The coding.ms 'typo3_shop' extension for TYPO3 lets any unauthenticated site visitor force orders that are still awaiting payment into the 'canceled' state by supplying an order identifier to the cancellation function, which performs no ownership check (CWE-862, IDOR-style missing authorization, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). The exposure is conditional on the site publishing a page that hosts the shop's order/cancellation plugin - without that reachable plugin the endpoint cannot be invoked - and already-paid orders are explicitly unaffected, so impact is confined to integrity of pending, unpaid transactions that the attacker can enumerate or guess. No public exploit code was identified at time of analysis and the issue is not in CISA KEV, so exploitation would be opportunistic rather than confirmed in the wild; successful abuse is a low-complexity, unauthenticated nuisance/fraud vector that can disrupt live storefronts by silently invalidating unpaid checkouts.
Unauthenticated attackers can overwrite the stored PayPal payment notification for an unpaid order on TYPO3 sites running the coding.ms shop extension when a page exposes the shop's order plugin. The endpoint accepts notification data without verifying its origin, so the impact is limited to integrity of the notification content for orders still awaiting payment; paid orders are unaffected, and confidentiality and availability are not impacted. No public exploit code or CISA KEV entry was identified in the provided data at time of analysis.
Deleted Outline administrators keep receiving the contents of workspace documents through webhook subscriptions their accounts created, because account deletion never disables those subscriptions. In Outline releases before 1.8.0, a privileged user who registered a WebhookSubscription pointing at an endpoint they control continues to receive DeliverWebhookTask payloads - including full document Markdown bodies and Yjs collaborative state - for every matching workspace event after the account is permanently removed, and this requires prior administrator-level privileges (PR:H in both the CVSS 4.0 and assessed CVSS 3.1 vectors) plus the webhook having been created before deletion. Confidentiality impact is high while integrity and availability are unaffected, making this a bounded post-offboarding data-exposure issue rather than an unauthenticated entry point, and no public exploit code was identified at time of analysis.
Error-message information disclosure in the a2a-rs Rust agent-to-agent server (a2a-server component) versions 0.4.0 through 0.4.3 lets remote, unauthenticated clients learn internal server detail when the framework returns raw diagnostic text in INTERNAL_ERROR responses. The leak surfaces only when the server itself faults - ProtoJSON stream serialization failures, HttpPushSender errors, extended-agent-card handler faults, or broadcast subscription lag - where pre-patch code passed the underlying detail (the project's own tests use a leaked filesystem path such as /etc/server/keys.pem as the example) straight to the caller instead of a generic message. Impact is limited to low-sensitivity diagnostic and implementation detail, not guaranteed credentials or user data, and no public exploit was identified at time of analysis; the issue is fixed by the sanitized_internal_error refactor in commit 713b943af94ab2d521d483b841618b97a2e78a4d (PR #127).
Payment bypass in the x402 Sign-In-With-X (SIWX) server extension lets a client that has paid for one cheap protected route unlock a more expensive route by supplying a mismatched PaymentPayload.resource URL and then reusing only its SIGN-IN-WITH-X header for repeat access. The flaw spans three implementations of the same extension - the npm package @x402/extensions 2.3.1 through 2.28.0, the x402 PyPI package 2.11.0 through 2.25.0, and the Go module github.com/x402-foundation/x402/go/v2 2.16.0 through 2.28.0 - and only manifests when at least two SIWX-protected routes exist at different price points. Exploitation is not anonymous: the attacker must complete a genuine payment for the cheapest route and hold a valid SIWX session, and no public exploit code or confirmed active exploitation was identified at time of analysis; an upstream fix exists in pull request #3840.
Unauthenticated remote attackers can crash the bulk port configuration service on Advantech ADAM-3600 edge controllers, causing a limited denial-of-service condition with no confidentiality or integrity impact. The flaw is network-reachable and requires no user interaction, but practical risk depends on whether the device's configuration service is exposed beyond properly segmented ICS/OT networks. No public exploit code has been identified at time of analysis, and the issue is availability-only rather than remote code execution.
Denial of service in Advantech ADAM-3600's license manager service allows unauthenticated network attackers to crash the service by triggering an integer overflow. The CVSS 4.0 score of 6.9 reflects network reachability with low availability impact only-no confidentiality or integrity effect-and no public exploit code or CISA KEV entry was identified at time of analysis. Because ADAM-3600 is an industrial RTU typically placed on segmented OT/field networks, realistic exploitation depends on attacker access to a connected control network or poor segmentation.
Unauthenticated remote attackers who can reach the Advantech ADAM-3600 license manager RPC service can crash it by sending a crafted message with msglen set to 0, triggering a NULL pointer dereference in rpc_rx_fsm. The flaw affects ADAM-3600 industrial RTUs and is availability-only, with no code execution, data disclosure, or integrity impact; no public exploit identified at time of analysis. Because the device is typically deployed on segmented ICS/OT networks, exposure is usually limited, making this a medium-severity denial-of-service issue rather than a critical compromise vector.
Unauthenticated remote attackers can crash the license manager service on Advantech ADAM-3600 by sending crafted RPC messages that trigger a NULL pointer dereference in the rpc_rx_fsm function, causing an availability-only denial of service. The provided CVSS 4.0 score is 6.9, while the assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, reinforcing that confidentiality and integrity are not affected. No public exploit was identified at time of analysis, and practical risk depends on whether the device's license manager RPC service is reachable from untrusted networks.
Denial of service in Advantech ADAM-3600 can be triggered by an unauthenticated remote attacker who opens and then disconnects a connection to the license manager service, invoking the on_disconnected callback and causing a NULL pointer dereference that crashes the service. The supplied CVSS 4.0 score is 6.9 (AV:N/AC:L/PR:N/UI:N/VA:L), and the independent assessment rates availability impact as Low with no confidentiality or integrity impact; this is a moderate-severity availability issue rather than a code-execution or data-access flaw. No public exploit identified at time of analysis.
FacturaScripts 2025.61 can disclose valid usernames through observable differences in login responses, such as error-message text, HTTP status codes, or response timing. This is a low-to-moderate information-disclosure issue: it does not grant access or code execution by itself, but it can feed targeted brute-force, password-spraying, credential-stuffing, or social-engineering attempts. No public exploit was identified at time of analysis, and the vendor has released a patch according to the INCIBE advisory.
Oracle WebCenter Content 14.1.2.0.0 allows unauthenticated network attackers to access critical data and make limited unauthorized changes through HTTP if they can induce a victim to perform a crafted action. The CVSS 3.1 score is 6.9 (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N), and no public exploit was identified at time of analysis. Mandatory user interaction and high attack complexity constrain reliable exploitation, but the scope change means connected products and trust relationships may also be affected.
Siebel CRM Integration versions 17.0 through 26.9 contain an EAI HTTP-facing weakness that lets an unauthenticated remote attacker, provided a legitimate user is induced to interact and other high-complexity conditions align, obtain scope-changing access to critical integration data and limited ability to modify it. The assessed CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N (6.9), reflecting mandatory victim interaction and high attack complexity rather than an easily repeatable default exploit. No public exploit was identified at time of analysis, and there is no CISA KEV confirmation of active exploitation.
Stored cross-site scripting (CWE-79) in FacturaScripts 2025.61 lets authenticated low-privilege users inject JavaScript through the 'city' and 'province' fields handled by the ListAlmacen endpoint, with execution occurring when another user-realistically an administrator-views the affected warehouse listing. Successful exploitation can steal session/CSRF material even when cookies are HttpOnly, or enable privilege escalation from a normal user to administrator; however, the attack is conditional on victim interaction and warehouse-edit access, and no public exploit code was identified at time of analysis. The vendor reports a patch, and the issue is rated moderate severity (CVSS 4.0: 6.9).
Oracle REST Data Services versions 24.2.0 through 26.1.0 expose an unauthenticated HTTP attack path in the Core component that, when a legitimate user is induced to interact with attacker-supplied content, can bypass authentication and permit unauthorized creation, deletion, or modification of critical data plus limited read access; the scope change means impact may extend to integrated products beyond ORDS itself. Exploitation is high-complexity and user-interaction-dependent (AC:H/UI:R), has no availability impact, and no public exploit identified at time of analysis.
Atsumi Electric ADX-series DVRs expose hidden firmware-upgrade functionality that lets an authenticated administrator load unauthorized firmware, compromising device integrity while leaving confidentiality and availability unaffected. The issue affects ADX5004, ADX5008, ADX404, ADX3004, ADX3008, ADX3016, ADX204, ADX1004, ADX1008, and ADX2016 devices and requires a valid administrator login over the network (CVSS 4.9). No public exploit was identified at time of analysis, and the main risk is exposure of weakly protected or internet-facing management interfaces.
Unauthenticated network attackers can exploit Helidon's OIDC component to read critical data and make limited unauthorized data changes, but only when high-complexity conditions are met and a victim is induced to interact during an authentication flow (CVSS 3.1 base 6.9). Affected releases are Helidon 4.0.0 through 4.5.5 and 27.0.0; the scope change means products integrated with the affected Helidon service may also be impacted. No public exploit identified at time of analysis and no CISA KEV entry is present; Oracle's October 2026 Critical Patch Update is the vendor patch reference.
High-privileged local attackers can corrupt or destroy critical PeopleSoft data and repeatedly crash the application in Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 by abusing the SQR reporting component. The attack is rated difficult to exploit and requires a privileged logon to the host running PeopleTools plus a triggering action from a separate legitimate user, so realistic exposure is limited to privileged insiders or post-compromise activity rather than remote opportunists; due to a scope change, a successful attack can also affect dependent products beyond PeopleTools itself. No public exploit code was identified at time of analysis and the issue is not in CISA KEV, so despite the 6.9 base score the practical priority is moderate-to-low and driven by the stacked prerequisites (AV:L/AC:H/PR:H/UI:R) rather than by broad exploitability.
ApostropheCMS versions prior to 4.33.0 fail to enforce the viewRole permission for anonymous visitors, allowing user-object fields to be disclosed when a developer has deliberately published user documents through a rendered relationship or an expressly enabled public API. The exposure is unauthenticated and low-complexity where it exists, but it is conditional on developer configuration - relationships do not automatically publish full user objects, and password hashes are stored separately and are never disclosed - so a default installation is not affected. The issue is fixed in 4.33.0; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Strict-mode input validation in json-smart through 2.6.0 can be bypassed by inserting a literal 0x1A (SUB) control character before malformed trailing data, causing JSONValue.parseStrict and isValidJsonStrict to accept payloads that downstream parsers such as Jackson or Gson reject or interpret differently. The flaw is unauthenticated (CVSS PR:N) and network-reachable, but it only matters where an application uses json-smart strict mode as a validation or trust gate and then passes the same raw bytes to a second parser; in that configuration it yields integrity impact through parser differentials, not code execution or data disclosure in json-smart itself. No public exploit code was identified at time of analysis, and the issue is assessed as medium-severity integrity-only rather than a top remediation priority.
HTTP request smuggling in Eclipse ThreadX NetX Duo's optional Web add-on allows unauthenticated remote clients to influence request-framing decisions by placing header-like field names in the request body; the embedded HTTP server scans the entire packet for headers instead of stopping at the end of the header section. The CVSS 4.0 score is 6.9, with low integrity and availability impact and no confidentiality impact, and exposure is limited to devices that enable and network-expose the Web add-on. No public exploit code or CISA KEV confirmation is present in the provided data; no public exploit identified at time of analysis.
A crafted ThreadX module can permanently hang the entire kernel by abusing the Module Manager's object-lookup path: the search name for a memory-protected module is validated on only one byte and then walked in privileged mode for as far as the module declares. Both lookup dispatchers are affected - the recommended txm_module_object_pointer_get_extended accepts a length argument but never uses it to bound the buffer, while the deprecated txm_module_object_pointer_get passes the maximum UINT value, removing the bound entirely - so a hostile module forces an out-of-bounds read (CWE-125) without needing to know anything about the memory it reaches. Because the walk happens with the kernel's preemption count raised, an unrecoverable read fault leaves the scheduler disabled for the remainder of the device's uptime, making this a durable denial of service rather than privilege escalation or code execution. The local attack vector (CVSS 4.0 base 6.9; assessed 3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H) requires the attacker to already be able to load or compromise a module in a build that enables the Module Manager; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (no CISA KEV listing).
Eclipse ThreadX deployments that use the Module Manager to load untrusted or mixed-trust modules let a module destroy kernel objects it does not own: the privileged dispatcher validates only that a pointer targets memory outside the caller's own code and data, which is the correct policy for *using* a shared object but not for deleting one. Any code running inside a loaded module, having obtained a pointer (for example via txm_module_object_pointer_get_extended name lookup) to an application- or peer-module-owned queue, semaphore, or mutex, can route that pointer to the kernel object delete service and have it torn down, yielding a local integrity and availability impact (CVSS 4.0 6.9; CVSS 3.1 AV:L/PR:L/UI:N/I:H/A:H, no confidentiality impact). Exploitation requires the module feature to be enabled with more than one trust domain, is local only, and does not apply to firmware built as a single monolithic trusted image; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV.
Eclipse CSI PIA executes its pre-authentication OIDC discovery and JWKS fetch operations synchronously directly on the asyncio event loop, so a single unauthenticated request can stall the entire service for every connected user. Any network-reachable deployment that has the OIDC authentication flow enabled is affected, and exploitation needs no credentials, privileges, or user interaction (CVSS 4.0 base 6.9, AV:N/AC:L/PR:N/UI:N, availability-only with VA:L). Impact is confined to denial of service with no confidentiality or integrity effect, and no public exploit code was identified at time of analysis.
Arbitrary code execution in IBM Cyber Fraud 1.0.0 through 1.0.2 requires an authenticated low-privilege user to upload a file with a dangerous type and then depends on a victim interacting with that file; the upload handler does not restrict dangerous file types (CWE-434). The vendor CVSS score is 6.8, while the independent assessment rates confidentiality, integrity, and availability impact as high with scope unchanged; the mandatory authentication (PR:L) and user interaction (UI:R) limit anonymous, fully automated exploitation. No public exploit code or CISA KEV entry was identified at time of analysis, and the realistic risk is moderate and context-dependent rather than an emergency.
Oracle One-to-One Fulfillment in Oracle E-Business Suite 12.2.3 through 12.2.15 exposes an authenticated, low-privileged attacker with HTTP access to integrity and availability impact in the Documents component; successful exploitation can cause unauthorized creation, deletion, or modification of critical fulfillment data and can trigger a hang or frequently repeatable crash. The CVSS 3.1 score is 6.8 with AC:H, indicating difficult exploitation that requires specific non-default timing, state, or module configuration conditions, and no public exploit was identified at time of analysis (not CISA KEV). This is a moderate-severity, moderate-priority issue rather than an urgent one.
Unauthenticated data exposure in the Report Distribution component of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 lets a network-positioned attacker read critical application data over HTTP, with the scope flag indicating that exposed data may extend into other PeopleSoft products built on the same platform. The 6.8 CVSS 3.1 score (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N) is driven by a high attack-complexity metric - Oracle describes the flaw as difficult to exploit, so success depends on server state, timing, or other conditions the attacker does not fully control rather than a single crafted request - and there is no integrity or availability impact. No public exploit identified at time of analysis, the issue is not on CISA KEV, and no EPSS score was supplied; practical risk concentrates on internet-reachable PeopleTools deployments rather than a broad mass-exploitation threat.
Unauthorized access to critical data in Oracle Demand Planning 12.1 and 12.2 requires a low-privileged authenticated attacker and a separate victim's interaction, yet successful exploitation can cross scope boundaries and expose data in connected Oracle Supply Chain products. The issue is scored CVSS 3.1 6.8 with confidentiality-only impact; no public exploit identified at time of analysis and no confirmed active exploitation was reported in the provided intelligence. Realistic risk is social-engineering-assisted data disclosure against logged-in users rather than autonomous compromise.
Oracle Payroll 12.2.3 through 12.2.15 allows a low-privileged authenticated attacker with HTTP access to the Internal Operations component to create, delete, modify, or read critical Payroll data, with high confidentiality and integrity impact and no availability impact. Oracle rates exploitation as difficult (AC:H), and no public exploit code or CISA KEV entry was identified at time of analysis.
Authenticated low-privileged users can read and modify critical data in Oracle Public Sector Human Resources (Regression Testing component) on Oracle E-Business Suite 12.2.3 through 12.2.15, with high confidentiality and integrity impact but high attack complexity. Exploitation requires HTTP network access and a valid low-privileged EBS account, and no user interaction is needed. This is a moderate, authenticated-only risk; no public exploit or active exploitation was identified at time of analysis.
Oracle E-Business Suite 12.2.3 through 12.2.15 has an unauthenticated HTTP attack path in the Application Object Library Core component that can lead to unauthorized creation, deletion, or modification of critical data and unauthorized read access. The vendor vector requires a non-attacker user to interact with the application and rates exploitation as high complexity (CVSS 3.1 6.8, AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N), so practical risk is constrained by the need to lure or socially engineer a legitimate user; no public exploit has been identified at time of analysis.
MySQL Router 26.7.0 allows unauthenticated network attackers to read and modify critical router-accessible data via its HTTPS interface, but successful exploitation is rated high-complexity and requires human interaction from someone other than the attacker. Oracle's October 2026 Critical Patch Update assigns CVSS 3.1 6.8 (C:H/I:H/A:N, AC:H, UI:R, PR:N), making this a genuine but medium-priority issue rather than a top-tier emergency; no public exploit code or CISA KEV entry was identified at time of analysis.
Oracle Essbase 21.8.3.0.0 can disclose critical data to a high-privileged, authenticated attacker over HTTP through a flaw in the Security component. The 6.8 CVSS 3.1 score reflects high confidentiality impact and a scope change (S:C) that can extend exposure to connected products, but exploitation requires an existing high-privileged account (PR:H), making this a moderate-priority risk rather than an unauthenticated remote compromise. No public exploit code or confirmed active exploitation (CISA KEV) is identified at time of analysis.
Authenticated low-privileged attackers can read and modify critical data in Oracle WebCenter Content: Imaging 14.1.2.0.0 through the SOAP interface, but high attack complexity and the need for a valid account keep practical risk moderate. The CVSS 3.1 score is 6.8 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N), with high confidentiality and integrity impact and no availability impact; only version 14.1.2.0.0 is affected, and no public exploit identified at time of analysis.
Oracle WebCenter Content: Imaging 14.1.2.0.0 (Core component) contains a hard-to-exploit access control weakness that lets a low-privileged, authenticated user reach the Imaging application over HTTP and read, create, delete, or modify data they should not control, giving full confidentiality and integrity impact to application data. Exploitation is gated by high attack complexity (AC:H - Oracle calls it 'difficult to exploit') and by the requirement for a pre-existing low-privileged account (PR:L), so anonymous outsiders cannot leverage it directly. No public exploit code or confirmed active exploitation is associated with this CVE at time of analysis, and the 6.8 Medium score reflects those friction factors rather than a trivial attack path.
Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 permit a low-privileged authenticated attacker who can reach the Content Server over HTTP to read, create, modify, or delete critical content repository data, yielding high confidentiality and integrity impact (CVSS 3.1 base 6.8). Exploitation is not unauthenticated: the assessed vector requires a valid low-privileged account (PR:L) plus network access, and the high attack complexity (AC:H) reflects additional conditions outside the attacker's direct control. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and no EPSS score was supplied, so risk is driven primarily by exposure of the Content Server interface and the population of low-privileged accounts rather than by imminent exploitation.
Authenticated low-privileged users can abuse high-complexity conditions in the LOV component of Oracle Complex Maintenance, Repair and Overhaul (CMRO) 12.2.3 through 12.2.15 to create, delete, modify, or read critical data reachable through CMRO over HTTP. The issue is rated CVSS 3.1 6.8 with high confidentiality and integrity impact but no availability impact, and exploitation requires valid EBS credentials plus attacker-independent conditions that Oracle describes as difficult to exploit. No public exploit identified at time of analysis.
Oracle MySQL Connector/ODBC 26.7.1 can allow a low-privileged, network-positioned attacker to read and modify connector-accessible data, but only under high-complexity conditions outside the attacker's control (CVSS 3.1 base 6.8, AC:H/PR:L/UI:N). The flaw affects confidentiality and integrity with no availability impact, and no public exploit code or CISA KEV entry was identified at time of analysis.
Low-privileged MySQL Server and MySQL Cluster users with network access can potentially gain read and write access to data beyond their intended authorization scope through the Server: Security: Privileges component. The issue affects MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1 plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, and Oracle characterizes exploitation as difficult with CVSS 6.8, AC:H, and PR:L. This is a moderate-priority issue, not a top-tier emergency; no public exploit identified at time of analysis, and no CISA KEV entry was present in the supplied intelligence.
Adjacent-network attackers who already hold high privileges can achieve full takeover of Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 through the Push Notifications component, gaining complete confidentiality, integrity and availability impact (CVSS 3.1 base 6.8, MEDIUM). The flaw is easily triggered once an attacker sits on the physical or adjacent communication segment attached to the PeopleTools host and no end-user action is required, but the AV:A and PR:H prerequisites keep real-world exposure well below the headline 'takeover' severity. No public exploit code or confirmed active exploitation was identified at time of analysis, and Oracle addressed the issue in its October 2026 Critical Patch Update.
Helidon deployments that use the helidon-security-providers-http-auth component can expose protected HTTP resources to unauthenticated network attackers, allowing reads of critical or otherwise inaccessible data. The affected lines are 3.0.0 through 3.2.21, 4.0.0 through 4.5.5, and 27.0.0; Oracle describes exploitation as difficult (AC:H) and confidentiality-only, with a scope change that may extend data exposure to additional products trusting the deployment. No public exploit identified at time of analysis.
Authenticated low-privileged users of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 can abuse the Application Data Sets component over HTTP to modify or delete critical application data and to cause repeated hangs or crashes, producing high integrity and availability impact. The CVSS 3.1 score is 6.8 (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H), and Oracle characterizes the issue as difficult to exploit, so reliable exploitation depends on non-default or attacker-uncontrollable conditions beyond a valid account. This is a moderate-priority issue rather than an emergency, and no public exploit identified at time of analysis.
Integrity-only manipulation of critical data in Oracle Java SE (8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27) and GraalVM for JDK/Enterprise Edition stems from SOCKS5 handling in the Networking component. An unauthenticated network attacker who can feed attacker-controlled data into the SOCKS5 code path may create, delete, or modify critical data, with a scope change that can affect additional products; Oracle rates exploitation as difficult (AC:H). No public exploit was identified at time of analysis, and no KEV confirmation is available.
Siebel Cloud Manager, the cloud provisioning and management component of Oracle Siebel CRM Cloud Applications versions 22.3 through 26.9, exposes critical data to unauthenticated attackers who can reach the deployment over an adjacent network segment. Successful exploitation yields full confidentiality and integrity impact - unauthorized creation, deletion, modification, and disclosure of all data accessible to the Siebel CRM Cloud Applications instance - though the CVSS 3.1 score of 6.8 reflects a deliberately high attack complexity and an AV:A adjacency requirement that rules out internet-based exploitation. No public exploit code has been identified at time of analysis and the issue does not appear on CISA KEV, so the realistic threat is confined to attackers who already hold a foothold on the underlying physical or layer-2 communication segment.
Oracle WebCenter Content's Content Server component (versions 12.2.1.4.0 and 14.1.2.0.0) allows an unauthenticated attacker on the same adjacent network segment to create, delete, or modify critical data and to access all WebCenter-accessible data. The CVSS 3.1 score is 6.8 (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), reflecting high attack complexity and adjacency requirements that sharply limit real-world exposure; no availability impact is scored. Exploitation status: no public exploit identified at time of analysis, and no CISA KEV entry was provided in the intelligence.
Unauthenticated attackers with access to the same physical network segment as JD Edwards EnterpriseOne Orchestrator 9.2.0.0 through 9.2.26.5 can read and modify critical Orchestrator data, although high attack complexity limits practical exploitation. The issue is rated CVSS 3.1 6.8 Medium with vector AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N. No public exploit was identified at time of analysis, and there is no CISA KEV entry.
NULL pointer dereference in HarfBuzz 8.0.0 through 14.6.0 lets a crafted font crash any application that shapes text with it, but only when the library is built with the experimental WebAssembly shaper enabled - a non-default compile-time option. An unauthenticated attacker supplies a malicious font whose embedded wasm module passes out-of-range addresses with non-zero lengths into the buffer_set_contents, face_create, or font_set_coords host imports, and the resulting crash yields availability-only impact (CVSS 3.1 base 6.8, AV:L/AC:L/PR:N/UI:R/A:H). No public exploit code and no confirmed active exploitation were identified at time of analysis, and the dominant risk limiter remains that default HarfBuzz builds never exercise the vulnerable code path.
Bearer-token authorization bypass in the Model Context Protocol TypeScript SDK packages lets a token minted for a different service be accepted by an MCP HTTP server built on requireBearerAuth() or verifyBearerToken(), giving the token holder the identity, scopes and tool access of an authenticated MCP client. Affected are @modelcontextprotocol/sdk 1.6.0-1.31.0, @modelcontextprotocol/server 2.0.0-2.2.0, @modelcontextprotocol/express 2.0.0-2.0.1 and @modelcontextprotocol/server-legacy 2.0.0-2.3.0, but only deployments whose authorization server also issues tokens for other services and whose verifyAccessToken() does not itself check the 'aud' claim. The flaw is authenticated (CVSS 6.8, AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) since the attacker must already hold a valid token from that shared authorization server; no public exploit code or confirmed active exploitation was identified at time of analysis, and note that upgrading alone does not remediate - the new expectedResource audience check ships disabled by default.
OpenImageIO's Cineon image reader can be crashed by a crafted Cineon file that declares an extremely large width, causing an integer overflow that undersizes the scanline buffer and lets UnPackPacked read past a 4-byte heap allocation. The flaw affects OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1; exploitation requires a local user to open or process a malicious file, and the impact is limited to a denial-of-service crash with no code execution or data disclosure. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, with the medium-severity rating (CVSS 6.8, independent assessment CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) reflecting the local, user-interaction-dependent attack path.
Denial of service in NSA Ghidra 10.2 through 12.1.4 allows an attacker who supplies a crafted 128-byte ELF file to force excessive memory allocation in the ELF loader, ending in an OutOfMemoryError during import/load-spec discovery or headless analysis. The issue is local and requires the victim or pipeline to load the untrusted file (user interaction), with impact limited to availability-no code execution, data disclosure, or integrity effect was assessed. No public exploit code was identified at time of analysis, and an upstream fix commit is available from the vendor.