High-privileged local users on hosts running Oracle Essbase 21.8.3.0.0 can obtain unauthorized read access to critical Essbase data through a flaw in the Java Based Agent component, and because the scope is changed the exposed data may include that of other products on the same host. The CVSS 3.1 score is 6.0 (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N), a confidentiality-only impact that requires an existing interactive logon and administrator-level privileges rather than network reachability. No public exploit code or CISA KEV entry was identified at time of analysis, and patching is available through the referenced Oracle Critical Patch Update.
Local, high-privileged attackers with logon to the infrastructure hosting Oracle Product Lifecycle Analytics 3.6.1 can exploit an installation-related flaw to obtain unauthorized read, create, delete, or modify access to critical application data. The CVSS 3.1 score is 6.0 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N), reflecting high confidentiality and integrity impact but no availability impact, and exploitation requires an already privileged local operator rather than remote unauthenticated access. No public exploit identified at time of analysis; this is a moderate-severity, low-urgency issue.
High-privileged users who can log on locally to hosts running Oracle Siebel CRM Development (versions 17.0 through 26.9) can leverage the Configuration Tools component to read and modify data well beyond their intended authorization boundary. The flaw carries a CVSS 3.1 base score of 6.0 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N), meaning the attacker must already hold an elevated local logon and no user interaction is needed - there is no network-reachable vector. There is no public exploit identified at time of analysis and it is not in CISA KEV; because the prerequisites limit abuse to already-trusted privileged accounts, this is best treated as a segregation-of-duties and defense-in-depth issue rather than an externally exploitable emergency.
High-privileged local users can corrupt critical data or repeatedly crash PeopleSoft PeopleTools 8.61-8.63 through the Updates Environment Mgmt component, with CVSS 3.1 scoring 6.0 for integrity and availability impact. Exploitation requires logon to the infrastructure hosting PeopleTools and pre-existing high privileges, so realistic exposure is limited to trusted insiders or attackers who have already escalated on the host. No public exploit identified at time of analysis, and no CISA KEV entry is associated with this CVE in the provided data.
Oracle Essbase 21.8.3.0.0 contains a Security-component flaw that allows a high-privileged local attacker to obtain unauthorized access to critical Essbase-accessible data, with scope change extending impact to additional products. Exploitation requires an authenticated logon to the host infrastructure (PR:H, AV:L) and no user interaction. No public exploit was identified at time of analysis, and Oracle addressed the issue in its October 2026 Critical Patch Update advisory.
Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 contain a high-privilege local vulnerability in the Porting component that lets an attacker with existing elevated credentials and logon access to the host infrastructure read, create, delete, or modify critical PeopleTools data, affecting both confidentiality and integrity (CVSS 3.1 base 6.0). The local attack vector and PR:H requirement mean this is an insider-abuse or post-compromise impact-escalation scenario rather than a remotely reachable flaw, and no public exploit code or CISA KEV active-exploitation entry was identified at time of analysis. Oracle addressed the issue in its October 2026 Critical Patch Update.
Predictable export archive filenames in the @apostrophecms/import-export module before 3.7.1 let an unauthenticated requester derive and fetch another user's export archive from publicly readable export storage while it still exists. Only deployments with the import-export feature enabled and export/upload storage that is publicly reachable over the network are exposed, and the attacker must time the request inside the window before the archive expires or is cleaned up. Exploitation additionally depends on a user with export permission having already created an archive, so real-world risk is conditional rather than universal; no public exploit code or confirmed active exploitation was identified at time of analysis, though the disclosure yields full read access to exported content (CVSS 4.0 6.0; assessed CVSS 3.1 AV:N/AC:H/PR:N/UI:R/C:H/I:N/A:N).
Insufficient filtering in Apache CouchDB's shared _replicator database (3.5.2 and earlier, all platforms) allows any authenticated user to read the replication credentials belonging to other users' replication jobs, potentially exposing usernames, passwords, or auth tokens for external source and target endpoints. The flaw is only meaningful in multi-user or multi-tenant deployments where distinct users' credential-bearing replications coexist; a low-privileged account with no user interaction and no admin rights can harvest those secrets and pivot to the systems they unlock, which is why the vendor's CVSS 4.0 vector rates subsequent-system confidentiality as high. Upgrading to 3.5.3 fixes the issue; no public exploit code or confirmed active exploitation was identified at time of analysis.
A path-traversal information disclosure in Vitest's mocker interceptor plugin requires a Windows host running the Vite dev server with WebSocket mock-registration enabled, and the attacker able to reach that server, to read files outside server.fs.allow that the Vitest process can access. The flaw arises because backslashes in a redirect mock pathname survive a POSIX-style join, so the allow-list check validates one path while the subsequent filesystem read resolves a different one - giving unauthenticated remote attackers read-only access to arbitrary process-readable files on Windows only. No public exploit code was identified at time of analysis and the flaw is not on the CISA KEV list; the high attack complexity and typical local binding of dev servers keep real-world risk moderate.
Denial of service affecting Oracle Siebel CRM Deployment versions 17.0 through 26.9 allows an unauthenticated, network-positioned attacker to hang or repeatedly crash the Deployment Server Infrastructure over HTTP. The CVSS 3.1 score is 5.9 with a high attack-complexity rating, meaning success depends on server-state, timing, or request characteristics outside the attacker's direct control, and impact is limited to availability with no confidentiality, integrity, or code-execution effect. No public exploit code was identified at time of analysis, and this is a moderate-severity availability issue rather than a top-priority compromise risk.
Credential disclosure in Mozilla Thunderbird's Exchange AutoDiscover account-setup flow allows an on-path network attacker to capture the user's password when the client falls back to plaintext HTTP and includes the entered credentials in that request. Thunderbird versions prior to 158.0.1 are affected; exploitation is limited to the one-time account-configuration window and requires the attacker to already control the network path (CVSS 5.9, AC:H). No public exploit code was identified at time of analysis.
Unauthenticated, network-reachable attackers can force a hang or repeatable crash of MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, and of MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, through the Server: Components Services component. Oracle rates this CVSS 3.1 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H), with impact limited to availability; the high attack complexity reflects conditions outside the attacker's control rather than a deterministic payload. No public exploit code or confirmed active exploitation was identified in the available intelligence, and the issue is materially lower risk where the MySQL listener is not exposed to untrusted networks.
Denial of service in Oracle Java SE 26.0.2 can be triggered when an application or web service passes attacker-controlled data to the Compiler component APIs. The flaw is remotely reachable without authentication or user interaction, but high attack complexity makes reliable triggering difficult, and impact is limited to availability (hang or repeated crash). No public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated network attackers can hang or repeatedly crash Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 by reaching the Business Interlink component over HTTP. Exploitation is constrained by high attack complexity, meaning the attacker must satisfy conditions beyond their direct control or achieve precise/repeatable triggering; impact is availability-only, with no confidentiality or integrity effect. The flaw is not listed in CISA KEV and no public exploit code was identified at time of analysis, so practical risk is moderate and depends heavily on whether Business Interlink is exposed beyond trusted internal networks.
A confidentiality-only information disclosure flaw exists in the Networking component of Oracle Java SE (11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27) and Oracle GraalVM for JDK (17.0.20.1, 21.0.12.1), rated CVSS 3.1 base 5.9. Successful exploitation allows an unauthenticated network attacker to read critical data or gain complete access to all data reachable by the affected Java runtime, but Oracle classifies the issue as 'Difficult to exploit' (AC:H) because success depends on special conditions such as specific data flows into the Networking APIs, and no public exploit code or active exploitation has been identified at time of analysis. Exposure is greatest for applications or web services that pass untrusted input into the Networking component APIs, and for sandboxed Java Web Start or applet deployments that load untrusted code and rely on the Java sandbox for security.
Oracle WebLogic Server 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 can expose critical server-accessible data to an unauthenticated remote attacker over HTTP, but Oracle rates the flaw difficult to exploit due to high attack complexity. No public exploit identified at time of analysis, no CISA KEV entry is present in the provided data, and no EPSS score was supplied. The CVSS 3.1 base score is 5.9, with confidentiality-only impact.
Unauthorized read access to critical data in Oracle JD Edwards EnterpriseOne Tools (versions 9.2.0.0 through 9.2.26.5) is possible for unauthenticated remote attackers through the Interoperability SEC component's HTTPS interface. Oracle characterizes the flaw as difficult to exploit (AC:H) and limits impact to confidentiality only, for a CVSS 3.1 base score of 5.9. No public exploit identified at time of analysis, and no CISA KEV activity is associated with this CVE.
Unauthenticated attackers with HTTP network access to the Portal security (Portal SEC) component of Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 may be able to read critical data, including potentially all data accessible through the Portal, via an authentication-bypass weakness. The CVSS 3.1 score of 5.9 reflects confidentiality-only impact (C:H/I:N/A:N) tempered by high attack complexity (AC:H), meaning exploitation depends on conditions outside the attacker's control such as specific configuration or environmental state, so the flaw is difficult rather than trivial to exploit reliably. No public exploit code and no CISA KEV confirmed active exploitation were identified at time of analysis.
Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 contain an unauthenticated HTTP-accessible flaw that can disclose critical or all application-accessible data. The vendor rates attack complexity as high (AC:H), meaning exploitation depends on conditions the attacker does not control and is not reliably repeatable, and impact is limited to confidentiality with no modification or denial of service. No public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated network attackers can obtain unauthorized read access to critical data in Oracle JD Edwards EnterpriseOne Tools (versions 9.2.0.0 through 9.2.26.5) by reaching the JDENET communication service, but Oracle rates the issue as difficult to exploit (CVSS 3.1 base 5.9, AC:H), and only confidentiality is affected. There is no public exploit code and no confirmed active exploitation at time of analysis, so practical risk is concentrated in environments that expose the JDENET transport beyond trusted internal networks.
Unauthenticated, network-reachable HTTP attackers can obtain unauthorized read access to critical data in Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 via a flaw in the Enterprise Infrastructure SEC component. Oracle scores it 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) in the October 2026 Critical Patch Update, explicitly rating it difficult to exploit and confining impact to confidentiality, with no effect on integrity or availability. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; EPSS scoring was not supplied in the source data.
Oracle Java SE and GraalVM JDK/Enterprise distributions can expose confidential data when JAXP processes attacker-supplied XML, with the most realistic path being services that feed untrusted data into XML APIs. The flaw affects specific Java SE 8u503, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, and 27 releases plus listed GraalVM versions, and is difficult to exploit (AC:H) with confidentiality-only impact. No public exploit was identified at time of analysis, and patch availability is documented through Oracle's October 2026 Critical Patch Update advisory.
Information disclosure in the JDBC component of Oracle Java SE, Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition (CVSS 3.1 base 5.9) lets an unauthenticated network attacker who can get attacker-influenced data into the affected JDBC APIs read critical data that the Java process can access; there is no integrity or availability impact. Exploitation is explicitly rated difficult (AC:H) and depends on non-trivial preconditions, chiefly a service that feeds untrusted input to those APIs or a sandboxed Java Web Start/applet client running untrusted code. No public exploit code was identified at time of analysis, and the issue was disclosed through the Oracle Critical Patch Update of October 2026 covering Java SE 8u503/8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1 and 27, GraalVM for JDK 17.0.20.1/21.0.12.1, and GraalVM Enterprise Edition 21.3.19.1.1.
MySQL Connector/Net 26.7.0, Oracle's ADO.NET client library for MySQL, can expose connector-accessible data to an unauthenticated network attacker who controls or impersonates the MySQL server the client connects to. Oracle rates it CVSS 3.1 5.9 (Medium) with AC:H, reflecting a difficult-to-exploit, confidentiality-only flaw that is not a direct hit against a passively listening service. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS data was supplied with the source intelligence.
Oracle Siebel CRM Cloud Applications versions 22.3 through 26.9 expose a confidentiality-only weakness in the Siebel Cloud Manager component that remote, unauthenticated attackers can reach over the network via LDAP. Oracle rates exploitation as difficult (CVSS 3.1 score 5.9, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N), so success appears to hinge on specific LDAP configuration, timing, or environmental conditions rather than a single repeatable request, and a successful attack yields disclosure of critical data rather than modification or service disruption. There is no CISA KEV listing and no public exploit identified at time of analysis, so this should be handled as a moderate-priority hardening item rather than an emergency.
Unlimited current-password guessing against ApostropheCMS versions before 4.33.0 lets anyone holding an already-authenticated session - even a disposable low-privilege guest session - grind out a victim's existing password through the self-service endpoint PATCH /api/v1/@apostrophecms/settings/password, because that route verifies the password directly without touching the login module's failed-attempt counter, delay, or lockout. Successful guessing yields full account takeover, so confidentiality and integrity are both rated High while availability is unaffected; the assessed vector is CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N (6.8), stricter on privileges than the vendor's published 5.9/PR:H but agreeing on impact. The attack is not self-starting - no pre-authentication vector exists and success still hinges on victim password entropy - and no public exploit code or active exploitation was identified at time of analysis, though the GHSA advisory itself ships a local PoC curl loop that demonstrates the missing throttle.
Authenticated low-privileged users can read critical Product Quality Management data and partially degrade availability in Oracle Agile Product Lifecycle Management for Process 6.2.4 through network HTTP requests, but Oracle rates exploitation as difficult (CVSS 3.1 5.9, AC:H, PR:L). The flaw is confined to the Product Quality Management component and requires valid credentials, so it is a targeted, post-authentication risk rather than an anonymous attack surface. No public exploit code or confirmed active exploitation was identified in the provided intelligence at time of analysis.
Oracle JDeveloper 12.2.1.4.0 and 14.1.2.0.0 expose an ADF Databinding flaw that lets a low-privileged authenticated user reach critical data over the network via SOAP, with a secondary ability to cause a partial denial of service. Oracle rates the issue 'difficult to exploit' (AC:H), so success hinges on configuration or environmental conditions rather than a straightforward single request; integrity is unaffected, and the realistic risk is confidential-data disclosure by an insider or a compromised low-privilege account. No public exploit code was identified at time of analysis and the issue is not in CISA KEV, making this a moderate, lower-priority item for patch planning.
Unauthorized modification of critical data in Oracle Java SE's JGSS component affects Java SE 8u503, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, and 27, as well as GraalVM for JDK 17.0.20.1/21.0.12.1 and GraalVM Enterprise Edition 21.3.19.1.1, allowing a remote, unauthenticated attacker to alter data accessible through the JVM. The flaw is difficult to exploit (CVSS 3.1 base 5.9, AC:H) and requires an application or web service that supplies attacker-controlled network data to JGSS APIs; Oracle states it is not reachable through untrusted Java Web Start applications or applets. No public exploit identified at time of analysis and no CISA KEV active exploitation is confirmed, with impact limited to integrity and no confidentiality or availability effect.
Data modification in Oracle JDeveloper 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated network attackers to create, delete, or modify critical or all JDeveloper-accessible data through the Java Business Objects component over HTTP, but Oracle and the CVSS vector classify exploitation as difficult because of high attack complexity and preconditions outside attacker control. The flaw is integrity-only (CVSS 3.1 base 5.9; C:N/I:H/A:N) with no confidentiality or availability impact, and no public exploit code has been identified at time of analysis. Realistic exposure is limited because JDeveloper is a developer tool that is not typically internet-exposed in production.
A high-complexity integrity flaw in the Security component of Oracle Java SE (8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27), Oracle GraalVM for JDK (17.0.20.1, 21.0.12.1) and Oracle GraalVM Enterprise Edition (21.3.19.1.1) lets a remote attacker who can feed untrusted data into the affected Security APIs create, delete or modify critical data, though the attacker gains no data disclosure or denial of service (CVSS 3.1 5.9, AV:N/AC:H/PR:N/UI:N/C:N/I:H/A:N). The primary server-side path requires an application that passes externally supplied data into those APIs, such as a web service; a secondary path affects deployments that rely on the Java sandbox to run untrusted Java Web Start applications or applets. Exploitation is rated difficult (AC:H) and no public exploit code or KEV listing was reported at time of analysis, so the practical risk is concentrated in applications that expose the vulnerable Security APIs to attacker-controlled input.
Unauthenticated data tampering in Oracle REST Data Services (ORDS) versions 24.2.0 through 26.1.0 lets a remote attacker with HTTP access to an exposed instance create, delete, or modify critical application data, with no confidentiality or availability impact. Oracle rates the flaw 'difficult to exploit' (AC:H), so success depends on conditions outside the attacker's control such as request timing, backend data state, or environment specifics that the vendor has not detailed. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied; exposure is limited to ORDS deployments reachable over the network on their HTTP interface, particularly 26.1.0 and earlier releases lacking the October 2026 Critical Patch Update.
Unauthenticated network attackers can hang or repeatedly crash MySQL Server and MySQL Cluster by targeting the Server: Security: Encryption component, producing a complete denial of service against the database service. The flaw carries CVSS 3.1 base score 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) and affects MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1 plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Oracle characterizes the issue as difficult to exploit because attack complexity is high, meaning the attacker must satisfy server-side conditions outside their direct control (specific state, timing or race behavior) rather than sending a single deterministic request; there is no public exploit identified at time of analysis and the issue is not in CISA KEV. Impact is strictly availability - no confidentiality or integrity loss - so exposure is materially reduced for instances not reachable from untrusted networks.
Oracle Agile PLM 2.6 contains an authentication-bypass weakness in the Acollect component that can let a remote, unauthenticated attacker read critical or all PLM-accessible data over TLS, though exploitation is rated difficult because of high attack complexity. No public exploit or CISA KEV entry was identified at time of analysis, and exposure is limited to reachable deployments with the Acollect component enabled.
Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allow a remote, unauthenticated attacker to tamper with or delete critical portal data and to partially degrade service availability through a flaw in the Runtime Tools component reachable over HTTP. Exploitation is not straightforward: the CVSS vector (AC:H, UI:R) means preconditions outside the attacker's control must line up and a legitimate user other than the attacker must be induced to perform an action, which sharply limits opportunistic or automated mass exploitation, and there is no confidentiality impact. At time of analysis there is no public exploit identified, no CISA KEV listing, and no EPSS score supplied, so this is a moderate-severity (5.9) issue to schedule on a normal patch cycle rather than an emergency; Oracle's October 2026 Critical Patch Update advisory is the reference for remediation.
Oracle Order Management in Oracle E-Business Suite 12.2.3 through 12.2.15 can expose critical application data through a high-complexity authenticated flaw in its Product Diagnostic Tools component. A network attacker holding a low-privileged account can use HTTP to read critical data and make limited unauthorized updates, inserts, or deletions, but successful exploitation depends on conditions outside the attacker's direct control. No public exploit was identified at time of analysis, and no CISA KEV entry was provided.
An authenticated low-privileged user with HTTP access to the eProcurement component of Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 can manipulate or expose data the account should not control, chiefly through unauthorized creation, deletion, or modification of critical records, with a smaller confidentiality spill. Exploitation is rated difficult (AC:H) because success depends on application state or configuration outside the attacker's direct control, and the Argentina financial localization must actually be deployed - so this is a moderate-risk issue unlikely to be a top-priority emergency, with no public exploit identified at time of analysis. Integrity impact is the dominant concern (I:H) while availability is unaffected (A:N).
Data exposure and limited data modification in Oracle Siebel CRM's Email Marketing component can be triggered by unauthenticated network attackers, affecting Siebel Apps - Marketing versions 17.0 through 26.9. The CVSS 5.9 rating reflects high attack complexity and a requirement for victim interaction, so exploitation is opportunistic rather than reliably repeatable. No public exploit was identified at time of analysis, and this should be treated as a moderate-risk patching priority rather than an emergency.
Unauthorized read of critical data and limited data modification in Siebel Cloud Manager affect Oracle Siebel CRM Cloud Applications 22.3 through 26.9, exploitable by unauthenticated attackers positioned on the same physical network segment. The issue carries CVSS 3.1 base score 5.9 with an adjacent attack vector (AV:A) and high attack complexity (AC:H), so it is not reachable directly from the internet and requires defeating additional non-default or timing conditions before exploitation succeeds. No public exploit code or CISA KEV entry was identified at time of analysis, and Oracle's October 2026 Critical Patch Update advisory is the vendor remediation reference.
Unauthenticated adjacent-network attackers can create, delete, or modify critical data in Oracle Communications BRM - Elastic Charging Engine 15.x, plus read a limited subset of data, by reaching the physical or adjacent communication segment attached to the ECE hardware. The issue is medium severity (CVSS 5.9) with high attack complexity (AC:H), so success depends on timing or runtime conditions outside the attacker's control and Internet-based exploitation is not possible. Affected releases are 15.0.0.0.0, 15.0.1.0.0.0, 15.1.0.0.0, and 15.2.0.0.0; no public exploit identified at time of analysis, and Oracle's October 2026 Critical Patch Update is the reference advisory.
Attackers positioned on the physical or adjacent communication segment serving Siebel Cloud Manager can bypass authentication and reach critical data held in Oracle Siebel CRM Cloud Applications 22.3 through 26.9. No credentials and no user interaction are needed (PR:N/UI:N), but the vendor rates the attack as difficult (AC:H) and confines it to AV:A, so it is not reachable over the open internet and the impact is scored at 5.9 with high confidentiality and low integrity consequences. No public exploit code was identified and the issue is not listed on CISA KEV at the time of analysis, making mass or remote exploitation impractical.
An authentication-bypass issue in Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 (Enterprise Infrastructure SEC component) lets an unauthenticated attacker positioned on the same physical or adjacent network segment read critical data and perform limited unauthorized updates, inserts, or deletes. The CVSS 3.1 score is 5.9 (AV:A/AC:H/PR:N/UI:N/C:H/I:L/A:N): no credentials or user interaction are required, but exploitation depends on non-deterministic conditions and local-segment access, so arbitrary internet attackers are not realistically exposed. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, making this a moderate rather than high priority.
Remote denial of service in Apple macOS allows an attacker who controls the network file server to crash the target system through an integer underflow triggered by crafted server responses. Affected releases are macOS versions before Golden Gate 27, Sequoia 15.8, and Tahoe 26.7; the CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, reflecting a high-complexity network attack with availability-only impact. No public exploit was identified at time of analysis, EPSS is low at 0.17% (percentile 6%), and Apple has released fixed versions.
Denial-of-service in Apple's iOS and iPadOS (26.x releases before 26.7, and versions before 27) allows an attacker who already holds a privileged on-path network position to degrade or halt availability on the target device; there is no confidentiality or integrity impact (CVSS 5.9, C:N/I:N/A:H, AC:H/PR:N/UI:N). Exploitation is gated by the on-path precondition - the attacker must already sit on the traffic path as a man-in-the-middle - so this cannot be triggered by an arbitrary remote Internet attacker against a device behind normal network boundaries, and no public exploit code was identified at time of analysis. Affected devices are fixed by updating to iOS/iPadOS 26.7 or 27.
Local low-privileged users on hosts running Oracle VM VirtualBox 7.2.16 can cause a complete denial of service-hang or frequently repeatable crash-of the VirtualBox Core component, with scope change potentially affecting other host products, but only when a second user performs a triggering action. This moderate-severity flaw requires local logon and human interaction, is not remotely reachable, and affects availability only; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Server-side request forgery in the A2A Java SDK before 1.3.0.Final allows an unauthenticated caller to register an attacker-chosen push-notification destination and make the server send task updates to loopback, private, link-local, cloud-metadata, IPv6 unique-local, or multicast addresses where routing permits. Push notifications are enabled by default, and the vulnerable BasePushNotificationSender sends to the stored TaskPushNotificationConfig URL without scheme restrictions, destination validation, or redirect bounds, although the attack is blind because responses are discarded and delivery success is not exposed. No public exploit was identified at time of analysis; the issue is rated CVSS 5.8 (medium, CWE-918) and is fixed in 1.3.0.Final.
PHP code injection in Open Source Social Network (OSSN) through the dynamic cache settings handler at actions/administrator/cache/dynamic.php allows a site administrator to break out of the generated configuration template and write arbitrary PHP into ossn.config.dcache.php by supplying crafted host, port, username, password, type, or status values that are concatenated without escaping. Publicly available exploit code exists (a Gist linked from the CVE record), and the issue affects OSSN up to versions 9.11 and 10.1. Exploitation is gated behind a fully authenticated administrator account on a site where the dynamic cache feature is configured, and because OSSN administrators are by design trusted users who can already upload components and themes containing arbitrary PHP, the primitive grants no capability beyond what an admin already holds - the vendor frames the fix as defense-in-depth and real-world risk is correspondingly low.
Improperly exported Android components in LeeDrOiD Labs Shortcutter 2 App 9.0.48 let a second, attacker-controlled application installed on the same device drive the app's internal ToggleGeneric logic and pass an arbitrary class name into Class.forName, producing low-severity information disclosure plus limited integrity and availability impact confined to the device. The attack is strictly local - there is no network vector - and requires only the ordinary privileges of a co-installed app (CVSS PR:L), so the attacker must first convince the user to install a malicious package. Publicly available exploit code exists (VulDB disclosure with a linked proof-of-concept document), but there is no CISA KEV listing, and the vendor was contacted early and released a fixed build, 9.0.90.
Unauthenticated network attackers can read a limited subset of Oracle Siebel CRM Cloud Applications data through the Siebel Cloud Manager component in versions 22.3 through 26.9. Oracle rates this CVSS 3.1 5.8 (Medium) with AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N, reflecting a low-complexity HTTP attack that requires no credentials or user interaction and can affect resources beyond the vulnerable component while only exposing confidentiality. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Unauthenticated HTTP requests to the PeopleSoft Enterprise PeopleTools Web Server component in versions 8.61 through 8.63 can return a subset of PeopleTools-accessible data that the requester should not be able to read, so internet- or intranet-exposed PeopleSoft portals are directly at risk. Oracle scored it CVSS 3.1 5.8 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N): no credentials, no user interaction and no special configuration are needed, but the impact is confidentiality-only - no data modification and no availability effect - and the scope change means exposed data may extend beyond PeopleTools into connected products. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied with the available intelligence.