SoftReadWriteLock in the Python filelock package (4.0.0 through 4.2.0) refreshes holder records by pathname without verifying that the name still resolves to the file it originally created, so a local user who can rename entries in the lock directory can substitute a named pipe (FIFO) and stall the lock, or - where the hard-link policy is permissive - link a file the victim can reach and cause the lock holder to write through it. Exploitation requires an authenticated local account sharing the lock directory (CVSS PR:L, AV:L), so this is a locally-exploitable, medium-severity issue (CVSS 6.1, integrity low, availability high) rather than a remote one; no public exploit code was identified at time of analysis and the flaw is fixed in filelock 4.2.1.
Python filelock's UnixFileLock truncates a regular file that a second local user has renamed onto the lock path (or hard-linked there when hard-link protections are relaxed), destroying that file's contents; when an explicit mode is requested, versions from 3.10.2 onward can additionally fchmod the file to the lock's mode. Exploitation requires a low-privileged local account (CVSS PR:L) plus rename/write permission on the directory holding the lock file, or a host with fs.protected_hardlinks disabled, so only multi-user shared lock directories and permissive-hardlink systems are exposed - no remote or unauthenticated path exists. Fixed in 4.2.1; no public exploit identified at time of analysis, and EPSS/KEV data are not available for this CVE.
Local, authenticated low-privileged users on hosts running Oracle Outside In Technology 8.5.8 can abuse the Outside In Clean Content SDK to corrupt or delete critical data and trigger a partial denial of service, with no confidentiality impact. The CVSS 3.1 score is 6.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L), so exposure is limited to environments where an attacker can both log on locally and get crafted content processed by the SDK. No public exploit code or confirmed active exploitation was identified at time of analysis.
A time-of-check-to-time-of-use (TOCTOU) flaw in the Python filelock library's ReadWriteLock, present from 4.1.0 through 4.2.0, allows a second local account to abuse rename rights in a shared, non-sticky parent directory to observe the randomized .filelock-* private hard-link directory name or forge a dead-owner sweep name, then rename a sibling directory onto that name so the lock's cleanup deletes it - producing high integrity impact with limited availability impact on data the attacker does not own. Exploitation requires a local account on the same host, rename access in a parent directory that is group/other-writable and lacks the sticky bit, and an application that places its ReadWriteLock database in such a shared location; deployments where the database directory is owned by the locking account or root and is not group/other-writable, or where parent directories are sticky, are not affected. The issue is fixed in 4.2.1, and no public exploit code was identified at time of analysis.
Reflected cross-site scripting in the Ticimax E-Commerce Platform (builds through 2026-10-20) lets remote attackers inject script into pages served to victims who follow a crafted link, potentially stealing session cookies, hijacking authenticated storefront or admin sessions, or rewriting page content to phish customers. Unauthenticated attackers can craft the URL (CVSS:3.1/PR:N), but the payload only executes when a victim actively opens it (UI:R), and the scope change (S:C) means impact lands in the victim's browser origin rather than the server itself, which is why the score sits at 6.1 rather than critical. No public exploit code and no confirmed active exploitation were identified at time of analysis; EPSS and KEV data were not provided, so the practical risk is driven by targeted social-engineering delivery against storefront users or administrators.
High-privileged attackers with network access to the CORBA interface can hang or repeatedly crash Oracle Siebel CRM Development versions 17.0 through 26.9 through the Integration - Scripting component, while also obtaining limited read and write access to a subset of application data. The CVSS 3.1 base score is 6.0 (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H), and no public exploit was identified at the time of analysis.
SQL injection in the Configurable Reports block for Moodle (moodle-block_configurablereports) before 5.3.1 allows an authenticated low-privileged user to read arbitrary database tables - including Moodle user password hashes - through the filter_var request parameter of viewreport.php. Exploitation requires that the attacker hold the capability to view a SQL-type report that was authored with the %%FILTER_VAR%% placeholder, which is why the vector carries AT:P and PR:L; impact is limited to confidentiality (C:H with I:N/A:N) and no user interaction is needed. A vendor patch is available in release 5.3.1, and no public exploit code was identified at time of analysis.
Authenticated high-privileged users of Oracle PeopleSoft Enterprise HCM Human Resources 9.2 can abuse the Administer Workforce component over HTTP to create, delete, or modify critical HR data, read a subset of otherwise restricted records, and force repeatable hangs or crashes of the application. Exploitation is constrained by three factors drawn from the CVSS vector - a high-privileged account (PR:H), interaction by a separate victim user (UI:R), and Oracle's own assessment that the flaw is difficult to exploit (AC:H) - which together point to insider or post-compromise misuse rather than opportunistic remote attack. There is no public exploit code identified at time of analysis and the issue is not in CISA KEV; the vendor-reported severity is 6.0, and independent assessment rates real-world urgency as low.
Oracle Siebel CRM Deployment 17.0 through 26.9 contains a local high-privilege access-control weakness that can let an attacker who already has logon access to the Siebel host read and modify critical deployment data. Exploitation is not network-reachable and requires a pre-existing high-privileged local foothold, so realistic risk is limited to malicious insiders or attackers who have already compromised a privileged account. No public exploit code or CISA KEV entry was identified at time of analysis.
Oracle Concurrent Processing 12.2.3 through 12.2.15 in Oracle E-Business Suite can expose critical data to a high-privileged attacker who already has interactive logon to the infrastructure where the component runs, with scope change extending confidentiality impact to other E-Business Suite products. The CVSS 3.1 score is 6.0 (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N), and impact is confined to confidentiality with no integrity or availability effect. No public exploit identified at time of analysis.
High-privileged local users on hosts running Oracle Essbase 21.8.3.0.0 can obtain unauthorized read access to critical Essbase data through a flaw in the Java Based Agent component, and because the scope is changed the exposed data may include that of other products on the same host. The CVSS 3.1 score is 6.0 (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N), a confidentiality-only impact that requires an existing interactive logon and administrator-level privileges rather than network reachability. No public exploit code or CISA KEV entry was identified at time of analysis, and patching is available through the referenced Oracle Critical Patch Update.
Local, high-privileged attackers with logon to the infrastructure hosting Oracle Product Lifecycle Analytics 3.6.1 can exploit an installation-related flaw to obtain unauthorized read, create, delete, or modify access to critical application data. The CVSS 3.1 score is 6.0 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N), reflecting high confidentiality and integrity impact but no availability impact, and exploitation requires an already privileged local operator rather than remote unauthenticated access. No public exploit identified at time of analysis; this is a moderate-severity, low-urgency issue.
High-privileged users who can log on locally to hosts running Oracle Siebel CRM Development (versions 17.0 through 26.9) can leverage the Configuration Tools component to read and modify data well beyond their intended authorization boundary. The flaw carries a CVSS 3.1 base score of 6.0 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N), meaning the attacker must already hold an elevated local logon and no user interaction is needed - there is no network-reachable vector. There is no public exploit identified at time of analysis and it is not in CISA KEV; because the prerequisites limit abuse to already-trusted privileged accounts, this is best treated as a segregation-of-duties and defense-in-depth issue rather than an externally exploitable emergency.
High-privileged local users can corrupt critical data or repeatedly crash PeopleSoft PeopleTools 8.61-8.63 through the Updates Environment Mgmt component, with CVSS 3.1 scoring 6.0 for integrity and availability impact. Exploitation requires logon to the infrastructure hosting PeopleTools and pre-existing high privileges, so realistic exposure is limited to trusted insiders or attackers who have already escalated on the host. No public exploit identified at time of analysis, and no CISA KEV entry is associated with this CVE in the provided data.
Oracle Essbase 21.8.3.0.0 contains a Security-component flaw that allows a high-privileged local attacker to obtain unauthorized access to critical Essbase-accessible data, with scope change extending impact to additional products. Exploitation requires an authenticated logon to the host infrastructure (PR:H, AV:L) and no user interaction. No public exploit was identified at time of analysis, and Oracle addressed the issue in its October 2026 Critical Patch Update advisory.
Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 contain a high-privilege local vulnerability in the Porting component that lets an attacker with existing elevated credentials and logon access to the host infrastructure read, create, delete, or modify critical PeopleTools data, affecting both confidentiality and integrity (CVSS 3.1 base 6.0). The local attack vector and PR:H requirement mean this is an insider-abuse or post-compromise impact-escalation scenario rather than a remotely reachable flaw, and no public exploit code or CISA KEV active-exploitation entry was identified at time of analysis. Oracle addressed the issue in its October 2026 Critical Patch Update.
Predictable export archive filenames in the @apostrophecms/import-export module before 3.7.1 let an unauthenticated requester derive and fetch another user's export archive from publicly readable export storage while it still exists. Only deployments with the import-export feature enabled and export/upload storage that is publicly reachable over the network are exposed, and the attacker must time the request inside the window before the archive expires or is cleaned up. Exploitation additionally depends on a user with export permission having already created an archive, so real-world risk is conditional rather than universal; no public exploit code or confirmed active exploitation was identified at time of analysis, though the disclosure yields full read access to exported content (CVSS 4.0 6.0; assessed CVSS 3.1 AV:N/AC:H/PR:N/UI:R/C:H/I:N/A:N).
Insufficient filtering in Apache CouchDB's shared _replicator database (3.5.2 and earlier, all platforms) allows any authenticated user to read the replication credentials belonging to other users' replication jobs, potentially exposing usernames, passwords, or auth tokens for external source and target endpoints. The flaw is only meaningful in multi-user or multi-tenant deployments where distinct users' credential-bearing replications coexist; a low-privileged account with no user interaction and no admin rights can harvest those secrets and pivot to the systems they unlock, which is why the vendor's CVSS 4.0 vector rates subsequent-system confidentiality as high. Upgrading to 3.5.3 fixes the issue; no public exploit code or confirmed active exploitation was identified at time of analysis.
A path-traversal information disclosure in Vitest's mocker interceptor plugin requires a Windows host running the Vite dev server with WebSocket mock-registration enabled, and the attacker able to reach that server, to read files outside server.fs.allow that the Vitest process can access. The flaw arises because backslashes in a redirect mock pathname survive a POSIX-style join, so the allow-list check validates one path while the subsequent filesystem read resolves a different one - giving unauthenticated remote attackers read-only access to arbitrary process-readable files on Windows only. No public exploit code was identified at time of analysis and the flaw is not on the CISA KEV list; the high attack complexity and typical local binding of dev servers keep real-world risk moderate.
Denial of service affecting Oracle Siebel CRM Deployment versions 17.0 through 26.9 allows an unauthenticated, network-positioned attacker to hang or repeatedly crash the Deployment Server Infrastructure over HTTP. The CVSS 3.1 score is 5.9 with a high attack-complexity rating, meaning success depends on server-state, timing, or request characteristics outside the attacker's direct control, and impact is limited to availability with no confidentiality, integrity, or code-execution effect. No public exploit code was identified at time of analysis, and this is a moderate-severity availability issue rather than a top-priority compromise risk.
Credential disclosure in Mozilla Thunderbird's Exchange AutoDiscover account-setup flow allows an on-path network attacker to capture the user's password when the client falls back to plaintext HTTP and includes the entered credentials in that request. Thunderbird versions prior to 158.0.1 are affected; exploitation is limited to the one-time account-configuration window and requires the attacker to already control the network path (CVSS 5.9, AC:H). No public exploit code was identified at time of analysis.
Unauthenticated, network-reachable attackers can force a hang or repeatable crash of MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, and of MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, through the Server: Components Services component. Oracle rates this CVSS 3.1 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H), with impact limited to availability; the high attack complexity reflects conditions outside the attacker's control rather than a deterministic payload. No public exploit code or confirmed active exploitation was identified in the available intelligence, and the issue is materially lower risk where the MySQL listener is not exposed to untrusted networks.
Denial of service in Oracle Java SE 26.0.2 can be triggered when an application or web service passes attacker-controlled data to the Compiler component APIs. The flaw is remotely reachable without authentication or user interaction, but high attack complexity makes reliable triggering difficult, and impact is limited to availability (hang or repeated crash). No public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated network attackers can hang or repeatedly crash Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 by reaching the Business Interlink component over HTTP. Exploitation is constrained by high attack complexity, meaning the attacker must satisfy conditions beyond their direct control or achieve precise/repeatable triggering; impact is availability-only, with no confidentiality or integrity effect. The flaw is not listed in CISA KEV and no public exploit code was identified at time of analysis, so practical risk is moderate and depends heavily on whether Business Interlink is exposed beyond trusted internal networks.
A confidentiality-only information disclosure flaw exists in the Networking component of Oracle Java SE (11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27) and Oracle GraalVM for JDK (17.0.20.1, 21.0.12.1), rated CVSS 3.1 base 5.9. Successful exploitation allows an unauthenticated network attacker to read critical data or gain complete access to all data reachable by the affected Java runtime, but Oracle classifies the issue as 'Difficult to exploit' (AC:H) because success depends on special conditions such as specific data flows into the Networking APIs, and no public exploit code or active exploitation has been identified at time of analysis. Exposure is greatest for applications or web services that pass untrusted input into the Networking component APIs, and for sandboxed Java Web Start or applet deployments that load untrusted code and rely on the Java sandbox for security.
Oracle WebLogic Server 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 can expose critical server-accessible data to an unauthenticated remote attacker over HTTP, but Oracle rates the flaw difficult to exploit due to high attack complexity. No public exploit identified at time of analysis, no CISA KEV entry is present in the provided data, and no EPSS score was supplied. The CVSS 3.1 base score is 5.9, with confidentiality-only impact.
Unauthorized read access to critical data in Oracle JD Edwards EnterpriseOne Tools (versions 9.2.0.0 through 9.2.26.5) is possible for unauthenticated remote attackers through the Interoperability SEC component's HTTPS interface. Oracle characterizes the flaw as difficult to exploit (AC:H) and limits impact to confidentiality only, for a CVSS 3.1 base score of 5.9. No public exploit identified at time of analysis, and no CISA KEV activity is associated with this CVE.
Unauthenticated attackers with HTTP network access to the Portal security (Portal SEC) component of Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 may be able to read critical data, including potentially all data accessible through the Portal, via an authentication-bypass weakness. The CVSS 3.1 score of 5.9 reflects confidentiality-only impact (C:H/I:N/A:N) tempered by high attack complexity (AC:H), meaning exploitation depends on conditions outside the attacker's control such as specific configuration or environmental state, so the flaw is difficult rather than trivial to exploit reliably. No public exploit code and no CISA KEV confirmed active exploitation were identified at time of analysis.
Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 contain an unauthenticated HTTP-accessible flaw that can disclose critical or all application-accessible data. The vendor rates attack complexity as high (AC:H), meaning exploitation depends on conditions the attacker does not control and is not reliably repeatable, and impact is limited to confidentiality with no modification or denial of service. No public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated network attackers can obtain unauthorized read access to critical data in Oracle JD Edwards EnterpriseOne Tools (versions 9.2.0.0 through 9.2.26.5) by reaching the JDENET communication service, but Oracle rates the issue as difficult to exploit (CVSS 3.1 base 5.9, AC:H), and only confidentiality is affected. There is no public exploit code and no confirmed active exploitation at time of analysis, so practical risk is concentrated in environments that expose the JDENET transport beyond trusted internal networks.
Unauthenticated, network-reachable HTTP attackers can obtain unauthorized read access to critical data in Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 via a flaw in the Enterprise Infrastructure SEC component. Oracle scores it 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) in the October 2026 Critical Patch Update, explicitly rating it difficult to exploit and confining impact to confidentiality, with no effect on integrity or availability. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; EPSS scoring was not supplied in the source data.
Oracle Java SE and GraalVM JDK/Enterprise distributions can expose confidential data when JAXP processes attacker-supplied XML, with the most realistic path being services that feed untrusted data into XML APIs. The flaw affects specific Java SE 8u503, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, and 27 releases plus listed GraalVM versions, and is difficult to exploit (AC:H) with confidentiality-only impact. No public exploit was identified at time of analysis, and patch availability is documented through Oracle's October 2026 Critical Patch Update advisory.
Information disclosure in the JDBC component of Oracle Java SE, Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition (CVSS 3.1 base 5.9) lets an unauthenticated network attacker who can get attacker-influenced data into the affected JDBC APIs read critical data that the Java process can access; there is no integrity or availability impact. Exploitation is explicitly rated difficult (AC:H) and depends on non-trivial preconditions, chiefly a service that feeds untrusted input to those APIs or a sandboxed Java Web Start/applet client running untrusted code. No public exploit code was identified at time of analysis, and the issue was disclosed through the Oracle Critical Patch Update of October 2026 covering Java SE 8u503/8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1 and 27, GraalVM for JDK 17.0.20.1/21.0.12.1, and GraalVM Enterprise Edition 21.3.19.1.1.
MySQL Connector/Net 26.7.0, Oracle's ADO.NET client library for MySQL, can expose connector-accessible data to an unauthenticated network attacker who controls or impersonates the MySQL server the client connects to. Oracle rates it CVSS 3.1 5.9 (Medium) with AC:H, reflecting a difficult-to-exploit, confidentiality-only flaw that is not a direct hit against a passively listening service. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS data was supplied with the source intelligence.
Oracle Siebel CRM Cloud Applications versions 22.3 through 26.9 expose a confidentiality-only weakness in the Siebel Cloud Manager component that remote, unauthenticated attackers can reach over the network via LDAP. Oracle rates exploitation as difficult (CVSS 3.1 score 5.9, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N), so success appears to hinge on specific LDAP configuration, timing, or environmental conditions rather than a single repeatable request, and a successful attack yields disclosure of critical data rather than modification or service disruption. There is no CISA KEV listing and no public exploit identified at time of analysis, so this should be handled as a moderate-priority hardening item rather than an emergency.
Unlimited current-password guessing against ApostropheCMS versions before 4.33.0 lets anyone holding an already-authenticated session - even a disposable low-privilege guest session - grind out a victim's existing password through the self-service endpoint PATCH /api/v1/@apostrophecms/settings/password, because that route verifies the password directly without touching the login module's failed-attempt counter, delay, or lockout. Successful guessing yields full account takeover, so confidentiality and integrity are both rated High while availability is unaffected; the assessed vector is CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N (6.8), stricter on privileges than the vendor's published 5.9/PR:H but agreeing on impact. The attack is not self-starting - no pre-authentication vector exists and success still hinges on victim password entropy - and no public exploit code or active exploitation was identified at time of analysis, though the GHSA advisory itself ships a local PoC curl loop that demonstrates the missing throttle.
Authenticated low-privileged users can read critical Product Quality Management data and partially degrade availability in Oracle Agile Product Lifecycle Management for Process 6.2.4 through network HTTP requests, but Oracle rates exploitation as difficult (CVSS 3.1 5.9, AC:H, PR:L). The flaw is confined to the Product Quality Management component and requires valid credentials, so it is a targeted, post-authentication risk rather than an anonymous attack surface. No public exploit code or confirmed active exploitation was identified in the provided intelligence at time of analysis.
Oracle JDeveloper 12.2.1.4.0 and 14.1.2.0.0 expose an ADF Databinding flaw that lets a low-privileged authenticated user reach critical data over the network via SOAP, with a secondary ability to cause a partial denial of service. Oracle rates the issue 'difficult to exploit' (AC:H), so success hinges on configuration or environmental conditions rather than a straightforward single request; integrity is unaffected, and the realistic risk is confidential-data disclosure by an insider or a compromised low-privilege account. No public exploit code was identified at time of analysis and the issue is not in CISA KEV, making this a moderate, lower-priority item for patch planning.
Unauthorized modification of critical data in Oracle Java SE's JGSS component affects Java SE 8u503, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, and 27, as well as GraalVM for JDK 17.0.20.1/21.0.12.1 and GraalVM Enterprise Edition 21.3.19.1.1, allowing a remote, unauthenticated attacker to alter data accessible through the JVM. The flaw is difficult to exploit (CVSS 3.1 base 5.9, AC:H) and requires an application or web service that supplies attacker-controlled network data to JGSS APIs; Oracle states it is not reachable through untrusted Java Web Start applications or applets. No public exploit identified at time of analysis and no CISA KEV active exploitation is confirmed, with impact limited to integrity and no confidentiality or availability effect.
Data modification in Oracle JDeveloper 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated network attackers to create, delete, or modify critical or all JDeveloper-accessible data through the Java Business Objects component over HTTP, but Oracle and the CVSS vector classify exploitation as difficult because of high attack complexity and preconditions outside attacker control. The flaw is integrity-only (CVSS 3.1 base 5.9; C:N/I:H/A:N) with no confidentiality or availability impact, and no public exploit code has been identified at time of analysis. Realistic exposure is limited because JDeveloper is a developer tool that is not typically internet-exposed in production.
A high-complexity integrity flaw in the Security component of Oracle Java SE (8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27), Oracle GraalVM for JDK (17.0.20.1, 21.0.12.1) and Oracle GraalVM Enterprise Edition (21.3.19.1.1) lets a remote attacker who can feed untrusted data into the affected Security APIs create, delete or modify critical data, though the attacker gains no data disclosure or denial of service (CVSS 3.1 5.9, AV:N/AC:H/PR:N/UI:N/C:N/I:H/A:N). The primary server-side path requires an application that passes externally supplied data into those APIs, such as a web service; a secondary path affects deployments that rely on the Java sandbox to run untrusted Java Web Start applications or applets. Exploitation is rated difficult (AC:H) and no public exploit code or KEV listing was reported at time of analysis, so the practical risk is concentrated in applications that expose the vulnerable Security APIs to attacker-controlled input.
Unauthenticated data tampering in Oracle REST Data Services (ORDS) versions 24.2.0 through 26.1.0 lets a remote attacker with HTTP access to an exposed instance create, delete, or modify critical application data, with no confidentiality or availability impact. Oracle rates the flaw 'difficult to exploit' (AC:H), so success depends on conditions outside the attacker's control such as request timing, backend data state, or environment specifics that the vendor has not detailed. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied; exposure is limited to ORDS deployments reachable over the network on their HTTP interface, particularly 26.1.0 and earlier releases lacking the October 2026 Critical Patch Update.
Unauthenticated network attackers can hang or repeatedly crash MySQL Server and MySQL Cluster by targeting the Server: Security: Encryption component, producing a complete denial of service against the database service. The flaw carries CVSS 3.1 base score 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) and affects MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1 plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Oracle characterizes the issue as difficult to exploit because attack complexity is high, meaning the attacker must satisfy server-side conditions outside their direct control (specific state, timing or race behavior) rather than sending a single deterministic request; there is no public exploit identified at time of analysis and the issue is not in CISA KEV. Impact is strictly availability - no confidentiality or integrity loss - so exposure is materially reduced for instances not reachable from untrusted networks.
Oracle Agile PLM 2.6 contains an authentication-bypass weakness in the Acollect component that can let a remote, unauthenticated attacker read critical or all PLM-accessible data over TLS, though exploitation is rated difficult because of high attack complexity. No public exploit or CISA KEV entry was identified at time of analysis, and exposure is limited to reachable deployments with the Acollect component enabled.
Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allow a remote, unauthenticated attacker to tamper with or delete critical portal data and to partially degrade service availability through a flaw in the Runtime Tools component reachable over HTTP. Exploitation is not straightforward: the CVSS vector (AC:H, UI:R) means preconditions outside the attacker's control must line up and a legitimate user other than the attacker must be induced to perform an action, which sharply limits opportunistic or automated mass exploitation, and there is no confidentiality impact. At time of analysis there is no public exploit identified, no CISA KEV listing, and no EPSS score supplied, so this is a moderate-severity (5.9) issue to schedule on a normal patch cycle rather than an emergency; Oracle's October 2026 Critical Patch Update advisory is the reference for remediation.
Oracle Order Management in Oracle E-Business Suite 12.2.3 through 12.2.15 can expose critical application data through a high-complexity authenticated flaw in its Product Diagnostic Tools component. A network attacker holding a low-privileged account can use HTTP to read critical data and make limited unauthorized updates, inserts, or deletions, but successful exploitation depends on conditions outside the attacker's direct control. No public exploit was identified at time of analysis, and no CISA KEV entry was provided.
An authenticated low-privileged user with HTTP access to the eProcurement component of Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 can manipulate or expose data the account should not control, chiefly through unauthorized creation, deletion, or modification of critical records, with a smaller confidentiality spill. Exploitation is rated difficult (AC:H) because success depends on application state or configuration outside the attacker's direct control, and the Argentina financial localization must actually be deployed - so this is a moderate-risk issue unlikely to be a top-priority emergency, with no public exploit identified at time of analysis. Integrity impact is the dominant concern (I:H) while availability is unaffected (A:N).
Data exposure and limited data modification in Oracle Siebel CRM's Email Marketing component can be triggered by unauthenticated network attackers, affecting Siebel Apps - Marketing versions 17.0 through 26.9. The CVSS 5.9 rating reflects high attack complexity and a requirement for victim interaction, so exploitation is opportunistic rather than reliably repeatable. No public exploit was identified at time of analysis, and this should be treated as a moderate-risk patching priority rather than an emergency.
Unauthorized read of critical data and limited data modification in Siebel Cloud Manager affect Oracle Siebel CRM Cloud Applications 22.3 through 26.9, exploitable by unauthenticated attackers positioned on the same physical network segment. The issue carries CVSS 3.1 base score 5.9 with an adjacent attack vector (AV:A) and high attack complexity (AC:H), so it is not reachable directly from the internet and requires defeating additional non-default or timing conditions before exploitation succeeds. No public exploit code or CISA KEV entry was identified at time of analysis, and Oracle's October 2026 Critical Patch Update advisory is the vendor remediation reference.
Unauthenticated adjacent-network attackers can create, delete, or modify critical data in Oracle Communications BRM - Elastic Charging Engine 15.x, plus read a limited subset of data, by reaching the physical or adjacent communication segment attached to the ECE hardware. The issue is medium severity (CVSS 5.9) with high attack complexity (AC:H), so success depends on timing or runtime conditions outside the attacker's control and Internet-based exploitation is not possible. Affected releases are 15.0.0.0.0, 15.0.1.0.0.0, 15.1.0.0.0, and 15.2.0.0.0; no public exploit identified at time of analysis, and Oracle's October 2026 Critical Patch Update is the reference advisory.