Oracle Database Server 19.3 through 19.32 and 21.3 through 21.23 allow a high-privileged database principal holding the Query Optimizer privilege to read a limited subset of RDBMS data it should not be able to access over Oracle Net. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N, base score 2.7) means the attacker must already be an authenticated, privileged account on the target instance, so the realistic threat population is insiders or holders of compromised privileged credentials rather than anonymous remote attackers, and there is no integrity or availability impact. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; fixes are delivered through Oracle's October 2026 Critical Patch Update.
Partial denial of service in MySQL Server and MySQL Cluster can be triggered by a high-privileged, authenticated attacker with network access through MySQL protocols against the Server: Telemetry component. The affected releases are MySQL Server and MySQL Cluster 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1. CVSS 3.1 scores the issue 2.7 with only low availability impact, and no public exploit was identified at time of analysis.
Unauthorized read access in Oracle Java SE's AWT component affects client-side sandboxed Java deployments that execute untrusted code, and it requires victim interaction plus high attack complexity to succeed. Affected releases include Java SE 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, and 27, as well as GraalVM for JDK 17.0.20.1 and 21.0.12.1 and GraalVM Enterprise Edition 21.3.19.1.1; this is a low-priority, low-severity issue despite the network vector, and no public exploit was identified at time of analysis. Real-world exposure is narrow because the Java applet and Web Start sandbox model is deprecated and rarely enabled, and server deployments running only trusted administrator-installed code are explicitly outside the vulnerability's scope.
Local information disclosure in the Python filelock library allows a low-privileged local user to infer whether an attacker-chosen path exists and is writable by racing a symbolic link into SoftFileLock's writability check. SoftFileLock versions 3.32.6 through 4.2.0 follow a symlink swapped in at the lock path when the lock node lacks its owner-write bit, so the observable acquisition result leaks the target path's existence and write status (CWE-59, CVSS 2.5). Exploitation requires local access, a specific permission and symlink-following configuration, and winning a TOCTOU race; no public exploit has been identified at time of analysis, and the issue is fixed in 4.2.1.
Oracle Solaris 11.4 exposes a low-severity integrity flaw in its Services component: an attacker with local logon access and no additional privileges (PR:N) can, under high-complexity conditions and with the involvement of a second user, cause unauthorized update, insert, or delete operations against some Solaris-accessible data. The CVSS 3.1 score is 2.5 (AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N), reflecting no confidentiality or availability impact and a narrowly bounded modification-only effect; no public exploit code has been identified at time of analysis and there is no CISA KEV confirmation. The requirement for local logon plus human interaction from someone other than the attacker keeps realistic risk well below that of a network-facing service flaw.
Partial denial of service in Oracle MySQL Connector/ODBC 26.7.1 is reachable only by an attacker who already holds a logon on the same infrastructure where the driver runs, and only when a separate user is induced to interact with the affected component; high attack complexity means the precondition state is hard to arrange reliably. Successful exploitation yields nothing beyond a partial availability impact on the connector itself - no confidentiality or integrity effect - which is why Oracle scored it CVSS 3.1 base 2.5. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and EPSS-style risk is correspondingly low.
Local information disclosure in Oracle PeopleSoft PeopleTools 8.61 through 8.63 lets a low-privileged user who already has logon access to the host infrastructure read a limited subset of PeopleTools data through the SQR reporting component. Exploitation is genuinely difficult: high attack complexity plus a local access path and low privileges mean the attacker must satisfy conditions outside their direct control, and the CVSS 3.1 base score is only 2.5 with confidentiality-only impact (no integrity or availability effect). No public exploit code and no confirmed active exploitation were identified at time of analysis, and the risk is low by every available signal.
Unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools 8.61-8.63 data is possible for a low-privileged attacker who already has local logon access to the infrastructure hosting PeopleTools and can interact with the Updates Environment Mgmt component under difficult-to-meet conditions. The issue is local-only, high-complexity, and confidentiality-only in impact (CVSS 2.5), and no public exploit has been identified at time of analysis. It is not listed in CISA KEV, so there is no confirmed active exploitation.
Oracle REST Data Services (ORDS) Core versions 24.2.0 through 26.1.0 allow a high-privileged authenticated user to induce a separate person into a crafted HTTP interaction, resulting in unauthorized update, insert, or delete operations against a limited subset of ORDS-accessible data. Successful exploitation requires two prerequisites that sharply constrain risk: the attacker must already hold high administrative or application privileges inside ORDS (PR:H), and a second, non-attacker human must be persuaded to interact with attacker-crafted content over HTTP (UI:R). Impact is integrity-only and partial (I:L) with no confidentiality or availability effect; no public exploit code or confirmed active exploitation was identified at time of analysis, and the low 2.4 base score reflects the heavy prerequisite burden rather than a benign code path.
Physical-access information disclosure in Siebel CRM Deployment 17.0 through 26.9 (Siebel Management Console) lets someone with hands-on access to the host read a limited subset of deployment data without authentication or user interaction. The CVSS 3.1 score is 2.4, reflecting the physical attack vector and confidentiality-only impact; no public exploit was identified at time of analysis.
Integrity-verification bypass in PyPA virtualenv before 21.14.9 allows a non-PyPI package index response to be consumed for a bundled seeder wheel without the default PyPI SHA-256 digest comparison ever being performed. The condition is narrow: it only arises when virtualenv is invoked with --seeder pip and --download, index environment variables are left unset so the default-index comparison policy is still active, and a non-PyPI index is configured that offers a candidate matching the bundled distribution name and version. Per our assessment (CVSS:3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L) this is unauthenticated but high-complexity and user-initiated, does not defeat TLS, does not give an attacker control of the index response, and produces only a low, integrity-focused outcome; no public exploit code has been identified at time of analysis and there is no KEV listing. The vendor fixed the flaw in 21.14.9 by staging downloads in a private temporary directory and installing pinned wheels with --no-index.
Missing authorization in Webstudio before 0.256.0 allows any authenticated user who knows another user's project UUID to read that project's publish history, titles, domains, preview images, and latest builds through the publishedBuilds and findManyByIds tRPC procedures. The issue is rated low severity (CVSS 2.3; assessed CVSS 3.1 vector AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) because exploitation requires a valid account plus an unguessable UUID obtained out-of-band, and impact is limited to read-only metadata disclosure. No public exploit code or CISA KEV entry was identified at time of analysis, and version 0.256.0 contains the vendor fix.
Wheel-cache poisoning in virtualenv 21.14.8 can leave a rejected, attacker-supplied archive in the reusable wheel cache, where a later seeding operation may select it without verification. The forged pip 'Saved' line path requires an attacker-controlled package index, default-index digest comparison, and knowledge of the absolute path to the genuine bundled wheel; the separate rejected-cache-file variant requires control over downloaded data or archive selection. The issue is low severity, does not bypass TLS or establish control of default PyPI, and is fixed in 21.14.9; no public exploit code is identified in the available data.
A locally reachable flaw in Oracle Siebel CRM Deployment's Server Infrastructure component lets an attacker who already holds high privileges and can log on to the host cause a partial denial of service, degrading availability of the deployment service. Only supported Siebel CRM Deployment releases 17.0 through 26.9 are affected, and the CVSS 3.1 base score is 2.3 (AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L), reflecting a local-only attack path, a high pre-existing privilege requirement, and no confidentiality or integrity impact. There is no public exploit identified at time of analysis and no CISA KEV listing, so this is a low-priority hardening item rather than an urgent exposure, though it should still be closed out in the routine Oracle Critical Patch Update cycle.
Limited read-only data exposure in Oracle Applications Manager (the Diagnostics component of Oracle E-Business Suite 12.2.3 through 12.2.15) is reachable over HTTP but only by an attacker who already holds a high-privileged OAM account, and exploitation additionally depends on conditions outside the attacker's control (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N, base score 2.2). Successful abuse yields unauthorized read access to a subset of OAM-accessible data with no integrity or availability impact and no unauthenticated path. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; the high privilege prerequisite and high attack complexity keep realistic risk well below what the network vector alone suggests.
Unauthorized read access to a subset of Marketing-accessible data in Oracle Siebel CRM 17.0 through 26.9 is possible only by a high-privileged, authenticated attacker over HTTP under high-complexity conditions. The CVSS 3.1 score is 2.2 (AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N), reflecting limited confidentiality impact and no integrity or availability effect. No public exploit code or confirmed active exploitation was identified at time of analysis.
A crafted request URL containing leading double slashes can cause the Vite development server to emit a protocol-relative module URL in transformed HTML, so a victim's browser fetches and executes an attacker-hosted module inside the Vite-served page. Only applications built on custom middleware that forwards an unchanged browser request URL into server.transformIndexHtml are affected, and the exposure is limited to the dev server rather than production builds; the impacted code paths exist in Vite before 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; exploitation additionally requires a victim developer to actively load the malicious page, which keeps real-world risk LOW.
Open redirect in Optimal IdM OptimalCloud 5.0 lets unauthenticated remote attackers craft a /v5.0/social link with an attacker-controlled state parameter, causing a victim who clicks it to be redirected to an arbitrary external site after social-login/OAuth callback handling. Exploitation requires user interaction and yields only integrity-low impact, with no confidentiality or availability effect. Publicly available exploit code exists per the CVSS v4 E:P proof-of-concept metric, but no CISA KEV entry confirms active exploitation and no EPSS score was provided.
Authenticated command injection in DrayTek Vigor2960 firmware 1.5.1.6 Revision 8218 allows a user with access to the web management interface to execute arbitrary OS commands by manipulating the newtable argument in the rename_table function of /cgi-bin/mainfunction.cgi. Publicly available exploit code exists in the GitHub DrayTek_Vigor2960_Security_Analysis repository (case DRV2960-0013), but no CISA KEV confirmation was provided. The vendor fixed the issue in firmware 1.5.1.7, though DrayTek states the Vigor2960 is end-of-support with limited support, so only legacy exposed units remain affected.
Reflected cross-site scripting in Optimal IdM's OptimalCloud 5.0 login endpoint (/v5.0/webapps/pages/public/Login) allows a remote, unauthenticated attacker to execute script in a victim's browser by supplying a crafted payload in the 'tz' parameter. Exploitation hinges on user interaction: the victim must click a link the attacker delivers, and impact is confined to that victim's browser session and the OptimalCloud origin (session/token theft or page defacement), not the server itself. No CISA KEV listing or confirmed active exploitation exists, the CVSS 4.0 vector records only proof-of-concept exploit maturity (E:P), and the vendor did not respond to disclosure, so no vendor-released patch was identified at time of analysis.
Authenticated attackers can abuse the plugin installer in arizu-id Fast Tunnel 1.0.0 to upload arbitrary files because the plugin_file argument is passed to ZipArchive::extractTo without adequate validation. Successful exploitation can write PHP payloads or Zip-Slip paths into web-accessible locations, with integrity impact assessed as High and confidentiality/availability impact as Low; publicly available exploit code exists, but no CISA KEV confirmation is available. The issue is fixed in version 1.0.1.
Digital ID authentication on a locked iPhone can be bypassed by an attacker with physical access when an iPhone Mirroring session is already active. The flaw is an improper-authentication and state-management issue rated CVSS 2.0 because exploitation requires device possession, a locked state, and the non-default condition of active mirroring, affecting iOS and iPadOS before version 27. Apple released fixes in iOS 27 and iPadOS 27; no public exploit is identified at time of analysis, no active exploitation is indicated by CISA KEV or SSVC, and EPSS is 0.19% (8th percentile).
Configuration injection in PyPA virtualenv's stdlib 'venv' creator allows a caller who controls the destination pathname to smuggle arbitrary keys into the generated pyvenv.cfg by embedding a Unicode line-boundary character (such as U+2028) in that path. Successful injection can set 'include-system-site-packages' to true - weakening environment isolation - or alter 'home' so the interpreter loads standard-library files from a different location, provided the attacker also controls that location. Only the non-default stdlib venv creator (--creator venv) is affected; the builtin creator does not use the vulnerable readback path. This is a low-priority, defense-in-depth issue rather than an urgent threat (CVSS 4.0 base 2.0 / assessed CVSS 3.1 AV:L/AC:H/PR:N/UI:R, all impacts Low), fixed in virtualenv 21.14.9; no public exploit code was identified at time of analysis and there is no KEV listing.
Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 can expose a limited subset of application data to a high-privileged attacker who already has interactive logon access to the host running the product, specifically through the Open Query component. The assessed CVSS 3.1 score is 1.9 (AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N), reflecting a local, high-complexity, privileged-only path with confidentiality impact limited to a subset of accessible data. No public exploit has been identified at time of analysis, and this is a low-priority issue best treated as an insider or post-compromise data-exposure risk rather than a remotely exploitable breach.
Authenticated users can exhaust memory in Apache CouchDB 3.5.2 and earlier through unsafe binary deserialization in the chttpd HTTP layer, causing a low-impact denial of service. The issue requires a valid CouchDB account and affects availability only, with automatic recovery rather than data loss or code execution. It is fixed in CouchDB 3.5.3, and no public exploit was identified at time of analysis.
Denial of service in Apache CouchDB 3.5.2 and earlier: the replicator lacks a circuit-breaker on HTTP redirects, so a replication endpoint that returns an endless redirect chain keeps the replicator chasing it indefinitely and degrades availability of the replication subsystem. The attacker must be an authenticated owner of a replication source or target (PR:L) and must control that endpoint's HTTP responses, so this is not reachable by an unauthenticated outsider and affects only availability, not confidentiality or integrity. Scoring is low (independent assessment: CVSS 3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L; vendor CVSS 4.0 base 0.6), and no public exploit code or confirmed active exploitation was identified at time of analysis - this is a low-priority issue despite being network-reachable.
Intermittent TLS 1.3 connection failures in Apache Tomcat (11.0.0-M21 through 11.0.26, 10.1.25 through 10.1.60, and 9.0.90 through 9.0.122) stem from incomplete cleanup of TLS 1.3 connection state, causing availability degradation rather than any loss of confidentiality or integrity. Remote attackers - or simply ordinary TLS 1.3 clients - can trigger the condition under normal traffic; the assessed vector is AV:N/AC:H/PR:N/UI:N with C:N/I:N/A:L, reflecting high attack complexity and only limited availability impact, with no path to code execution or data disclosure. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, and vendor-released fixes exist in 11.0.27, 10.1.61, and 9.0.123.
Information disclosure in Apache Tomcat 9.0.92 through 9.0.122, 10.1.27 through 10.1.60, and 11.0.0-M23 through 11.0.26 allows trailer fields from an earlier HTTP request to persist and leak into a subsequent request on the same reused connection. The root cause is incomplete cleanup of per-request trailer state (CWE-459); exploitation requires chunked requests that actually carry trailers and keep-alive connection reuse, so real-world exposure is limited because most clients do not send trailers. No public exploit or CISA KEV confirmation is identified in the provided data, and the independent assessment rates confidentiality impact as low (AV:N/AC:H/PR:N/UI:N/C:L/I:N/A:N); vendor fixes are 11.0.27, 10.1.61, and 9.0.123.
Local unprivileged users on hosts running Apache Tomcat 9.0.47 through 9.0.122 with the APR/Native connector configured for unix domain sockets can exploit a TOCTOU race during socket creation to gain unauthorized access to the socket, with limited confidentiality and integrity impact per the assessed vector (AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N). The NIO-connector form of this issue was fixed under CVE-2026-65183; this CVE covers the remaining APR/Native path. No public exploit was identified at time of analysis, and the vendor-released fix is Tomcat 9.0.123.
Execution After Redirect in Apache Tomcat 9.0.x, 10.1.x, and 11.0.x lets remote attackers cause request processing to continue after an HTTP redirect, which can bypass redirect-based access or flow controls and lead to limited information disclosure. The issue affects applications running on the listed version ranges, including end-of-life 7.0.x and 8.5.x releases, that depend on a redirect to stop execution rather than explicitly terminating the request. Vendor fixes are available in 11.0.27, 10.1.61, and 9.0.123; available data shows no KEV entry, no public exploit code, and no EPSS score.
Apache Tomcat's OpenSSLLifecycleListener fails open: when the listener is configured for FIPS mode but FIPS activation fails at startup, Tomcat logs an error and then silently continues running on JSSE in non-FIPS mode with the supplied configuration, so the server operates with weaker cryptography than the operator intended. The flaw affects Apache Tomcat 11.0.0-M14 through 11.0.26, 10.1.22 through 10.1.60, and 9.0.92 through 9.0.122, and only manifests in non-default deployments where OpenSSLLifecycleListener is explicitly enabled in FIPS mode and activation actually fails. No public exploit identified at time of analysis; the independent assessment rates it CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N - a low-to-moderate operational and compliance issue for FIPS-required environments rather than an urgent remote-exploitation priority (authenticated, high-privilege, local attack vector).
Apache Cocoon (all versions, retired/unsupported) can expose one user's cached sensitive content to another user when caching is enabled in a multi-user deployment, due to shared cache entries that are not sufficiently isolated per user (CWE-524). The exposure is opportunistic rather than deterministic: a network attacker cannot force a specific victim's data into the cache, and only applications that actually cache sensitive per-user output are at risk. No public exploit code was identified at time of analysis, the CVE is not in CISA KEV, and the independent assessment rates it CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N with no vendor patch because the project is retired.