Critical data exposure in Oracle WebCenter Content 14.1.2.0.0 requires a low-privileged authenticated attacker, network access via HTTP, and interaction by a separate user, and is rated difficult to exploit. Successful exploitation can give unauthorized read access to critical WebCenter Content data and limited update, insert, or delete access, with scope change potentially affecting additional Oracle products. No public exploit code was identified at time of analysis.
Oracle WebCenter Content deployments at 12.2.1.4.0 and 14.1.2.0.0 expose the Content Server component to a low-privileged, authenticated attacker who can send crafted HTTP requests and, after convincing a separate user to perform an interaction, obtain unauthorized read access to critical content and limited insert/update/delete capability, with scope change allowing follow-on impact to other products. Oracle classifies the flaw as difficult to exploit - high attack complexity, a mandatory valid account, and a human-interaction lure all gate success - so the 6.5 MEDIUM score is a fair representation and this should be treated as a routine patch-cycle item rather than an emergency. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor fix is available through the October 2026 Oracle Critical Patch Update.
Oracle Siebel CRM's Customer Order Management component (versions 17.0 through 26.9) contains a medium-severity (CVSS 6.5) flaw that requires a low-privileged authenticated attacker and interaction by another user. Successful exploitation over HTTP can let an attacker read and modify limited Order Management data, cause partial denial of service, and potentially affect additional products because of the scope-change metric. No public exploit was identified at time of analysis; Oracle addressed the issue in its October 2026 Critical Patch Update.
Improper access control in the DevTools component of Google Chrome builds earlier than 156.0.8078.47 lets a remote attacker who convinces a victim to open a crafted HTML page leak sensitive information from the browser; no credentials or elevated privileges are required, but the attack hinges on the victim actively loading the attacker's page. The flaw is rated Medium (CVSS 6.5, AV:N/AC:L/PR:N/UI:R/C:H/I:N/A:N) with confidentiality-only impact, and Google has released a fixed build (156.0.8078.47). No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the issues.chromium.org tracker remains access-restricted, limiting technical detail.
Unauthenticated HTTP access to Oracle BI Publisher 12.2.1.4.0 can allow a remote attacker to read a subset of accessible data and perform limited unauthorized updates, inserts, or deletions through the Web Server component. The issue is network-reachable, low-complexity, and requires no user interaction (CVSS 3.1 6.5), but impact is limited to partial confidentiality and integrity effects with no availability impact. No public exploit code or CISA KEV active exploitation is identified in the provided data, so no public exploit identified at time of analysis.
Authenticated privilege escalation in Zyxel EX3501-T0 5G NR CPE firmware through 5.44(ACHR.6)C0 allows a low-privileged session holder to rewrite the login_privilege data via the device's Data Access Layer and obtain full administrative control. The root cause is a missing authorization check (CWE-863) on DAL operations, reachable over the network but gated behind a valid low-privilege login (PR:L), so it is not an unauthenticated remote compromise path. No public exploit code and no confirmed active exploitation were identified at time of analysis; note that the vendor-published base score of 6.5 reflects only confidentiality impact, whereas our assessment scores it C:H/I:H/A:H because tampering with privilege state also damages device integrity and availability.
A mid-tier, difficult-to-exploit flaw in Oracle Helidon 4.0.0 through 4.5.5 exposes the LRA (Long Running Actions / MicroProfile LRA saga-coordination) HTTP endpoints to unauthenticated remote attackers, allowing partial reads, unauthorized update/insert/delete of some Helidon-accessible data, and partial denial of service. Exploitation is not a straightforward single request - successful attacks hinge on high-complexity conditions the attacker must induce or race (AC:H), and the scope change flag means impact can propagate to other products integrated with the Helidon service. No public exploit code or confirmed active exploitation was identified at time of analysis, though Oracle's October 2026 CPU advisory addresses the issue; the primary pressure point is availability and data integrity for internet-facing Helidon LRA deployments.
Memory corruption in the Google Lens component of Google Chrome on desktop allows a remote attacker to read memory within the renderer sandbox by convincing a victim to load a crafted HTML page. Exploitation requires user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N per independent assessment) and is confined to memory reads inside the already-sandboxed renderer - there is no sandbox escape, no memory write, and no availability impact, which is why Google rated it Chromium security severity Low and EPSS is only 0.19% (9th percentile). No public exploit code or confirmed active exploitation was identified at time of analysis, and Chrome builds from 156.0.8078.47 onward contain the fix.
Out-of-bounds read in Google Chrome's Payments component affects builds prior to 156.0.8078.47 and lets a remote attacker disclose memory inside the renderer sandbox when a victim loads a crafted HTML page. The attack is unauthenticated but requires user interaction, and the impact is limited to information disclosure rather than code execution or data modification; it is most concerning as a building block for a separate sandbox escape. EPSS is low at 0.19% (9th percentile), and no public exploit was identified at time of analysis; Google has released Chrome 156.0.8078.47 as the fix.
Memory corruption in Chrome's V8 JavaScript engine allows a remote, unauthenticated attacker to read memory inside the renderer sandbox by convincing a victim to open a crafted HTML page in any desktop Chrome build prior to 156.0.8078.47. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) confirms the only meaningful barrier is user interaction - the target must navigate to attacker-controlled content - while impact is confined to confidentiality of in-sandbox memory with no code execution, data modification, or sandbox escape described. Exploitation has not been confirmed in the wild: there is no CISA KEV listing and no public exploit identified at time of analysis, and EPSS sits at 0.19% (9th percentile), indicating low practical exploitation likelihood in the near term.
Memory corruption in the Views UI component of Google Chrome on macOS prior to 156.0.8078.47 allows an unauthenticated remote attacker who persuades a victim to load a crafted HTML page to read memory inside the renderer sandbox. The impact is limited to confidentiality of renderer-process memory - there is no sandbox escape, no write primitive, and no code execution path described - and exploitation is gated by mandatory user interaction and the macOS-specific build. Google rates this Chromium severity Medium, EPSS is low at 0.19% (9th percentile), and no public exploit has been identified at time of analysis; a vendor patch exists in 156.0.8078.47.
Memory corruption in the WebAppInstalls component of Google Chrome for Android before version 156.0.8078.47 lets a remote attacker who convinces a user to open a crafted HTML page trigger an out-of-bounds memory read inside the renderer sandbox, potentially exposing process memory contents. The attack is unauthenticated (PR:N) but requires the victim to actively load the malicious page (UI:R), and the weakness is confined to Chrome on Android with default configurations affected. Impact is limited to information disclosure within the sandbox with no write primitive, sandbox escape, or denial-of-service shown; no public exploit code has been identified at time of analysis, EPSS is 0.18% (8th percentile), and the issue is not in CISA KEV. Our independent assessment scores confidentiality impact as Low (CVSS 3.1 base ~4.3: AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) rather than the NVD-style C:H, reflecting the sandbox-contained read primitive, making this a low-to-moderate priority patch rather than an emergency.
Out-of-bounds read in Google Chrome's GetUserMedia implementation allows remote attackers to read memory inside the renderer sandbox by convincing a user to open a crafted HTML page on versions prior to 156.0.8078.47. The issue is medium severity (CVSS 6.5) with high confidentiality impact but no integrity or availability impact, and exploitation requires user interaction (UI:R) while no authentication is required (PR:N); the sandbox limits exposure unless chained with a separate sandbox-escape vulnerability. No public exploit identified at time of analysis, EPSS is low at 0.18% (8th percentile), and a vendor-released patch is available in Chrome 156.0.8078.47.
Memory corruption within Chrome's CSS engine lets a remote attacker read memory that is otherwise confined to the renderer sandbox by convincing a user to open a crafted HTML page in any Chrome build prior to 156.0.8078.47. The CVSS vector (AV:N/AC:L/PR:N/UI:R) means no credentials are needed, but the attack is not drive-by-silent: it depends on the victim navigating to attacker-controlled content, so it is a social-engineering or malicious-page delivery problem rather than a wormable one. Impact is bounded to information disclosure inside the sandbox - there is no sandbox escape, no code execution and no data modification - and our independent assessment rates confidentiality impact as Low rather than the vendor-published High, giving a moderate-risk browser flaw that does not warrant emergency prioritization. EPSS is just 0.18% (8th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis, though Google has shipped a fix in 156.0.8078.47.
Out-of-bounds read in Google Chrome's WebHID handling before version 156.0.8078.47 lets a remote attacker disclose memory from inside the renderer sandbox by convincing a user to open a crafted HTML page. Exploitation requires user interaction (UI:R) and no authentication (PR:N), but the effect is limited to read-only information disclosure (C:H/I:N/A:N) and does not itself provide code execution or sandbox escape. No public exploit code or CISA KEV entry was identified at time of analysis, and EPSS is low at 0.18% (8th percentile); a vendor patch is available in 156.0.8078.47.
An out-of-bounds write in Apple's operating systems (iOS/iPadOS, macOS, tvOS, visionOS, watchOS) allows an attacker within wireless radio range to crash or unexpectedly terminate the system. No authentication or user interaction is required, but the impact is limited to denial of service - there is no memory disclosure or code execution. Unpatched devices below iOS/iPadOS 26.7 or 27, macOS Sequoia 15.8 / Tahoe 26.7 / Golden Gate 27, and tvOS/visionOS/watchOS 27 remain affected; no public exploit code or active exploitation has been identified, and EPSS is low (0.18%, 7th percentile) with CISA SSVC reporting no exploitation and low automatability.
Sensitive information disclosure in Google Chrome's Extensions subsystem affects builds prior to 156.0.8078.47, where improper access control lets a remote attacker use a crafted HTML page to read data that should be isolated from web content. Exploitation is not zero-click: the victim must load the attacker's page in a vulnerable browser (UI:R), though no authentication or credentials are needed and the attack path is remote and low complexity. Google rates the issue Medium (Chromium severity) and has released a fixed build; no public exploit code or confirmed active exploitation was identified at time of analysis, and the realistic impact is bounded to confidentiality loss with no integrity or availability effect.
Critical project data exposure and limited data tampering in Primavera P6 Enterprise Project Portfolio Management Web Access can occur when a low-privileged authenticated user persuades another user to interact with crafted HTTP content. Affected releases span 21.12.0.0 through 25.12.8, and the CVSS scope change means a successful attack may also affect connected Oracle products. Exploitation is rated difficult, requires valid credentials and a second human victim; no public exploit identified at time of analysis, and there is no CISA KEV entry.
Takeover of Oracle Global Lifecycle Management OPatchAuto is possible in versions 12.2.0.1.16 through 12.2.0.1.52, but only for an attacker who already holds high-privileged logon access to the host running the tool and who can additionally induce a second person - in practice an administrator initiating a patch operation - to perform a UI action (CVSS:3.1/AV:L/AC:L/PR:H/UI:R, score 6.5). A successful attack fully compromises confidentiality, integrity and availability of the OPatchAuto installation, which typically means code execution in the context of the privileged operator running the patching workflow. No public exploit code was identified at time of analysis and the issue is not in CISA KEV; the combination of a local vector, high privileges and mandatory third-party human interaction confines realistic exposure to insider or already-compromised-operator scenarios.
Out-of-bounds read in Apple's wireless stack can crash affected devices when an unauthenticated attacker within wireless/radio proximity triggers the vulnerable code path. It affects iOS/iPadOS before 26.7 and before 27, macOS before Sequoia 15.8, Tahoe 26.7, and Golden Gate 27, plus tvOS, visionOS, and watchOS before 27; Apple has released fixed versions. No public exploit code was identified at time of analysis, and CISA SSVC rates exploitation as none and automation as no.
Full takeover of Oracle PeopleSoft PeopleTools 8.61 through 8.63 is possible through a flaw in the product's Security component, but only by an authenticated attacker who already holds high privileges on the host and can induce a separate user to perform an action. The CVSS 3.1 base score is 6.5 (AV:L/AC:L/PR:H/UI:R), and no public exploit code or CISA KEV entry has been identified at time of analysis, so realistic risk is concentrated in insider or post-compromise scenarios rather than mass remote exploitation.
Local information disclosure in Oracle Autonomous Health Framework 26.3 through 26.8 lets a low-privileged user who already has logon access to the host read critical data exposed through the Trace File Analyzer component; the scope change means the confidentiality impact can extend to other products on the same infrastructure. The issue is rated CVSS 6.5 and is a post-compromise or malicious-insider risk rather than a remote attack, and no public exploit was identified at time of analysis.
Local low-privileged users with logon access to a Siebel CRM Cloud Applications host can read critical application data beyond their intended scope through a flaw in the Siebel Cloud Manager component, affecting supported versions 22.3 through 26.9. The CVSS 3.1 score is 6.5 (Medium) with AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, meaning exploitation requires authenticated local access, needs no user interaction, changes scope, and impacts confidentiality only. No public exploit code or CISA KEV entry was identified at time of analysis.
Local, authenticated low-privileged users on a JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 host can exploit the Installation Security component to bypass controls and gain unauthorized read access to critical data, with scope change potentially exposing co-located products. The issue requires prior logon to the infrastructure (AV:L/PR:L) and has no integrity or availability impact, making it a moderate insider-risk concern rather than a remote emergency. No public exploit was identified at time of analysis, and no KEV or EPSS data was supplied.
Data exposure in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with local logon to the Content Server host to read critical data, and the scope change means the compromise can affect additional products. The assessed vector is local, requires a valid low-privilege account, and needs no user interaction; no public exploit was identified at time of analysis. This is a moderate-severity, context-dependent issue rather than a drop-everything emergency.
Information disclosure in the Indian Payroll component of Oracle HRMS (India) within Oracle E-Business Suite 12.2.3 through 12.2.15 lets a low-privileged attacker who already holds a valid logon on the infrastructure host read critical data, with the scope of the compromise extending beyond the vulnerable component to additional products. The vector is local and authenticated (AV:L, PR:L, UI:N, AC:L), so a foothold or internal credentials are a prerequisite, and impact is confined to confidentiality (C:H with no integrity or availability effect), giving a CVSS 3.1 base score of 6.5. No public exploit code and no CISA KEV entry were identified at time of analysis, and the attack surface is further narrowed to organizations that actually run the India payroll localization.
Denial of service in Oracle Secure Backup 19.1.0.0.0 and 19.1.0.1.0 can be triggered by a low-privileged user who already has local logon to the host running the product, specifically through the Device Management and Support component. Successful exploitation causes a hang or repeatable crash, and the CVSS scope change means co-located products may also be affected, while confidentiality and integrity are not impacted. No public exploit identified at time of analysis, and the issue is local and requires valid authentication per CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H.
Local integrity compromise in Oracle Solaris 11.4's Utility component allows a low-privileged user with an existing logon to create, delete, or modify critical data, with scope change potentially affecting additional products. Oracle rates this CVSS 3.1 6.5 (AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N); no public exploit code or CISA KEV confirmation was identified in the available intelligence. The flaw is not remotely exploitable and requires authenticated local access, narrowing realistic risk to insiders or attackers who already have a foothold.
Local attackers who already hold an interactive logon on a JD Edwards EnterpriseOne Tools host can leverage a separate privileged user's installation or security-configuration action to gain unauthorized modification of critical data, limited read access, and denial of service in versions 9.2.0.0 through 9.2.26.5 (CVSS 6.5). Exploitation is constrained by high attack complexity, the need for a second human actor, and local access; no public exploit identified at time of analysis.
Low-privileged users who can log on interactively to a JD Edwards EnterpriseOne Tools server can corrupt or delete critical enterprise data, read a limited subset of application data, and repeatedly hang or crash the Enterprise Infrastructure SEC component, with Oracle scoping the flaw to Tools releases 9.2.0.0 through 9.2.26.5. The attack is local only (AV:L) and high complexity (AC:H), so it is not reachable across the network and is realistically confined to insiders or intruders who already hold a foothold on the host, which keeps the CVSS 3.1 base score at 6.5 despite high integrity and availability impact. No public exploit code has been identified at time of analysis, the CVE is not in CISA KEV, and no EPSS score was supplied in the available intelligence; treat this as a moderate-priority insider-risk and hardening item rather than an emergency patch.
Stored cross-site scripting in the VPN log monitoring screen of Stormshield Network Security (SNS) appliances allows a low-privileged authenticated user to plant script content that gets persisted into VPN log data and later rendered unescaped in the SNS management interface, where it executes in the session of an administrator who opens that screen. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, medium at 6.5) reflects a scope change, so injected code runs with the trust of the appliance's own administrative origin rather than the attacker's, although practical success hinges on a privileged operator actually viewing the affected log screen. Authentication requirements are confirmed from the vector's PR:L component - a low-privileged authenticated account is needed - and no public exploit code identified at time of analysis.
Cross-origin redirect following in the Model Context Protocol TypeScript client SDK lets a malicious or compromised MCP server or OAuth authorization server receive credentials the client intended for a different origin: custom headers such as X-API-Key and mcp-session-id on any followed redirect, plus full request bodies containing OAuth refresh_token and client_secret values when the redirect uses a method-preserving 307 or 308. The flaw (CWE-200) affects @modelcontextprotocol/sdk through 1.31.0 and @modelcontextprotocol/client 2.0.0 through 2.2.0, and only applications using StreamableHTTPClientTransport, SSEClientTransport, or the SDK's OAuth helpers such as auth() are exposed - stdio clients are not; extraction of the CVSS 6.5 score requires remote, unauthenticated reachability but high attack complexity, since real exposure depends on the client being steered to a cross-origin redirect by an untrusted or intercepted endpoint. No public exploit code and no confirmed active exploitation were identified at time of analysis, and modern fetch runtimes already strip the Authorization header across origins, which limits the blast radius somewhat.
An authorization bypass in the @apostrophecms/import-export module of ApostropheCMS (versions prior to 3.7.1) lets a low-privilege contributor with draft editing rights cross the publication boundary during a duplicate-import continuation. Because the module accepts a client-supplied replacement choice without binding it to a server-side analysis owned by that user or re-authorizing the canonical target document, the contributor can select a published document for replacement on an import-enabled localized type and modify content they should not be able to touch. The flaw is rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) with integrity-only impact; no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor's current assessment derives from remediation review rather than a repeated end-to-end reproduction.
Vitest dev servers in versions 5.0.0-beta.6 through 5.0.4 misapply Vite's server.fs.deny denylist, letting remote attackers who can reach a Vitest UI, Browser Mode, or API server read project files that should have been blocked and retrieve the fallback API token stored at node_modules/.vitest/.vitest-secret-token. A second variant, requiring Browser Mode with test.projects and a victim visiting an attacker-controlled site, leaks JavaScript-compatible .env values. No public exploit code or active exploitation has been identified at time of analysis, and the practical exposure is limited because these are development-only servers typically bound to localhost; the fix ships in Vitest 5.0.5.
Stored cross-site scripting in the CozyThemes Rootblox WordPress plugin through version 1.0.7 allows an authenticated low-privileged user to persist malicious input that executes in another user's browser when that victim views the affected page. The CVSS 3.1 score is 6.5 with PR:L and UI:R, so risk is concentrated on sites granting low-trust accounts content-submission access; no public exploit was identified at time of analysis.
Stored cross-site scripting in the Brainstorm Force SureCart WordPress plugin (all versions through 4.9.5) allows an authenticated low-privileged user to persist a script payload that later executes in a higher-privileged administrator's browser when the affected page is viewed, matching CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (6.5). Because exploitation requires both a foothold account capable of submitting the stored data and victim interaction, the practical risk is bounded rather than a self-propagating compromise, and the scope change (S:C) means the payload executes in the administrator's session context rather than the attacker's. No public exploit code and no CISA KEV entry were identified at time of analysis, and the available data does not identify a fixed SureCart release, so sites on 4.9.5 or earlier should be treated as unpatched pending confirmation from the Patchstack advisory.
Missing authorization in the Meta Box WordPress Custom Fields Framework (versions up to and including 5.15.2) lets an authenticated low-privilege user read custom-field and meta data they are not authorized to access, because the vulnerable code path does not verify that the requester holds the required capability. Only confidentiality is impacted (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/C:H/I:N/A:N), and exploitation requires a valid WordPress account on the target site - so sites with open user registration or any attacker-held account are the realistic risk. No public exploit code or confirmed active exploitation was identified at time of analysis.
Stored cross-site scripting in Castos Seriously Simple Podcasting affects WordPress sites running versions through 3.17.0, allowing an authenticated low-privilege content author to persist script payloads in podcast content that execute when another user views the affected page. The 6.5-severity issue requires victim interaction and is limited to sites exposing posting capabilities to untrusted accounts; no public exploit code or CISA KEV confirmation was identified at time of analysis.
Denial of service in Mozilla Firefox's built-in PDF Viewer (pdf.js) allows remote attackers to crash or hang the browser when a victim opens a crafted PDF document, either via a web page or an email attachment. The issue affects Firefox versions prior to 158.0.1 and is fixed in that release; exploitation requires user interaction (UI:R) and provides no confidentiality or integrity impact, only availability loss confined to the browser process. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied.
High-privileged users of Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 can abuse the Asset Management component over HTTP to create, delete, or modify critical records, read data they should not reach, and partially disrupt availability of the module (CVSS 3.1 6.4, Medium). Exploitation is gated by two hard preconditions: the attacker must already hold a high-privilege authenticated account (PR:H) and a separate victim must be induced to interact with the attack (UI:R), so this cannot be triggered unauthenticated or fully automated. No public exploit code was identified and there is no CISA KEV confirmation of active exploitation at time of analysis; the practical exposure is confined to organizations running the Argentina localization of FIN Common Objects on version 9.1.
Authenticated low-privileged users with HTTP access to Oracle Agile Product Lifecycle Management for Process 6.2.4 can exploit a high-complexity flaw in the Product Quality Management component to gain broad read access to critical data, make limited unauthorized data changes, and trigger a partial denial of service. The issue carries a CVSS 3.1 base score of 6.4 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L); the high attack-complexity rating means successful exploitation depends on conditions outside the attacker's direct control. No public exploit code or confirmed active exploitation (CISA KEV) was identified in the available intelligence at time of analysis.
Denial of service plus limited data tampering in Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5: a low-privileged authenticated attacker who can reach the JDENET service over the network can hang or repeatedly crash the application (Availability impact rated High) while also reading and modifying a subset of the data it exposes. Oracle classifies the flaw as difficult to exploit (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H, base score 6.4), meaning success depends on specific timing or server-state conditions rather than a single crafted request, and a valid account is required. No public exploit code or confirmed active exploitation has been identified at time of analysis, so this is a normal-CPU-cycle remediation rather than an emergency.
Oracle JD Edwards EnterpriseOne Tools (component: Enterprise Infrastructure SEC) versions 9.2.0.0 through 9.2.26.5 can be driven into a persistent hang or repeatable crash through the JDENET protocol, while also exposing a limited slice of application data to unauthorized read and modification. The attack is network-reachable but rated high complexity and requires an existing low-privilege account, so it is a constrained, moderate-severity (CVSS 6.4) issue rather than an easily triggered remote takeover; no public exploit code exists and there is no confirmed active exploitation (not in CISA KEV) at time of analysis. Impact concentrates on availability, with secondary confidentiality and integrity effects.
Oracle Siebel CRM Deployment releases 17.0 through 26.9 expose a Server Infrastructure weakness that lets a low-privilege user with HTTP access hang or repeatedly crash the component while also reading and modifying a limited subset of data it manages. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H, base 6.4) shows the attack is remote but gated by a valid low-privilege Siebel account and by a high-complexity precondition such as a race window or a particular server state the attacker does not fully control, so the availability impact dominates (A:H) while confidentiality and integrity effects stay low. No public exploit code was identified at time of analysis and there is no CISA KEV confirmation of active exploitation; this is a moderate-severity, moderate-priority issue rather than a top-tier emergency, with the highest practical risk in deployments where the Siebel server is internet-facing or broadly reachable from the corporate network and low-privilege accounts are liberally provisioned.
Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 allows an authenticated low-privileged user with HTTP access to the BI Platform Security component to read and modify a limited subset of BIEE data, with scope change that may affect additional Oracle products. The vector requires a valid low-tier account and no user interaction, so exposure depends on externally reachable or untrusted low-privileged BIEE accounts. It is a real-but-not-urgent, medium-severity priority; no public exploit code or CISA KEV active exploitation is identified at time of analysis.
Stored cross-site scripting in the DiviGear Carousel WordPress plugin (all versions through 5.2.0) lets any authenticated user at subscriber level or above write arbitrary script into the site's stored license settings through the plugin's update_license AJAX action. The payload is persisted without sanitization and is echoed unescaped into a single-quoted HTML value attribute on the DiviGear > Activation settings page, so it executes in the browser of an administrator who later opens that page, enabling session theft or privileged actions performed as the victim. Exploitation is gated on a valid low-privilege account and on an administrator visiting the Activation screen; no public exploit code was identified at time of analysis and the issue is not in CISA KEV.
Privilege escalation and takeover within the Package Build SEC component of Oracle JD Edwards EnterpriseOne Tools (9.2.0.0 through 9.2.26.5) allows a high-privileged user who already holds logon access to the application host to fully compromise the product's confidentiality, integrity and availability. The flaw is rated difficult to exploit (AC:H) and requires both local access and existing high privileges, so realistic exposure is limited to malicious insiders or attackers who have already compromised a privileged account rather than remote or unauthenticated actors. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; vendor remediation is published through Oracle's October 2026 Critical Patch Update.
Oracle Agile PLM 9.3.6 contains a high-complexity Security component flaw that a locally logged-on low-privilege attacker can use to gain broad read access to critical Agile PLM data and limited ability to modify it. The CVSS 3.1 score is 6.4 (AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N), and the scope change means successful exploitation may affect resources beyond the Agile PLM application itself. No public exploit code or CISA KEV entry was identified at time of analysis, so risk is mainly to environments where untrusted users already have interactive host access.
A local privilege-escalation-style flaw in Oracle Essbase 21.8.3.0.0's Java Based Agent component lets an attacker who already holds a low-privileged logon on the Essbase host read, modify, or delete sensitive data managed by the product. Because the vector is AV:L/AC:H/PR:L/UI:N/S:C, exploitation requires local access plus a condition outside the attacker's control, and the scope change means co-located products on the same host may also be compromised. No public exploit code or confirmed active exploitation was identified at time of analysis, and the moderate CVSS 3.1 base score of 6.4 reflects confidentiality-heavy impact with only partial integrity loss.
The TYPO3 extension "FAL Protect" fails to enforce its access protection on files stored in file storages configured with a non-default relative base path, allowing those files to be fetched straight from the web server without any authentication or permission check. The flaw only manifests on websites running TYPO3 14.3 that use such a non-default storage configuration; default relative base paths are not affected, and no public exploit code or confirmed active exploitation was identified at the time of analysis. Impact is limited to confidentiality - unauthenticated remote attackers can read protected files but cannot modify or delete them - making this a genuine but moderate-priority issue rather than a critical emergency.