must satisfy conditions outside their direct control before a crafted request succeeds, so this is a serious but not trivially repeatable flaw. No public exploit code identified at time of analysis, and no EPSS score was provided with the available data.
Oracle Java SE (8u503/8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, and 27), GraalVM for JDK 17.0.20.1/21.0.12.1, and GraalVM Enterprise Edition 21.3.19.1.1 contain a moderate-priority, difficult-to-exploit flaw in the 2D component that unauthenticated remote attackers can reach through APIs processing attacker-supplied data. Successful exploitation can repeatedly hang or crash the JVM (complete denial of service) and may allow limited unauthorized reads and updates of accessible data. No public exploit code or CISA KEV entry was identified at time of analysis; Oracle addresses the issue in its October 2026 Critical Patch Update.
Local privilege escalation in Oracle Applications DBA (the AD Utilities component of Oracle E-Business Suite) affects versions 12.2.3 through 12.2.15 and lets a low-privileged user who already holds an interactive logon on the database/application tier host elevate to full control of the Applications DBA tooling, with high confidentiality, integrity and availability impact (CVSS 3.1 base 7.0). Exploitation is gated: the vector is AV:L/AC:H/PR:L/UI:N, so the attacker must first obtain a local account on the infrastructure where AD Utilities runs and must satisfy conditions Oracle describes as 'difficult to exploit', making this primarily an insider or post-compromise escalation risk rather than an external attack path. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Local privilege escalation in Oracle E-Business Suite Applications DBA (AD Utilities) versions 12.2.3 through 12.2.15 allows an attacker who already has a low-privileged logon on the host to take over the Applications DBA component, with high confidentiality, integrity, and availability impact. Exploitation is rated difficult (AC:H) and requires authenticated local access (PR:L) with no user interaction; no public exploit identified at time of analysis.
Full compromise of Oracle PeopleSoft Enterprise PeopleTools 8.61-8.63 is achievable through its SQR reporting component, but only under narrow conditions: the attacker must already hold a logon account on the host where PeopleTools executes and must induce a different user to perform an action. Oracle scores this 7.0 High (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H), with high attack complexity and a human-interaction requirement that make it a moderate-priority issue rather than an urgent, mass-exploitation threat. No public exploit code or confirmed active exploitation was identified at time of analysis, and PR:N indicates that no PeopleSoft application authentication is needed once local host access has been obtained.
Local takeover of Oracle Application Testing Suite 13.3.0.1 via its OpenScript component allows an authenticated low-privileged user with logon access to the host to compromise the application, with high confidentiality, integrity, and availability impact. Exploitation is difficult (AC:H, described by Oracle as 'difficult to exploit') and requires local access plus a valid low-privileged account, making this a genuine-but-moderate-priority issue rather than a top-tier emergency. No public exploit code or CISA KEV entry was identified at time of analysis.
Local, low-privileged attackers with logon access to the host running Oracle Agile Engineering Data Management 6.2.1 can exploit the Engineering Communication Interface to achieve full takeover of the product, with high impact to confidentiality, integrity, and availability. Exploitation requires authenticated local access and high attack complexity, which limits reliability, and no public exploit code has been identified at time of analysis. This is a high-severity but non-remote issue confined to version 6.2.1.
Oracle Inventory Management 12.2.3 through 12.2.15 can be fully taken over by an authenticated low-privileged attacker who can log on locally to the infrastructure running Oracle E-Business Suite, through a high-complexity flaw in the Internal Operations component. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.0) reflects mandatory local access and conditions outside the attacker's control, so exploitation is difficult and Oracle labels it accordingly. No public exploit code or CISA KEV entry was identified in the supplied intelligence at time of analysis, and no EPSS score was provided.
Product takeover is possible in Oracle Payroll 12.2.3 through 12.2.15, where a low-privileged attacker who can log on locally to the infrastructure hosting the application can exploit a difficult-to-control condition to fully compromise Payroll confidentiality, integrity, and availability. The CVSS 3.1 score is 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), confirming authentication with low privileges is required and that the attack is not network-reachable. No public exploit code or confirmed active exploitation was identified at time of analysis.
Takeover of Oracle BI EE 12.2.1.4.0 is possible for an authenticated, low-privileged attacker who already has local logon to the infrastructure hosting the BI Foundation component, though high attack complexity makes reliable exploitation dependent on conditions beyond the attacker's control. The issue carries CVSS 3.1 base score 7.0 with full confidentiality, integrity, and availability impact, but it is not remotely or unauthenticated exploitable. No public exploit is identified at time of analysis, so risk is concentrated on hosts where semi-trusted users hold local accounts.
Stored cross-site scripting in Stormshield Network Security’s captive/enrollment portal allows an unauthenticated remote attacker to submit a certificate-creation request containing a persistent payload that executes when an administrator opens and validates the pending request. The flaw is rated CVSS 7.0 (High) by the vendor, while the independent assessment scores it AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N because exploitation depends on the portal being reachable and on administrator validation of the attacker’s specific request. No public exploit identified at time of analysis, and the provided intelligence does not confirm active exploitation (CISA KEV).
Integer overflow in the Eclipse ThreadX module manager lets a loaded module under-allocate an object-pool block and corrupt the adjacent byte-pool block. When a module calls txm_module_object_allocate with an object_size near ULONG_MAX, the manager's unchecked addition of its fixed 16-byte private header wraps, so the pool serves a block smaller than the header and the subsequent header write spills past its end into the neighbouring allocation. The issue is locally exploitable by a low-privileged attacker who already has code running inside a loaded module, affects only builds that compile in and use the ThreadX module subsystem, requires no user interaction, and no public exploit code was identified at time of analysis (no CISA KEV listing was provided).
Server-side request forgery in a2a-rs 0.4.0 through 0.4.3 lets unauthenticated remote clients steer the A2A server's push-notification sender at arbitrary destinations - loopback (127.0.0.1/::1/localhost), RFC 1918 and IPv6 ULA private ranges, link-local and multicast addresses, cloud metadata endpoints such as 169.254.169.254 and metadata.google.internal, or non-HTTP schemes - by submitting a crafted TaskPushNotificationConfig. The CNA rates it 6.9, and exploitation is conditional on push notifications actually being enabled via with_push_notifications, with the SSRF being effectively blind because the outbound webhook response is not reflected back to the attacker. An upstream fix exists as commit 2ba50176 (PR #124); no public exploit code or CISA KEV entry was identified at time of analysis.
Heap memory disclosure in Advantech ADAM-3600 industrial remote terminal units lets remote attackers read beyond the bounds of allocated heap buffers and exfiltrate whatever sensitive data resides in adjacent memory. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:L only) indicates the flaw is reachable over the network without authentication or user interaction against an exposed device, but impact is confined to confidentiality - no integrity or availability effect. No public exploit code and no confirmed active exploitation were identified at time of analysis; realistic risk is governed less by the software flaw than by whether the RTU is reachable from an untrusted network, since these OT devices are normally shielded by ICS segmentation.
Server-side request forgery in the TYPO3 extension Kitodo.Presentation allows unauthenticated remote attackers to make the web server issue arbitrary HTTP requests through the extension's public URL-fetching proxy endpoint, because one HTTP request method skips the authorization check that guards the other methods. The attacker controls the target URL and receives back the resulting status code and a limited set of response headers, which is enough to probe internal hosts and ports and map reachable services, though response bodies are explicitly not returned. Scored 6.9 under CVSS 4.0 (AV:N/AC:L/AT:N/PR:N/UI:N, with only low confidentiality impact), the flaw is trivially triggerable by remote attackers who can reach the endpoint; no public exploit code or confirmed active exploitation was identified at time of analysis.
CAPTCHA bypass in the TYPO3 accessible_form_captcha extension allows automated clients to defeat the challenge by extracting the correct answer from the CAPTCHA image data, because the audio accessibility feature that embeds the answer is enabled by default. Any TYPO3 form that relies on this extension as its sole anti-automation control is exposed to bot-driven abuse; impact is limited to integrity of the CAPTCHA check (no data disclosure or service disruption), and no public exploit code was identified at time of analysis. The flaw is rated moderate severity (CVSS 3.1: 6.9, AV:N/AC:L/PR:N/UI:N with I:L only).