Takeover of Oracle Global Lifecycle Management OPatchAuto is possible in versions 12.2.0.1.16 through 12.2.0.1.52, but only for an attacker who already holds high-privileged logon access to the host running the tool and who can additionally induce a second person - in practice an administrator initiating a patch operation - to perform a UI action (CVSS:3.1/AV:L/AC:L/PR:H/UI:R, score 6.5). A successful attack fully compromises confidentiality, integrity and availability of the OPatchAuto installation, which typically means code execution in the context of the privileged operator running the patching workflow. No public exploit code was identified at time of analysis and the issue is not in CISA KEV; the combination of a local vector, high privileges and mandatory third-party human interaction confines realistic exposure to insider or already-compromised-operator scenarios.
Out-of-bounds read in Apple's wireless stack can crash affected devices when an unauthenticated attacker within wireless/radio proximity triggers the vulnerable code path. It affects iOS/iPadOS before 26.7 and before 27, macOS before Sequoia 15.8, Tahoe 26.7, and Golden Gate 27, plus tvOS, visionOS, and watchOS before 27; Apple has released fixed versions. No public exploit code was identified at time of analysis, and CISA SSVC rates exploitation as none and automation as no.
Full takeover of Oracle PeopleSoft PeopleTools 8.61 through 8.63 is possible through a flaw in the product's Security component, but only by an authenticated attacker who already holds high privileges on the host and can induce a separate user to perform an action. The CVSS 3.1 base score is 6.5 (AV:L/AC:L/PR:H/UI:R), and no public exploit code or CISA KEV entry has been identified at time of analysis, so realistic risk is concentrated in insider or post-compromise scenarios rather than mass remote exploitation.
Local information disclosure in Oracle Autonomous Health Framework 26.3 through 26.8 lets a low-privileged user who already has logon access to the host read critical data exposed through the Trace File Analyzer component; the scope change means the confidentiality impact can extend to other products on the same infrastructure. The issue is rated CVSS 6.5 and is a post-compromise or malicious-insider risk rather than a remote attack, and no public exploit was identified at time of analysis.
Local low-privileged users with logon access to a Siebel CRM Cloud Applications host can read critical application data beyond their intended scope through a flaw in the Siebel Cloud Manager component, affecting supported versions 22.3 through 26.9. The CVSS 3.1 score is 6.5 (Medium) with AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, meaning exploitation requires authenticated local access, needs no user interaction, changes scope, and impacts confidentiality only. No public exploit code or CISA KEV entry was identified at time of analysis.
Local, authenticated low-privileged users on a JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 host can exploit the Installation Security component to bypass controls and gain unauthorized read access to critical data, with scope change potentially exposing co-located products. The issue requires prior logon to the infrastructure (AV:L/PR:L) and has no integrity or availability impact, making it a moderate insider-risk concern rather than a remote emergency. No public exploit was identified at time of analysis, and no KEV or EPSS data was supplied.
Data exposure in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with local logon to the Content Server host to read critical data, and the scope change means the compromise can affect additional products. The assessed vector is local, requires a valid low-privilege account, and needs no user interaction; no public exploit was identified at time of analysis. This is a moderate-severity, context-dependent issue rather than a drop-everything emergency.
Information disclosure in the Indian Payroll component of Oracle HRMS (India) within Oracle E-Business Suite 12.2.3 through 12.2.15 lets a low-privileged attacker who already holds a valid logon on the infrastructure host read critical data, with the scope of the compromise extending beyond the vulnerable component to additional products. The vector is local and authenticated (AV:L, PR:L, UI:N, AC:L), so a foothold or internal credentials are a prerequisite, and impact is confined to confidentiality (C:H with no integrity or availability effect), giving a CVSS 3.1 base score of 6.5. No public exploit code and no CISA KEV entry were identified at time of analysis, and the attack surface is further narrowed to organizations that actually run the India payroll localization.
Denial of service in Oracle Secure Backup 19.1.0.0.0 and 19.1.0.1.0 can be triggered by a low-privileged user who already has local logon to the host running the product, specifically through the Device Management and Support component. Successful exploitation causes a hang or repeatable crash, and the CVSS scope change means co-located products may also be affected, while confidentiality and integrity are not impacted. No public exploit identified at time of analysis, and the issue is local and requires valid authentication per CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H.
Local integrity compromise in Oracle Solaris 11.4's Utility component allows a low-privileged user with an existing logon to create, delete, or modify critical data, with scope change potentially affecting additional products. Oracle rates this CVSS 3.1 6.5 (AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N); no public exploit code or CISA KEV confirmation was identified in the available intelligence. The flaw is not remotely exploitable and requires authenticated local access, narrowing realistic risk to insiders or attackers who already have a foothold.
Local attackers who already hold an interactive logon on a JD Edwards EnterpriseOne Tools host can leverage a separate privileged user's installation or security-configuration action to gain unauthorized modification of critical data, limited read access, and denial of service in versions 9.2.0.0 through 9.2.26.5 (CVSS 6.5). Exploitation is constrained by high attack complexity, the need for a second human actor, and local access; no public exploit identified at time of analysis.
Low-privileged users who can log on interactively to a JD Edwards EnterpriseOne Tools server can corrupt or delete critical enterprise data, read a limited subset of application data, and repeatedly hang or crash the Enterprise Infrastructure SEC component, with Oracle scoping the flaw to Tools releases 9.2.0.0 through 9.2.26.5. The attack is local only (AV:L) and high complexity (AC:H), so it is not reachable across the network and is realistically confined to insiders or intruders who already hold a foothold on the host, which keeps the CVSS 3.1 base score at 6.5 despite high integrity and availability impact. No public exploit code has been identified at time of analysis, the CVE is not in CISA KEV, and no EPSS score was supplied in the available intelligence; treat this as a moderate-priority insider-risk and hardening item rather than an emergency patch.
Stored cross-site scripting in the VPN log monitoring screen of Stormshield Network Security (SNS) appliances allows a low-privileged authenticated user to plant script content that gets persisted into VPN log data and later rendered unescaped in the SNS management interface, where it executes in the session of an administrator who opens that screen. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, medium at 6.5) reflects a scope change, so injected code runs with the trust of the appliance's own administrative origin rather than the attacker's, although practical success hinges on a privileged operator actually viewing the affected log screen. Authentication requirements are confirmed from the vector's PR:L component - a low-privileged authenticated account is needed - and no public exploit code identified at time of analysis.
Cross-origin redirect following in the Model Context Protocol TypeScript client SDK lets a malicious or compromised MCP server or OAuth authorization server receive credentials the client intended for a different origin: custom headers such as X-API-Key and mcp-session-id on any followed redirect, plus full request bodies containing OAuth refresh_token and client_secret values when the redirect uses a method-preserving 307 or 308. The flaw (CWE-200) affects @modelcontextprotocol/sdk through 1.31.0 and @modelcontextprotocol/client 2.0.0 through 2.2.0, and only applications using StreamableHTTPClientTransport, SSEClientTransport, or the SDK's OAuth helpers such as auth() are exposed - stdio clients are not; extraction of the CVSS 6.5 score requires remote, unauthenticated reachability but high attack complexity, since real exposure depends on the client being steered to a cross-origin redirect by an untrusted or intercepted endpoint. No public exploit code and no confirmed active exploitation were identified at time of analysis, and modern fetch runtimes already strip the Authorization header across origins, which limits the blast radius somewhat.
An authorization bypass in the @apostrophecms/import-export module of ApostropheCMS (versions prior to 3.7.1) lets a low-privilege contributor with draft editing rights cross the publication boundary during a duplicate-import continuation. Because the module accepts a client-supplied replacement choice without binding it to a server-side analysis owned by that user or re-authorizing the canonical target document, the contributor can select a published document for replacement on an import-enabled localized type and modify content they should not be able to touch. The flaw is rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) with integrity-only impact; no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor's current assessment derives from remediation review rather than a repeated end-to-end reproduction.
Vitest dev servers in versions 5.0.0-beta.6 through 5.0.4 misapply Vite's server.fs.deny denylist, letting remote attackers who can reach a Vitest UI, Browser Mode, or API server read project files that should have been blocked and retrieve the fallback API token stored at node_modules/.vitest/.vitest-secret-token. A second variant, requiring Browser Mode with test.projects and a victim visiting an attacker-controlled site, leaks JavaScript-compatible .env values. No public exploit code or active exploitation has been identified at time of analysis, and the practical exposure is limited because these are development-only servers typically bound to localhost; the fix ships in Vitest 5.0.5.
Stored cross-site scripting in the CozyThemes Rootblox WordPress plugin through version 1.0.7 allows an authenticated low-privileged user to persist malicious input that executes in another user's browser when that victim views the affected page. The CVSS 3.1 score is 6.5 with PR:L and UI:R, so risk is concentrated on sites granting low-trust accounts content-submission access; no public exploit was identified at time of analysis.
Stored cross-site scripting in the Brainstorm Force SureCart WordPress plugin (all versions through 4.9.5) allows an authenticated low-privileged user to persist a script payload that later executes in a higher-privileged administrator's browser when the affected page is viewed, matching CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (6.5). Because exploitation requires both a foothold account capable of submitting the stored data and victim interaction, the practical risk is bounded rather than a self-propagating compromise, and the scope change (S:C) means the payload executes in the administrator's session context rather than the attacker's. No public exploit code and no CISA KEV entry were identified at time of analysis, and the available data does not identify a fixed SureCart release, so sites on 4.9.5 or earlier should be treated as unpatched pending confirmation from the Patchstack advisory.
Missing authorization in the Meta Box WordPress Custom Fields Framework (versions up to and including 5.15.2) lets an authenticated low-privilege user read custom-field and meta data they are not authorized to access, because the vulnerable code path does not verify that the requester holds the required capability. Only confidentiality is impacted (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/C:H/I:N/A:N), and exploitation requires a valid WordPress account on the target site - so sites with open user registration or any attacker-held account are the realistic risk. No public exploit code or confirmed active exploitation was identified at time of analysis.
Stored cross-site scripting in Castos Seriously Simple Podcasting affects WordPress sites running versions through 3.17.0, allowing an authenticated low-privilege content author to persist script payloads in podcast content that execute when another user views the affected page. The 6.5-severity issue requires victim interaction and is limited to sites exposing posting capabilities to untrusted accounts; no public exploit code or CISA KEV confirmation was identified at time of analysis.
Denial of service in Mozilla Firefox's built-in PDF Viewer (pdf.js) allows remote attackers to crash or hang the browser when a victim opens a crafted PDF document, either via a web page or an email attachment. The issue affects Firefox versions prior to 158.0.1 and is fixed in that release; exploitation requires user interaction (UI:R) and provides no confidentiality or integrity impact, only availability loss confined to the browser process. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied.
High-privileged users of Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 can abuse the Asset Management component over HTTP to create, delete, or modify critical records, read data they should not reach, and partially disrupt availability of the module (CVSS 3.1 6.4, Medium). Exploitation is gated by two hard preconditions: the attacker must already hold a high-privilege authenticated account (PR:H) and a separate victim must be induced to interact with the attack (UI:R), so this cannot be triggered unauthenticated or fully automated. No public exploit code was identified and there is no CISA KEV confirmation of active exploitation at time of analysis; the practical exposure is confined to organizations running the Argentina localization of FIN Common Objects on version 9.1.
Authenticated low-privileged users with HTTP access to Oracle Agile Product Lifecycle Management for Process 6.2.4 can exploit a high-complexity flaw in the Product Quality Management component to gain broad read access to critical data, make limited unauthorized data changes, and trigger a partial denial of service. The issue carries a CVSS 3.1 base score of 6.4 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L); the high attack-complexity rating means successful exploitation depends on conditions outside the attacker's direct control. No public exploit code or confirmed active exploitation (CISA KEV) was identified in the available intelligence at time of analysis.
Denial of service plus limited data tampering in Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5: a low-privileged authenticated attacker who can reach the JDENET service over the network can hang or repeatedly crash the application (Availability impact rated High) while also reading and modifying a subset of the data it exposes. Oracle classifies the flaw as difficult to exploit (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H, base score 6.4), meaning success depends on specific timing or server-state conditions rather than a single crafted request, and a valid account is required. No public exploit code or confirmed active exploitation has been identified at time of analysis, so this is a normal-CPU-cycle remediation rather than an emergency.
Oracle JD Edwards EnterpriseOne Tools (component: Enterprise Infrastructure SEC) versions 9.2.0.0 through 9.2.26.5 can be driven into a persistent hang or repeatable crash through the JDENET protocol, while also exposing a limited slice of application data to unauthorized read and modification. The attack is network-reachable but rated high complexity and requires an existing low-privilege account, so it is a constrained, moderate-severity (CVSS 6.4) issue rather than an easily triggered remote takeover; no public exploit code exists and there is no confirmed active exploitation (not in CISA KEV) at time of analysis. Impact concentrates on availability, with secondary confidentiality and integrity effects.
Oracle Siebel CRM Deployment releases 17.0 through 26.9 expose a Server Infrastructure weakness that lets a low-privilege user with HTTP access hang or repeatedly crash the component while also reading and modifying a limited subset of data it manages. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H, base 6.4) shows the attack is remote but gated by a valid low-privilege Siebel account and by a high-complexity precondition such as a race window or a particular server state the attacker does not fully control, so the availability impact dominates (A:H) while confidentiality and integrity effects stay low. No public exploit code was identified at time of analysis and there is no CISA KEV confirmation of active exploitation; this is a moderate-severity, moderate-priority issue rather than a top-tier emergency, with the highest practical risk in deployments where the Siebel server is internet-facing or broadly reachable from the corporate network and low-privilege accounts are liberally provisioned.
Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 allows an authenticated low-privileged user with HTTP access to the BI Platform Security component to read and modify a limited subset of BIEE data, with scope change that may affect additional Oracle products. The vector requires a valid low-tier account and no user interaction, so exposure depends on externally reachable or untrusted low-privileged BIEE accounts. It is a real-but-not-urgent, medium-severity priority; no public exploit code or CISA KEV active exploitation is identified at time of analysis.
Stored cross-site scripting in the DiviGear Carousel WordPress plugin (all versions through 5.2.0) lets any authenticated user at subscriber level or above write arbitrary script into the site's stored license settings through the plugin's update_license AJAX action. The payload is persisted without sanitization and is echoed unescaped into a single-quoted HTML value attribute on the DiviGear > Activation settings page, so it executes in the browser of an administrator who later opens that page, enabling session theft or privileged actions performed as the victim. Exploitation is gated on a valid low-privilege account and on an administrator visiting the Activation screen; no public exploit code was identified at time of analysis and the issue is not in CISA KEV.
Privilege escalation and takeover within the Package Build SEC component of Oracle JD Edwards EnterpriseOne Tools (9.2.0.0 through 9.2.26.5) allows a high-privileged user who already holds logon access to the application host to fully compromise the product's confidentiality, integrity and availability. The flaw is rated difficult to exploit (AC:H) and requires both local access and existing high privileges, so realistic exposure is limited to malicious insiders or attackers who have already compromised a privileged account rather than remote or unauthenticated actors. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; vendor remediation is published through Oracle's October 2026 Critical Patch Update.
Oracle Agile PLM 9.3.6 contains a high-complexity Security component flaw that a locally logged-on low-privilege attacker can use to gain broad read access to critical Agile PLM data and limited ability to modify it. The CVSS 3.1 score is 6.4 (AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N), and the scope change means successful exploitation may affect resources beyond the Agile PLM application itself. No public exploit code or CISA KEV entry was identified at time of analysis, so risk is mainly to environments where untrusted users already have interactive host access.
A local privilege-escalation-style flaw in Oracle Essbase 21.8.3.0.0's Java Based Agent component lets an attacker who already holds a low-privileged logon on the Essbase host read, modify, or delete sensitive data managed by the product. Because the vector is AV:L/AC:H/PR:L/UI:N/S:C, exploitation requires local access plus a condition outside the attacker's control, and the scope change means co-located products on the same host may also be compromised. No public exploit code or confirmed active exploitation was identified at time of analysis, and the moderate CVSS 3.1 base score of 6.4 reflects confidentiality-heavy impact with only partial integrity loss.
The TYPO3 extension "FAL Protect" fails to enforce its access protection on files stored in file storages configured with a non-default relative base path, allowing those files to be fetched straight from the web server without any authentication or permission check. The flaw only manifests on websites running TYPO3 14.3 that use such a non-default storage configuration; default relative base paths are not affected, and no public exploit code or confirmed active exploitation was identified at the time of analysis. Impact is limited to confidentiality - unauthenticated remote attackers can read protected files but cannot modify or delete them - making this a genuine but moderate-priority issue rather than a critical emergency.
This is a moderate-severity, authentication-gated server-side request forgery (SSRF) rather than a top-tier emergency: CVE-2026-28329 affects SolarWinds Observability Self-Hosted (CVSS 6.4) and requires a valid low-privileged authenticated session (PR:L). An attacker who can reach the vulnerable server-side request feature can make the application server send requests to attacker-controlled or internal destinations, which may expose otherwise firewalled services or cloud metadata endpoints; impact is limited by the authentication requirement and the server’s network reachability, and no public exploit or confirmed active exploitation was identified at time of analysis.
A request-routing discrepancy in Cloudflare Pingora before 0.9.0 lets an unauthenticated remote attacker send a single HTTP/2 request that the proxy evaluates under one authority while the upstream receives a different Host, so Host-based filters, access controls, or cache keys can be applied to the wrong virtual host. Exploitation is conditional and moderate risk: the deployment must terminate client HTTP/2 in Pingora, make security or caching decisions from the request URI authority, and sit in front of an upstream that routes by Host and serves different content per Host. The outcome is limited-impact confidentiality and integrity exposure on the downstream component (possible cache poisoning or host-based access-control bypass); there is no public exploit code and no confirmed active exploitation at time of analysis, and Cloudflare's own CDN path was unaffected because its internal Pingora services do not accept HTTP/2 from clients.
A path-traversal information-disclosure flaw in Vite's development server (versions 8.2.0 through 8.2.3 and 8.3.0 through 8.3.2) lets a remote requester read the first 4 bytes of any file on the host filesystem - including files deliberately excluded from server.fs allowed roots, such as .env secrets and private keys - by appending a ?vite-wasm-instance query string to the request path. The internal Wasm plugin's load hook strips the query, reads the target path directly from disk without applying server.fs checks, then fails WebAssembly parsing and leaks the file's leading bytes in the resulting Node/Deno error message. Exploitation requires a network-reachable dev server (localhost-bound by default, so exposure via 0.0.0.0 binding, proxying, or a shared network is a precondition); no public exploit code exists in the provided data and CISA KEV does not list it, while the assessed impact is limited confidentiality loss given only 4 bytes leak per request.
Unauthenticated information disclosure in the coding.ms 'typo3_fluid_form' extension for TYPO3 lets remote attackers retrieve files other visitors uploaded through forms, because the download link depends on a predictable token and the file name in the request is not verified in a guess-resistant way. Only sites that run the extension and use its file-upload-via-form workflow are exposed, and only files that already exist can be read; the vendor rates the issue CVSS 4.0 base 6.3, while our independent assessment scores it CVSS 3.1 6.5-equivalent at AV:N/AC:H/PR:N/UI:N with low confidentiality impact and no integrity or availability effect. A second exposure path exists: the token is rendered in plain text in the text/plain body of the notification email, so anyone who can read that message (forwarding, misdelivery, mailbox compromise, mailing-list archiving) obtains the token directly. No public exploit code or confirmed active exploitation was identified in the provided data.
Authenticated low-privileged users of Oracle REST Data Services (ORDS) 24.2.0 through 26.1.0 can, over HTTP, read and modify a subset of Database Actions-accessible data and cause a partial denial of service against the service. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, base 6.3) confirms the attacker must already hold a valid low-privileged session; no victim interaction is required. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, making this a moderate, authenticated patch priority rather than an emergency.
Oracle WebCenter Content 14.1.2.0.0 (Content Server component) allows a low-privileged, HTTP-reachable attacker to create, delete, or modify critical repository data and read a limited subset of it, but only after a second, typically higher-privileged user is induced to interact with attacker-controlled content or a crafted request. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N) makes valid credentials and victim interaction both mandatory, so the flaw is not anonymously reachable and is poorly suited to automated or wormable mass exploitation; integrity impact is high while confidentiality is limited and availability is unaffected. No public exploit code and no confirmed active exploitation were identified at time of analysis, consistent with a moderate, not top-tier, priority rating.
Oracle Database Server's Java VM (Oracle JVM/OJVM) component carries an integrity-only flaw affecting versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3, reachable by a low-privileged account with network access through the SOCKS5 pathway. Oracle explicitly rates the issue as difficult to exploit (AC:H), and impact is limited to unauthorized creation, deletion, or modification of critical and Java VM-accessible data, with a scope change (S:C) meaning additional products can be affected; confidentiality and availability are unaffected. This is a moderate-priority issue rather than a top-tier emergency, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Oracle Essbase 21.8.3.0.0 exposes a Security-component flaw that lets an authenticated low-privileged attacker with network HTTP access read and modify a subset of accessible data and cause a partial denial of service. The CVSS 3.1 score is 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), so exploitation requires a valid Essbase account but no user interaction or elevated privileges. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was provided.
Administrator credentials for EdgeLink-enabled Advantech ADAM-3600 devices can be recovered from an encrypted project file, exposing sensitive device management secrets to anyone who obtains that engineering artifact. The issue is a moderate, conditional information-disclosure risk: exploitation requires local access and prior possession of the project file, which is normally confined to operator workstations, backups, or repositories, and there is no remote unauthenticated path. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was provided.
A low-privileged attacker who already holds logon access to the host running Siebel CRM Development 17.0 through 26.9 can abuse the Integration - Scripting component to read and modify critical data within the application. Oracle rates this 6.3 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) and explicitly labels it difficult to exploit, since high attack complexity means specific timing, configuration, or environmental preconditions must align; there is no availability impact and no remote network path. No public exploit code has been identified at time of analysis and there is no KEV entry, so this is a moderate-severity, low-urgency item for patch-cycle handling rather than emergency response; remediation is delivered through Oracle's October 2026 Critical Patch Update.
Local, authenticated attackers holding a low-privileged logon on a host where Oracle Siebel CRM Deployment's Server Infrastructure component runs (supported versions 17.0 through 26.9) can exploit this flaw to obtain complete read and write access to all deployment-accessible data, breaking both confidentiality and integrity. Exploitation is difficult (AC:H) and confined to the local host with no network vector, so it is primarily an insider-threat or post-compromise escalation concern rather than an internet-facing emergency, and no public exploit code was identified at time of analysis, with no CISA KEV listing.
Authenticated low-privilege users with interactive logon to the host running Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 can exploit a flaw in the Enterprise Infrastructure SEC component to gain unauthorized read and write access to critical application data, scoring CVSS 6.3 with high confidentiality and integrity impact but no availability impact. Exploitation is local only (AV:L) and rated high complexity (AC:H), meaning an attacker must already hold a valid account on the infrastructure host and satisfy additional non-default conditions or timing before the weakness can be reliably triggered. No public exploit code or confirmed active exploitation has been identified at time of analysis, and no CISA KEV listing applies.
JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 can allow a low-privileged attacker who already has local logon to the hosting infrastructure to compromise the Enterprise Infrastructure SEC component, including reading and modifying critical EnterpriseOne data. The CVSS 3.1 score is 6.3 with AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N, so exploitation is local, requires an authenticated low-privileged account, and depends on difficult-to-control preconditions rather than network reachability. This is a moderate-priority issue rather than an emergency: no public exploit code or CISA KEV entry was identified at time of analysis.
The Python `filelock` package's opt-in `StrictSoftFileLock` (3.30.0 through <4.2.1) and `SoftReadWriteLock` (4.0.0 through <4.2.1) can adopt a protocol directory (`<path>.filelock`/`claims` or `<path>.rw`/`gen`/`holders`) that another local account created first inside a shared, non-sticky parent directory, letting that account tamper with protocol state and admit two concurrent lock holders. Only local attackers on the same host who win the creation race can exploit it; the default `FileLock` class is not affected, there is no confidentiality impact, and the race/ordering requirement raises attack complexity. No public exploit code was identified at time of analysis, and the issue is fixed in filelock 4.2.1.
Participants Database, a WordPress plugin by xnau webdesign, is affected through version 2.7.8.5 by an insecure direct object reference (CWE-639) that lets an authenticated low-privilege user manipulate a user-controlled record key to bypass intended access-control checks and read or alter participant records. The issue is remote with no user interaction required, but impact is limited to low confidentiality, integrity, and availability; no public exploit code or confirmed active exploitation was identified at time of analysis. Risk is greatest on WordPress sites that allow self-service registration or run permissive/default access-level settings for the plugin.
Vite development servers can be induced to serve a single file from outside the project root after import analysis records a root-relative browser URL, rather than the cleaned resolved module identifier, in the internal safeModulePaths trust list. Only non-Windows hosts running a network-accessible dev server (not a production build) are affected, and only when server.fs.deny does not already block the target file; because the colliding path must correspond to a project-relative URL authorized by the application graph, arbitrary path traversal is not achievable and impact is limited to read disclosure with no integrity or availability effect. Exploitation requires the coincidence of an imported project file whose URL matches an absolute host path plus attacker access to the exposed dev server, which the independent assessment scores as higher complexity (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N); no public exploit code was identified at time of analysis.
Argument injection in launch-editor (prior to 2.14.2), the Node.js 'open file in editor' helper shipped with Vite and vite-plus, allows an unauthenticated attacker who can place a file whose name begins with '+' or '-' into the project working directory to have that name interpreted as a command-line flag by the selected editor. When the reachable editor is Vim/gVim, MacVim, Emacs/Emacsclient, or Notepad++ with a plugin exposing dangerous operations, and the path stays relative (or is converted to a relative WSL path), this can lead to unintended file overwrite or arbitrary command execution in the developer's context. Exploitation is heavily preconditioned - the malicious filesystem entry must already exist, a vulnerable editor must be the configured one, and VS Code or absolute-path invocations are unaffected - so per the independent assessment it is rated AC:H with limited (low) confidentiality, integrity, and availability impact rather than a straightforward RCE; no public exploit code has been identified at time of analysis.
OS command injection on Windows in the launch-editor npm package before 2.14.2 lets remote attackers who can influence an environment variable value or a file path containing '%' trigger cmd.exe variable expansion and execute arbitrary commands when the open-in-editor feature is invoked. The flaw is rated medium severity (CVSS 4.0 base 6.3; CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) and is limited to Windows developer workstations using Vite or Vite Plus dev-server tooling; no public exploit identified at time of analysis.