Authenticated remote code execution is possible in TOTOLINK X2000R firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 through a stack-based buffer overflow in the boa formMapDelDevice hostname handling. An attacker must already hold administrative credentials on the device's web management interface and send a crafted HTTP request with an oversized hostname value; no public exploit code was identified at time of analysis. The published CVSS 9.1 uses a changed-scope (S:C) vector, while our independent assessment treats scope as unchanged (S:U) and stresses that practical risk is conditional on exposed management access and unchanged/default admin credentials.
Stack-based buffer overflow in the boa HTTP management interface of TOTOLINK X2000R firmware (TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) allows an authenticated administrator to trigger memory corruption via an overlong 'macstr' parameter to formMapDelDevice, potentially achieving arbitrary code execution. The flaw is network-reachable and low-complexity but requires valid high-privilege credentials (CVSS PR:H), so it is not an unauthenticated remote takeover despite the 9.1 base score. No public exploit code or active exploitation is identified in the provided data; exposure is highest where the management interface is reachable from untrusted networks such as WAN/remote management.
Stack-based buffer overflow in the boa web server's formParentControl url handler on TOTOLINK X2000R firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 lets an authenticated attacker send a crafted HTTP request that can corrupt stack memory and potentially achieve arbitrary code execution. The source advisory rates it CVSS 3.1 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), while independent assessment treats the prerequisite as authenticated access (PR:L) with unchanged scope; the main exposure driver is internet-reachable router management with valid or weak/default credentials. No public exploit code or CISA KEV entry was identified at time of analysis.
Authenticated stack-based buffer overflow in the TOTOLINK X2000R router (firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) allows a user holding administrator credentials on the boa web management interface to send a crafted HTTP request to the formParentControl handler with an oversized 'deviceName' parameter and achieve arbitrary code execution on the device. Talos rates the issue 9.1, while our reassessment keeps the high confidentiality/integrity/availability impact but scores scope as unchanged (S:U) rather than changed; the dominant limiting factor is PR:H, so real-world risk concentrates on routers reachable from the WAN with default or reused admin passwords or where an authentication bypass can be chained. No public exploit code was identified at the time of analysis and the CVE is not listed in CISA KEV, so there is no confirmation of active exploitation.
Authenticated stack-based buffer overflow in the TOTOLINK X2000R router's boa web management interface allows an attacker with admin-level credentials to achieve arbitrary code execution by sending a crafted HTTP request to the formIpv6Setup PPPoE handler, specifically through an oversized pppoe_dns2 parameter. The vulnerability affects firmware build TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 and is gated by PR:H, so it is not an unauthenticated remote takeover; exposure is materially lower when the web UI is not reachable from the WAN. No public exploit code or confirmed active exploitation was identified at time of analysis, though the published CVSS score is 9.1 and the assessed vector confirms high confidentiality, integrity, and availability impact.
Arbitrary code execution in TOTOLINK X2000R firmware (TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) is possible through a stack-based buffer overflow in the boa web server's formIpv6Setup PPPoE handler when the pppoe_dns1 parameter receives an overlong value. The attack requires an authenticated HTTP request with valid management credentials (CVSS PR:H) and network reachability to the router's management interface, which is typically LAN-side. No public exploit was identified at time of analysis; Talos rates the issue 9.1 critical under a scope-changed vector, while the independent assessment scopes the impact to the device (S:U) and still considers it high severity.
Stack-based buffer overflow in the boa web server of the TOTOLINK X2000R router (firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) allows an attacker holding valid administrative credentials to achieve arbitrary code execution by sending a crafted HTTP request that oversizes the static_dns2 parameter to the formIpv6Setup handler. The flaw carries a CVSS 3.1 base score of 9.1, but exploitation is gated by PR:H - the attacker must first authenticate to the web management interface and have network reachability to it, so unauthenticated or internet-wide mass exploitation is not indicated by the available data. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and no vendor-released patch has been identified; risk is concentrated on devices whose administrative interface is WAN-exposed or protected by default or weak credentials.
Authenticated remote code execution affects TOTOLINK X2000R routers running firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 through a stack-based buffer overflow in the boa HTTP server's formIpv6Setup handler. An attacker who already holds administrative credentials can send a crafted HTTP request with an oversized static_dns1 parameter to corrupt stack memory and potentially execute arbitrary code. The flaw is rated CVSS 9.1 but requires high-privilege access to the management interface; no public exploit was identified at time of analysis, and no CISA KEV entry was provided.
Critical data disclosure and denial of service in Oracle Mobile Field Service (Oracle E-Business Suite 12.2.3 through 12.2.15) allow unauthenticated network attackers to read sensitive application data and cause a hang or frequently repeatable crash via crafted HTTP requests. The CVSS 3.1 base score is 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H), reflecting complete confidentiality and availability impact with no integrity impact. No public exploit code or confirmed active exploitation was identified at time of analysis.
Authentication bypass in Networknt light-4j 2.1.5 before 2.4.0 lets unauthenticated attackers impersonate LDAP/AD-delegated users by sending a Basic Authorization header with a known username and an empty password. The flaw is only reachable where BasicAuthHandler uses LDAP/AD delegation and the backing directory treats a non-empty username with an empty password as a successful bind; static/config-file Basic auth and bearer-token deployments are not affected, and directories that reject empty-password binds neutralize the attack. Vendor-released patch: 2.4.0; no public exploit identified at time of analysis.
Unauthenticated network attackers can corrupt or destroy data and trigger a hang or repeated crash in Oracle Outside In Technology 8.5.8 through the Outside In Clean Content SDK when an embedding application parses attacker-supplied documents. The CVSS 3.1 score is 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H), with high integrity and availability impact but no confidentiality impact; no public exploit code was identified at time of analysis. Real-world exposure depends on whether a product embedding the SDK accepts untrusted files for ingestion, conversion, indexing, or preview.
Remote unauthenticated attackers who can reach the Adapters component of Oracle SOA Suite 12.2.1.4.0 or 14.1.2.0.0 over HTTP can modify or delete critical data and cause a hang or frequently repeatable crash, producing a CVSS 9.1 integrity and availability impact. No public exploit identified at time of analysis and no CISA KEV entry is present in the supplied data, but the low-complexity, no-privilege vector makes patching and reducing network exposure high priorities.
Unauthenticated network attackers can read, create, delete, or modify critical data in Oracle WebLogic Server 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 through the Core component's HTTP interface. The 9.1 CVSS score reflects high confidentiality and integrity impact with no availability impact, low complexity, and no user interaction. No public exploit identified at time of analysis, and no CISA KEV confirmation was provided; exposure is primarily determined by whether WebLogic HTTP/T3 listeners are reachable from untrusted networks.
Unauthenticated, network-reachable attackers can read and modify critical data in Oracle Product Workbench, the WebUI component of Oracle E-Business Suite, across versions 12.2.3 through 12.2.15. The flaw carries a CVSS 3.1 score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), meaning no credentials or user interaction are required beyond HTTP reachability to the Product Workbench WebUI endpoint. At the time of analysis, no public exploit code has been identified and the issue is not listed in CISA KEV, but Oracle's 'easily exploitable' rating and the complete absence of an authentication prerequisite make internet-exposed EBS deployments a priority.
Unsigned firmware images are accepted and flashed by the boa-based firmware update handler on TOTOLINK X2000R routers running build TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327, allowing an attacker who already holds administrative web-interface credentials to install arbitrary firmware. The flaw is an improper verification of cryptographic signature (CWE-347): the device performs no meaningful code-signing check on the uploaded image, so a crafted binary can yield persistent, privileged control of the router. Talos rates it CVSS 3.1 base 9.1, though the practical barrier is the PR:H administrative prerequisite; no public exploit code or CISA KEV entry is associated with this CVE at time of analysis.
Unauthenticated network attackers can read and modify critical data through the LDAP Gateway component of Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0, which permits LDAP operations without enforcing authentication. With a CVSS 3.1 score of 9.1 (AV:N/AC:L/PR:N/UI:N, C:H/I:H), exploitation requires only reachability to the exposed LDAP listener and no user interaction. Oracle's October 2026 Critical Patch Update references the fix; no public exploit code or confirmed active exploitation was identified at time of analysis, so risk is concentrated in environments where the LDAP Gateway is network-accessible.
Unauthenticated attackers with HTTPS reachability to the Installation Security component in Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 can read and modify critical EnterpriseOne Tools data; availability is not impacted. The CVSS 3.1 score is 9.1 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N), and Oracle's October 2026 Critical Patch Update is the cited advisory. No public exploit code or CISA KEV entry was identified at time of analysis, so risk is highest for internet-exposed instances.
Unauthenticated HTTP access to JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 can allow a remote attacker to read and alter critical application data, with CVSS 9.1 reflecting high confidentiality and integrity impact but no availability impact. The flaw is in the Enterprise Infrastructure SEC component and is rated PR:N/AC:L/UI:N, so the main practical barrier is network reachability to an affected instance; no public exploit was identified at time of analysis and no CISA KEV confirmation was provided. Oracle's October 2026 Critical Patch Update is the reference advisory for remediation.
Unauthenticated, network-reachable attacks against the BRM Server component of Oracle Communications Billing and Revenue Management 15.0.0.0.0 through 15.2.0.0.0 can read and modify critical billing data through the product's HTTP interface, a flaw Oracle rates as easily exploitable with CVSS 3.1 score 9.1 (C:H/I:H/A:N). The vector (AV:N/AC:L/PR:N/UI:N) means no credentials, user interaction, or special conditions are needed beyond network reachability of the HTTP interface; because BRM is typically a back-office telecom billing system, real-world risk hinges on whether that interface is exposed to an attacker-reachable segment. No CISA KEV listing or public exploit code was identified at time of analysis, and no EPSS score was provided, though the intrinsic severity and Oracle's 'easily exploitable' label warrant prompt patching.
Authentication bypass in Oracle Helidon 4.0.0 through 4.5.5 allows unauthenticated remote attackers to read and modify critical application data over HTTP when the helidon-microprofile-security component is used. Oracle rates the issue CVSS 9.1 with high confidentiality and integrity impact and no availability impact, and the vector shows no privileges or user interaction required. No public exploit identified at time of analysis, and the supplied data does not confirm active exploitation (CISA KEV), but the exposure is serious for network-reachable applications relying on the affected security component.
Authenticated high-privileged attackers with network access can achieve full takeover of Oracle Business Intelligence Enterprise Edition 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0 through the Analytics Web Administration component, with scope change extending impact to connected products. The CVSS 3.1 score is 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H); no public exploit identified at time of analysis.
Authentication, authorization, and rate-limiting middleware bypass in @fastify/middie 9.0.0 through 9.3.5 can let a single unauthenticated remote request reach a route handler while path-scoped middleware registered with use() is silently skipped. The flaw occurs when the middleware mount path joined to the plugin scope prefix diverges from the path Fastify's router serves, particularly when the scope prefix ends in a slash, when array mount paths are used, or when mount paths lack a leading slash. Risk is configuration-dependent: applications that rely on path-scoped middie middleware for security and use those mount-path patterns are exposed, while applications enforcing authorization in a post-routing Fastify hook are not; no public exploit identified at time of analysis, and the vendor patch is 9.3.6.
Oracle Agile Product Lifecycle Management for Process 6.2.4 exposes critical data to unauthenticated remote attackers through an HTTP-reachable Product Quality Management component, allowing high-impact confidentiality and integrity compromise with a CVSS 3.1 score of 9.1. The flaw is assessed as remotely exploitable with no privileges or user interaction, but no CISA KEV listing and no public exploit code were identified at time of analysis. No EPSS score or SSVC decision data was supplied, so exploitation probability is not quantified.
Low-privileged authenticated users can exploit the Federated Partitions component in Oracle Essbase 21.8.3.0.0 over HTTP to obtain broad read access to critical Essbase data, limited unauthorized insert/update/delete capability, and a partial denial of service. The critical 9.1 CVSS score is driven mainly by the scope change (S:C) and high confidentiality impact (C:H), meaning successful exploitation can also affect resources in connected products beyond Essbase itself. Attack complexity is low and no user interaction is required, but the flaw is not anonymously reachable - an attacker must already hold a valid low-privileged Essbase account (PR:L). No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied with the source data.
Authenticated low-privileged attackers with HTTP network access to Oracle Essbase 21.8.3.0.0 can exploit a flaw in the Security component to read critical Essbase-accessible data, make limited unauthorized updates, inserts, or deletions, and cause a partial denial of service. The CVSS 3.1 score is 9.1 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L), with the scope change indicating that successful exploitation can significantly affect additional connected products beyond Essbase. No public exploit identified at time of analysis; exploitation requires valid low-privileged credentials and reachability to the HTTP interface.
Path traversal in the FileArtifactService of Google ADK TypeScript (@google/adk) 0.4.0 through 0.5.x allows remote unauthenticated attackers to read files outside the configured artifact storage root by supplying crafted relative or percent-encoded sequences (../, ..%2F) in the userId or sessionId parameters, with a write primitive available when an agent tool path invokes saveArtifact. Exploitation is contingent on the operator explicitly enabling the non-default FileArtifactService and exposing the ADK API server to attacker-reachable traffic; applications using the default InMemoryArtifactService are unaffected. No public exploit code has been identified at time of analysis, and the issue is fixed in @google/adk 0.6.0; the assessed CVSS 3.1 score is 9.1-adjacent in impact (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:N) because the service must first be misconfigured into the file-backed mode.
SuggestArr deployments running in 'local_bypass' authentication mode can be tricked into granting a full administrative session without any credentials by spoofing the X-Forwarded-For header. Because api_service/app.py applies ProxyFix(x_for=1) and enforce_authentication() in api_service/auth/middleware.py trusts the resulting request.remote_addr, a remote attacker who can reach the instance can set X-Forwarded-For to a trusted CIDR value such as 127.0.0.1 and be automatically logged in as an admin via _load_bypass_user_context(), exposing endpoints like /api/users and /api/jobs. The CVSS 4.0 vector is unauthenticated (PR:N) with high confidentiality and integrity impact; exploitation is conditional on the non-default combination of local_bypass being enabled and the app sitting behind a reverse proxy, and no public exploit code or CISA KEV entry was identified at time of analysis.
Apache Tomcat 11.0.0-M25 through 11.0.26 can split the body of a large non-blocking (NIO) response across the current request and the next request received on the same reused keep-alive connection, most likely causing the second request to fail and potentially leaking fragments of the first response to a different client. Remote, unauthenticated attackers can trigger the condition (CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H, 9.1 as published; our assessment raises attack complexity to High because the target must both perform large non-blocking writes and reuse the connection, and the corruption outcome is non-deterministic), so reliable attacker control over which or how much data leaks is not established. No public exploit code and no CISA KEV entry were identified at time of analysis, and 11.0.27 resolves the flaw.
Apache Tomcat 11.0.22-11.0.26, 10.1.55-10.1.60, and 9.0.118-9.0.122 contain an object-recycling race in HTTP/2 processing of asynchronous servlets that can mix up requests or responses between users. The issue is network-reachable and unauthenticated, but exploitation requires both HTTP/2 and asynchronous servlet use on the same deployment and depends on concurrent in-flight requests, so impact is probabilistic rather than deterministic. No public exploit code was identified at time of analysis and no CISA KEV confirmation was provided; fixed versions are 11.0.27, 10.1.61, and 9.0.123.
Authentication bypass in Apache Tomcat's JNDI realm allows unauthenticated remote attackers to log in without a valid password when the realm is configured with a non-GSSAPI SASL mechanism. The flaw affects 11.0.0-M1 through 11.0.26, 10.1.0-M1 through 10.1.60, and 9.0.0.M1 through 9.0.122, plus EOL 8.5.x and 7.0.x branches, and Apache has released fixes in 11.0.27, 10.1.61, and 9.0.123. No public exploit has been identified at time of analysis, and exploitation requires the non-default JNDIRealm/non-GSSAPI SASL configuration.
Kiro Crew before version 0.7.2 contains a missing authorization flaw in its WhatsApp group channel integration that lets a remote attacker who is a member of an operator-configured WhatsApp group control the operator's other agent sessions and execute arbitrary commands on the host. The attacker must already belong to the specific group (low privileges, PR:L), but no operator interaction is required; deployments that do not enable the WhatsApp channel are not exposed. The vendor has released version 0.7.2 to fix the issue, and no public exploit code has been identified at the time of analysis.
Out-of-bounds write in Adobe Acrobat for Edge can lead to arbitrary code execution in the context of the current user when a victim opens a crafted PDF. The flaw is remotely reachable with low attack complexity and no attacker authentication, but it requires user interaction and does not by itself elevate privileges beyond the current user. No public exploit code has been identified at time of analysis, though the high CVSS score and Edge default PDF-handler exposure make prompt patching advisable.
Memory corruption in the PEAK-System PCAN Windows CAN device drivers allows local low-privileged attackers to overflow a fixed-size stack buffer by delivering a crafted record whose DLC field exceeds 0x0f, which the parser uses unchecked to index a length table before copying attacker-controlled data from record+0x1c. Exploitation gives high integrity and availability impact (arbitrary stack memory corruption, likely crash or controlled writes) but no confidentiality impact, and it requires local access with low privileges and no user interaction. No public exploit code or confirmed active exploitation was identified at time of analysis.
Stack-based buffer overflow (CWE-121) in IBM Planning Analytics 2.0 and 2.1 allows a remote attacker who holds valid low-privilege credentials to overflow an improperly bounds-checked stack buffer and potentially execute arbitrary code on the Planning Analytics server. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) confirms network reachability, low attack complexity, no user interaction, and high confidentiality, integrity and availability impact, with the credential requirement being the principal limiting factor rather than any technical obstacle. There is no CISA KEV listing and no public exploit code identified at time of analysis, so this is a high-priority patching item rather than an emergency, with exposure driven by how widely authenticated access is granted and whether the service is reachable from untrusted networks.
Memory corruption in Google Chrome's WebRTC component, affecting builds prior to 156.0.8078.47, allows a remote attacker to corrupt memory and potentially execute arbitrary code inside the browser's renderer sandbox by convincing a victim to load a crafted HTML page. Exploitation is unauthenticated (PR:N) but requires user interaction (UI:R) - the victim must navigate to attacker-controlled content that exercises WebRTC processing - and any resulting code execution is confined to the renderer sandbox, so full system compromise would additionally require a separate sandbox-escape flaw. Google rates the issue Chromium security severity Critical and a vendor patch is available; no public exploit code or confirmed active exploitation was identified at time of analysis, so this is a high-priority patch-now item rather than a top-tier emergency.
Memory corruption in the WebAppInstalls component of Google Chrome builds prior to 156.0.8078.47 lets a remote attacker who convinces a user to load a crafted HTML page potentially execute arbitrary code inside the browser sandbox. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) confirms no privileges are required but victim interaction is mandatory, and the vendor's own 'inside the sandbox' qualifier means host-level compromise would additionally require a separate sandbox escape. No public exploit code or CISA KEV entry is associated with this CVE in the available intelligence, so it is a hardening/patch-priority item rather than a confirmed active threat; a vendor fix exists in Chrome 156.0.8078.47.
Memory corruption in Google Chrome's WebProtect component (versions prior to 156.0.8078.47) lets a remote, unauthenticated attacker who convinces a victim to render a crafted HTML page potentially execute arbitrary code inside the renderer sandbox. Exploitation requires user interaction per CVSS UI:R, and the flaw alone does not permit host compromise - escaping the sandbox would require chaining a separate vulnerability. No public exploit code or confirmed active exploitation was identified in the provided intelligence, and Google rates the Chromium security severity as Low despite the 8.8 CVSS base score.
Memory corruption in the BrowserTag component of Google Chrome before 156.0.8078.47 lets a remote attacker who convinces a victim to load a crafted HTML page corrupt memory within the renderer and potentially execute arbitrary code inside the browser sandbox; no credentials or privileges are required, only that the victim renders the page (CVSS PR:N/UI:R). The resulting code execution is scope-limited to the sandbox - escaping to the host requires a separate sandbox-escape bug not covered by this CVE - which is why Google rates the Chromium security severity Low even though the generic CVSS base score computes to 8.8. No public exploit code or confirmed active exploitation was identified at time of analysis, and Chrome's silent auto-update mechanism shortens the exposure window on default desktop installations. Signals are mixed and must be weighed carefully: the numeric severity is high while the practical post-exploitation impact is constrained by the sandbox.
Use-after-free in Google Chrome's BrowserTag component, affecting desktop builds prior to 156.0.8078.47, allows remote unauthenticated attackers to execute arbitrary code inside the Chrome renderer sandbox when a victim loads a crafted HTML page (CVSS 3.1: 8.8, AV:N/AC:L/PR:N/UI:R). Because code execution is confined to the renderer sandbox, full host compromise would additionally require a separate sandbox-escape vulnerability, which limits the practical blast radius. No public exploit code or confirmed active exploitation was identified at time of analysis, and Google rates the issue Chromium security severity Medium despite the high base score.
Remote code execution inside the Chrome renderer sandbox is achievable via a use-after-free condition in the WebRTC implementation of Google Chrome builds prior to 156.0.8078.47. A victim only needs to load a crafted HTML page (UI:R, PR:N per the CVSS vector), and because WebRTC is enabled by default in standard Chrome builds the vulnerable code path is reachable without special configuration. The vendor rates Chromium security severity High, and while code execution is confined to the sandbox - meaning a separate sandbox escape is required for full host compromise - the CVSS 8.8 and confirmed availability of a vendor patch make this a genuine high-priority patching target; no public exploit code has been identified at time of analysis.
Memory corruption in Google Chrome's WebFonts handling allows a remote attacker to potentially execute arbitrary code inside the renderer sandbox by convincing a victim to load a crafted HTML page in any Chrome desktop build prior to 156.0.8078.47. The attack requires no authentication but is not zero-click - the victim must visit the attacker-controlled page (CVSS:3.1/AV:N/AC:L/PR:N/UI:R, 8.8), and Google rates the underlying Chromium bug as Low severity because any code execution achieved stays confined to the sandboxed renderer unless the attacker chains a separate sandbox escape. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released a fixed build.
Use-after-free in Google Chrome's WebAppInstalls component allows a remote attacker who convinces a victim to open a crafted HTML page to corrupt heap memory and potentially execute arbitrary code inside the renderer sandbox, affecting Chrome builds prior to 156.0.8078.47 on Windows, macOS, and Linux. Exploitation is constrained by two factors: the attacker has no path to trigger the bug without user interaction (UI:R, the victim must navigate to the malicious page), and the resulting code execution is sandbox-confined, so standalone impact is limited to the renderer process unless chained with a separate sandbox-escape primitive - which is why our assessed vector (C:L/I:L/A:L) is materially lower than the 8.8 base score derived from the C:H/I:H/A:H vector. Signals conflict sharply and must be read together: Google rates the flaw Chromium security severity Low and has shipped a fix in 156.0.8078.47, while the NVD-style vector implies full confidentiality, integrity, and availability loss; no public exploit code or confirmed active exploitation was identified at time of analysis.
Use-after-free in Google Chrome's WebAppInstalls component before 156.0.8078.47 allows a remote, unauthenticated attacker to execute arbitrary code inside the browser sandbox when a victim loads a crafted HTML page. Google rates the issue Low, and the independent assessment emphasizes that the flaw does not escape the sandbox, which explains the sharp conflict with the 8.8 CVSS score. No public exploit identified at time of analysis, and Google has released Chrome 156.0.8078.47 as the vendor fix.
Privilege escalation through the REST WebServices component of Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged authenticated attacker with HTTP network access to take over the OIM deployment, with high confidentiality, integrity and availability impact (CVSS 8.8). Exploitation requires a valid low-privilege account on the target instance (PR:L) but no user interaction and only low attack complexity, so exposure hinges on whether the REST interface is reachable by untrusted networks. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied with the source data.
Mobile Field Service in Oracle E-Business Suite 12.2.3 through 12.2.15 exposes the Admin UI to a low-privileged authenticated network attacker over HTTP, allowing takeover of the module with high confidentiality, integrity, and availability impact (CVSS 8.8). Exploitation requires valid application credentials and reachability of the Admin UI endpoint; it is not remote-unauthenticated, and deployments without the module are not exposed. No public exploit code was identified at time of analysis.
Authenticated low-privilege users can compromise and take over Oracle E-Business Suite Integrated SOA Gateway 12.2.3 through 12.2.15 over HTTP, with high confidentiality, integrity, and availability impact per CVSS 3.1 score 8.8. The assessed vector requires a valid low-privilege EBS account and reachable SOA Provider component, so fully anonymous attackers cannot exploit it. No public exploit code or CISA KEV entry was identified at time of analysis, and Oracle's October 2026 CPU advisory provides the remediation path.
Oracle E-Business Suite Integrated SOA Gateway versions 12.2.3 through 12.2.15 contain a high-severity flaw in the SOA Provider component that allows a low-privileged, authenticated attacker with HTTP network access to take over the affected gateway. Successful exploitation can fully compromise confidentiality, integrity, and availability of the Integrated SOA Gateway (CVSS 8.8). No public exploit code or confirmed active exploitation was identified at time of analysis; exposure is limited to EBS deployments that enable and expose the Integrated SOA Gateway.
Oracle Cost Management, a module of Oracle E-Business Suite (releases 12.2.3 through 12.2.15), permits a low-privileged authenticated attacker with HTTP network access to fully compromise the Cost Planning component, resulting in high confidentiality, integrity, and availability impact. Oracle's own advisory characterizes the flaw as easily exploitable and capable of leading to takeover of the module, yielding a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The practical barrier is authentication: the attacker must already hold valid low-privilege EBS credentials, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Authenticated low-privileged users with network HTTP access can achieve takeover of Oracle Purchasing 12.2.3 through 12.2.15, with high confidentiality, integrity, and availability impact (CVSS 8.8). The vulnerability is low-complexity and requires no user interaction, but exploitation depends on a valid low-privileged E-Business Suite session and reachability of the Purchasing Internal Operations component. No public exploit identified at time of analysis; the October 2026 Oracle Critical Patch Update is the remediation reference.
Authenticated compromise of Oracle Enterprise Manager for Siebel 13.5 and 24.1 can escalate to full takeover through the Configuration Management component, with a low-privileged network attacker able to affect confidentiality, integrity, and availability at CVSS 8.8. The flaw requires only a valid low-privileged account and HTTP access, not user interaction, so exposure is significant wherever such accounts exist; however, no public exploit identified at time of analysis and no CISA KEV confirmation is present, so this is not assessed as an active emergency.