An insecure direct object reference (CWE-639) in Blinko through 1.8.8 lets any authenticated user read and modify tags belonging to other accounts by supplying arbitrary tag IDs to the tag tRPC router procedures fullTagNameById, updateTagIcon, and updateTagOrder. Because tag IDs are sequential in the backing Prisma database, a low-privileged logged-in attacker can enumerate IDs to disclose private note topics (tag names) and tamper with other users' tag icons and ordering. Impact is bounded to tag metadata rather than note bodies and is only meaningful on shared multi-user deployments; no public exploit identified at time of analysis, and the vendor has published an upstream fix in PR #1171.
Missing authorization in Sharkord versions before 0.0.8 allows any authenticated member to call the others.updateSettings tRPC mutation without the MANAGE_SETTINGS permission, enabling tampering with server-wide configuration such as join passwords, registration toggles, upload limits, and plugin loading. The issue affects default deployments because the vulnerable code path simply omits the permission check, though exploitation requires a valid member account and is therefore limited to authenticated users rather than unauthenticated outsiders. At the time of analysis, no public exploit code was identified, and the vendor has released a patch in version 0.0.8.
Missing authorization in Magepeople's Bus Ticket Booking with Seat Reservation plugin through 5.9.7 allows unauthenticated remote attackers to perform certain privileged actions that should require proper capability checks, with impact limited to low-integrity changes. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, so no credentials or user interaction are required, but confidentiality and availability are not affected. No public exploit code or confirmed active exploitation was identified in the provided data at time of analysis.
Missing authorization in Arraytics Booktics through 1.0.30 lets unauthenticated remote attackers reach a plugin endpoint that should be access-controlled, exposing limited data (CVSS 5.3). The issue is CWE-862 and affects WordPress sites with the plugin active; no public exploit identified at time of analysis.
Missing authorization (CWE-862) in the Castos Seriously Simple Podcasting WordPress plugin through 3.17.0 lets unauthenticated remote attackers reach functionality that should be capability-gated, per the CVSS vector (PR:N/UI:N) on default configurations. The practical consequence is limited to low-level confidentiality disclosure - unauthorized read access to plugin-controlled data - with no integrity or availability impact. Exploitation is trivially reachable but low-impact, so this is a moderate-priority exposure rather than a site-takeover risk; no public exploit code or active exploitation (CISA KEV) is identified at time of analysis, and an EPSS score was not supplied with the source data.
LearnPress before 4.4.10 permits authenticated instructors to tamper with other instructors' courses, quizzes, and questions through legacy lp-ajax editor actions. The handlers verify a generic editor nonce but do not perform a per-object ownership or capability check, so an instructor can reuse their own nonce with another object's id to change content, alter quiz answers, or trash questions; confidentiality is not exposed per the assessed vector. The vendor has released version 4.4.10, no public exploit identified at time of analysis, and practical risk is limited to multi-instructor sites where another instructor's content is available to target.
OpenCATS before 0.10.0 allows any authenticated low-privilege user to view EEO demographic reports without holding the canSeeEEOInfo permission, exposing aggregate ethnicity, veteran, gender and disability statistics. Exploitation is a simple direct invocation of the customizeEEOReport and generateEEOReportPreview actions in ReportsUI::handleRequest(); no exploit code beyond the public advisory and GitHub issue is needed, but a valid session is mandatory (PR:L) and no public exploit tooling is confirmed. This is a genuine but low-severity information-disclosure issue, not a high-priority emergency - EPSS and KEV data were not provided and no public exploit was identified at time of analysis.
Missing authorization in the import module of OpenCATS (all versions before 0.10.0) allows any authenticated user holding only READ-level access to invoke the import revert action and mass-delete previously imported candidate, company, and contact records. Exploitation requires valid low-privilege credentials, network access to the web interface, and the existence of a prior import whose importID can be supplied; no administrative rights or user interaction are needed. The vendor has released 0.10.0 with an access-level check in ImportUI::handleRequest(); no public exploit code was identified at time of analysis and the issue is not in CISA KEV.
Authenticated users with only READ-level access in OpenCATS before 0.10.0 can create, rename, delete, and populate saved lists they do not own through the modules/lists/ajax endpoints. The flaw is a missing authorization check (CWE-862) in newList.php, editListName.php, deleteList.php, and addToLists.php, allowing low-privilege accounts to tamper with saved lists site-wide. Impact is limited to integrity because the endpoints do not expose list contents, and no public exploit code was identified in the provided intelligence at time of analysis.
OpenCATS before 0.10.0 permits any authenticated user, including read-only accounts, to invoke ajax/testEmailSettings.php without the required site-administrator authorization and send a fixed test email through the server's configured SMTP relay with an attacker-supplied From address. The assessed CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N (5.3, medium), reflecting mandatory authentication, no confidentiality or availability impact, and limited integrity impact from spoofed outbound mail; the SMTP relay must already be configured for delivery. No public exploit code was identified at time of analysis, and the vendor-released 0.10.0 update contains the authorization fix.
Out-of-bounds heap read in the Eclipse ThreadX USBX host stack can be triggered when a malicious USB device presenting the MTP/PTP class is attached and the host performs ordinary object enumeration, causing adjacent heap memory to be disclosed to the application or an unmapped-page fault that crashes the host. The issue is physically gated: an unauthenticated attacker needs physical access, and the target must be running USBX in USB host mode with MTP/PTP support enabled and must enumerate the crafted device. Vendor scoring is CVSS 4.0 5.2 (Medium); no public exploit was identified at time of analysis, and impact is limited to low confidentiality loss plus possible denial of service, with no integrity impact or code execution.
DOM-based cross-site scripting in LIFF SDK 2.20.0 through 2.31.0 allows unauthenticated remote attackers (CVSS PR:N) to execute arbitrary JavaScript in the origin of a LIFF application's endpoint when a victim opens a specially crafted URL in an external browser, which can disclose JavaScript-accessible authentication tokens or application data and permit unauthorized actions under the victim's session. Exploitation is not drive-by: it demands that the targeted user actively open the attacker-supplied link, and the vulnerable code path is specific to the external-browser context rather than the in-app LINE client, so real-world exposure is materially narrower than a plain network attack vector implies. Only two vendor references were supplied (the LINE security advisory page and GitHub advisory GHSA-wppr-qmp4-w627); no public exploit code and no active exploitation were identified at time of analysis.
Reflected cross-site scripting in the VPL (Virtual Programming Lab) activity module for Moodle before 5.0.0 lets an attacker execute arbitrary JavaScript inside the browser session of a teacher or grader who holds the mod/vpl:similarity capability. The payload is delivered through the unencoded filename1/filename2 parameters of similarity/diff.php, which the plugin concatenates into the page's HTML header without escaping, so the script runs when the privileged user opens a crafted link. Because exploitation requires that user interaction and confines impact to the victim's own session rather than the Moodle server, severity is moderate (CVSS 5.1); no public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is fully resolved in the 5.0.0 release.
An out-of-bounds write in GNU UnRTF, the command-line RTF-to-HTML/text converter, can crash the process when a user converts a maliciously crafted RTF file, producing a denial-of-service condition. The flaw affects UnRTF releases tracked under the generic GNU Project CPE (no fixed version range is enumerated in the source data) and is reachable without authentication, but requires the victim to open or process the attacker-supplied RTF file. No public exploit code or confirmed active exploitation is identified at time of analysis, and the realistic impact is limited to loss of availability of the conversion process rather than code execution or data disclosure.
Denial of service in Oracle Solaris 11.4's Services component can be triggered by an attacker who already holds an interactive local logon, causing a hang or frequently repeatable crash of the affected host. The CVSS 3.1 vector is AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, meaning exploitation is local rather than remote, does not require credentials beyond the local logon, needs no user interaction, and depends on specific runtime conditions that make reliable success difficult. No public exploit code or CISA KEV entry was identified at time of analysis, and impact is confined to availability on the single affected system.
Improper authorization in @e2e-dev/github before 0.4.1 lets anyone who can comment on a pull request hijack the CI test report comment that the reporter manages. Because findComment and upsertComment in packages/github/src/post.ts match a comment purely by the tool's predictable first-line marker and never verify who wrote it, an attacker can pre-seed a marker-bearing comment so results land in their own comment and edit failures into passes, or post a decoy that causes the genuine report to be suppressed. The flaw requires an authenticated, low-privileged GitHub user (PR:L) and that the CI workflow actually runs to update the report (UI:P), and impact is limited to the integrity of report comments - no code execution or secret exposure; no public exploit code was identified at time of analysis, and 0.4.1 fixes the issue by checking the comment author against the token's account.
Stored cross-site scripting in react-admin before 5.15.5 lets an authenticated attacker with low-privilege write access to URL-type record fields execute JavaScript in an administrator's session when the administrator clicks a rendered UrlField or FileField link. The vulnerable components emitted javascript: URI values as clickable hrefs, including obfuscated variants using mixed case, leading control characters, or embedded tabs and newlines, while exploitation depends on administrator click interaction and attacker influence over stored URL data. CVSS 4.0 base score is 5.1, no public exploit identified at time of analysis, and upgrading to 5.15.5 renders unsafe URLs as plain text.
Blind server-side request forgery in Eclipse PIA allows an approved OIDC identity provider to force PIA's token-verification flow to fetch an arbitrary host and port, including plaintext HTTP, from PIA's network position. The issue is in verify_token (pia/oidc.py), which follows jwks_uri from a trusted issuer's discovery document without parsing it as a URL, comparing it to the issuer origin, or requiring HTTPS, and the fetch is triggered by an unauthenticated POST /v1/upload/sbom that is then rejected with 401. Because the response is not reflected to the attacker, impact is limited to outbound GET reconnaissance/interaction; exploitation requires a high-privileged position controlling a registered per-project Jenkins issuer under https://ci.eclipse.org/<project>/oidc (PR:H), and no public exploit was identified at time of analysis.
Authenticated low-privileged users of Oracle Essbase 21.8.3.0.0 can exploit a Security component access-control weakness over HTTP to read a limited subset of data they should not be able to access, and because the CVSS vector sets scope change (S:C), exposed data may extend to additional integrated products. The flaw is rated CVSS 3.1 5.0 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N), so exploitation requires a valid low-privilege account and network reachability to the HTTP interface; no user interaction is needed and complexity is low. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
An authenticated low-privileged user of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 can exploit the Query component over HTTP to read a limited subset of application data, with scope change potentially exposing data in integrated products. Oracle rates this information-disclosure issue at CVSS 3.1 base 5.0; no public exploit was identified at time of analysis, and remediation is available through Oracle's October 2026 Critical Patch Update.
Low-privileged authenticated users can read a subset of data accessible through Oracle REST Data Services 24.2.0 through 26.1.0 by sending crafted HTTP requests to a Core endpoint. The issue is rated CVSS 3.1 5.0 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N), so exploitation requires a valid low-privilege account and network reachability, with no user interaction; the scope change means disclosed data may extend to integrated products. No public exploit code or confirmed active exploitation was identified at time of analysis.
Low-privileged users with valid Essbase credentials can read a subset of data they should not be able to access through the Security component of Oracle Essbase 21.8.3.0.0 over HTTP, with the scope change flag indicating that disclosed data may extend into additional connected products. The issue is rated CVSS 5.0 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) - moderate severity and not high priority, because the authentication prerequisite means the attacker must already hold a low-level account, pointing to insider or post-compromise scenarios rather than anonymous internet exploitation. No public exploit code was identified and the flaw is not in CISA KEV; the primary exposure for defenders is unpatched Essbase deployments reachable over HTTP from untrusted networks.
Oracle Essbase 21.8.3.0.0 contains an access-control weakness in its Security component that lets an authenticated low-privileged user reach data beyond their intended authorization boundary over HTTP, exposing a limited subset of readable data (CVSS 3.1 base 5.0, AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N). Because the scope is changed, the disclosed data can flow into other products integrated with Essbase, so real-world impact depends on deployment topology. No public exploit code has been identified at time of analysis and the issue is not known to be actively exploited; Oracle addresses it in its October 2026 Critical Patch Update.
An information-disclosure flaw in Oracle Essbase's Security component (affecting release 21.8.3.0.0) lets a low-privileged account holder reach the server over HTTP and read a subset of Essbase-accessible data they should not see. Because the CVSS scope is changed (S:C), the exposed data can extend beyond Essbase into other dependent products, though integrity and availability are unaffected (I:N/A:N); the requirement for a valid account (PR:L) keeps the barrier to entry moderate. At time of analysis there is no public exploit identified, and the vendor has published an advisory in its October 2026 Critical Patch Update.
Oracle SOA Suite Fabric Layer in versions 12.2.1.4.0 and 14.1.2.0.0 contains a difficult-to-exploit authenticated flaw that lets a low-privileged attacker with HTTPS network access read and modify limited SOA Suite data and cause partial denial of service. The CVSS 3.1 score is 5.0 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L), so exploitation requires a valid low-privileged account and a specialized condition rather than a reliable single request. No public exploit was identified at time of analysis, and impact is bounded to partial confidentiality, integrity, and availability effects.
Trusted Answer Search 26.1 contains a PL/SQL package flaw that a locally logged-on, low-privileged attacker can trigger only with high attack complexity and human interaction from another user, yielding limited read/write access and partial denial of service with possible scope change to additional products. No public exploit was identified at time of analysis, and the CVSS 3.1 base score is 5.0.
Local credential disclosure in cockpit-machines, the Cockpit web module for managing libvirt/KVM virtual machines on Red Hat Enterprise Linux 9 and 10, exposes a guest VM's VNC console password to other unprivileged users on the same host. When an operator saves VNC console settings, the configured password is handed to an underlying system utility as a command-line argument, so any local user able to inspect another user's process entries can read the secret during that brief window. Exploitation requires an already-authenticated local account (PR:L), a host without hidepid-style process hiding, and a concurrent victim save action (UI:R); no public exploit code exists and the flaw is not in CISA KEV.
Information disclosure in cockpit-machines on Red Hat Enterprise Linux 9 and 10 lets a local unprivileged user capture RHSM authentication tokens from the command line of a short-lived image-retrieval helper process when cross-user process inspection is enabled. The attacker needs a local shell account and a concurrent image-retrieval operation by another user; stolen tokens can be used against RHSM resources only until they expire. This is a moderate-risk, low-urgency issue with no public exploit identified at time of analysis, and it does not provide remote access, code execution, or integrity/availability impact.
Denial of service in MySQL Server and MySQL Cluster lets an attacker who already holds high database privileges crash or repeatedly hang the service by sending crafted input that exercises the Server: Optimizer component. The affected releases are MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1; the CVSS vector confirms network reachability, low attack complexity, no user interaction, and an availability-only impact, but the PR:H prerequisite sharply limits who can exploit it. No public exploit identified at time of analysis, and no CISA KEV entry is present in the supplied data, so this is a moderate availability risk rather than a broad unauthenticated remote attack.
Denial of service in Oracle MySQL Server and MySQL Cluster lets a high-privileged, network-connected database user hang or repeatedly crash the server by exercising the Server: Optimizer component. Only MySQL Server 8.4.0 through 8.4.12, 9.7.0 through 9.7.3 and 26.7.0 through 26.7.1, plus MySQL Cluster 8.0.0 through 8.0.49 and the 8.4.x, 9.7.x and 26.7.x branches, are affected; the CVSS 3.1 score is 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H), reflecting an availability-only impact. The decisive constraint is the PR:H prerequisite - an unprivileged or read-only account cannot trigger it, so the realistic threat is an insider or an actor who already holds a privileged database credential; no public exploit code and no confirmed active exploitation were identified at time of analysis. Exploitation condition: authenticated session as a high-privileged MySQL user with network reachability to the listener over a supported protocol, submitting crafted input that reaches the optimizer; no user interaction is required and complexity is low, so the crash is reliably repeatable once that access exists.
A high-privileged, authenticated user can crash MySQL Server or MySQL Cluster or hang it repeatedly through crafted queries that abuse the Server: Optimizer component, causing complete denial of service with no data disclosure or modification. Affected builds are MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. The CVSS 3.1 score is 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H); the decisive limiter is the PR:H requirement, so an unauthenticated or low-privileged attacker cannot trigger it, and no public exploit code or KEV-listed active exploitation was identified at time of analysis.
Denial of service in Oracle MySQL Server and MySQL Cluster allows an authenticated, high-privilege attacker with network access to hang or repeatedly crash the database service. The flaw is in the Server: Replication component and affects MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1. Exploitation requires PR:H credentials but is low-complexity and needs no user interaction; only availability is impacted, and no public exploit identified at time of analysis.
Denial of service in Oracle MySQL Server and MySQL Cluster's InnoDB component affects authenticated users holding high database privileges; an attacker with network access can cause a hang or frequently repeatable crash (complete DOS) of the MySQL Server or MySQL Cluster instance. The issue is rated CVSS 3.1 base 4.9 with availability-only impact and affects MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1 plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1. No public exploit identified at time of analysis, and exploitation requires the high-privilege prerequisite, confining realistic risk to insiders, compromised admin/service credentials, or multi-tenant deployments where untrusted parties hold high DB privileges.
Denial of service in Oracle MySQL Server and MySQL Cluster allows a high-privileged attacker with network access to hang or repeatedly crash the database service. Affected ranges include MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1; exploitation requires HIGH database privileges (CVSS PR:H) over multiple standard protocols. The issue has a CVSS 3.1 base score of 4.9 with availability-only impact, and no public exploit was identified at time of analysis.
Denial of service in Oracle MySQL Server and MySQL Cluster can be triggered by a high-privileged, network-positioned attacker against the InnoDB component, causing a hang or frequently repeatable crash of the database service. Affected releases are MySQL Server 9.7.0 through 9.7.3 and 26.7.0 through 26.7.1, plus the matching MySQL Cluster versions; CVSS 3.1 score is 4.9 with availability-only impact. Exploitation requires an authenticated session with high MySQL privileges (PR:H), and no public exploit or CISA KEV entry is identified in the available data.
A denial-of-service flaw in the Optimizer component of MySQL Server and MySQL Cluster lets a high-privileged, network-connected database account hang or repeatedly crash the server, with CVSS 3.1 base score 4.9 (availability-only). Affected releases are MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1 and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Exploitation requires an authenticated session using a highly privileged account (PR:H) over MySQL's supported protocols, so the realistic threat is insiders or attackers who already hold privileged credentials; no public exploit code or confirmed active exploitation was identified at time of analysis.
Denial of service in Oracle MySQL Server and MySQL Cluster lets an attacker who already holds high-privilege database credentials hang or repeatedly crash the server through the Server: Optimizer component, reachable over the network via multiple protocols. Affected builds are MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. The CVSS 3.1 base score is 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H), reflecting availability-only impact with no disclosure or modification of data; no public exploit code or confirmed active exploitation was identified at time of analysis, and the PR:H prerequisite means realistic abuse comes from a malicious or compromised privileged account rather than anonymous external attackers.
Denial of service in Oracle MySQL Server and MySQL Cluster can be triggered by an authenticated, high-privileged attacker sending queries that exercise the Server: Optimizer component, resulting in a hang or repeatable crash of the database service. Affected releases include MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1. The CVSS 3.1 base score is 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H); the high-privilege prerequisite limits exposure to insiders or compromised accounts, and no public exploit has been identified at time of analysis.
A denial-of-service flaw in the Oracle MySQL Server Optimizer also affects MySQL Cluster, allowing a high-privileged attacker with network access to hang or repeatedly crash the server (CVSS 3.1 base 4.9, availability-only). Affected releases are MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1. Exploitation requires an authenticated session holding HIGH database privileges (CVSS PR:H), which sharply limits exposure; no public exploit code or confirmed active exploitation was identified at time of analysis.
Authenticated high-privileged users can crash or hang MySQL Server and MySQL Cluster 9.7.0-9.7.3 and 26.7.0-26.7.1 through malformed input handled by the Server: GIS component, causing a denial of service with no confidentiality or integrity impact. Exploitation requires network access and a privileged database account, so realistic risk is concentrated in trusted-insider or already-compromised-credential scenarios; no public exploit identified at time of analysis.
Denial of service in Oracle MySQL Server (8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1) and MySQL Cluster (8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1) allows a high-privileged, network-positioned attacker to hang or repeatedly crash the database service, but only on deployments running Group Replication, since the defect sits in the Server: Group Replication GCS component and standalone instances never reach the vulnerable code path. Oracle scores it CVSS 3.1 4.9 (AV:N/AC:L/PR:H/UI:N, availability-only), so the realistic threat is a privileged insider, a stolen administrative account, or a multi-tenant clustered environment rather than an anonymous internet attacker. No public exploit code or active exploitation was identified at time of analysis, keeping this a genuine but low-priority availability issue rather than an emergency.
High-privileged MySQL accounts can crash or hang the database engine through the Server: Clone Plugin component, giving a complete denial of service against MySQL Server and MySQL Cluster deployments. The flaw carries a CVSS 3.1 base score of 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H), meaning the attacker must already hold a high-privilege MySQL account and network reachability to the database, but once those preconditions are met the crash is low-complexity, requires no user interaction, and is easily repeatable. Affected builds are MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1; no public exploit identified at time of analysis. Realistic exposure is largely confined to insiders, compromised privileged accounts, or post-compromise lateral movement rather than anonymous internet attackers.
Denial of service in Oracle MySQL Server and MySQL Cluster 26.7.0-26.7.1 lets a high-privileged, network-positioned user trigger hangs or repeatable crashes in the Server: Security: Encryption component. The flaw is remotely reachable via multiple MySQL protocols with low attack complexity once the attacker already holds an administrative MySQL account, and it affects availability only (CVSS 3.1 4.9, A:H). No public exploit identified at time of analysis; the high-privilege prerequisite confines practical risk to trusted insiders or post-compromise scenarios.
Denial of service in Oracle MySQL Server and MySQL Cluster (Server: Replication component) lets a high-privileged, network-reachable database account hang or repeatedly crash the service, affecting MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1 as well as MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. The CVSS 3.1 base score is 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H), so impact is availability-only and the attack path is gated behind elevated MySQL privileges - this is a privileged-insider or post-compromise persistence-of-disruption scenario rather than an anonymous remote attack. There is no CISA KEV listing and no public exploit code identified at time of analysis; Oracle addresses the flaw in its October 2026 Critical Patch Update.
Denial of service in MySQL Server and MySQL Cluster is possible when a high-privileged, authenticated attacker submits a crafted query that is mishandled by the Server Optimizer. The issue affects MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1; successful exploitation causes a hang or repeatable crash. No public exploit has been identified at time of analysis, and this CVE is not listed in CISA KEV.
High-privilege denial of service in Oracle MySQL Server (InnoDB) and MySQL Cluster lets an attacker who already holds elevated database privileges crash or hang the service over the network, causing complete loss of availability. Affected builds span MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis; because exploitation requires high privileges, this is primarily an insider or post-compromise risk rather than a remotely exploitable unauthenticated threat (CVSS 4.9).
Authenticated high-privileged users can force InnoDB in MySQL Server or MySQL Cluster to hang or crash repeatedly by sending crafted requests over the network through multiple MySQL protocols, producing a complete denial of service with no confidentiality or integrity impact. Affected releases include MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1 and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1. No public exploit code or CISA KEV entry is identified at time of analysis, and the high-privilege prerequisite makes this a moderate-to-low priority issue despite the broad deployment of MySQL.
High-privileged users of affected MySQL Server 8.4.x, 9.7.x, and 26.7.x releases, as well as MySQL Cluster 8.0.x, 8.4.x, 9.7.x, and 26.7.x, can crash or hang the InnoDB-backed service over network protocols, causing a complete denial of service. The CVSS 3.1 score is 4.9 (AV:N/AC:L/PR:H/UI:N/C:N/I:N/A:H), so exploitation requires an authenticated account with high database privileges and provides no data confidentiality or integrity impact. No public exploit code or CISA KEV entry is identified at time of analysis, and Oracle's October 2026 Critical Patch Update is the vendor reference.
A high-privileged database account is enough for an attacker with network reachability to hang or repeatedly crash MySQL Server and MySQL Cluster, because a flaw in the InnoDB storage engine can be triggered over supported protocols with low attack complexity (CVSS 3.1: 4.9, AV:N/AC:L/PR:H/UI:N/C:N/I:N/A:H). MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1, and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1 are affected. Impact is availability only, no public exploit code was identified at time of analysis, and the issue is not in CISA KEV.
Denial-of-service in Oracle MySQL Server and MySQL Cluster lets a high-privileged database user trigger a hang or repeatable crash through crafted DDL operations sent over the network via supported database protocols. Affected releases are MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Because the attack requires an already-privileged (DBA-level) account, the realistic threat is a malicious insider or an adversary who has already compromised administrative database credentials; there is no confidentiality or integrity impact, no user interaction, and no public exploit identified at time of analysis. Scoring is CVSS 3.1 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).