Low-privileged authenticated remote attackers can achieve full takeover of applications that embed Oracle Outside In Clean Content SDK 8.5.8 by sending crafted content over HTTP, with high confidentiality, integrity, and availability impact (CVSS 8.8). The flaw affects Oracle Fusion Middleware's Outside In Technology component, and real exposure depends on whether an integrating product accepts attacker-supplied files and passes them to the SDK. All available intelligence is vendor-sourced from Oracle's October 2026 Critical Patch Update; no public exploit code or confirmed active exploitation was identified at time of analysis.
JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5 contain a takeover-class vulnerability in the Enterprise Infrastructure SEC component that a low-privileged, network-positioned attacker can exploit over HTTP with no user interaction, yielding full confidentiality, integrity, and availability impact (CVSS 3.1 base 8.8). Oracle's CPU October 2026 advisory frames it as easily exploitable, but the PR:L vector means valid low-privilege credentials are a prerequisite, so exposure is concentrated among insiders or attackers who already hold a foothold or stolen account. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied; an attacker who clears the authentication bar can compromise the JD Edwards EnterpriseOne Tools deployment itself.
Low-privileged authenticated users can achieve full takeover of Oracle JD Edwards EnterpriseOne Tools (versions 9.2.0.0 through 9.2.26.5) by sending crafted HTTP requests to the Monitoring and Diagnostics SEC component, gaining high impact across confidentiality, integrity, and availability (CVSS 3.1 base score 8.8). No user interaction or elevated privileges are required - only a valid low-tier account and network reachability to the EnterpriseOne Tools HTTP interface - making any compromised or over-provisioned service account a viable launch point. No public exploit code or confirmed active exploitation has been identified at time of analysis, but the low attack complexity and the pre-authentication-free path from a standard account to full compromise warrant prompt patching.
Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 can be fully taken over by a low-privileged authenticated attacker who reaches the OIM Legacy UI over HTTP. The flaw is network-reachable, low complexity, and requires no user interaction, but it is not unauthenticated: any valid low-privilege account is enough. No public exploit was identified at the time of analysis, and Oracle's October 2026 Critical Patch Update advisory is the available vendor reference.
Oracle SOA Suite Fabric Layer can be taken over by low-privileged remote attackers with network access, affecting releases 12.2.1.4.0 and 14.1.2.0.0. The CVSS 3.1 score of 8.8 reflects full confidentiality, integrity, and availability impact; exploitation requires a valid low-privilege account (PR:L), but no user interaction and low attack complexity make it straightforward once credentials or a session are obtained. Available intelligence does not identify public exploit code or CISA KEV active exploitation at time of analysis.
Full takeover of Oracle SOA Suite is achievable by authenticated low-privilege attackers who can reach the Fabric Layer over HTTP in versions 12.2.1.4.0 and 14.1.2.0.0. The flaw is network-reachable, low-complexity, and requires no user interaction, with high confidentiality, integrity, and availability impact once a valid low-privilege account is obtained. No public exploit code or CISA KEV entry is identified in the supplied intelligence; vendor fixes are referenced through Oracle's October 2026 Critical Patch Update advisory.
Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 can be fully compromised by an authenticated low-privileged attacker who reaches the Fabric Layer over HTTP; successful exploitation affects confidentiality, integrity, and availability and can lead to takeover of the SOA Suite deployment (CVSS 8.8). The flaw is easily exploitable once a valid low-privileged account exists, so exposure is bounded by credential possession rather than anonymity. No public exploit code or confirmed active exploitation was identified in the provided intelligence at time of analysis.
Oracle Business Process Management Suite 12.2.1.4.0 and 14.1.2.0.0 ship a flaw in the BPM Composer component that lets any low-privileged, network-reachable account over HTTP take full control of the BPM Suite instance, with high confidentiality, integrity and availability impact (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The gating factor is authentication: exploitation requires a valid low-privilege credential and no user interaction, so exposure is concentrated in deployments that broadly issue accounts or where credentials can be phished or reused. No public exploit code was identified at time of analysis, and the issue is fixed in Oracle's October 2026 Critical Patch Update; risk is elevated because the barrier to entry is a single ordinary user session rather than administrative access.
Authenticated low-privileged attackers can take over Oracle Service Bus 14.1.2.0.0 by reaching its HTTP interface, with high confidentiality, integrity, and availability impact (CVSS 8.8). Only the 14.1.2.0.0 Core component is listed as affected, and Oracle characterizes the flaw as easily exploitable; no public exploit identified at time of analysis and no CISA KEV entry was provided. The authentication requirement is the main barrier, so exposure is greatest where Service Bus HTTP endpoints are reachable by users who can obtain even minimal valid credentials.
Low-privileged authenticated attackers with network HTTP access can exploit the Oracle Service Bus Core component to achieve takeover of the service, with high confidentiality, integrity, and availability impact (CVSS 8.8). Oracle Service Bus 12.2.1.4.0 and 14.1.2.0.0 are affected, and exploitation requires a valid account but no user interaction; no public exploit code was identified at time of analysis. The authentication prerequisite limits exposure compared with unauthenticated flaws, but default deployments reachable over HTTP remain at risk from any low-privilege user.
Oracle Service Bus 12.2.1.4.0 and 14.1.2.0.0 expose a high-severity flaw in the Core component that lets a low-privileged, network-positioned attacker take over the service bus, with full impact to confidentiality, integrity and availability (CVSS 3.1 base 8.8). Exploitation is straightforward once credentials exist - no user interaction, low attack complexity, HTTP-reachable - but it is not unauthenticated: the attacker must already hold a valid low-privilege account on the target (PR:L). At time of analysis there is no CISA KEV listing and no public exploit code identified, so this is a credible high-priority patch target rather than an emergency, and the practical risk is dominated by how freely low-privilege accounts can be obtained and how exposed the HTTP interface is.
Oracle Service Bus 12.2.1.4.0 and 14.1.2.0.0 allows an authenticated low-privileged attacker with network access to its HTTP interface to take over the service, with high confidentiality, integrity, and availability impact (CVSS 8.8). Exploitation requires valid low-privileged credentials and reachability to a Service Bus HTTP endpoint, but no user interaction and low attack complexity; default supported configurations appear affected. No public exploit identified at time of analysis.
Takeover of Oracle GoldenGate is possible through its Admin Server Executable, where a low-privileged authenticated attacker with HTTPS network access can achieve high confidentiality, integrity, and availability impact (CVSS 8.8). Affected deployments are GoldenGate 19.1.0.0.0 through 19.32.0.0, 21.3 through 21.23, and 23.4 through 23.26.3.0.0, while instances patched to the October 2026 CPU fix level are not exposed. No public exploit code has been identified at time of analysis, but low attack complexity and network reachability make timely patching important.
Takeover of JD Edwards EnterpriseOne Tools is possible for low-privileged attackers who can reach the JDENET service on affected versions 9.2.0.0 through 9.2.26.5. The flaw is in the Interoperability SEC component and has a CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), requiring a valid low-level account or an existing authenticated foothold rather than anonymous access. No public exploit identified at time of analysis; Oracle's October 2026 Critical Patch Update advisory is the reference source.
Low-privileged users who can reach the JDENET service on Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 can escalate to full takeover of the EnterpriseOne Tools instance, affecting confidentiality, integrity, and availability (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw sits in the Database and Comm SEC component, requires only network reachability plus a valid low-privilege account, and needs no user interaction or elevated rights, making attack complexity low. No public exploit code or confirmed active exploitation was identified at time of analysis, so this is a credible high-priority issue but not a drop-everything emergency; the practical constraint on attackers is possession of credentials and exposure of JDENET.
Authenticated low-privileged attackers with HTTP access to the Oracle BI EE Analytics Server can take over affected 8.2.0.0.0 and 26.01.0.0.0 installations, with high confidentiality, integrity, and availability impact (CVSS 8.8). Exploitation requires a valid low-privilege account (PR:L) but no user interaction and low complexity; no public exploit was identified at time of analysis.
Low-privileged authenticated users can achieve full takeover of Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 through the OIM Legacy UI component, which is reachable over HTTP and requires no victim interaction. The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects complete loss of confidentiality, integrity and availability, but exploitation is gated on an attacker already holding a valid low-privilege OIM account plus network reachability to the deployed Legacy UI - unauthenticated external exploitation is not indicated by the assessed vector. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, so the practical risk is highest for environments where the Legacy UI is exposed to broad network segments or where low-privilege accounts are weakly governed.
Authenticated takeover of Oracle Identity Manager is achievable through the OIM Legacy UI component: a holder of any low-privileged account who can reach the instance over HTTPS can escalate to full control of confidentiality, integrity, and availability (CVSS 8.8). Only versions 12.2.1.4.0 and 14.1.2.1.0 of the Fusion Middleware product are listed as affected, and no user interaction or special attack conditions are required beyond that minimal foothold. Oracle resolves the issue with the October 2026 Critical Patch Update; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, but the low complexity and high payoff make unpatched, lower-trust-accessible deployments a priority.
An authenticated low-privileged user who can reach the Oracle Contract Lifecycle Management for Public Sector HTTP endpoints in Oracle E-Business Suite can achieve full takeover of the CLM module's data and functionality - a complete loss of confidentiality, integrity and availability scored at CVSS 3.1 base 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Only instances running the Award/PO component of CLM for Public Sector on releases 12.2.3 through 12.2.15 are exposed, and the attack requires a valid account (PR:L) with no user interaction and low complexity once that prerequisite is met. No public exploit code or CISA KEV entry was identified at time of analysis, but Oracle typically withholds technical detail until customers have patched, so the absence of exploit reporting should not be read as low risk for internet-facing or broadly accessible EBS deployments.
Oracle Solaris 11.3 and 11.4 can be fully compromised - confidentiality, integrity, and availability - by an authenticated low-privileged attacker who can reach the HTTP-exposed Utility component, per Oracle's October 2026 Critical Patch Update. The CVSS 3.1 base score of 8.8 reflects network reachability (AV:N), low attack complexity (AC:L), and no user interaction (UI:N), gated only by the PR:L requirement for an existing low-privilege account on the host; successful exploitation is described by Oracle as leading to takeover of the operating system. No public exploit code has been identified and there is no CISA KEV listing at time of analysis, but the modest preconditions mean exposed Solaris estates should treat this as a high-priority patching item.
Takeover of Oracle Product Hub is possible for a low-privileged authenticated attacker with HTTP access to the Internal Operations component in Oracle E-Business Suite 12.2.3 through 12.2.15. The flaw carries CVSS 3.1 score 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning any valid low-tier session can reach the vulnerable component without user interaction and potentially gain full control of confidentiality, integrity, and availability. No public exploit code or CISA KEV entry was identified at time of analysis, but the low attack complexity and authenticated network vector make it a credible priority for exposed EBS deployments.
Oracle Product Hub in Oracle E-Business Suite 12.2.3 through 12.2.15 can be taken over by an authenticated low-privileged attacker with HTTP network access, enabling high impact to confidentiality, integrity, and availability of the component. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) shows low attack complexity and no user interaction once a valid low-privileged account is obtained, making this a genuine high-priority issue. No public exploit identified at time of analysis and no CISA KEV entry or EPSS score was provided in the supplied intelligence, but Oracle has published an October 2026 CPU advisory for remediation.
Any authenticated low-privilege user who can reach the HTTP interface of Oracle Product Hub (the Internal Operations component of Oracle E-Business Suite) can take full control of the module, with high impact on confidentiality, integrity, and availability (CVSS 8.8, AV:N/AC:L/PR:L/UI:N/S:U). Deployments of E-Business Suite 12.2.3 through 12.2.15 running Product Hub are in scope, and because attack complexity is low and no user interaction is required, a single valid low-privilege session is sufficient to attempt exploitation - the real barrier is first obtaining EBS credentials and network reachability to the endpoint. No public exploit code and no CISA KEV entry were identified at time of analysis, so this is a credible mid-to-high priority patching item rather than an emergency, but the low bar for a credentialed insider or compromised account keeps it worth scheduling promptly.
Authenticated low-privileged users can achieve full takeover of the Oracle Engineering Change Management component in Oracle E-Business Suite 12.2.3 through 12.2.15 over HTTP, with high impact to confidentiality, integrity, and availability (CVSS 8.8, PR:L/AC:L/UI:N). The flaw is easily exploitable once a valid EBS account is obtained; no public exploit code or confirmed active exploitation is identified in the available intelligence. Risk is greatest for internet-exposed EBS instances or environments where low-privilege accounts are readily available.
Oracle Applications Manager, the diagnostics and management console bundled with Oracle E-Business Suite 12.2.3 through 12.2.15, can be fully taken over by a low-privileged attacker who has network access to its HTTP interface. The flaw carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation is remote, low-complexity, requires no user interaction, and yields high confidentiality, integrity, and availability impact once a valid low-privilege EBS account is obtained. There is no public exploit code and no CISA KEV confirmation at time of analysis, but the low bar (PR:L, AC:L, UI:N) and the internal-facing nature of many Diagnostics deployments make this a high-priority patching item in the October 2026 Oracle Critical Patch Update.
Authenticated low-privilege users can take over Oracle Mobile Field Service in Oracle E-Business Suite 12.2.3 through 12.2.15 by sending crafted HTTP requests, and the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) scores 8.8 because a single valid low-privilege account yields full confidentiality, integrity, and availability impact on the component. No user interaction and no non-default configuration are required, so the practical barrier is holding or obtaining any valid EBS account; risk rises sharply where the EBS login interface is internet-exposed or low-privilege accounts are numerous or easily obtained. No public exploit code or CISA KEV entry was identified at time of analysis, but this remains a genuine high priority for organizations running the affected E-Business Suite releases.
Oracle E-Business Suite Mobile Field Service 12.2.3 through 12.2.15 is exposed to takeover through its Internal Operations component by an authenticated, low-privileged attacker with HTTPS network access; the CVSS 3.1 score is 8.8 with high confidentiality, integrity and availability impact and no user interaction. Exploitation requires valid credentials but no special configuration, and no public exploit was identified at time of analysis. Organizations running the listed EBS releases should treat this as high priority because a low-privileged account can compromise the product's confidentiality, integrity and availability.
Application takeover in Oracle Mobile Field Service, the field-service module of Oracle E-Business Suite 12.2.3 through 12.2.15, is achievable over HTTP by any attacker who already holds a low-privilege application account. Because no user interaction is required, attack complexity is low, and the vector leaves scope unchanged while scoring high across confidentiality, integrity and availability (CVSS 3.1 base 8.8), a single compromised technician or contractor login is enough to pivot into full control of the module rather than a narrow data leak. Exploitation-signal data is thin: the issue is not in CISA KEV, no public exploit code has been identified at time of analysis, and no EPSS score was supplied, so priority should be driven by the technical profile and by whether the module is actually deployed - the authentication prerequisite is the main limiting factor, while the prevalence of low-privilege EBS accounts is the main aggravating one.
Oracle Mobile Field Service in Oracle E-Business Suite 12.2.3 through 12.2.15 allows an authenticated low-privileged attacker with network access via HTTPS to compromise the application, leading to full takeover with high confidentiality, integrity, and availability impact. The vulnerability is easily exploitable (CVSS 8.8) but requires a valid low-privileged account; no public exploit code has been identified at time of analysis.
Authenticated low-privileged users can fully compromise Oracle Mobile Field Service in Oracle E-Business Suite 12.2.3 through 12.2.15, achieving high confidentiality, integrity, and availability impact (CVSS 8.8, AV:N/PR:L, no user interaction). The flaw resides in the Internal Operations component and is reachable over HTTPS, so only EBS deployments that actually run Mobile Field Service are exposed. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, but low attack complexity combined with the existing-credential requirement makes this a realistic privilege-escalation path for an insider or a compromised low-privileged account.
Authenticated low-privileged attackers can achieve takeover of Oracle Mobile Field Service in Oracle E-Business Suite 12.2.3 through 12.2.15 by reaching the Internal Operations component over HTTP. The flaw is remotely exploitable with low complexity and no user interaction, yielding high confidentiality, integrity, and availability impact; it requires a valid low-privileged account (PR:L) rather than anonymous access. No public exploit identified at time of analysis, and no CISA KEV entry is present in the provided intelligence; Oracle addresses the issue in its October 2026 Critical Patch Update.
Authenticated low-privileged users can achieve takeover of Oracle Agile Product Lifecycle Management for Process 6.2.4 by sending crafted HTTP requests to its Product Quality Management component, with high confidentiality, integrity and availability impact. The vulnerability is network-reachable at low attack complexity, requires no user interaction, and is limited in the provided data to version 6.2.4; exploitation still requires a valid low-privilege account, so exposure depends on how widely such accounts are issued and whether the application is internet-facing. No public exploit identified at time of analysis; nevertheless, the 8.8 score and post-authentication takeover potential make it a high-priority remediation item.
Authenticated low-privileged users can achieve full takeover of Oracle Agile Product Lifecycle Management for Process 6.2.4 through its HTTP interface in the Product Quality Management component. The flaw has a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning high confidentiality, integrity, and availability impact once a valid account is obtained, with no user interaction required. No public exploit code or CISA KEV entry was identified at time of analysis, and Oracle's October 2026 Critical Patch Update advisory is the primary remediation reference.
SQL-layer compromise in Oracle Siebel CRM's Life Sciences eDetailing component, affecting versions 17.0 through 26.9, allows an authenticated low-privileged attacker with network access to execute SQL against the application and achieve full takeover, with high confidentiality, integrity, and availability impact. The vendor-assigned CVSS 3.1 score is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating a low-complexity, no-user-interaction attack once low privileges are obtained; no public exploit identified at time of analysis.
Remote code execution in IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 stems from an improper-authentication weakness (CWE-287) that lets a network-reachable, low-privilege authenticated attacker execute arbitrary code with no user interaction. The CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) indicates full loss of confidentiality, integrity, and availability once the flaw is triggered. No public exploit code was identified at time of analysis, and the vulnerability has not been confirmed as actively exploited (CISA KEV); the primary constraint on attackers is the need for low-privilege authenticated access to the TRIRIGA platform.
Unauthenticated network attackers can take over Oracle Siebel CRM Development versions 17.0 through 26.9 through the Siebel Approval Manager component, but only if a targeted user is tricked into interacting with attacker-supplied content over HTTP. The CVSS 3.1 score is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting high confidentiality, integrity, and availability impact gated by mandatory user interaction. No public exploit code or confirmed active exploitation is identified in the available intelligence at time of analysis.
Chrome for Android releases before 156.0.8078.47 contain a type-confusion flaw in FullScreen handling that can let a remote attacker execute arbitrary code inside the browser sandbox when a victim opens a crafted HTML page. Exploitation requires user interaction and no authentication, and any code execution is confined to the renderer sandbox absent a separate sandbox-escape chain. Vendor patches are available in 156.0.8078.47; no public exploit was identified at time of analysis.
Memory corruption in Google Chrome's Paint component before 156.0.8078.47 lets unauthenticated remote attackers execute arbitrary code within the renderer sandbox when a victim loads a crafted HTML page. The issue is rated CVSS 8.8 and Critical by Chromium, but the impact is constrained because code execution stays inside the sandbox and escaping to the host would require a separate sandbox-escape chain. No public exploit or CISA KEV entry was identified at time of analysis, and Google has released 156.0.8078.47 as the fixed version.
Memory corruption in Google Chrome's Accessibility implementation before version 156.0.8078.47 lets remote attackers execute arbitrary code at Chrome's sandbox privilege level by convincing a victim to open a crafted HTML page. Unauthenticated attackers can trigger the flaw through normal browsing, and because code execution is confined to the renderer sandbox, achieving host-level compromise requires chaining a separate sandbox-escape vulnerability. Google rates this Critical (Chromium severity) with a CVSS of 8.8; a vendor patch is available and no public exploit has been identified at time of analysis.
Use-after-free in Google Chrome's Accessibility component before 156.0.8078.47 allows unauthenticated remote attackers to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction and is confined to the sandbox, so full host compromise would require chaining a separate sandbox escape; no public exploit was identified at time of analysis. Google rates the Chromium security severity Critical, and affected users should update to 156.0.8078.47.
Remote code execution inside Chrome's renderer sandbox on Android is possible through a use-after-free in the WebAppInstalls component of Google Chrome versions prior to 156.0.8078.47. An unauthenticated remote attacker can deliver a crafted HTML page, but the victim must navigate to or render it (UI:R), and the CVSS 3.1 score is 8.8 with scope unchanged (S:U), so OS-level compromise requires a separate sandbox escape. No public exploit identified at time of analysis; patching to 156.0.8078.47 is the direct fix.
Memory corruption in Google Chrome's WebUI component before version 156.0.8078.47 allows unauthenticated remote attackers to execute arbitrary code inside the browser sandbox when a victim is induced to load a crafted HTML page. Exploitation requires user interaction (UI:R) and no special configuration; successful code execution is confined to the sandbox unless chained with a separate sandbox-escape vulnerability, which limits real-world host compromise. A vendor patch is available in Chrome 156.0.8078.47, and no public exploit or confirmed active exploitation was identified at time of analysis.
A use-after-free in the browser component of Google Chrome versions prior to 156.0.8078.47 permits a remote attacker to execute arbitrary code inside the renderer sandbox by convincing a victim to load a crafted HTML page (CVSS 3.1 base 8.8, AV:N/AC:L/PR:N/UI:R). No authentication or non-default configuration is needed, but the mandatory user interaction and the fact that code execution is confined 'inside the sandbox' are the key limiting factors - full host compromise would require chaining an additional sandbox-escape flaw. No public exploit code or confirmed active exploitation was identified at time of analysis; Google credits the flaw as reported through its Chrome CVE administration process and has released a stable-channel fix.
Use-after-free in Google Chrome's WebSockets implementation before 156.0.8078.47 enables remote code execution inside the renderer sandbox when a victim opens a crafted HTML page, requiring user interaction but no authentication. Google has released a vendor patch, and no public exploit or CISA KEV confirmation was identified at time of analysis. The raw 8.8 CVSS reflects high confidentiality, integrity, and availability impact within the renderer, but standalone host compromise would require chaining a separate sandbox-escape vulnerability, so the score overstates standalone impact even though the product makes this a high-priority patch-now issue.
Out-of-bounds memory access in the ning compress-lzf library before version 1.2.0 lets crafted LZF streams make the default sun.misc.Unsafe-based UnsafeChunkDecoder read beyond its decompression buffer, leaking unrelated JVM heap contents into decompressed output or crashing the JVM. Any application that feeds untrusted, attacker-supplied LZF data to the default LZFDecoder is exposed without authentication or user interaction, while applications decompressing only trusted internal data are largely unaffected. The issue was fixed upstream by improved bounds checks in version 1.2.0; no public exploit code or active exploitation has been confirmed at time of analysis.
Unauthenticated network attackers can achieve takeover of JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 through the Enterprise Infrastructure SEC component, provided they first convince a legitimate user to interact with attacker-supplied content over HTTP. The CVSS 3.1 score is 8.8 with high confidentiality, integrity, and availability impact, while the UI:R requirement is the main practical barrier to exploitation. No public exploit code was identified at time of analysis and no KEV status is present in the supplied intelligence.
Crafted-document processing in Oracle Outside In Technology 8.5.8 (Outside In Core) can be exploited by an unauthenticated network attacker to take over the affected application, with high confidentiality, integrity, and availability impact. The attacker delivers a malicious file over HTTP and succeeds only if a person or automated pipeline opens it (UI:R), so real-world exposure is bounded by whether the deploying product ingests untrusted documents through Outside In. No CISA KEV listing appears in the supplied intelligence and no public exploit was identified at time of analysis; the 8.8 score reflects potential impact rather than demonstrated exploitation.
Use-after-free in Google Chrome's Performance component (all desktop builds prior to 156.0.8078.47) allows an unauthenticated remote attacker to execute arbitrary code inside the browser sandbox when a victim loads a crafted HTML page. The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects high confidentiality and integrity impact, but exploitation requires the user to actively visit or render attacker-controlled content and, per Google's advisory, code execution is confined to the Chrome sandbox - host-level compromise would require chaining a separate sandbox escape. No public exploit code or confirmed active exploitation was identified at time of analysis, and Google has released a fixed build.
Memory corruption in Google Chrome's sandboxed renderer (desktop builds prior to 156.0.8078.47) lets a remote, unauthenticated attacker execute arbitrary code inside the sandbox when a user opens a crafted HTML page. Because the CVSS vector specifies UI:R and S:U, exploitation requires a deliberate user visit to attacker-controlled content (malicious site, compromised legitimate site, or injected ad/iframe) and the resulting code execution stays confined to the renderer process - meaningful standalone impact is bounded unless the bug is chained with a separate sandbox-escape flaw. Signals conflict on severity: the 8.8 base score (AV:N/AC:L/PR:N/UI:R/C:H/I:H/A:H) reflects full confidentiality, integrity and availability loss within the renderer, while Google rates it Chromium security severity Medium, consistent with a sandbox-confined, user-interaction-gated issue; no public exploit code or CISA KEV entry was identified at time of analysis, so real-world risk currently rests on targeted exploitation rather than mass scanning.
Use-after-free in SVG rendering in Google Chrome before 156.0.8078.47 allows a remote attacker to execute arbitrary code within the renderer sandbox when a victim opens a crafted HTML page. The issue is rated CVSS 8.8 with UI:R, so exploitation requires user interaction such as visiting attacker-controlled content; no public exploit code or confirmed active exploitation was identified at time of analysis, and Google has released a fixed build.