Unauthenticated remote takeover of Oracle Data Integrator 12.2.1.4.0 and 14.1.2.0.0 is possible through the ODI Console / Repository Explorer over HTTP, as addressed in Oracle's October 2026 Critical Patch Update. The CVSS 3.1 score is 9.8 with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning no authentication, no user interaction, and high confidentiality, integrity, and availability impact. No public exploit code or CISA KEV confirmation was identified in the supplied intelligence at time of analysis, but internet-exposed ODI Console instances are high priority because the assessed limiting factor is network reachability rather than any special configuration.
Unauthenticated remote takeover of Oracle Data Integrator is possible through the Console / Repository Explorer RMI interface on versions 12.2.1.4.0 and 14.1.2.0.0, with CVSS 3.1 score 9.8 reflecting high confidentiality, integrity, and availability impact. Attackers with network reachability to the RMI listener need no credentials or user interaction; the primary exposure constraint is whether that listener is reachable across network boundaries. Exploitation status: no public exploit identified at time of analysis.
Full system takeover of Oracle Solaris 11.3 and 11.4 is possible for unauthenticated network attackers who can reach the Image Packaging System (IPS) HTTP service, with high confidentiality, integrity, and availability impact. The 9.8 CVSS score reflects network reachability with low attack complexity, no privileges, and no user interaction, but practical exposure depends on whether the IPS endpoint is accessible from an attacker-reachable network path. No public exploit code or CISA KEV entry was identified at time of analysis.
Unauthenticated network attackers can take over Oracle Communications BRM Elastic Charging Engine 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, and 15.2.0.0.0 by reaching the Java RMI interface used in cloud-native deployments; CVSS 3.1 is 9.8 with high confidentiality, integrity, and availability impact and no privileges or user interaction required. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was provided, so practical risk is driven mainly by whether the RMI listener is exposed beyond trusted telecom back-office/OSS-BSS networks.
Remote unauthenticated takeover of Oracle Essbase 21.8.3.0.0 is possible through the TCP-exposed Security component, with CVSS 3.1 scoring 9.8 and high confidentiality, integrity, and availability impact. Exploitation needs only network reachability to the affected service, no credentials, and no user interaction, so internet-facing or broadly reachable Essbase deployments carry the greatest risk. No public exploit code or CISA KEV entry was identified in the supplied intelligence at time of analysis.
Remote, unauthenticated takeover of Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 is possible when attackers can reach the T3 or IIOP listener used by the End User Self Service component. Oracle rates this 9.8 with no credentials, no user interaction, and no non-default configuration required, so default deployments are exposed if those protocols are network-reachable. No public exploit was identified at time of analysis, but risk is highest where T3/IIOP are internet-facing or broadly reachable from untrusted segments.
Unauthenticated network access to the LDAP Gateway in Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0 can result in full compromise of the connector, with high confidentiality, integrity, and availability impact (CVSS 9.8). The vector is AV:N/AC:L/PR:N/UI:N, so reachability of the LDAP service is the main prerequisite; deployments that expose it only to trusted networks materially reduce exposure. No CISA KEV status is supplied and no public exploit identified at time of analysis, but the severity and ease of exploitation warrant urgent patching or network restriction.
Remote unauthenticated takeover of Oracle Solaris 11.4 is possible through a flaw in the 'Utility' component, which exposes a network-reachable TCP service to attackers with no credentials or user interaction. Oracle rates the issue CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting full confidentiality, integrity, and availability impact; the precise protocol, port, and vulnerable service configuration are not named in the available data and must be confirmed against the Oracle CPU October 2026 advisory. No public exploit code or CISA KEV entry was identified in the provided intelligence at time of analysis.
Unauthenticated attackers can bypass JWT signature verification in Eclipse ioFog Controller 3.8.0 through 3.9.1 on the operator WebSocket upgrade handlers for the exec and log routes, allowing them to open privileged sessions for any microservice or fog node whose UUID they know. By crafting a token with an 'admin' group claim, the attacker matches the built-in admin role without needing an account or RoleBinding. No public exploit identified at time of analysis, but the flaw is rated CVSS 9.8 and requires immediate attention.
Arbitrary code execution outside the renderer sandbox in Google Chrome prior to 156.0.8078.47 can be triggered when a victim loads a crafted HTML page that corrupts memory in Chrome's Network component. The assessed CVSS vector requires user interaction and high attack complexity but no authentication (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H), and successful exploitation would bypass the normal need for a separate sandbox-escape chain. Google rates the Chromium severity as Medium; no public exploit code was identified at time of analysis, and patched builds are not affected.
Memory corruption in Google Chrome's Compositing component before 156.0.8078.47 can let an unauthenticated remote attacker potentially execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page. The issue requires user interaction to open the malicious content and, per independent assessment, has high practical attack complexity because reliable heap manipulation and defeat of sandbox/ASLR mitigations are needed. No public exploit was identified at time of analysis, and the vendor has released a fixed build.
Sandbox escape and code execution in Google Chrome's Privacy component allows remote attackers to run arbitrary code outside the browser sandbox when a victim renders a crafted HTML page, affecting all Chrome builds prior to 156.0.8078.47. Exploitation requires user interaction (CVSS UI:R) and no authentication (PR:N), yet the resulting scope change (S:C) lets a renderer-level flaw compromise the host - Google rates it Chromium security severity Medium, suggesting lower exploit reliability than the 9.6 base score implies. No public exploit code or CISA KEV listing was identified at time of analysis, and a vendor patch is available.
Out-of-bounds write in Google Chrome's Forms component before version 156.0.8078.47 allows a remote, unauthenticated attacker to potentially execute arbitrary code outside the sandbox when a victim opens a crafted HTML page. Exploitation requires the victim to navigate to the malicious page (UI:R); no public exploit code or confirmed active exploitation was identified at time of analysis, and Google rates the Chromium security severity as Low despite the 9.6 CVSS score. Vendor-released patch: 156.0.8078.47.
Sandbox escape in Google Chrome on Windows (versions prior to 156.0.8078.47) lets a remote attacker who lures a victim to a crafted HTML page trigger memory corruption in the CredentialProvider component and potentially execute code outside the Chrome sandbox. The attack is unauthenticated (PR:N) but requires user interaction (UI:R) - the victim must navigate to attacker-controlled content - and is confined to the Windows platform on unpatched builds. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, though the vendor rates the underlying bug only 'Medium' (Chromium security severity) while the CVSS 3.1 vector scores 9.6 with a scope change (S:C), a discrepancy that reflects Google's typical treatment of sandbox-escape primitives that must be chained with a separate renderer compromise to achieve full code execution.
Use-after-free in Google Chrome's Internals component before 156.0.8078.47 allows a remote attacker to escape the browser sandbox and execute arbitrary code when a victim loads a crafted HTML page. The flaw is unauthenticated from the attacker's perspective but requires victim interaction (UI:R), and the scope change plus high confidentiality, integrity, and availability impact produce a Critical 9.6 base score. No public exploit code or confirmed active exploitation was identified at time of analysis; Google has released the fixed 156.0.8078.47 build.
Use-after-free in Google Chrome's WebAppInstalls (web app / PWA installation) component affects versions prior to 156.0.8078.47 and can let a remote attacker who convinces a victim to open a crafted HTML page potentially execute arbitrary code outside the browser sandbox. The CVSS 3.1 base score is 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), driven by the scope change and high confidentiality, integrity and availability impact, although Google assigns only a Medium Chromium security severity and frames code execution as 'potential' because it depends on reliably reclaiming freed memory after the free. No public exploit code or CISA KEV entry was identified at time of analysis, and the mandatory user interaction (UI:R) rules out fully autonomous, unattended exploitation; the vendor-released fix is Chrome 156.0.8078.47.
Improper input validation in ANGLE, Chrome's default graphics translation layer, allows a remote unauthenticated attacker who persuades a Windows user to open a crafted HTML page to potentially execute arbitrary code outside the browser sandbox in Google Chrome builds prior to 156.0.8078.47. The CVSS 3.1 base score is 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), reflecting mandatory user interaction offset by a scope change that carries impact beyond the renderer boundary; the flaw carries a Chromium security severity of High and is enabled by default on all Windows installs. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so the risk is driven by default-configuration exposure and the sandbox-escape potential rather than confirmed active exploitation.
Potential out-of-sandbox code execution in Google Chrome desktop stable releases before 156.0.8078.47 is reachable when a user opens an attacker-crafted HTML page, requiring user interaction but no authentication. The CVSS 9.6 scope-changed score reflects high confidentiality, integrity, and availability impact, but Chromium rates the issue Medium and the advisory describes out-of-sandbox execution as potential rather than demonstrated; a vendor patch is available in 156.0.8078.47, and no public exploit identified at time of analysis.
Memory corruption in Google Chrome's ServiceWorker implementation before 156.0.8078.47 can allow a remote attacker who persuades a user to load crafted HTML to potentially execute arbitrary code outside the browser sandbox. The flaw needs no target credentials but requires user interaction (UI:R) and affects default Chrome configurations; CVSS 3.1 scores it 9.6 due to scope change and high confidentiality, integrity, and availability impact, and exploitation status is no public exploit identified at time of analysis.
Use-after-free in Google Chrome Core before 156.0.8078.47 allows a remote, unauthenticated attacker to execute arbitrary code outside the renderer sandbox when a victim loads a crafted HTML page, with the required user interaction being the main limiting factor. Default desktop Chrome installations on affected versions are exposed if a user visits the malicious page; successful exploitation crosses the sandbox boundary and can affect the host. Vendor-released patch: 156.0.8078.47, and no public exploit identified at time of analysis.
Memory corruption in the DevTools component of Google Chrome prior to 156.0.8078.47 lets a remote attacker who convinces a victim to load a crafted HTML page execute arbitrary code outside the browser sandbox (a scope change from the renderer into the host environment). Exploitation is materially constrained: the defect lives in DevTools rather than the normal rendering path, so the victim must have DevTools open or active while loading the malicious page - which is why Chromium assigns this a 'Low' security severity despite a 9.6 CVSS base score, and our own assessment raises attack complexity to High for the same reason. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis; the vendor-released fix is Chrome 156.0.8078.47.
Improper input validation in Chrome's PrintPreview component (versions prior to 156.0.8078.47) lets a remote attacker who convinces a victim to open a crafted HTML page and invoke print preview escape the renderer sandbox and potentially execute arbitrary code outside it. The CVSS 3.1 vector scores 9.6 Critical: network reachable, low complexity, no privileges required, but user interaction (UI:R) and changed scope (S:C) reflecting the sandbox escape. No public exploit code or confirmed active exploitation was identified at time of analysis; vendor-released patch version 156.0.8078.47 is available.
Improper input validation in Google Chrome's Extensions subsystem, affecting builds prior to 156.0.8078.47, can let a remote attacker who persuades a victim to render a crafted HTML page potentially escape the browser sandbox and run arbitrary code at the operating-system level, rather than inside the renderer's restricted environment. The attack requires user interaction (the victim must navigate to or load the attacker-supplied content) but no authentication or prior privileges, and the CVSS 3.1 vector is unusually severe for a Chrome bug at AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H (9.6) because the scope change reflects crossing from the browser process into the host OS - yet Google's own Chromium severity rating for this issue is Low, and the advisory's wording is 'potentially execute arbitrary code,' indicating the escape is not deterministic and may hinge on additional runtime conditions. At the time of analysis there is no public exploit code identified and no CISA KEV listing, and a vendor patch exists in Chrome 156.0.8078.47, distributed through Chrome's automatic update channel, which materially shortens the realistic exposure window.
Improper input validation in Google Chrome's Date handling lets a remote, unauthenticated attacker potentially execute arbitrary code outside the browser sandbox when a victim opens a crafted HTML page in any build prior to 156.0.8078.47. Google rates the Chromium security severity as High and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) reflects full confidentiality, integrity and availability impact with changed scope, meaning the compromise can escape Chrome's normal trust boundary. The only real prerequisite is user interaction - the target must be lured to attacker-controlled web content - and patched builds plus ChromeOS/desktop channel updates remove the condition; no public exploit code or CISA KEV listing was identified at time of analysis.
Use-after-free in Google Chrome's PerformanceAPIs - the Performance, PerformanceObserver and performance timing interfaces - allows a remote, unauthenticated attacker who gets a victim to load a crafted HTML page to potentially execute arbitrary code outside the browser sandbox on Chrome builds prior to 156.0.8078.47. The only prerequisite is that the user navigate to (or be redirected to) attacker-controlled content (UI:R, PR:N), and changed-scope scoring drives the CVSS to 9.6 - a number that must be read alongside Google's own Chromium severity rating of Medium and the assessment's caveat that the sandbox escape is described as potential rather than confirmed. Vendor patch is available; no public exploit was identified at time of analysis, and there is no CISA KEV confirmation of active exploitation.
Memory corruption in Google Chrome's CSS engine allows a remote, unauthenticated attacker to potentially execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page; affected builds are Chrome desktop and ChromeOS prior to 156.0.8078.47. Exploitation requires user interaction because the victim must render the malicious page, and no public exploit was identified at time of analysis. Google rates the issue Critical (CVSS 9.6) and has released a fixed version.
Use-after-free in Google Chrome for Android before 156.0.8078.47 can allow a remote, unauthenticated attacker to potentially execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page. The CVSS 3.1 score is 9.6 (Critical), driven by the scope change reflecting a sandbox escape, although Chromium rates the flaw Medium and the vendor describes code execution outside the sandbox as potential. Exploitation requires user interaction to load the crafted page; no public exploit code or active exploitation has been identified at time of analysis.
Arbitrary code execution outside the sandbox is possible in Google Chrome prior to 156.0.8078.47 because of a use-after-free in the V8 JavaScript engine. An unauthenticated remote attacker can lure a victim to a crafted HTML/JavaScript page; successful exploitation can corrupt V8 memory and execute code on the host beyond the renderer sandbox. Google has released 156.0.8078.47 to address it, and no public exploit identified at time of analysis.
Memory corruption in the Prompts component of Google Chrome for Android before 156.0.8078.47 can allow a remote, unauthenticated attacker to execute arbitrary code outside the sandbox when a victim loads a crafted HTML page. The CVSS 3.1 score is 9.6 because of the scope change and high confidentiality/integrity/availability impact, even though Google assigns a Medium Chromium severity; exploitation requires user interaction, and no public exploit code or CISA KEV entry is identified in the provided data. Google has released 156.0.8078.47 as the vendor-fixed version.
Memory corruption in the WebAppInstalls component of Google Chrome for Android before 156.0.8078.47 can be triggered when a user opens an attacker-crafted HTML page, potentially allowing remote code execution outside the browser sandbox. No authentication is required, but exploitation depends on user interaction, is limited to Android builds below the fixed version, and our assessment applies AC:H despite the mechanical 9.6 CVSS score. No public exploit has been identified at time of analysis, and Google rates the Chromium issue Low, so the conflicting severity signals should be reconciled before treating this as a high-urgency RCE campaign.
Signals conflict and that conflict is the headline: CVE-2026-113138 is a memory-corruption flaw in Google Chrome's WebAppInstalls component affecting versions prior to 156.0.8078.47, with a CVSS 3.1 score of 9.6 but a Chromium vendor severity of Medium. An unauthenticated remote attacker can trigger the flaw when a victim loads crafted HTML (UI:R), potentially achieving code execution outside the sandbox, although the vendor's wording and Medium rating indicate host compromise likely depends on additional sandbox-escape chaining rather than being guaranteed. Vendor-released patch: 156.0.8078.47; no public exploit was identified at time of analysis.
Memory corruption in Google Chrome's PolicyContainer component affects desktop builds prior to 156.0.8078.47 and can allow a remote attacker to potentially execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page. Exploitation requires the target to actively visit attacker-controlled content (CVSS UI:R, PR:N), and while the vector scores 9.6 because the scope change pushes confidentiality, integrity, and availability impact to High, Chromium's own 'Medium' severity rating and the description's 'potentially' indicate weaponization is non-trivial. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Use-after-free in Google Chrome's DevTools component, affecting desktop builds prior to 156.0.8078.47, can potentially allow a remote attacker to execute arbitrary code outside the browser sandbox. Exploitation requires the victim to load a crafted HTML page while an active DevTools session is engaged, so the attack is remote and unauthenticated but gated by user interaction and a non-default browser state - which is why Chromium assigned it a Low security severity while the raw vector scores 9.6 and our independent assessment lowers it to high attack complexity (AC:H). No public exploit code or confirmed active exploitation was identified at time of analysis, and Google has released a fixed build.
Improper input validation in Google Chrome's Permissions handling lets a remote attacker who persuades a victim to load a crafted HTML page execute arbitrary code outside the browser sandbox on desktop builds prior to 156.0.8078.47. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) reflects unauthenticated remote reach and a scope change, meaning the impact escapes the browser process boundary, although the Chromium project itself rates the flaw as Medium severity. Google shipped a fix in the 156.0.8078.47 stable channel release; no public exploit code or confirmed active exploitation was identified at time of analysis, so the primary exposure is unpatched desktop users who can be lured into visiting attacker-controlled content.
Improper input validation in Google Chrome's Compositing component before 156.0.8078.47 can let a remote, unauthenticated attacker achieve code execution outside the browser sandbox when a victim loads a crafted HTML page. The CVSS 3.1 score is 9.6 Critical (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), but exploitation depends on user interaction and the vendor describes the code-execution outcome as potential rather than guaranteed. Google has released a fixed build, and no public exploit code has been identified at time of analysis.
Memory corruption in Google Chrome's PerformanceAPIs (all builds prior to 156.0.8078.47) allows remote attackers to potentially execute arbitrary code outside the sandbox when a victim loads a crafted HTML page. The CVSS 3.1 vector scores 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), but the signals conflict sharply: Google rates the Chromium severity as Low and qualifies the sandbox escape only as 'potentially' achievable, so reliable code execution beyond the browser sandbox may not be practical. No public exploit was identified at time of analysis, and a vendor patch (156.0.8078.47) is available.
Google Chrome desktop builds before 156.0.8078.47 contain a memory-safety defect in the Permissions code path that can be reached when a victim loads attacker-controlled HTML. Successful exploitation could allow unauthenticated remote attackers to execute code beyond Chrome's sandbox, but the attacker must first convince a user to visit a malicious or compromised page; Google's Medium Chromium severity and the CVSS scope change indicate meaningful impact without evidence of easy or active exploitation. No public exploit identified at time of analysis, and automatic Chrome updates should quickly reduce exposure for most users.
Memory corruption in the Canvas rendering component of Google Chrome prior to 156.0.8078.47 lets a remote attacker potentially execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page. Exploitation is unauthenticated over the network but requires user interaction - the victim must navigate to or be lured onto the attacker-controlled page - and, per the scope-change rating, a reliable sandbox escape must also be achieved, which is the real barrier in practice despite the low attack-complexity score. CVSS 3.1 rates this 9.6 Critical (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) even though Chromium's own severity is Medium; vendor patches are available in Chrome 156.0.8078.47 and no public exploit code or confirmed active exploitation was identified at time of analysis.
Authenticated low-privileged attackers who can reach the OSSL module of Oracle HTTP Server over HTTP can read and modify critical data, with a scope change that lets the impact extend into other Fusion Middleware products reachable through or proxied by the server. The flaw carries a CVSS 3.1 base score of 9.6 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N; no availability impact) and affects only Oracle HTTP Server 12.2.1.4.0 and 14.1.2.0.0. No public exploit code or CISA KEV entry was identified at time of analysis, but the low attack complexity and the front-end position of OHS make this a high-priority patch target.
Authenticated low-privileged attackers with network access to the Fabric Layer component of Oracle Business Process Management Suite 12.2.1.4.0 and 14.1.2.0.0 can achieve high confidentiality and integrity impact, including creation, deletion, or modification of critical data and full read access to BPM Suite data, with scope change extending impact to additional Oracle products. The flaw requires a valid account (CVSS PR:L) but no user interaction and low attack complexity, making it easily exploitable once credentials are obtained. No public exploit code or active exploitation has been identified at time of analysis.
Authenticated low-privileged network attackers can exploit Oracle SOA Suite's Fabric Layer to bypass access controls and gain read/write access to critical SOA data, with potential impact spreading to integrated products through scope change. The issue affects versions 12.2.1.4.0 and 14.1.2.0.0 and carries a CVSS 3.1 score of 9.6 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N). No public exploit code or CISA KEV entry was identified at time of analysis.
Authenticated low-privilege users can read, create, modify, or delete critical data held in PeopleSoft Enterprise PeopleTools 8.61-8.63 - and, because the CVSS scope is changed, data in connected products as well - by sending crafted requests over HTTP to the SQR component. Exploitation is low-complexity and requires no user interaction, but does require a valid account (PR:L), so exposure is bounded to those who can obtain credentials such as insiders, phished users, or broadly provisioned portal accounts. No public exploit code and no CISA KEV entry were identified at time of analysis; internet-exposed PeopleSoft portals represent the highest realistic risk, and this is a genuine high-priority vulnerability rather than an inflated score.
Froxlor before 2.3.15 allows an authenticated hosting customer with write access to their document root to escalate to root by replacing the statistics directory with a symlink, so the root-run traffic cron's recursive chown follows the link and changes ownership of arbitrary host directories. Exploitation requires a valid customer account, enabled goaccess/webalizer/awstats statistics, and execution of the scheduled traffic cron; no public exploit identified at time of analysis. Vendor-released patch: 2.3.15.
Forged network packets sent to the Advantech ADAM-3600 remote terminal unit (RTU) can trigger arbitrary command execution at maximum (administrative/root) privilege, giving an unauthenticated remote attacker full control of the device. The flaw is rated 9.3 under CVSS 4.0 and corroborated by an independent assessment of CVSS 3.1 AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H - no authentication, no user interaction, and no non-default configuration are required, so a single crafted packet against a default-configured unit is sufficient. Exploitation is bounded mainly by network reachability: these RTUs normally sit on segmented OT/SCADA networks, but any unit exposed to the internet or reachable from a compromised IT/DMZ segment is directly at risk. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied; CSA Singapore (AL-2026-149) and Advantech have published advisories. This is a genuinely high-priority flaw, not a high-CVSS-but-low-real-risk case.
Authentication bypass in Advantech ADAM-3600 remote terminal units allows unauthenticated network attackers to bypass the proprietary protocol's authentication mechanism and potentially achieve high impact on confidentiality, integrity, and availability (CVSS 9.3; assessed CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The flaw is remotely reachable with no credentials or user interaction, but realistic risk depends on whether the device's proprietary protocol service is exposed beyond segmented OT/field networks. No public exploit code or CISA KEV entry was identified at time of analysis, and EPSS data was not provided.
Unauthenticated attackers who can reach the HTTP interface of Oracle SOA Suite's Fabric Layer can bypass authentication to read critical data and make limited unauthorized modifications in versions 12.2.1.4.0 and 14.1.2.0.0. Oracle rates the flaw 9.3 under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N); the scope change indicates that a successful compromise can reach beyond SOA Suite into other Fusion Middleware components deployed in the same environment. No public exploit code or confirmed active exploitation was identified at time of analysis, but the absence of authentication, user-interaction, or complexity prerequisites makes this a high-priority patch target wherever the SOA HTTP interface is network-reachable.
Authenticated OS command injection in the TOTOLINK X2000R boa web interface lets an attacker with administrative access execute arbitrary code on the router through the formWizard newPass setup-wizard handler. The flaw affects firmware build TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 and carries a published CVSS score of 9.1; our assessed vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, with high confidentiality, integrity, and availability impact but unchanged scope. Exploitation requires a valid admin session (PR:H), and no CISA KEV listing, public exploit code, or active exploitation was identified at time of analysis.
Call teardown in Signal's RingRTC media library is unreliable before version 2.72.0: a peer that floods the call's finite-state-machine event channel can prevent a locally initiated hangup from actually tearing down the call, leaving the audio track - and potentially the video track - live after the user believes the call has ended. The attacker must already be an accepted participant in the call (the CVSS 4.0 vector is PR:N, i.e. no privileges required, though call participation is a practical prerequisite) and the victim must actively hang up (UI:P) for the impact to occur, which is why the upstream score of 9.3 is tempered by these preconditions. No public exploit code and no active exploitation have been identified at time of analysis; the realistic threat is a malicious or compromised call peer deliberately saturating the queue so the microphone stays open.
Path traversal (Zip Slip) in FlexGet's optional decompress plugin allows remote attackers to write arbitrary files outside the intended extraction directory by delivering archives containing ../ sequences or absolute member paths through a feed. Affected are FlexGet releases before 3.20.7 that have the decompress plugin configured; an attacker who can supply or poison a feed consumed by the target can drop Python files into FlexGet's plugins directory, achieving code execution with the privileges of the FlexGet process. A vendor fix exists in 3.20.7 (commit 38fa748) adding a resolved-path containment check and a PathTraversalError class, and the public commit diff plus regression tests effectively document the exploitation technique; no public exploit was identified at time of analysis and there is no KEV confirmation of active exploitation.
Oracle Agile Product Lifecycle Management for Process 6.2.4 contains a remotely reachable, unauthenticated weakness that lets an attacker who first persuades a legitimate user to open a crafted link or view attacker-controlled content gain unauthorized creation, deletion, and modification of critical PLM data alongside full read access to it, with impact potentially extending into connected products because the CVSS scope is changed (base 9.3). The attacker cannot complete the chain alone - the vector requires that second user's interaction (UI:R), and availability is unaffected (A:N) - so exposure is concentrated in internet- or intranet-reachable 6.2.4 deployments whose users can be socially engineered. No public exploit code was identified and the issue is not confirmed actively exploited (not in CISA KEV) at the time of analysis, so the 9.3 severity reflects theoretical impact rather than observed attacks.