This is a moderate-severity, authentication-gated server-side request forgery (SSRF) rather than a top-tier emergency: CVE-2026-28329 affects SolarWinds Observability Self-Hosted (CVSS 6.4) and requires a valid low-privileged authenticated session (PR:L). An attacker who can reach the vulnerable server-side request feature can make the application server send requests to attacker-controlled or internal destinations, which may expose otherwise firewalled services or cloud metadata endpoints; impact is limited by the authentication requirement and the server’s network reachability, and no public exploit or confirmed active exploitation was identified at time of analysis.
A request-routing discrepancy in Cloudflare Pingora before 0.9.0 lets an unauthenticated remote attacker send a single HTTP/2 request that the proxy evaluates under one authority while the upstream receives a different Host, so Host-based filters, access controls, or cache keys can be applied to the wrong virtual host. Exploitation is conditional and moderate risk: the deployment must terminate client HTTP/2 in Pingora, make security or caching decisions from the request URI authority, and sit in front of an upstream that routes by Host and serves different content per Host. The outcome is limited-impact confidentiality and integrity exposure on the downstream component (possible cache poisoning or host-based access-control bypass); there is no public exploit code and no confirmed active exploitation at time of analysis, and Cloudflare's own CDN path was unaffected because its internal Pingora services do not accept HTTP/2 from clients.
A path-traversal information-disclosure flaw in Vite's development server (versions 8.2.0 through 8.2.3 and 8.3.0 through 8.3.2) lets a remote requester read the first 4 bytes of any file on the host filesystem - including files deliberately excluded from server.fs allowed roots, such as .env secrets and private keys - by appending a ?vite-wasm-instance query string to the request path. The internal Wasm plugin's load hook strips the query, reads the target path directly from disk without applying server.fs checks, then fails WebAssembly parsing and leaks the file's leading bytes in the resulting Node/Deno error message. Exploitation requires a network-reachable dev server (localhost-bound by default, so exposure via 0.0.0.0 binding, proxying, or a shared network is a precondition); no public exploit code exists in the provided data and CISA KEV does not list it, while the assessed impact is limited confidentiality loss given only 4 bytes leak per request.
Unauthenticated information disclosure in the coding.ms 'typo3_fluid_form' extension for TYPO3 lets remote attackers retrieve files other visitors uploaded through forms, because the download link depends on a predictable token and the file name in the request is not verified in a guess-resistant way. Only sites that run the extension and use its file-upload-via-form workflow are exposed, and only files that already exist can be read; the vendor rates the issue CVSS 4.0 base 6.3, while our independent assessment scores it CVSS 3.1 6.5-equivalent at AV:N/AC:H/PR:N/UI:N with low confidentiality impact and no integrity or availability effect. A second exposure path exists: the token is rendered in plain text in the text/plain body of the notification email, so anyone who can read that message (forwarding, misdelivery, mailbox compromise, mailing-list archiving) obtains the token directly. No public exploit code or confirmed active exploitation was identified in the provided data.
Authenticated low-privileged users of Oracle REST Data Services (ORDS) 24.2.0 through 26.1.0 can, over HTTP, read and modify a subset of Database Actions-accessible data and cause a partial denial of service against the service. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, base 6.3) confirms the attacker must already hold a valid low-privileged session; no victim interaction is required. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, making this a moderate, authenticated patch priority rather than an emergency.
Oracle WebCenter Content 14.1.2.0.0 (Content Server component) allows a low-privileged, HTTP-reachable attacker to create, delete, or modify critical repository data and read a limited subset of it, but only after a second, typically higher-privileged user is induced to interact with attacker-controlled content or a crafted request. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N) makes valid credentials and victim interaction both mandatory, so the flaw is not anonymously reachable and is poorly suited to automated or wormable mass exploitation; integrity impact is high while confidentiality is limited and availability is unaffected. No public exploit code and no confirmed active exploitation were identified at time of analysis, consistent with a moderate, not top-tier, priority rating.
Oracle Database Server's Java VM (Oracle JVM/OJVM) component carries an integrity-only flaw affecting versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3, reachable by a low-privileged account with network access through the SOCKS5 pathway. Oracle explicitly rates the issue as difficult to exploit (AC:H), and impact is limited to unauthorized creation, deletion, or modification of critical and Java VM-accessible data, with a scope change (S:C) meaning additional products can be affected; confidentiality and availability are unaffected. This is a moderate-priority issue rather than a top-tier emergency, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Oracle Essbase 21.8.3.0.0 exposes a Security-component flaw that lets an authenticated low-privileged attacker with network HTTP access read and modify a subset of accessible data and cause a partial denial of service. The CVSS 3.1 score is 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), so exploitation requires a valid Essbase account but no user interaction or elevated privileges. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was provided.
Administrator credentials for EdgeLink-enabled Advantech ADAM-3600 devices can be recovered from an encrypted project file, exposing sensitive device management secrets to anyone who obtains that engineering artifact. The issue is a moderate, conditional information-disclosure risk: exploitation requires local access and prior possession of the project file, which is normally confined to operator workstations, backups, or repositories, and there is no remote unauthenticated path. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was provided.
A low-privileged attacker who already holds logon access to the host running Siebel CRM Development 17.0 through 26.9 can abuse the Integration - Scripting component to read and modify critical data within the application. Oracle rates this 6.3 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) and explicitly labels it difficult to exploit, since high attack complexity means specific timing, configuration, or environmental preconditions must align; there is no availability impact and no remote network path. No public exploit code has been identified at time of analysis and there is no KEV entry, so this is a moderate-severity, low-urgency item for patch-cycle handling rather than emergency response; remediation is delivered through Oracle's October 2026 Critical Patch Update.
Local, authenticated attackers holding a low-privileged logon on a host where Oracle Siebel CRM Deployment's Server Infrastructure component runs (supported versions 17.0 through 26.9) can exploit this flaw to obtain complete read and write access to all deployment-accessible data, breaking both confidentiality and integrity. Exploitation is difficult (AC:H) and confined to the local host with no network vector, so it is primarily an insider-threat or post-compromise escalation concern rather than an internet-facing emergency, and no public exploit code was identified at time of analysis, with no CISA KEV listing.
Authenticated low-privilege users with interactive logon to the host running Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 can exploit a flaw in the Enterprise Infrastructure SEC component to gain unauthorized read and write access to critical application data, scoring CVSS 6.3 with high confidentiality and integrity impact but no availability impact. Exploitation is local only (AV:L) and rated high complexity (AC:H), meaning an attacker must already hold a valid account on the infrastructure host and satisfy additional non-default conditions or timing before the weakness can be reliably triggered. No public exploit code or confirmed active exploitation has been identified at time of analysis, and no CISA KEV listing applies.
JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 can allow a low-privileged attacker who already has local logon to the hosting infrastructure to compromise the Enterprise Infrastructure SEC component, including reading and modifying critical EnterpriseOne data. The CVSS 3.1 score is 6.3 with AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N, so exploitation is local, requires an authenticated low-privileged account, and depends on difficult-to-control preconditions rather than network reachability. This is a moderate-priority issue rather than an emergency: no public exploit code or CISA KEV entry was identified at time of analysis.
The Python `filelock` package's opt-in `StrictSoftFileLock` (3.30.0 through <4.2.1) and `SoftReadWriteLock` (4.0.0 through <4.2.1) can adopt a protocol directory (`<path>.filelock`/`claims` or `<path>.rw`/`gen`/`holders`) that another local account created first inside a shared, non-sticky parent directory, letting that account tamper with protocol state and admit two concurrent lock holders. Only local attackers on the same host who win the creation race can exploit it; the default `FileLock` class is not affected, there is no confidentiality impact, and the race/ordering requirement raises attack complexity. No public exploit code was identified at time of analysis, and the issue is fixed in filelock 4.2.1.
Participants Database, a WordPress plugin by xnau webdesign, is affected through version 2.7.8.5 by an insecure direct object reference (CWE-639) that lets an authenticated low-privilege user manipulate a user-controlled record key to bypass intended access-control checks and read or alter participant records. The issue is remote with no user interaction required, but impact is limited to low confidentiality, integrity, and availability; no public exploit code or confirmed active exploitation was identified at time of analysis. Risk is greatest on WordPress sites that allow self-service registration or run permissive/default access-level settings for the plugin.
Vite development servers can be induced to serve a single file from outside the project root after import analysis records a root-relative browser URL, rather than the cleaned resolved module identifier, in the internal safeModulePaths trust list. Only non-Windows hosts running a network-accessible dev server (not a production build) are affected, and only when server.fs.deny does not already block the target file; because the colliding path must correspond to a project-relative URL authorized by the application graph, arbitrary path traversal is not achievable and impact is limited to read disclosure with no integrity or availability effect. Exploitation requires the coincidence of an imported project file whose URL matches an absolute host path plus attacker access to the exposed dev server, which the independent assessment scores as higher complexity (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N); no public exploit code was identified at time of analysis.
Argument injection in launch-editor (prior to 2.14.2), the Node.js 'open file in editor' helper shipped with Vite and vite-plus, allows an unauthenticated attacker who can place a file whose name begins with '+' or '-' into the project working directory to have that name interpreted as a command-line flag by the selected editor. When the reachable editor is Vim/gVim, MacVim, Emacs/Emacsclient, or Notepad++ with a plugin exposing dangerous operations, and the path stays relative (or is converted to a relative WSL path), this can lead to unintended file overwrite or arbitrary command execution in the developer's context. Exploitation is heavily preconditioned - the malicious filesystem entry must already exist, a vulnerable editor must be the configured one, and VS Code or absolute-path invocations are unaffected - so per the independent assessment it is rated AC:H with limited (low) confidentiality, integrity, and availability impact rather than a straightforward RCE; no public exploit code has been identified at time of analysis.
OS command injection on Windows in the launch-editor npm package before 2.14.2 lets remote attackers who can influence an environment variable value or a file path containing '%' trigger cmd.exe variable expansion and execute arbitrary commands when the open-in-editor feature is invoked. The flaw is rated medium severity (CVSS 4.0 base 6.3; CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) and is limited to Windows developer workstations using Vite or Vite Plus dev-server tooling; no public exploit identified at time of analysis.
Oracle Agile PLM 9.3.6 can disclose critical or all PLM-accessible data through its Import component to an attacker who already has a local logon on the server infrastructure. The flaw is low-complexity and requires no user interaction, but it is not remotely triggerable and affects confidentiality only, with no write or denial impact. No public exploit code was identified at time of analysis; Oracle's October 2026 Critical Patch Update advisory is the reference.
Local attackers who already hold a logon to the host running Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 can read critical application data through the Test Framework component without supplying any application-level credentials or user interaction. The exposure is confidentiality-only (CVSS 3.1 base 6.2, AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), so integrity and availability of the PeopleTools environment are not directly affected and the practical gate is the mandatory pre-existing local foothold on the PeopleTools server - a realistic threat mainly from insiders or attackers who have already compromised the host. It is not a top-tier emergency: no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, and no EPSS score was supplied with the source data.
Local code execution on iOS and iPadOS (before 26.7 and the 27 line), macOS Golden Gate (before 27), and visionOS (before 27) can let an attacker-controlled app process overwrite restricted files, breaking file-system integrity protections. The issue is an improper privilege-management and permissions-validation weakness (CWE-269) scored 6.2 with a local-only vector (AV:L/AC:L/PR:N/UI:N), so it is unauthenticated once code is running but cannot be reached remotely - a malicious or sideloaded app must first execute on the device. No public exploit identified at time of analysis and no KEV confirmation; Apple has released vendor patches in iOS 26.7/iPadOS 26.7, iOS 27/iPadOS 27, macOS Golden Gate 27, and visionOS 27.
Cross-site scripting in ApostropheCMS before 4.33.0 allows an unauthenticated attacker to craft a link that, when opened by an authenticated user in the admin context, abuses apos.http.parseQuery prototype-key handling to mutate browser prototypes and reach a DOM sink for script execution in the victim's session. Exploitation requires user interaction and only affects pages that load the admin bundle, so anonymous front-end visitors are not exposed; no public exploit was identified at time of analysis. Version 4.33.0 fixes the issue, which is scored CVSS 6.1 with a scope change.
Cross-site scripting in IBM Carbon Charts 0.4.0 through 1.27.19 lets remote attackers execute arbitrary JavaScript in a victim's browser session when the MeterChart title text exceeds the available container width and is truncated. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) indicates unauthenticated remote exploitation that requires the victim to load a page rendering the chart, with scope change and limited confidentiality/integrity impact. No public exploit code was identified at time of analysis, and practical exploitation depends on the host application passing attacker-influenced text into a MeterChart title and that title being long enough to trigger truncation.
Oracle Agile PLM 9.3.6 Web Client contains a client-side injection weakness that a remote, unauthenticated attacker can deliver over HTTP, but exploitation requires a victim other than the attacker to interact with attacker-controlled content. Successful attacks can read or modify a limited subset of data accessible through the victim's Agile PLM session, with scope change potentially affecting additional products and no availability impact; no public exploit code or CISA KEV entry was identified at time of analysis.
Oracle One-to-One Fulfillment in Oracle E-Business Suite 12.2.3 through 12.2.15 contains an Admin Console UI exposure that can be triggered when a privileged console user is induced to interact with attacker-controlled content, allowing limited unauthorized read and write actions within the victim's session and potentially affecting other products due to scope change. The CVSS 3.1 score is 6.1, and the vector shows PR:N with UI:R, meaning the attacker needs no credentials but cannot succeed without human interaction from an operator other than the attacker. No public exploit code or confirmed active exploitation was identified in the supplied intelligence, so this is a moderate, context-dependent risk rather than a mass-exploitation emergency.
Content injection in Oracle Email Center's Message Component (Oracle E-Business Suite 12.2.3 through 12.2.15) allows unauthenticated, network-based attackers to trick a victim into interacting with attacker-supplied content over HTTP, yielding partial read and update/insert/delete access to Email Center data (CVSS 3.1 6.1). The scope change (S:C) means injected content may affect additional Oracle EBS products, but confidentiality and integrity impacts are low and availability is unaffected. No public exploit code or confirmed active exploitation was identified at time of analysis.
Reflected cross-site scripting (XSS) is the assessed weakness in Oracle Customer Care within Oracle E-Business Suite 12.2.3 through 12.2.15, where an unauthenticated remote attacker can use HTTP to induce a victim user to open attacker-supplied content and cause limited unauthorized reads or updates in Customer Care and, through scope change, potentially affect other EBS products available to that user. The CVSS 3.1 base score is 6.1, exploitation requires human interaction, and confidentiality/integrity impact is Low with no availability impact; no public exploit identified at time of analysis.
Unauthenticated HTTP-based content injection in the Fluid Core component of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 lets a remote attacker abuse a victim's authenticated browser session, so that crafted content or a crafted link opened by a legitimate user can cause unauthorized read of a subset of PeopleTools-accessible data and limited insert, update, or delete operations - with the scope change (S:C) indicating impact can extend beyond PeopleTools into other products reachable from that session. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, 6.1) is the textbook signature of a cross-site scripting / content-injection flaw rather than a true authentication bypass, despite the 'Authentication Bypass' tag on the source record; no availability impact is described. No public exploit code or confirmed active exploitation (CISA KEV) is identified in the available data, and the mandatory user-interaction prerequisite (UI:R) is the primary limiting factor, with realistic risk concentrated on internet-facing PeopleSoft portals whose user populations are susceptible to phishing.
Unauthenticated, network-reachable content injection in the Web Server component of Oracle BI Publisher allows an attacker to craft a link or served page that, once a victim is induced to interact with it, can read and modify a limited subset of BI Publisher data - and because the vector carries a scope change (S:C), the injected content executes in the victim's context and may affect resources beyond the vulnerable component itself. Affected releases are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0, all of which are reachable over HTTP with no credentials required of the attacker (PR:N), though the attack cannot succeed without a human in the loop (UI:R). The CVSS 3.1 base score is 6.1 with Low confidentiality and integrity impact; no public exploit code has been identified at time of analysis and the CVE is not in CISA KEV, so it should be triaged as moderate rather than critical.
Oracle Siebel CRM Integration 25.12 through 26.9 is exposed through its Open Integration component to unauthenticated, HTTP-based attacks that succeed only when a legitimate user interacts with attacker-supplied content. A successful attack gives limited read access plus unauthorized insert, update, or delete capability within the integration scope, and the scope change means other products can be affected. At CVSS 3.1 base 6.1, the required user interaction is the main barrier to automated exploitation, and no public exploit was identified at the time of analysis.
Unauthorized data modification and limited data disclosure in JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 can be triggered by an unauthenticated network attacker who convinces a victim to interact with a crafted HTTP request; the pattern is consistent with a cross-site-scripting-class issue in the Monitoring and Diagnostics SEC component. Successful exploitation can update, insert, or delete some accessible data and read a subset, with a scope change that may affect additional products, but no public exploit was identified at time of analysis and it is not confirmed actively exploited. This is a moderate-severity issue (CVSS 3.1 base 6.1) whose primary limiting factor is the required victim interaction.
Unauthenticated, user-assisted attacks against the JD Edwards EnterpriseOne Tools web interface (supported versions 9.2.0.0 through 9.2.26.5) let a remote attacker lure a victim into interacting with attacker-supplied HTTP content, yielding low-impact read and write access to a subset of application data, with scope change extending the impact to additional connected products. Oracle scores this 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) - the UI:R requirement for a tricked human victim is the main limiting factor, so it cannot be triggered automatically. No public exploit code and no CISA KEV entry are identified at time of analysis, and no EPSS data was supplied; treat this as a schedule-the-patch item rather than an emergency.
A cross-site scripting-style injection flaw in the Web Runtime SEC component of Oracle JD Edwards EnterpriseOne Tools (versions 9.2.0.0 through 9.2.26.5) can be triggered over HTTP by an unauthenticated remote attacker, but only succeeds if a victim other than the attacker interacts with attacker-supplied content (UI:R). CVSS 3.1 scores it 6.1 with scope change, low confidentiality and low integrity impact on the affected and possibly additional products, and no availability impact; the practical delivery vehicle is a targeted JD Edwards user session rather than mass-automated scanning. Exploitation requires social engineering of a legitimate user's browser, there is no confirmed active exploitation (not in CISA KEV), and no public exploit code was identified at time of analysis.
Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 are affected by a moderate-severity Runtime Tools flaw that lets remote unauthenticated attackers obtain partial read access and limited update/insert/delete capability against portal data, with potential scope change into integrated products. Exploitation requires a victim other than the attacker to interact with crafted content (UI:R), which limits unattended mass exploitation, and the CVSS 3.1 score is 6.1; no public exploit code was identified at time of analysis.
Cross-site scripting-class weakness in Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 (Business Interlink) appears to let an unauthenticated remote attacker who persuades a victim to interact with crafted HTTP content gain limited read and update/insert/delete access to some PeopleTools data, with possible scope change to linked products. The CVSS 3.1 base score is 6.1, and exploitation requires user interaction (UI:R), so the flaw cannot be triggered autonomously against an idle server and is best treated as a moderate-severity, socially engineered issue. No public exploit code or CISA KEV entry is identified in the supplied intelligence; no public exploit identified at time of analysis.
Unauthenticated attackers with HTTP network access to the Content Server component of Oracle WebCenter Content can induce a targeted user to perform an interaction that grants limited unauthorized read and insert/update/delete access to application data, with scope change potentially extending impact to connected products. The issue affects versions 12.2.1.4.0 and 14.1.2.0.0 and carries a CVSS 3.1 base score of 6.1; no public exploit code or CISA KEV confirmation was identified at time of analysis, and the required victim interaction makes automated mass exploitation impractical.
Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 contain a moderate-severity flaw in the OIM Legacy UI that can allow an unauthenticated network attacker to read a subset of OIM data and update, insert, or delete some OIM-accessible data if a victim user is induced to interact with attacker-supplied content. The CVSS 3.1 base score is 6.1, with scope change indicating possible impact beyond OIM itself, but the UI:R requirement means exploitation depends on user action and is not silent or automatic at scale. No public exploit identified at time of analysis.
Reflected cross-site scripting in the HTML UI component of Oracle E-Business Suite's Installed Base module (versions 12.2.3 through 12.2.15) lets an unauthenticated remote attacker deliver a crafted HTTP request or link that executes in a victim's session once that user interacts with it. Because the vector carries scope change (S:C) with low confidentiality and integrity impact, a successful attack can read and modify a subset of Installed Base data and potentially affect other EBS products sharing the session context; there is no availability impact. No public exploit code or confirmed active exploitation was identified at time of analysis, and exploitation depends on social-engineering a user into following the crafted link.
Oracle Purchasing in Oracle E-Business Suite 12.2.3 through 12.2.15 contains an approval-workflow flaw that can let an unauthenticated network attacker read or modify some Purchasing data if a legitimate user is induced to interact with attacker-supplied content. The CVSS 3.1 score is 6.1 (MEDIUM) with scope change, meaning successful exploitation may affect additional EBS products beyond Purchasing. No public exploit code or CISA KEV entry was identified at time of analysis, and the required user interaction makes automated mass exploitation unlikely.
Oracle Demand Planning 12.1 and 12.2 contains a flaw in the Internal Operations component that allows an unauthenticated, network-capable attacker to deliver HTTP content and rely on a victim user's interaction to cause unauthorized read access to a subset of Demand Planning data and limited insert/update/delete actions. The CVSS 3.1 score is 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), with partial confidentiality and integrity impact, no availability impact, and a scope change that can affect additional products; successful exploitation requires a separate human victim to interact with attacker-supplied content, which limits practical exploitability. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, so this is a routine patch-cycle priority rather than an emergency.
Reflected cross-site-scripting-style input handling in Oracle Siebel CRM's Email Marketing component (Siebel Apps - Marketing, versions 17.0 through 26.9) allows an unauthenticated remote attacker to use HTTP to induce a victim to render crafted content, potentially altering or reading limited marketing data and, because of scope change, affecting connected products. The CVSS 3.1 score is 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), with the requirement for user interaction and limited confidentiality/integrity impact constraining practical risk. No public exploit was identified at time of analysis.
Unauthenticated remote attackers can exploit the Siebel Apps - Marketing component in Oracle Siebel CRM 17.0 through 26.9 over HTTP to gain unauthorized read access and limited insert/update/delete capability, provided a victim is first induced to perform a user-interaction step. The issue is scope-changing and moderate severity (CVSS 3.1 base 6.1, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), so exploitation is gated by social engineering rather than direct automated compromise. No public exploit code or CISA KEV confirmation was identified at time of analysis.
A browser-mediated injection flaw (signals point to reflected cross-site scripting) in the Siebel Apps - Marketing component of Oracle Siebel CRM 17.0 through 26.9 allows an unauthenticated remote attacker to have crafted HTTP content executed in the context of a legitimate Marketing user who is lured into interacting with it. Successful exploitation yields unauthorized read access to a subset of Marketing data plus unauthorized update, insert, or delete capability, and because the flaw has scope change (S:C) the impact may extend to other products; no public exploit code was identified and the issue is not in CISA KEV at time of analysis, with moderate severity (CVSS 3.1 6.1) reflecting the user-interaction prerequisite and low confidentiality/integrity weighting.
Oracle REST Data Services 24.2.0 through 26.1.0 contains a web-facing flaw that can let an unauthenticated network attacker cause limited unauthorized reads and writes to ORDS-accessible data when a victim is induced to interact with attacker-supplied content. The CVSS 3.1 score is 6.1, with scope change indicating that sessions or downstream products trusting ORDS output may also be affected; the mandatory user interaction is the primary barrier to exploitation. No public exploit code or confirmed active exploitation was identified at time of analysis.
Oracle PeopleSoft Enterprise FIN Common Objects Brazil 9.1, specifically the eProcurement component, exposes critical data to a high-privileged attacker who can reach the server over the adjacent network segment. Successful exploitation lets that attacker create, delete, or modify critical records and read all data the module can access, with high confidentiality and integrity impact and no availability impact. The CVSS 3.1 score of 6.1 reflects severe data impact offset by demanding prerequisites: an existing high-privileged account (PR:H) plus physical or adjacent-network access (AV:A), no user interaction (UI:N), and low attack complexity (AC:L) once those are met. No public exploit code or confirmed active exploitation was identified at time of analysis, so risk is concentrated among insiders and attackers who already hold a strong foothold on the PeopleSoft deployment.
Symlink redirection in filelock's ReadWriteLock and AsyncReadWriteLock (versions 3.20.4 through 4.0.8) allows a local user with write access to a shared lock directory to plant a symbolic link at the lock database path, causing SQLite to create, open, or lock a different file than the one the victim intended. The practical effect is integrity loss - mutual exclusion can be split between two targets so two processes believe they hold the same lock, and a lock database can be forced into an attacker-chosen location - with a modest availability impact from the resulting SQLite errors. The attacker must already hold a local account (PR:L, AV:L, unauthenticated network access is not a factor), must be able to create names in the lock directory before the victim initialises its lock, and the victim must actually use the newer ReadWriteLock classes rather than the classic FileLock. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and the issue is fixed in filelock 4.0.9.
Percent-encoded scheme normalization in fast-uri before 2.4.8, in 3.0.0 through 3.1.8, and in 4.0.0 through 4.2.2 can convert an input that raw-string filters consider inert into a live javascript, data, or vbscript URL. Applications that parse, normalize, or resolve a URL with fast-uri, screen dangerous schemes using the raw input, and then store or render the normalized/resolved result-or use equal() for equality-based allowlists-can be exposed to stored or reflected cross-site scripting. Exploitation requires victim interaction (UI:R), and no public exploit identified at time of analysis; KEV status is not indicated.
Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 contain a flaw in the Web Runtime SEC component that allows an unauthenticated, network-positioned attacker to deliver HTTP content which a legitimate logged-in user must be lured into interacting with, yielding partial read plus unauthorized insert/update/delete against that user's accessible data (CVSS 3.1 base 6.1, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). The scope change (S:C) means the impact can extend beyond EnterpriseOne Tools into other products that share the victim's browser session and trust context, but confidentiality and integrity effects are each rated Low and there is no availability impact. No public exploit code or CISA KEV entry was identified at time of analysis, and a vendor fix is published in Oracle's October 2026 Critical Patch Update.
Low-privileged users holding a local logon account on infrastructure running Oracle Product Lifecycle Analytics 3.6.1 can abuse an installation-related defect to read critical application data and partially degrade availability of the service. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L, base 6.1) confirms the attack is local-only and requires existing low-privileged host access with no user interaction, yielding high confidentiality and low availability impact but no integrity impact. No public exploit code has been identified and there is no confirmed active exploitation (not in CISA KEV) at time of analysis, and overall risk is materially bounded by the local attack surface, the single affected version, and the fact that the product is a specialized Supply Chain back-office application.
Local low-privileged users with logon access to Oracle Siebel CRM Development hosts can create, delete, or modify critical configuration data in versions 17.0 through 26.9, with a CVSS 3.1 base score of 6.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N). The flaw is easily exploitable once an attacker holds valid low-privilege credentials on the development infrastructure, requires no user interaction, and primarily threatens integrity while exposing a subset of readable data. No public exploit identified at time of analysis, the provided source data does not include a CISA KEV designation, and no EPSS score was supplied; the reporting source's 'Authentication Bypass' tag should be read alongside the authoritative PR:L/AV:L vector, which confirms a local authenticated prerequisite rather than remote unauthenticated access.