Oracle Essbase 21.8.3.0.0 can disclose critical data to a high-privileged, authenticated attacker over HTTP through a flaw in the Security component. The 6.8 CVSS 3.1 score reflects high confidentiality impact and a scope change (S:C) that can extend exposure to connected products, but exploitation requires an existing high-privileged account (PR:H), making this a moderate-priority risk rather than an unauthenticated remote compromise. No public exploit code or confirmed active exploitation (CISA KEV) is identified at time of analysis.
Authenticated low-privileged attackers can read and modify critical data in Oracle WebCenter Content: Imaging 14.1.2.0.0 through the SOAP interface, but high attack complexity and the need for a valid account keep practical risk moderate. The CVSS 3.1 score is 6.8 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N), with high confidentiality and integrity impact and no availability impact; only version 14.1.2.0.0 is affected, and no public exploit identified at time of analysis.
Oracle WebCenter Content: Imaging 14.1.2.0.0 (Core component) contains a hard-to-exploit access control weakness that lets a low-privileged, authenticated user reach the Imaging application over HTTP and read, create, delete, or modify data they should not control, giving full confidentiality and integrity impact to application data. Exploitation is gated by high attack complexity (AC:H - Oracle calls it 'difficult to exploit') and by the requirement for a pre-existing low-privileged account (PR:L), so anonymous outsiders cannot leverage it directly. No public exploit code or confirmed active exploitation is associated with this CVE at time of analysis, and the 6.8 Medium score reflects those friction factors rather than a trivial attack path.
Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 permit a low-privileged authenticated attacker who can reach the Content Server over HTTP to read, create, modify, or delete critical content repository data, yielding high confidentiality and integrity impact (CVSS 3.1 base 6.8). Exploitation is not unauthenticated: the assessed vector requires a valid low-privileged account (PR:L) plus network access, and the high attack complexity (AC:H) reflects additional conditions outside the attacker's direct control. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and no EPSS score was supplied, so risk is driven primarily by exposure of the Content Server interface and the population of low-privileged accounts rather than by imminent exploitation.
Authenticated low-privileged users can abuse high-complexity conditions in the LOV component of Oracle Complex Maintenance, Repair and Overhaul (CMRO) 12.2.3 through 12.2.15 to create, delete, modify, or read critical data reachable through CMRO over HTTP. The issue is rated CVSS 3.1 6.8 with high confidentiality and integrity impact but no availability impact, and exploitation requires valid EBS credentials plus attacker-independent conditions that Oracle describes as difficult to exploit. No public exploit identified at time of analysis.
Oracle MySQL Connector/ODBC 26.7.1 can allow a low-privileged, network-positioned attacker to read and modify connector-accessible data, but only under high-complexity conditions outside the attacker's control (CVSS 3.1 base 6.8, AC:H/PR:L/UI:N). The flaw affects confidentiality and integrity with no availability impact, and no public exploit code or CISA KEV entry was identified at time of analysis.
Low-privileged MySQL Server and MySQL Cluster users with network access can potentially gain read and write access to data beyond their intended authorization scope through the Server: Security: Privileges component. The issue affects MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1 plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, and Oracle characterizes exploitation as difficult with CVSS 6.8, AC:H, and PR:L. This is a moderate-priority issue, not a top-tier emergency; no public exploit identified at time of analysis, and no CISA KEV entry was present in the supplied intelligence.
Adjacent-network attackers who already hold high privileges can achieve full takeover of Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 through the Push Notifications component, gaining complete confidentiality, integrity and availability impact (CVSS 3.1 base 6.8, MEDIUM). The flaw is easily triggered once an attacker sits on the physical or adjacent communication segment attached to the PeopleTools host and no end-user action is required, but the AV:A and PR:H prerequisites keep real-world exposure well below the headline 'takeover' severity. No public exploit code or confirmed active exploitation was identified at time of analysis, and Oracle addressed the issue in its October 2026 Critical Patch Update.
Helidon deployments that use the helidon-security-providers-http-auth component can expose protected HTTP resources to unauthenticated network attackers, allowing reads of critical or otherwise inaccessible data. The affected lines are 3.0.0 through 3.2.21, 4.0.0 through 4.5.5, and 27.0.0; Oracle describes exploitation as difficult (AC:H) and confidentiality-only, with a scope change that may extend data exposure to additional products trusting the deployment. No public exploit identified at time of analysis.
Authenticated low-privileged users of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 can abuse the Application Data Sets component over HTTP to modify or delete critical application data and to cause repeated hangs or crashes, producing high integrity and availability impact. The CVSS 3.1 score is 6.8 (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H), and Oracle characterizes the issue as difficult to exploit, so reliable exploitation depends on non-default or attacker-uncontrollable conditions beyond a valid account. This is a moderate-priority issue rather than an emergency, and no public exploit identified at time of analysis.
Integrity-only manipulation of critical data in Oracle Java SE (8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27) and GraalVM for JDK/Enterprise Edition stems from SOCKS5 handling in the Networking component. An unauthenticated network attacker who can feed attacker-controlled data into the SOCKS5 code path may create, delete, or modify critical data, with a scope change that can affect additional products; Oracle rates exploitation as difficult (AC:H). No public exploit was identified at time of analysis, and no KEV confirmation is available.
Siebel Cloud Manager, the cloud provisioning and management component of Oracle Siebel CRM Cloud Applications versions 22.3 through 26.9, exposes critical data to unauthenticated attackers who can reach the deployment over an adjacent network segment. Successful exploitation yields full confidentiality and integrity impact - unauthorized creation, deletion, modification, and disclosure of all data accessible to the Siebel CRM Cloud Applications instance - though the CVSS 3.1 score of 6.8 reflects a deliberately high attack complexity and an AV:A adjacency requirement that rules out internet-based exploitation. No public exploit code has been identified at time of analysis and the issue does not appear on CISA KEV, so the realistic threat is confined to attackers who already hold a foothold on the underlying physical or layer-2 communication segment.
Oracle WebCenter Content's Content Server component (versions 12.2.1.4.0 and 14.1.2.0.0) allows an unauthenticated attacker on the same adjacent network segment to create, delete, or modify critical data and to access all WebCenter-accessible data. The CVSS 3.1 score is 6.8 (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), reflecting high attack complexity and adjacency requirements that sharply limit real-world exposure; no availability impact is scored. Exploitation status: no public exploit identified at time of analysis, and no CISA KEV entry was provided in the intelligence.
Unauthenticated attackers with access to the same physical network segment as JD Edwards EnterpriseOne Orchestrator 9.2.0.0 through 9.2.26.5 can read and modify critical Orchestrator data, although high attack complexity limits practical exploitation. The issue is rated CVSS 3.1 6.8 Medium with vector AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N. No public exploit was identified at time of analysis, and there is no CISA KEV entry.
NULL pointer dereference in HarfBuzz 8.0.0 through 14.6.0 lets a crafted font crash any application that shapes text with it, but only when the library is built with the experimental WebAssembly shaper enabled - a non-default compile-time option. An unauthenticated attacker supplies a malicious font whose embedded wasm module passes out-of-range addresses with non-zero lengths into the buffer_set_contents, face_create, or font_set_coords host imports, and the resulting crash yields availability-only impact (CVSS 3.1 base 6.8, AV:L/AC:L/PR:N/UI:R/A:H). No public exploit code and no confirmed active exploitation were identified at time of analysis, and the dominant risk limiter remains that default HarfBuzz builds never exercise the vulnerable code path.
Bearer-token authorization bypass in the Model Context Protocol TypeScript SDK packages lets a token minted for a different service be accepted by an MCP HTTP server built on requireBearerAuth() or verifyBearerToken(), giving the token holder the identity, scopes and tool access of an authenticated MCP client. Affected are @modelcontextprotocol/sdk 1.6.0-1.31.0, @modelcontextprotocol/server 2.0.0-2.2.0, @modelcontextprotocol/express 2.0.0-2.0.1 and @modelcontextprotocol/server-legacy 2.0.0-2.3.0, but only deployments whose authorization server also issues tokens for other services and whose verifyAccessToken() does not itself check the 'aud' claim. The flaw is authenticated (CVSS 6.8, AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) since the attacker must already hold a valid token from that shared authorization server; no public exploit code or confirmed active exploitation was identified at time of analysis, and note that upgrading alone does not remediate - the new expectedResource audience check ships disabled by default.
OpenImageIO's Cineon image reader can be crashed by a crafted Cineon file that declares an extremely large width, causing an integer overflow that undersizes the scanline buffer and lets UnPackPacked read past a 4-byte heap allocation. The flaw affects OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1; exploitation requires a local user to open or process a malicious file, and the impact is limited to a denial-of-service crash with no code execution or data disclosure. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, with the medium-severity rating (CVSS 6.8, independent assessment CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) reflecting the local, user-interaction-dependent attack path.
Denial of service in NSA Ghidra 10.2 through 12.1.4 allows an attacker who supplies a crafted 128-byte ELF file to force excessive memory allocation in the ELF loader, ending in an OutOfMemoryError during import/load-spec discovery or headless analysis. The issue is local and requires the victim or pipeline to load the untrusted file (user interaction), with impact limited to availability-no code execution, data disclosure, or integrity effect was assessed. No public exploit code was identified at time of analysis, and an upstream fix commit is available from the vendor.
Denial of service in the Eclipse ThreadX Module Manager (CWE-400) lets a loaded user-mode module permanently drain the shared module object pool by cycling threads. Each thread a module creates consumes two allocations - a TX_THREAD control block plus a separately allocated TXM_MODULE_KERNEL_STACK_SIZE kernel stack - but the thread-delete dispatcher releases only the control block, so every valid create/terminate/delete cycle silently removes one fixed-size block from a finite pool shared by the Module Manager and all other loaded modules. A module that loops this lifecycle long enough exhausts the pool, after which no memory-protected module anywhere in the system can create kernel objects or new user-mode threads. Exploitation requires local execution of a loadable user-mode module (PR:L per the assessed CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H vector) and is purely an availability impact; no public exploit code or confirmed active exploitation was identified at time of analysis.
Truncated JPEG marker segments and a zero chroma sampling factor in Eclipse ThreadX GUIX's software JPEG decoder can trigger an out-of-bounds read and a non-terminating block-decode loop, letting a local, unauthenticated attacker who can get a crafted JPEG opened or rendered crash or hang the device and potentially disclose a small amount of adjacent memory. Both triggers reproduce in the default configuration with GX_SOFTWARE_DECODER_SUPPORT enabled; the CVSS 3.1 score is 6.1 (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H), so the dominant outcome is availability loss rather than large-scale data theft. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was provided.
An out-of-bounds read in the Eclipse ThreadX GUIX JPEG software decoder lets a crafted JPEG file expose memory beyond an undersized image buffer. The flaw affects GUIX builds with GX_SOFTWARE_DECODER_SUPPORT enabled, which is the shipped default, and is triggered by a JPEG whose marker ordering is illegal - specifically a second SOF0 frame header placed after SOS - which re-parses the frame header after the output buffer has already been allocated and its geometry latched. The decoder then returns GX_SUCCESS and publishes a GX_PIXELMAP whose reported dimensions and data_size exceed the actual allocation, so any consumer trusting the structure, including GUIX's own display drivers via the ordinary draw path, reads past the buffer; interaction is required and the attack is local (the malicious file must reach the decoder), and no public exploit code has been identified at time of analysis.
Out-of-bounds reads in Eclipse ThreadX GUIX can expose adjacent memory or terminate the application when gx_binres_theme_load() or gx_binres_font_load() processes a crafted theme or font resource that declares more data than it contains or embeds an out-of-range offset. The loaders accept a bare resource pointer with no length, so file-controlled offsets can drive reads past the buffer end; a well-formed, narrow glyph range is sufficient, and no underflow or integer-wrap is required. Exploitation is local and requires the application to load an untrusted GUIX resource, and no public exploit or CISA KEV activity is identified at time of analysis.
Out-of-bounds write in the Eclipse ThreadX GUIX binary resource theme loader lets an attacker who supplies a crafted GUIX theme file corrupt the GUIX memory arena and potentially hijack execution or crash the device. The flaw is only reachable in products that call the public API gx_binres_theme_load() on externally supplied or user-replaceable theme files, with GX_BINARY_RESOURCE_SUPPORT compiled in (the shipped default). CVSS 4.0 rates this 6.8 (Medium) with a local attack vector and required user interaction; no public exploit code and no CISA KEV entry were identified at time of analysis.
Eclipse OpenJ9 through 0.63 can expose local files to a remote receiver when an analyst opens a crafted diagnostic dump bundle with jdmpview or equivalent legacy DTFJ code. The bundle's XML metadata can define an external entity that references an arbitrary local file, causing the tool to read that file and transmit its contents to an attacker-controlled host. This is a local, user-interaction-dependent issue in the legacy DTFJ XML path; no public exploit was identified at time of analysis, and the risk is moderate and context-dependent rather than a mass-exploitation priority.
Local service takeover in Oracle Mobile Field Service (Oracle E-Business Suite) versions 12.2.3 through 12.2.15 allows an attacker who already holds high-privileged logon to the host infrastructure to compromise the service, with high confidentiality, integrity, and availability impact. Exploitation requires local access and pre-existing high privileges, which confines realistic risk to insiders or attackers who have already compromised the host; no public exploit identified at time of analysis. The October 2026 Oracle Critical Patch Update remediates the flaw.
A local privilege-escalation-style flaw in Oracle Mobile Field Service (part of Oracle E-Business Suite, Internal Operations component) lets an attacker who already holds a high-privileged account on the host where the service runs take full control of the affected component, with high impact to confidentiality, integrity and availability. Only E-Business Suite deployments running versions 12.2.3 through 12.2.15 are affected, and because the vector is local (AV:L) with PR:H, the practical exposure is limited to trusted insiders or attackers who have already compromised a privileged host account; no public exploit code or active exploitation has been identified at time of analysis. Oracle addresses it in its October 2026 Critical Patch Update, so patch availability exists via the vendor advisory.
Local privilege abuse in the Siebel CRM Deployment component (Server Infrastructure) of Oracle Siebel CRM lets an attacker who already holds a high-privileged account on the deployment host take full control of that component, with high confidentiality, integrity, and availability impact confined to Siebel CRM Deployment itself (scope unchanged). Supported releases 17.0 through 26.9 are affected; the CVSS 3.1 base score is 6.7 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). The attack path is not remotely reachable and requires existing privileged local logon, which limits the practical threat to insiders or intruders who have already compromised a privileged account on the host; no public exploit identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV).
Local, highly privileged users on hosts running Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 can exploit the Package Build SEC component to compromise the confidentiality, integrity, and availability of the installation, with a CVSS 3.1 base score of 6.7. Exploitation requires logon access to the underlying infrastructure and pre-existing high privileges, so realistic exposure is limited to malicious insiders or attackers who have already compromised a privileged account rather than external unauthenticated users. No public exploit code was identified and the issue is not confirmed as actively exploited at time of analysis, making this a moderate-priority hardening item rather than an emergency patch.
Local privilege escalation in Oracle Communications Billing and Revenue Management can let an attacker who already holds high-privileged host access compromise the Platform component, affecting versions 15.0.0.0.0 through 15.2.0.0.0. The CVSS 3.1 score is 6.7 with AV:L/PR:H, so the main barrier is the requirement for a high-privileged local logon rather than network reachability; no public exploit was identified at time of analysis.
Local privilege-abuse in Oracle Communications Billing and Revenue Management (BRM) 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0 lets an attacker who already holds a high-privileged logon on the BRM host fully compromise the application, with high confidentiality, integrity and availability impact and unchanged scope (CVSS 3.1 base 6.7). The attack is not network-reachable and requires no user interaction once the privileged host foothold exists, so the realistic threat population is insiders, compromised administrator accounts, or an adversary who has already escalated on the underlying infrastructure. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied; severity is driven by the value of the BRM platform rather than by ease of remote access.
High-privileged local attackers can take over Oracle MySQL Server and MySQL Cluster through the Server: Components Services component, affecting MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1 plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1. The CVSS 3.1 score is 6.7 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), so exploitation requires an existing high-privileged account with logon to the MySQL host rather than remote or unauthenticated access. No CISA KEV listing or public exploit code is reported in the supplied data; no public exploit identified at time of analysis.
Local privilege escalation in the Server Infrastructure component of Oracle Siebel CRM Deployment (supported versions 17.0 through 26.9) lets an attacker who already holds high-privileged logon access on the deployment host take over the Siebel CRM Deployment instance, with full confidentiality, integrity, and availability impact confined to that component. The attack is local (AV:L), requires high privileges (PR:H), and needs no user interaction. No public exploit code or confirmed active exploitation was identified at time of analysis, and the CVSS 3.1 base score of 6.7 reflects a moderate-priority issue whose real-world risk is strongly constrained by the mandatory prior privileged foothold on the server.
Oracle Siebel CRM Deployment (Server Infrastructure component), versions 17.0 through 26.9, can be fully compromised - confidentiality, integrity and availability - by an attacker who already holds a high-privileged logon on the host where the deployment component runs. The flaw is not remotely reachable: exploitation requires local access plus administrative credentials (CVSS 3.1 6.7, AV:L/PR:H/UI:N), but once those prerequisites are met, attack complexity is low and no user interaction is needed, making it a realistic post-compromise or insider escalation path rather than an external entry point. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and no EPSS data was supplied.
Siebel CRM Deployment (Server Infrastructure component) versions 17.0 through 26.9 can be taken over by an attacker who already holds a high-privileged account and has interactive logon access to the infrastructure host where the component executes. The issue is rated CVSS 3.1 base 6.7 with high confidentiality, integrity, and availability impact, but the local attack vector (AV:L) and high-privilege prerequisite (PR:H) sharply constrain the realistic attacker population to insiders or actors who already have a foothold. No public exploit identified at time of analysis; no CISA KEV entry is present in the provided data.
Local takeover of Oracle JD Edwards EnterpriseOne Tools (9.2.0.0 through 9.2.26.5, E1 Dev Platform Tech component on UNIX) is achievable by an attacker who already holds a low-privileged logon account on the host, but only if a separate user performs a triggering interaction and difficult-to-satisfy conditions are met (CVSS 3.1 base 6.7, AV:L/AC:H/PR:L/UI:R). Successful exploitation gives high confidentiality, integrity and availability impact within the Tools product, effectively handing the attacker control of the platform from an already-established local foothold. Oracle addressed the flaw in its October 2026 Critical Patch Update; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the local-access, authentication and victim-interaction prerequisites substantially limit real-world exposure.
Complete takeover of Oracle Agile PLM MCAD Connector 3.6 can be achieved by a low-privileged attacker who already has local logon access, provided a separate user interacts with attacker-supplied content; high attack complexity and the mandatory second-party action sharply limit practical risk. No public exploit code, CISA KEV entry, or EPSS score was provided at time of analysis.
The SCIM provisioning API in Grafana Enterprise resolves user objects by ID without scoping them to the caller's organization, so a service account holding user-management permissions in one org can read, modify, disable, or delete users that belong to every other org on the same instance (CWE-639 IDOR). Only Enterprise deployments with the non-default SCIM feature turned on are exposed, and the attacker must already control a privileged service account token (CVSS PR:H), which keeps this a moderate-priority 6.7 authorization flaw rather than a pre-auth compromise path. Practical impact concentrates on multi-organization, multi-tenant instances where cross-org victims actually exist; no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV).
Oracle Payroll in Oracle E-Business Suite 12.2.3 through 12.2.15 presents a moderate-priority, full-impact takeover risk: an attacker who already holds high privileges in the application and can reach it over HTTP may compromise confidentiality, integrity, and availability, but Oracle rates exploitation as difficult due to high attack complexity. No public exploit code or confirmed active exploitation was identified at time of analysis.
High-privileged attackers with network access to PeopleSoft Enterprise PeopleTools 8.61 through 8.63 can exploit a high-complexity flaw in the Multichannel Framework component to take over the affected PeopleTools instance, with full confidentiality, integrity, and availability impact. The vulnerability requires an authenticated account with high privileges and specific exploit conditions, so it is not reachable by anonymous remote users. No public exploit code or active exploitation is identified at time of analysis.
Successful exploitation of Oracle Mobile Field Service within Oracle E-Business Suite 12.2.3 through 12.2.15 allows an attacker who already holds high privileges on the instance to take full control of the module, with high confidentiality, integrity and availability impact per Oracle's CVSS 3.1 score of 6.6. The component is reachable over HTTP but is explicitly rated difficult to exploit (AC:H), and the PR:H prerequisite sharply limits the pool of viable attackers to those who have already obtained elevated access. No public exploit code has been identified at time of analysis, and the issue is addressed in Oracle's October 2026 Critical Patch Update.
High-privileged, authenticated attackers with network access can achieve takeover of Oracle EDI Gateway in Oracle E-Business Suite 12.2.3 through 12.2.15 by exploiting a difficult-to-trigger flaw in the component's miscellaneous EDI issue handling. The CVSS 3.1 base score is 6.6 with High confidentiality, integrity, and availability impact, but the high privilege prerequisite (PR:H) and high attack complexity (AC:H) keep this a moderate-priority issue rather than an emergency. No public exploit code or confirmed active exploitation was identified at time of analysis.
High-privileged SQL access to the Monitoring and Diagnostics SEC component of Oracle JD Edwards EnterpriseOne Tools (versions 9.2.0.0 through 9.2.26.5) can yield unauthorized read of critical data and limited insert/update/delete capability, with a scope change that lets the impact propagate to additional connected products. Exploitation is explicitly rated difficult (AC:H) and is gated behind an attacker who already holds high privileges (PR:H) plus network reachability; no user interaction is required (UI:N). The CVSS 3.1 base score is 6.6, and no public exploit identified at time of analysis. Risk is therefore concentrated in environments where administrative or otherwise highly privileged JD Edwards accounts are shared, weakly controlled, or exposed to untrusted networks.
Siebel Cloud Manager, a component of Oracle Siebel CRM Cloud Applications versions 22.3 through 26.9, permits a high-privileged attacker with HTTP network access to create, delete, or modify critical data and to read a limited subset of application data, with the added risk that a successful exploit can significantly affect additional products beyond the vulnerable component (scope change). The flaw is explicitly difficult to exploit and requires the attacker to already hold elevated privileges on the Cloud Manager interface, so realistic risk is concentrated among insiders or attackers who have already compromised an administrative account. No public exploit code has been identified at time of analysis, and Oracle addressed the issue in its October 2026 Critical Patch Update.
JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 contains a difficult-to-exploit security weakness in the Monitoring and Diagnostics SEC component that lets a high-privileged attacker with HTTP network access read critical data and make limited updates, with scope change potentially affecting additional products. The CVSS 3.1 score is 6.6 (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N), requiring an already privileged account and high attack complexity. No public exploit code or CISA KEV entry was identified at time of analysis; EPSS was not provided.
Physical-access attackers who can convince a legitimate operator to interact with a crafted element can achieve complete takeover of Oracle Fusion Middleware Control 12.2.1.4.0 and 14.1.2.0.0 (Framework component), with high confidentiality, integrity and availability impact under CVSS 3.1 scoring of 6.6. The moderate score is driven almost entirely by the attack vector (AV:P) and the required victim interaction (UI:R) rather than by any weakness in the impact, and no attacker authentication (PR:N) is needed once those two preconditions are met. No public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis; Oracle ships the fix through its October 2026 Critical Patch Update cycle.
DOM-based cross-site scripting in the Stormshield Network Security web administration panel lets an attacker run arbitrary script inside a logged-in administrator's browser session when the admin follows a crafted link containing a payload in a specific request parameter. Successful exploitation exposes data available to the authenticated session, which the assessed vector rates as high confidentiality impact with no integrity or availability effect (S:C/C:H/I:N/A:N). Rated medium severity at CVSS 6.6, the flaw is constrained by mandatory user interaction, adjacent-network access, and the need to socially engineer a currently authenticated administrator; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, so it warrants scheduled rather than emergency patching.
Local low-privileged users on hosts running Oracle Outside In Technology 8.5.8 can abuse the Clean Content SDK document-processing path to create, delete, or modify critical data, read a limited subset of accessible data, and cause a partial denial of service. The flaw carries a CVSS 3.1 base score of 6.6 with an integrity-heavy profile (I:H, C:L, A:L) and requires an existing local logon (AV:L, PR:L) without user interaction, making it a moderate local threat rather than a remotely reachable one. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
PeopleSoft Enterprise PeopleTools 8.61 through 8.63 can be repeatedly crashed and have some of its data read or altered by a low-privileged user who already has a logon on the host or application-tier infrastructure where PeopleTools runs. The flaw is in the Porting component and is local-only (CVSS AV:L, PR:L), so it is not remotely reachable without an existing foothold; no user interaction is required. Oracle rates it 6.6, and no public exploit code or CISA KEV activity was identified at the time of analysis.
High-privileged attackers with HTTP access to PeopleSoft Enterprise PeopleTools 8.61 through 8.63 can exploit the Meta Data component to read critical application data and cause a hang or repeatable crash, producing high confidentiality and availability impact. The issue is rated CVSS 3.1 6.5 and requires an already high-privileged PeopleSoft account (PR:H), so exploitation is realistic mainly for trusted insiders or attackers who already hold privileged credentials. No public exploit code or CISA KEV entry was identified at time of analysis.
Resource exhaustion in ApostropheCMS's import-export module before 3.7.1 allows an authenticated user with importer permission to submit archives whose decompressed bytes, entry count, or per-entry sizes are not bounded before document-type authorization, potentially consuming server resources and leaving staging or extracted artifacts behind after extraction or parsing failures. The flaw is network-reachable and low-complexity but requires a logged-in importer (PR:L), and the maintainers have not validated the full end-to-end denial-of-service impact, so the assessed availability effect is limited. No public exploit or CISA KEV entry is identified in the provided data; the issue is fixed in @apostrophecms/import-export 3.7.1.