Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 can disclose critical portal-accessible data to an unauthenticated, network-positioned attacker who convinces a separate user to interact with a crafted HTTP request against the Runtime Tools component. Rated CVSS 3.1 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N), the flaw is purely a confidentiality problem - there is no integrity or availability impact - and the mandatory victim-interaction step is the main practical barrier to exploitation. No public exploit code or confirmed active exploitation was identified at time of analysis, so this is a moderate-priority issue that warrants timely patching rather than emergency response.
Unauthenticated disclosure of critical Oracle Applications Framework data in Oracle E-Business Suite 12.2.3 through 12.2.15 lets a network-positioned attacker reach OAF HTTP endpoints and read data the victim user is authorized to see, but only after that user is induced into a human interaction such as following an attacker-supplied link. The CVSS 3.1 score of 6.5 reflects confidentiality-only impact (C:H/I:N/A:N) with no integrity or availability effect, and no public exploit code has been identified at time of analysis. Real-world risk sits below the headline score because the mandatory UI:R step blocks automated or wormable exploitation and the attacker must be able to reach the OAF interface while a legitimate user can be persuaded to interact.
Oracle Outside In Technology 8.5.8 (Outside In Core) can expose critical data to unauthenticated remote attackers who persuade a user to open, preview, or submit a crafted document for parsing; the assessed CVSS 3.1 score is 6.5 with confidentiality-only impact and mandatory user interaction. No public exploit code or CISA KEV entry is identified in the provided data, and EPSS is not supplied; this is a moderate-priority data-disclosure issue that depends on the malicious file reaching an application that invokes Outside In parsing.
Unauthenticated network attackers can cause partial integrity and availability impact in Oracle Java SE (8u503, 8u503-perf, 11.0.32.1), Oracle GraalVM for JDK (17.0.20.1, 21.0.12.1), and Oracle GraalVM Enterprise Edition (21.3.19.1.1) by supplying malicious input to Utility-component APIs. The CVSS 3.1 score is 6.5 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L; no public exploit was identified at time of analysis. Practical exploitation depends on an application exposing the affected APIs to untrusted data, or on legacy sandboxed Java Web Start/applet deployments that execute untrusted code.
Unauthenticated HTTP requests against Oracle Helidon 4.0.0 through 4.5.5 and 27.0.0 can alter or delete some Helidon-accessible data and partially degrade service availability, with the fault residing in the helidon-common-concurrency-limits component. The disclosed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, base 6.5) means no credentials or user interaction are needed, but impact is capped at low integrity and low availability with no confidentiality loss and no scope change, so the risk derives from the easy attack profile rather than severe consequences. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; Oracle addresses it through its October 2026 Critical Patch Update.
Unauthenticated HTTP access to PeopleSoft Financials 9.1 with the Brazil localization (FIN Common Objects) can allow remote attackers to make limited unauthorized updates, inserts, or deletes and cause a partial denial of service, with no confidentiality impact. Oracle rates this CVSS 3.1 base 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L), and no public exploit identified at time of analysis. Exposure is limited to organizations running the affected Brazil Common Objects module on a PeopleSoft web tier reachable by the attacker.
Oracle Java SE, together with the GraalVM for JDK and GraalVM Enterprise Edition distributions, contains a Networking component vulnerability that allows unauthenticated network attackers to make limited unauthorized changes to accessible data and to cause a partial denial of service, without any confidentiality loss or code execution. The affected builds are Java SE 8u503/8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1 and 27, GraalVM for JDK 17.0.20.1 and 21.0.12.1, and GraalVM Enterprise Edition 21.3.19.1.1. No public exploit code or confirmed active exploitation is identified at time of analysis; practical risk is concentrated in services that pass attacker-controlled data into the affected networking APIs and in legacy sandboxed applet or Web Start deployments.
Attacker-influenced DNS responses can corrupt outbound traffic from Helidon's WebClient when the round-robin DNS resolver is in use, allowing a network-positioned attacker to perform limited unauthorized modification of data and cause partial denial of service in Helidon 4.0.0 through 4.5.5 and 27.0.0. The flaw is remotely reachable without credentials or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, base 6.5), but only for deployments that actually enable the helidon-webclient-dns-resolver-round-robin component and only where the attacker can shape the DNS answers that client receives, such as a rogue DNS server or an on-path/DNS-spoofing position. There is no confidentiality impact and no public exploit identified at time of analysis, so this should be treated as a routine, scheduled-patch priority rather than an emergency.
Denial of service in Oracle Outside In Technology 8.5.8 (Outside In Core) lets unauthenticated remote attackers hang or repeatedly crash applications that parse attacker-supplied documents, with the CVSS 3.1 score of 6.5 reflecting an availability-only impact. The vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) requires network reachability plus human interaction from someone other than the attacker - typically a user opening, previewing, or uploading a crafted file into a service built on the Outside In SDK. No public exploit code exists and there is no CISA KEV listing at time of analysis, so the realistic exposure is confined to environments that embed Outside In Core in an internet-facing or multi-tenant document-processing path. Patch availability is indicated only through the Oracle Critical Patch Update advisory; no exact fixed version is stated in the available data.
Authenticated integrity compromise of Oracle WebCenter Content: Imaging 14.1.2.0.0 is achievable over the network through the product's SOAP web-service interface, where a low-privileged account can create, delete, or modify critical Imaging data without any user interaction. Confidentiality and availability are untouched - the entire CVSS 3.1 base score of 6.5 derives from a High integrity impact with PR:L, AC:L, and AV:N, meaning the only real barrier is holding valid low-tier credentials. There is no CISA KEV listing and no public exploit identified at time of analysis, so risk is concentrated in environments where the Imaging SOAP endpoint is broadly reachable by multi-tenant or delegated users rather than in mass internet-wide scanning.
Integrity compromise in Oracle JD Edwards EnterpriseOne Homebuilder 9.2 lets a low-privileged, authenticated attacker reach the Homebuilder Management component over JDENET and create, delete, or modify critical business data at will. Only version 9.2 is listed as affected, and the flaw is rated CVSS 3.1 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) - no confidentiality or availability impact, but total loss of integrity for data the account can reach. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and the attacker must already hold valid credentials, so this is not anonymously exploitable.
Oracle Java SE (8u503, 8u503-perf, 11.0.32.1, 17.0.20.1), Oracle GraalVM for JDK (17.0.20.1, 21.0.12.1) and Oracle GraalVM Enterprise Edition (21.3.19.1.1) contain an input-handling weakness in the 2D component that a remote, unauthenticated attacker can reach over the network through multiple protocols, resulting in unauthorized creation, deletion or modification of critical data plus a partial denial of service. Oracle rates the flaw 'difficult to exploit' (CVSS 3.1 6.5, AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L), so success depends on conditions the attacker cannot directly control - in practice the target must route attacker-supplied data into the 2D APIs, or run untrusted code inside the Java sandbox via applets or Web Start. No public exploit code or active exploitation was identified at time of analysis, and this is a patch-on-normal-cycle issue rather than an emergency.
Unauthenticated network attackers can cause a hang or frequently repeatable crash of Oracle MySQL Server and MySQL Cluster and make limited unauthorized data changes through the Server: Pluggable Auth component. Affected releases are MySQL Server 8.4.0 through 8.4.12, 9.7.0 through 9.7.3, and 26.7.0 through 26.7.1, plus MySQL Cluster 8.0.0 through 8.0.49, 8.4.0 through 8.4.12, 9.7.0 through 9.7.3, and 26.7.0 through 26.7.1. Oracle rates exploitation as difficult (CVSS 6.5, AC:H), and no public exploit identified at time of analysis; risk is highest where MySQL network ports are exposed to untrusted networks.
Unauthorized creation, deletion, or modification of data in Oracle BIEE's BI Search component affects versions 8.2.0.0.0 and 12.2.1.4.0. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) describes an unauthenticated network attacker who must convince another user to interact with crafted HTTP content; impact is integrity-only, with no confidentiality or availability loss. This is a moderate-priority issue rather than a top-tier one, and no public exploit code was identified at time of analysis.
Authenticated low-privileged attackers with network reachability to the JDENET service can crash or repeatedly hang Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 (E1 Dev Platform Tech on UNIX), producing a complete denial of service. The CVSS 3.1 score is 6.5, with impact confined to availability (A:H) and no confidentiality or integrity effect; exploitation requires valid low-privileged credentials (PR:L) and no user interaction (UI:N). No public exploit code identified at time of analysis, and the CVE is not reported in CISA KEV; EPSS was not supplied.
Denial of service in Oracle MySQL Server and MySQL Cluster 9.7.0 through 9.7.3 allows an authenticated low-privileged attacker with network access to crash or hang the database via crafted queries against the Server: Optimizer component. Oracle rates the issue as easily exploitable (CVSS 3.1: 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), with impact limited to availability. No public exploit code or CISA KEV entry was identified in the provided intelligence at time of analysis.
Oracle Agile PLM 9.3.6’s Application Server component exposes an HTTP-reachable, unauthenticated path that can yield full read access to PLM-accessible data plus limited insert/update/delete capability, rated CVSS 3.1 6.5. The vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N) means no credentials or user interaction are required, but Oracle’s 'difficult to exploit' rating and AC:H indicate attackers must satisfy server-state or timing preconditions beyond their direct control. No public exploit code or CISA KEV entry was identified in the available intelligence at time of analysis, and availability is not impacted.
Unauthenticated HTTP access to Oracle Siebel CRM's Open UI in versions 17.0 through 26.9 can let an attacker read and modify a limited subset of application data, with CVSS 6.5 reflecting partial confidentiality and integrity impact and no availability effect. The flaw is remotely reachable without credentials or user interaction, so exposed Open UI endpoints are the main exposure point; Oracle's October 2026 Critical Patch Update advisory is the listed vendor reference, and no public exploit has been identified at time of analysis.
Partial confidentiality and integrity compromise is possible in Oracle Java SE (8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27), Oracle GraalVM for JDK (17.0.20.1, 21.0.12.1) and Oracle GraalVM Enterprise Edition (21.3.19.1.1) through the Libraries component, which can be driven to mishandle attacker-supplied data via multiple network protocols by a remote attacker who needs no credentials or user interaction. Successful exploitation yields unauthorized read access to a subset of data plus unauthorized update, insert or delete capability, with no availability impact (CVSS 3.1 base 6.5, AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). The practical exposure depends on whether a deployed application passes untrusted input into the affected Libraries APIs (or, in the legacy case, runs sandboxed Web Start/applet code); no public exploit code is identified at time of analysis and the issue is not listed on CISA KEV, so the medium score reflects constrained, partial impact rather than absence of a network attack path.
Unauthenticated network attackers can access or modify data in JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 through the Monitoring and Diagnostics SEC component, although high attack complexity makes reliable exploitation difficult. The issue is reachable over HTTP and carries a CVSS 3.1 score of 6.5 with high confidentiality and low integrity impact; no public exploit identified at time of analysis and no CISA KEV entry is present in the provided data.
Unauthorized data access and limited data modification are possible in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 through the Content Server component. Unauthenticated remote attackers with HTTP network reachability can exploit this difficult-to-execute flaw to read critical content and modify some data, with CVSS 6.5 reflecting high confidentiality and low integrity impact. No public exploit was identified at time of analysis, and there is no CISA KEV confirmation of active exploitation.
Authentication bypass in Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 lets a remote, unauthenticated attacker reach critical application data over HTTP and make limited unauthorized changes to it. Oracle rates the flaw 'difficult to exploit' - the CVSS 6.5 score pairs a high attack-complexity rating (AC:H) with no authentication or user-interaction requirements (PR:N/UI:N), so practical risk is concentrated in internet-facing PeopleSoft portals that depend on the Security component for access control. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the referenced Oracle Critical Patch Update is the vendor's fix vehicle.
Authentication bypass in the WebLogic component of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 lets unauthenticated, network-positioned attackers read critical application data and make limited unauthorized data changes over TLS. Oracle classifies the issue as difficult to exploit (CVSS AC:H), meaning success hinges on specific server state or configuration conditions rather than a single reliable request. No public exploit identified at time of analysis; the vendor advisory is Oracle's October 2026 Critical Patch Update.
Oracle Agile PLM 9.3.6 leaves critical product lifecycle data exposed through its Application Server component, which can be reached over a TLS connection by an unauthenticated attacker who can then read, and to a lesser degree modify, records the application can access (CVSS 3.1 base 6.5, C:H/I:L/A:N). Oracle classifies the flaw as difficult to exploit (AC:H), so success depends on conditions outside the attacker's control such as specific server state, timing, or deployment-specific knowledge rather than a single reliable request; no user interaction is required and impact stays within the application's own scope. No public exploit code or confirmed active exploitation was identified at time of analysis, and exploitation is materially constrained for deployments where the Application Server is segmented away from untrusted networks. Oracle published the fix in its October 2026 Critical Patch Update.
Oracle Helidon 4.0.0 through 4.5.5 and 27.0.0 can be driven by unauthenticated network attackers to disclose a limited subset of Helidon-accessible data and cause partial denial of service in the helidon-webclient-websocket component. The CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L), and no public exploit was identified at time of analysis; exploitation requires the application to use the WebSocket client and to initiate connections toward endpoints an attacker can influence. This is a moderate-severity issue suited to normal patch-cycle remediation rather than emergency response.
Information disclosure in Oracle Siebel CRM Deployment (Server Infrastructure) versions 17.0 through 26.9 allows a low-privileged authenticated attacker with HTTP network access to read critical data accessible to the Siebel CRM Deployment component. The vendor CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so impact is limited to confidentiality with no integrity or availability effect; no public exploit was identified at time of analysis and no CISA KEV entry is present. Although the source tags call this an authentication bypass, the assessed vector requires a valid low-privileged Siebel account, making network exposure and account privilege the primary risk factors.
Oracle JD Edwards EnterpriseOne Tools builds 9.2.0.0 through 9.2.26.5 expose a confidentiality weakness in the Web Runtime SEC component reachable over the JDENET protocol, letting an authenticated low-privileged attacker read data well beyond their intended authorisation scope - up to all EnterpriseOne Tools-accessible data. Rated CVSS 3.1 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), the bug is easy to trigger once valid credentials and network access to JDENET exist, and no user interaction is required. Exploitation status: no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was supplied in the available intelligence; the realistic risk is concentrated in deployments that expose JDENET broadly and permit loosely governed low-privilege ERP accounts.
Oracle Siebel CRM Cloud Applications 22.3 through 26.9 can expose sensitive tenant data, potentially all data accessible to that tenant, to an authenticated low-privilege user through the Siebel Cloud Manager component. The issue is remotely reachable over HTTP with low attack complexity and no user interaction, and impact is confidentiality-only (CVSS 3.1 base 6.5; PR:L). No public exploit identified at time of analysis.
Information disclosure in Oracle iSupport, the customer self-service module of Oracle E-Business Suite (versions 12.2.3 through 12.2.15), lets a low-privilege account holder read data well beyond their intended scope - up to and including all data the iSupport Service Requests component can reach - over plain HTTP. Oracle's October 2026 Critical Patch Update credits the flaw with a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning no user interaction and no special conditions beyond a valid self-service login; there is no integrity or availability impact. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied, so the practical risk scales with how many low-privilege iSupport accounts exist and whether the portal is internet-facing - this is a moderate, authenticated data-exposure issue rather than an unauthenticated emergency.
Unauthenticated remote access to Oracle Siebel CRM Deployment Server Infrastructure in versions 17.0 through 26.9 can allow a network attacker to read a limited subset of deployment data and update, insert, or delete some records over HTTP. The CVSS 3.1 score is 6.5 with low confidentiality and integrity impact and no availability impact, and the available Oracle tagging identifies an authentication-bypass condition. No public exploit code or CISA KEV entry was identified at time of analysis, so this is a moderate patching priority rather than an emergency.
Unauthenticated attackers with network access over HTTP can exploit the LDAP component in Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 to read a subset of accessible data and to perform unauthorized inserts, updates, or deletes. The CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), with no availability impact, and no public exploit was identified at time of analysis. Risk is concentrated on internet-facing or otherwise reachable PeopleTools web tiers; internal-only or segmented deployments are materially less exposed.
Oracle Java SE (8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1 and 27), Oracle GraalVM for JDK (17.0.20.1, 21.0.12.1) and Oracle GraalVM Enterprise Edition (21.3.19.1.1) expose a flaw in the Security component that lets a network-reachable, unauthenticated attacker achieve partial read and partial modify access to data accessible through those APIs, with no availability impact. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, score 6.5), exploitation requires no privileges and no user interaction, but the JVM must actually process attacker-influenced input through the affected APIs - typically a web service that supplies data to them - or, in the legacy client case, run untrusted code inside a sandboxed Java Web Start application or applet. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical attack surface is narrower than the score implies because Java Web Start and the browser applet plugin are absent from modern JDKs.
Unauthenticated network attackers can read and modify a subset of data held in Oracle Communications Billing and Revenue Management (BRM) Server, affecting versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. The flaw is reachable over TLS with no credentials or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, 6.5 Medium), and impact is bounded to low confidentiality and low integrity loss with no availability effect. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied, so real-world risk is driven mainly by whether the BRM TLS interface is reachable from untrusted networks. Because BRM is back-office telecom infrastructure normally segmented from the internet, practical exploitation generally presupposes an attacker already positioned on the hosting network segment, in a partner-connected environment, or against an improperly exposed deployment.
Unauthenticated remote attackers can cause limited unauthorized data modification and partial denial of service in Oracle Java SE and GraalVM deployments by supplying crafted data to APIs in the Utility component. Affected releases include Oracle Java SE 8u503, 8u503-perf, and 11.0.32.1; Oracle GraalVM for JDK 17.0.20.1 and 21.0.12.1; and Oracle GraalVM Enterprise Edition 21.3.19.1.1. Oracle disclosed the issue in its October 2026 Critical Patch Update, and no public exploit has been identified at time of analysis.
Authenticated low-privileged users can create, modify, or delete critical data in the Siebel CRM Deployment Server Infrastructure component of Oracle Siebel CRM versions 17.0 through 26.9 by sending crafted requests over the HTTP interface. The flaw is rated CVSS 3.1 6.5 with an integrity-only impact (C:N/I:H/A:N) and is easily exploitable once a valid low-privilege credential or session is obtained - it is not confirmed as unauthenticated despite the 'Authentication Bypass' tag attached to the report. No public exploit code or confirmed active exploitation (CISA KEV) is identified at time of analysis, making this a moderate-priority integrity risk concentrated on internet-facing Siebel application servers.
Unauthenticated HTTP requests can modify some data and cause a partial denial of service in the QAS component of PeopleSoft Enterprise PeopleTools 8.61 through 8.63. The CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L), reflecting low integrity and availability impact with no confidentiality impact. No public exploit was identified at time of analysis, and real-world exposure depends on whether the QAS HTTP interface is reachable from untrusted networks.
Untrusted input that reaches Java's JGSS (GSS-API / Kerberos) security services can hang or repeatedly crash a JVM and, to a limited degree, alter data the component handles, affecting Oracle Java SE 8u503, 8u503-perf and 11.0.32.1, Oracle GraalVM for JDK 17.0.20.1 and 21.0.12.1, and Oracle GraalVM Enterprise Edition 21.3.19.1.1. Oracle scores this 6.5 on an AV:N/AC:H/PR:N/UI:N vector with C:N/I:L/A:H - no credentials or user interaction are needed, but the high attack complexity means successful exploitation depends on crafted tokens combined with timing or state conditions rather than one deterministic request, and realistic exposure is confined to deployments that actually feed attacker-controlled data into the JGSS path (for example a web service supplying data to those APIs, or sandboxed Web Start/JApplet code loading untrusted content). No public exploit code and no CISA KEV entry were identified at time of analysis, so this reads as a lower-priority, difficult-to-exploit hardening item - availability-weighted but not an urgent, actively exploited threat.
Oracle Payroll in Oracle E-Business Suite 12.2.3 through 12.2.15 allows an authenticated low-privilege attacker with network access to the Payroll HTTP interface to create, delete, or modify critical payroll data through the Element Types, Links, and Entries component. This is a moderate-priority integrity flaw: confidentiality and availability are unaffected, and exploitation requires valid EBS credentials rather than anonymous access. No public exploit was identified at time of analysis.
Improper bounds handling in the Skia graphics library lets a remote attacker who convinces a Chrome-for-Android user to open a crafted HTML page corrupt memory and read data from inside the renderer sandbox. The flaw affects Chrome on Android builds prior to 156.0.8078.47 and requires user interaction (UI:R) but no credentials or non-default configuration (PR:N), with the assessed impact limited to confidentiality loss (C:H) rather than code execution or sandbox escape. Google rates the underlying bug Critical internally and has shipped a fixed build; EPSS is low at 0.24% (14th percentile) and there is no KEV listing and no public exploit code identified at time of analysis.
Adjacent-network attackers can trigger a hang or repeatable full crash of the Oracle Database Server RDBMS component in versions 23.4.0 through 23.26.3, producing a complete denial of service. The flaw is easily exploitable - low complexity, no authentication, and no user interaction - but is gated by a network-adjacency precondition: the attacker must sit on the same physical communication segment (Layer-2/local network) as the database hardware, so it is not reachable across routed or internet boundaries. Impact is availability-only (CVSS 3.1 6.5, AV:A/AC:L/PR:N/UI:N/C:N/I:N/A:H); no public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS or KEV data was supplied.
Denial of service in Oracle MySQL Server and MySQL Cluster Group Replication allows an unauthenticated attacker on the same Layer-2 network segment to hang or repeatedly crash the database service. The flaw affects Group Replication GCS deployments in MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1 and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1; standalone instances without Group Replication enabled are not exposed. No public exploit was identified at time of analysis, and impact is limited to availability with no confidentiality or integrity effect.
Memory corruption in ANGLE within Google Chrome on Windows prior to 156.0.8078.47 can allow a remote attacker to potentially read memory inside the browser sandbox when a victim loads a crafted HTML page. The issue is medium severity (CVSS 6.5) and requires user interaction, with confidentiality impact only and no indicated sandbox escape or code execution; no public exploit identified at time of analysis and EPSS is low at 0.23% (13th percentile). Google has released a vendor patch in Chrome 156.0.8078.47.
Memory corruption in Google Chrome's Extensions component before version 156.0.8078.47 can let a remote attacker read memory inside the browser sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction - the victim must visit or be redirected to the malicious page - and the assessed impact is confidentiality-only, with no code execution, data modification, or crash from this bug alone, making it most relevant as a chaining primitive. No public exploit code was identified at time of analysis, EPSS is low at 0.23%, and Google rates the Chromium security severity as Medium.
Chrome Installer on macOS before 156.0.8078.47 contains an out-of-bounds read that can be triggered when a victim opens a crafted HTML page, potentially exposing memory inside the browser sandbox. Exploitation requires user interaction and no privileges, but the independent assessment limits confidentiality impact to Low because readable data remains inside the sandbox and no sandbox escape is demonstrated. No public exploit identified at time of analysis and no CISA KEV entry appears in the supplied data; EPSS is 0.23% (13th percentile) and the vendor has released Chrome 156.0.8078.47.
Out-of-bounds memory read in Google Chrome on Windows before 156.0.8078.47 allows an unauthenticated remote attacker who convinces a victim to load a crafted HTML page to read memory inside the renderer sandbox. Chromium rates it Medium (CVSS 6.5, C:H/I:N/A:N), and the impact is strictly a confidentiality leak bounded by the sandbox, with no integrity or availability impact, no code execution, and no sandbox escape described. Exploitation requires user interaction, EPSS is low at 0.23% (13th percentile), no public exploit or CISA KEV entry was identified at time of analysis, and a vendor patch is available.
Memory disclosure inside the browser sandbox in Google Chrome for iOS versions prior to 156.0.8078.47 allows a remote attacker to read memory via a crafted HTML page that exercises the SignIn code path. Attackers must convince a victim to navigate to an attacker-controlled page (UI:R), but no authentication or special configuration is needed; the impact is limited to confidentiality of memory within the renderer sandbox, with no sandbox escape or code execution. Exploitation risk is currently low - EPSS is 0.23% (13th percentile), no public exploit code has been identified at time of analysis, and the issue is not in CISA KEV; a vendor patch (156.0.8078.47) is available.
An out-of-bounds memory read in Chrome's Dawn WebGPU implementation (CVE-2026-113322) lets a remote attacker who convinces a victim to open a crafted HTML page read memory inside the renderer sandbox. Only Chrome builds earlier than 156.0.8078.47 are affected, and exploitation requires user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, 6.5), with impact limited to confidentiality - no memory write, code execution, or sandbox escape is described. At time of analysis there is no confirmed active exploitation and no public exploit code identified, and EPSS is low at 0.23% (13th percentile); a vendor patch is already available, which materially reduces real-world exposure.
Out-of-bounds memory read in Google Chrome's Bluetooth component (all builds prior to 156.0.8078.47) allows remote attackers to disclose memory contents from inside the renderer sandbox by getting a victim to load a crafted HTML page. Exploitation is remote, low-complexity, unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 6.5), but requires the target to visit or render the attacker's page, and grants only confidentiality impact - no memory write, code execution, or service disruption on its own. Chromium rates the issue High severity; EPSS is 0.23% (13th percentile) and no public exploit code or confirmed active exploitation was identified at time of analysis. Affected users are those on Chrome builds older than 156.0.8078.47, including ChromeOS devices tracked by the parallel stable-channel advisory.
Out-of-bounds read in Google Chrome's Media component (fixed in 156.0.8078.47) lets a remote attacker read memory inside the renderer sandbox by convincing a user to open a crafted HTML page that feeds malformed media data to Chrome's parsing pipeline. Exploitation is unauthenticated (PR:N) but requires user interaction (UI:R), and the information leak is bounded by the renderer sandbox, so a separate sandbox escape would be required to reach host memory; confidentiality impact is rated High while integrity and availability are unaffected. No public exploit code or active exploitation was identified at time of analysis (EPSS 0.23%, 13th percentile), and the vendor has released a fixed build, so exposure is largely limited to browsers that have not yet auto-updated.
Out-of-bounds read in the Offline component of Google Chrome on Android allows a remote attacker who convinces a user to open a crafted HTML page to read memory inside the renderer sandbox, exposing potentially sensitive process data. Only Android builds prior to 156.0.8078.47 are affected; the CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N), so exploitation requires user interaction with attacker-controlled content and yields information disclosure only - no code execution or sandbox escape is described. EPSS is low at 0.23% (13th percentile) and no public exploit code was identified at time of analysis; this is a routine patch-management item, not an emergency, with a vendor fix already shipped in Chrome 156.0.8078.47.