Authenticated path traversal in aaPanel through version 8.25.0 lets a logged-in panel user read files outside the intended download directory by manipulating the 'filename' argument of the send_file endpoint in BTPanel/routes/v2.py. Remote attackers who hold at least a low-privileged panel account can use ../ style sequences to escape the base path and disclose arbitrary files readable by the aaPanel web process, silently and without any user interaction. Publicly available exploit code exists (a dedicated GitHub PoC repository), and exploitation is gated by two real constraints: prior authentication and the operating-system permissions of the panel's service account.
Path traversal in DrayTek Vigor2960 1.5.1.6 Revision 8218 allows an authenticated low-privilege user to manipulate the setSWMProfile argument in /cgi-bin/mainfunction.cgi and reach files outside the intended directory. Publicly available exploit code exists, and the vendor states that 2960 firmware 1.5.1.7 corrected many security issues while noting the Vigor2960 is End-of-Service with limited support. The CVSS 4.0 score is 5.3 with Low confidentiality, integrity, and availability impact; risk increases where the web management interface is reachable from untrusted networks.
Improper authorization of custom URL schemes in Nerimity Desktop up to 2.2.2 allows unauthenticated remote attackers to pass attacker-controlled URLs to Electron's shell.openExternal through the Window Open Handler, and publicly available exploit code exists. Exploitation requires the victim to interact with attacker-supplied content and the host OS to have a registered handler for the abused scheme, which limits practical impact to medium severity. Upgrading to 2.3.3 restricts shell.openExternal to http/https URLs and resolves the flaw.
Authenticated command injection in the IPsec certificate-handling path of DrayTek Vigor2960 routers running firmware 1.5.1.6 Revision 8218 lets a low-privilege management user execute arbitrary OS commands on the device, fully compromising confidentiality, integrity and availability. Publicly available exploit code exists and maps directly to the flaw (DRV2960-0014), though no active exploitation is confirmed by CISA KEV. DrayTek has discontinued the Vigor2960 (EoS with limited support) and states it only reviews major issues such as unauthenticated flaws, making the availability of the 1.5.1.7 fix and a prompt upgrade the primary defense.
Authenticated path traversal in the End-of-Sale DrayTek Vigor2960 1.5.1.6 web management interface lets a low-privilege user manipulate the multipart field name processed by cgiEscape in /cgi-bin/mainfunction.cgi, enabling path traversal and file clobbering. The vendor fixed the issue in firmware 1.5.1.7, but public exploit code exists for the affected swmconfigupload component; exploitation still requires valid credentials and reachability to the management interface. No CISA KEV confirmation or EPSS score was included, so this should be treated as a moderate-priority authenticated issue rather than confirmed active exploitation.
Authenticated remote attackers can exploit an unrestricted file-upload flaw in DrayTek Vigor2960 firmware 1.5.1.6 Revision 8218 by manipulating the upload_path and upload_name parameters in the commonupload function of /cgi-bin/mainfunction.cgi, resulting in arbitrary file clobber on the device. Publicly available exploit code exists, but exploitation requires valid credentials and access to the web management interface, keeping the issue moderate-risk rather than an emergency. DrayTek addressed the flaw in firmware 1.5.1.7; because the Vigor2960 is end-of-sale with limited support, exposure is limited to units still running the vulnerable release.
Authenticated path traversal in DrayTek Vigor2960 firmware 1.5.1.6 (Revision 8218) lets a user with a valid web-management session manipulate the 'action' argument in the Apmupload component of /cgi-bin/mainfunction.cgi to traverse paths and potentially clobber targeted files, with low confidentiality, integrity, and availability impact. The issue is remotely reachable but requires authentication and network access to the management interface, and the vendor has fixed it in firmware 1.5.1.7; publicly available exploit code exists, while no CISA KEV active-exploitation confirmation was provided. Because the Vigor2960 is end-of-support and unpatched devices may persist, defenders should prioritize inventory and access restrictions, though the authentication prerequisite keeps risk low for most environments.
OS command injection in mcollina mcp-ripgrep through 0.4.0 lets a local, low-privilege user who can control the Advanced Search Tool's fileType argument run arbitrary shell commands with the MCP server's privileges. Publicly available exploit code exists, and the finding is disputed by the maintainer as documented shell-execution behavior; no CISA KEV active-exploitation confirmation is present. Real-world priority is low-to-moderate because the attack is strictly local and depends on untrusted input reaching fileType.
PHP code injection in Open Source Social Network (OSSN) through the dynamic cache settings handler at actions/administrator/cache/dynamic.php allows a site administrator to break out of the generated configuration template and write arbitrary PHP into ossn.config.dcache.php by supplying crafted host, port, username, password, type, or status values that are concatenated without escaping. Publicly available exploit code exists (a Gist linked from the CVE record), and the issue affects OSSN up to versions 9.11 and 10.1. Exploitation is gated behind a fully authenticated administrator account on a site where the dynamic cache feature is configured, and because OSSN administrators are by design trusted users who can already upload components and themes containing arbitrary PHP, the primitive grants no capability beyond what an admin already holds - the vendor frames the fix as defense-in-depth and real-world risk is correspondingly low.
Improperly exported Android components in LeeDrOiD Labs Shortcutter 2 App 9.0.48 let a second, attacker-controlled application installed on the same device drive the app's internal ToggleGeneric logic and pass an arbitrary class name into Class.forName, producing low-severity information disclosure plus limited integrity and availability impact confined to the device. The attack is strictly local - there is no network vector - and requires only the ordinary privileges of a co-installed app (CVSS PR:L), so the attacker must first convince the user to install a malicious package. Publicly available exploit code exists (VulDB disclosure with a linked proof-of-concept document), but there is no CISA KEV listing, and the vendor was contacted early and released a fixed build, 9.0.90.
Oracle Siebel CRM's Marketing component (Siebel Apps - Marketing, versions 17.0 through 26.9) allows a high-privileged attacker who can log on locally to the Siebel infrastructure to read and modify limited Marketing data and cause a partial denial of service. The CVSS 3.1 score is 3.9 with vector AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L; Oracle describes exploitation as difficult, and no public exploit code or confirmed active exploitation is identified in the supplied intelligence. Because local access and high privileges are prerequisites, realistic risk is concentrated among trusted insiders or attackers who have already compromised a privileged account on the host.
Limited unauthorized read/write access and partial denial of service in Oracle Siebel CRM Deployment 17.0 through 26.9 require an attacker to already hold high-privileged logon access to the infrastructure host running the Server Infrastructure component. The CVSS 3.9 vector (AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L) confirms a local, difficult-to-exploit path with low confidentiality, integrity, and availability impact, so practical risk is confined to privileged local operators or an adversary who has already compromised such an account. No public exploit identified at time of analysis; the vendor reference is Oracle's October 2026 Critical Patch Update advisory.
Local, already high-privileged users on servers running Oracle PeopleSoft Enterprise PeopleTools 8.61-8.63 can abuse the Business Interlink component to gain partial read access and partial insert/update/delete capability over PeopleTools data, plus a partial denial-of-service condition against the PeopleTools process itself. Exploitation is gated by several preconditions - an interactive logon to the host (AV:L), high privileges on that host (PR:H), and attack complexity Oracle characterizes as 'difficult to exploit' (AC:H) - so this is a limited post-compromise or insider-abuse scenario rather than a remotely reachable flaw. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; the 3.9 CVSS base score and the tightly capped Low/Low/Low impact reflect that an attacker must already control the underlying infrastructure to benefit.
PeopleSoft Enterprise CC Common Application Objects 9.2 exposes low-complexity HTTP functionality that lets an attacker who already holds a high-privileged account read and modify a limited subset of application data. Oracle's October 2026 CPU rates this CVSS 3.1 3.8 (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N); no public exploit identified at time of analysis and no CISA KEV confirmation. Realistic exposure is therefore malicious or compromised privileged insiders rather than unauthenticated remote attackers.
Denial of service in Oracle MySQL Cluster 8.0.0 through 8.0.37 can be triggered by an attacker who already has physical access to a cluster node and high-level privileges, causing a hang or repeatable crash in the InnoDB component. The high attack complexity and privileged, physical-access prerequisites make this a low-priority availability issue; only availability is impacted, with no confidentiality or integrity effect. No public exploit code or confirmed active exploitation was identified in the provided intelligence at time of analysis.
Oracle PeopleSoft Enterprise FIN Cash Management 9.2 (component: Cash Management) contains a low-severity flaw that lets an attacker who already holds a high-privileged account with logon access to the application server host tamper with, read, or partially disrupt Cash Management data. Because the vector is local (AV:L) with high attack complexity (AC:H), high privileges (PR:H), and a mandatory action by a separate human user (UI:R), successful exploitation yields only limited confidentiality, integrity, and availability impact (CVSS 3.1 base score 3.8). No public exploit code and no confirmed active exploitation were identified at time of analysis, so this is best treated as an insider-risk and patch-hygiene item rather than an external attack path.
Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 carries a low-severity flaw in the Data Mover component that lets an attacker who already holds high privileges and a valid logon on the PeopleTools host - and who can induce a second, different user to perform an action - read and modify a limited subset of PeopleSoft data and trigger a partial denial of service. Oracle's October 2026 Critical Patch Update scores it CVSS 3.1 3.8 (AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L) and explicitly calls it difficult to exploit, so realistic exposure is an insider or post-compromise scenario rather than opportunistic attack; no public exploit code or confirmed active exploitation was identified at time of analysis.
Partial denial of service in Oracle Helidon 4.0.0 through 4.5.5 can be triggered by an unauthenticated network attacker through the helidon-webserver-http2 component, but high attack complexity and availability-only impact make this a low-priority issue. The CVSS 3.1 score is 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L), meaning degraded rather than total availability and no confidentiality or integrity loss. No public exploit identified at time of analysis and no CISA KEV confirmation was present in the supplied intelligence.
Unauthenticated remote attackers can cause a partial denial of service in the Email Marketing component of Oracle Siebel Apps - Marketing (supported releases 17.0 through 26.9) by sending crafted HTTP requests, though Oracle rates exploitation as difficult (AC:H) and the impact is confined to availability of the Marketing application (C:N/I:N/A:L, S:U). With a CVSS 3.1 base score of 3.7 and no public exploit identified at time of analysis, this is a low-priority availability issue rather than a data-compromise or takeover risk.
Unauthenticated modification and deletion of other users' notifications is possible in ApostropheCMS versions prior to 4.33.0, because the notification module's PATCH and DELETE REST endpoints act directly on the underlying MongoDB collection without verifying that the requester is authenticated or that they own the target document. The practical barrier is knowledge of a valid notification ID: these are MongoDB ObjectIds, so they are not readily enumerable, which is why the vector carries AC:H despite PR:N and UI:N. Impact is limited to integrity of notification records (no confidentiality exposure and no availability impact), and no public exploit code has been identified at time of analysis; the issue is fixed in 4.33.0.
IBM Cyber Fraud versions 1.0.0 through 1.0.2 issue session cookies without the Secure attribute, so a remote, unauthenticated attacker who already sits in a man-in-the-middle position on the network path can capture session data whenever the application is reached over plain HTTP (CVSS 3.7, AC:H, low confidentiality impact only). The flaw does not bypass authentication or grant direct access; it only widens exposure of cookies that are transmitted unencrypted. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and deployments that enforce HTTPS/HSTS end-to-end largely neutralize the issue.
Unauthorized read access to a subset of data in Oracle Essbase 21.8.3.0.0 is possible for unauthenticated network attackers through the Java Based Agent over HTTP, but the high attack complexity makes successful exploitation difficult. This is a low-priority, confidentiality-only issue with no integrity or availability impact and no public exploit identified at time of analysis.
Partial denial of service in Oracle Java SE 27's Networking component can be triggered by unauthenticated remote attackers who can reach an exposed Java API and supply crafted network data; the CVSS 3.1 score is 3.7 with AC:H and only A:L, so successful exploitation is difficult and produces limited, recoverable availability impact. The flaw also matters for deployments that run untrusted code in the Java sandbox, such as Java Web Start applications or applets. No public exploit was identified at time of analysis and there is no CISA KEV confirmation.
Oracle Siebel CRM's Open UI component (End User product, versions 17.0 through 26.9) permits unauthenticated remote attackers with HTTP access to read a limited subset of application data, with no integrity or availability impact. Exploitation is rated high complexity (AC:H), meaning success hinges on specific conditions Oracle has not disclosed, so reliable attacks are difficult. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and the CVSS 3.1 base score of 3.7 reflects the narrow confidentiality-only exposure.
Siebel Cloud Manager, the management component of Oracle Siebel CRM Cloud Applications versions 22.3 through 26.9, can be reached over HTTP by an unauthenticated attacker and, under difficult-to-satisfy conditions, disclose a limited subset of application data. The CVSS 3.1 score is 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N), with no integrity or availability impact and no public exploit code or CISA KEV confirmation identified at time of analysis. Because exploitation depends on conditions outside the attacker's control and only read access is exposed, signals converge on low real-world priority despite network reachability; Oracle's October 2026 CPU advisory is the reference for fixes.
Unauthenticated read access to a subset of PeopleSoft Enterprise PeopleTools data is exposed through the Report Distribution component in versions 8.61 through 8.63, reachable over HTTP, but Oracle characterizes exploitation as difficult (AC:H) and scores the issue only 3.7. No user interaction is required per the CVSS vector, and the impact is confidentiality-only with no integrity or availability effect. No public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was supplied.
Unauthorized read access to a limited subset of Java SE-accessible data is exposed in Oracle Java SE 25.0.4.1 and 27 through the Compiler component when attacker-controlled data is supplied to its APIs, such as through a web service that feeds external input into the compiler. The vector is network-reachable and requires no authentication or user interaction, but Oracle rates attack complexity as high and impact as confidentiality-only and low (CVSS 3.1 base 3.7); no public exploit was identified at time of analysis and no KEV entry is associated.
PeopleSoft Enterprise PeopleTools 8.61 through 8.63 contains a confidentiality-only weakness in its Tuxedo component that can let an unauthenticated remote attacker read a subset of PeopleTools-accessible data over HTTP. Exploitation is rated difficult because of High attack complexity, requiring attacker conditions beyond their control such as a race or transient server state, and the assessed impact is limited to partial information disclosure with no integrity or availability effect. This is a low-severity issue (CVSS 3.1 base 3.7); no public exploit identified at time of analysis and no CISA KEV entry is present in the supplied data, so it should be treated as low priority, especially where the PeopleTools/Tuxedo layer is not exposed to untrusted networks.
Unauthenticated network attackers can read a limited subset of Marketing data in Oracle Siebel CRM 17.0 through 26.9, but exploitation is rated high-complexity and Oracle describes it as difficult. CVSS 3.1 is 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N), so confidentiality only and no integrity or availability impact; no public exploit was identified at time of analysis.
Oracle REST Data Services (Core component) versions 24.2.0 through 26.1.0 expose an HTTP-reachable path that lets an unauthenticated, remote attacker read a limited subset of data the service can access, with no integrity or availability impact. The vendor rates exploitation as difficult (AC:H), meaning success hinges on conditions outside the attacker's full control such as request state, timing, or specific deployment configuration, which sharply limits reliable real-world abuse; the resulting CVSS 3.1 base score is 3.7 (low). No public exploit code or confirmed active exploitation was identified at time of analysis, and an EPSS score was not supplied, so the practical risk is dominated by exposure of ORDS endpoints rather than by known attack tooling. Affected deployments should still be prioritized for the October 2026 Oracle Critical Patch Update because the flaw is network-reachable and requires no credentials.
Serialization and normalization in the Node.js fast-uri library can emit a relative reference containing an unescaped bare colon in its first path segment, so a string that was inert on input re-parses as an absolute URI with a scheme - including javascript:, data:, or vbscript: - when the caller opts into the non-default `reference: suffix` mode. Applications on fast-uri before 2.4.8, 3.0.0 through 3.1.8, and 4.0.0 through 4.2.2 that pass untrusted relative references through serialize(), normalize(), or resolve() with that option and then render or follow the result inherit a cross-site scripting vector; the library's equal() comparison can likewise conflate a scheme-bearing reference with a relative one. The default configuration is unaffected, the attacker-controlled preconditions make this high-complexity (CVSS 3.1 base 3.7, AC:H, PR:N, impact limited to integrity), and no public exploit has been identified at time of analysis.
A partial denial of service can be triggered in Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 through the BI Search component, which is reachable over HTTP by an unauthenticated network attacker (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I/A:L, base score 3.7). Oracle characterizes the flaw as 'difficult to exploit,' meaning success depends on server-side conditions outside the attacker's direct control, and the only consequence is reduced availability of the BI service - there is no confidentiality or integrity impact. At time of analysis there is no public exploit identified, no CISA KEV listing, and no EPSS signal provided, so this is a low-priority availability nuisance rather than a realistic attack path; remediation is nonetheless available through Oracle's October 2026 Critical Patch Update advisory.
A hard-to-exploit integrity flaw in the 2D component of Oracle Java SE 8u503 and 8u503-perf, and Oracle GraalVM Enterprise Edition 21.3.19.1.1, allows an unauthenticated network attacker to make limited unauthorized modifications to data accessible to the Java runtime. Exploitation is not straightforward: it requires attacker-controlled data to reach the affected 2D APIs - typically through an application or web service that passes external input into graphics/2D routines, or through sandboxed Web Start applications and applets that load untrusted code - and success depends on conditions outside the attacker's control (AC:H). No public exploit code or confirmed active exploitation was identified at time of analysis, and impact is confined to limited integrity change with no confidentiality or availability effect (CVSS 3.7), so real-world priority is low.
Oracle Java SE 21.0.12.1, 25.0.4.1, and 27 contain an integrity-only flaw in the Security component that remote attackers can reach through multiple protocols, potentially causing limited unauthorized update, insert, or delete access to some accessible data. Exploitation is difficult because high attack complexity requires conditions outside the attacker's control, and successful attacks do not affect confidentiality or availability. No public exploit code or CISA KEV entry was identified at time of analysis, making this a low-severity issue despite the ubiquitous product.
Unauthenticated network attackers can make limited unauthorized data changes in Oracle PeopleSoft Enterprise SCM Manufacturing 9.2 through an HTTP-reachable security flaw, but exploitation is difficult because it depends on high-complexity conditions outside the attacker's control. The impact is integrity-only, with no confidentiality or availability effect, and no public exploit was identified at time of analysis. Oracle's October 2026 Critical Patch Update advisory is the reference for fixes, and exposure is lower where the SCM Manufacturing HTTP interface is not reachable from untrusted networks.
Unauthorized modification of HR data in Oracle JD Edwards EnterpriseOne Human Resources Management 9.2 is possible for unauthenticated remote attackers over HTTP, but only under high-complexity conditions and with limited integrity impact (CVSS 3.1 base score 3.7). The vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) shows no confidentiality or availability loss, and no public exploit code or confirmed active exploitation was identified at time of analysis. Practical risk is genuinely low-priority, particularly because JD Edwards HR deployments are usually segmented from the public internet.
Unauthorized data modification in Oracle Java SE and GraalVM JAXP can be triggered by unauthenticated network attackers who can supply data to the affected XML APIs, though Oracle rates exploitation as difficult (AC:H). Affected releases include Java SE 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, and 27, plus GraalVM for JDK 17.0.20.1 and 21.0.12.1 and GraalVM Enterprise Edition 21.3.19.1.1. Impact is limited to partial integrity with no confidentiality or availability effect; no public exploit identified at time of analysis, and practical exposure is narrow because the classic sandboxed applet/Web Start path is largely deprecated.
Unauthenticated remote attackers can make limited unauthorized inserts, updates, or deletes against data exposed through the Portal component of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63, reachable over HTTP. The severity is genuinely low: the CVSS 3.1 base score is 3.7 because Oracle explicitly rates the flaw 'difficult to exploit' (AC:H), meaning success hinges on a condition such as specific server state or precise timing that the attacker cannot directly control, and the impact is capped at partial integrity loss with no confidentiality or availability effect. No public exploit code was identified at time of analysis and the CVE is not listed in CISA KEV, so there is no confirmed active exploitation; the practical risk is further bounded by the combination of high attack complexity and the absence of any disclosure or denial-of-service component. No EPSS score was supplied with the intelligence, reinforcing that prioritization should be driven by asset exposure rather than threat activity.
A limited-integrity flaw in the Networking component of Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition allows a remote, unauthenticated attacker to make unauthorized updates, inserts, or deletions to some data, provided they can supply malicious input to the affected networking APIs. Oracle rates exploitation as difficult (CVSS AC:H, 3.7 base score), with no confidentiality or availability impact; the realistic exposure paths are web services that pass attacker-controlled data into these APIs and sandboxed Java Web Start/applet deployments running untrusted internet code. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV, so it is a low-priority patch item rather than an emergency.
Integrity-only data modification in Oracle Java SE's JSSE TLS component can be triggered by unauthenticated network attackers who can supply data to affected TLS-processing APIs, although exploitation is rated difficult and limited to low-integrity impact. Affected deployments include Java SE 8u503/8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, and 27, along with GraalVM for JDK 17.0.20.1/21.0.12.1 and GraalVM Enterprise Edition 21.3.19.1.1; the 3.7 CVSS score and lack of public exploit code make this a low-priority issue, with client-side risk concentrated in sandboxed Java Web Start and applet deployments.
Unauthenticated network attackers can achieve limited unauthorized update, insert, or delete access to data in Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 by targeting the Application Server - JRE component over SSH, but Oracle rates exploitation as difficult (AC:H). The issue is low severity (CVSS 3.7) with integrity-only impact and no confidentiality or availability effect; no public exploit code or CISA KEV active exploitation is identified in the provided data.
Path-relative references are silently rewritten as root-relative in fast-uri before 2.4.8, in 3.0.0 through 3.1.8, and in 4.0.0 through 4.2.2, because normalize() and serialize() apply RFC 3986 dot-segment removal to a relative reference's path even though that algorithm is only defined for the merged target path during resolution. An unauthenticated remote attacker who can influence a reference that a consuming application normalizes and then resolves - or stores as a cache, deduplication, or authorization key - can cause that reference to escape its intended directory and designate a different resource, yielding a limited integrity impact; attack complexity is high because the vulnerable normalize-before-resolve usage pattern must exist in the host application. No public exploit identified at time of analysis, and no KEV listing.
Remote, unauthenticated read access to a limited subset of diagnostic data in Oracle Fusion Middleware Common Libraries and Tools 12.2.1.4.0 and 14.1.1.0.0 is possible through the Remote Diagnostic Agent over HTTP, but exploitation is difficult (AC:H) and depends on conditions outside the attacker's control. Oracle's October 2026 CPU assigns a low CVSS 3.1 base score of 3.7 with confidentiality-only impact (C:L), and no public exploit code or confirmed active exploitation has been identified at time of analysis. Real-world risk is substantially lower where diagnostic and management endpoints are not exposed to untrusted networks.
ImageIO in Oracle Java SE (including 8u503, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, and 27) and related GraalVM releases can expose a limited subset of process-accessible data when attacker-controlled image content is decoded through the affected component. The CVSS vector describes a network-reachable, unauthenticated issue (PR:N) but with high attack complexity and only low confidentiality impact; there is no integrity or availability effect. No public exploit was identified at time of analysis, and practical risk is concentrated in services or sandboxed Java deployments that actually pass untrusted images to ImageIO.
Limited data exposure in Oracle Helidon 4.0.0 through 4.5.5 occurs in the Long Running Actions (LRA) coordinator when a network-reachable LRA HTTP endpoint is targeted, allowing an unauthenticated remote attacker to read a subset of Helidon-accessible data. The CVSS 3.1 score is 3.7 because attack complexity is high and only confidentiality is affected; there is no integrity, availability, or scope impact. No public exploit code or CISA KEV entry has been identified at time of analysis.
Unauthenticated HTTP access to PeopleSoft Enterprise CC Common Application Objects 9.2 can allow limited unauthorized update, insert, or delete operations within the BAM Framework component, but only when high-complexity preconditions are satisfied. The issue carries a CVSS 3.1 score of 3.7 with integrity-only impact and no confidentiality or availability effect; no public exploit identified at time of analysis, and there is no CISA KEV confirmation.
Low-impact integrity modification in Oracle Java SE's JSSE component is possible when an unauthenticated remote attacker can feed crafted data into TLS-handling APIs, but exploitation requires high-complexity, hard-to-control conditions and affects only limited accessible data. The affected releases span Java SE 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, and 27, plus GraalVM for JDK 17.0.20.1/21.0.12.1 and GraalVM Enterprise Edition 21.3.19.1.1. No public exploit identified at time of analysis, and the CVSS 3.1 score is 3.7 with no confidentiality or availability impact.
Unauthorized update, insert, or delete access to some Oracle Siebel CRM End User data is possible through the Open UI component in versions 17.0 through 26.9. The issue is network-reachable over HTTP and requires no credentials or user interaction, but Oracle characterizes it as difficult to exploit because of high attack complexity; impact is integrity-only with a CVSS 3.1 base score of 3.7 and no confidentiality or availability effect. No public exploit code was identified at time of analysis.
sanitize-html 2.17.7 and later before 2.18.0 can bypass SMIL URL protection when an application opts into a non-default allow-list that permits namespace-prefixed SVG animation elements plus URL-targeting attributes. The prefixed animation tags do not match the library's unprefixed animation-element check, so a sanitized SVG can rewrite a link destination to an unsafe URI and execute script if a user activates that link. The default configuration is not unconditionally affected, exploitation requires content-submission access and a victim click, and the issue is fixed in sanitize-html 2.18.0; no public exploit code was identified at time of analysis.
Local, high-complexity access-control weakness tagged as an authentication bypass in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager) 22.3 through 26.9 lets a low-privileged user who already has host logon read and modify a subset of application data. The CVSS 3.1 score is only 3.6 because the attack is strictly local, difficult to execute, and limited to partial confidentiality and integrity impact with no availability effect. No public exploit was identified at time of analysis, and successful exploitation requires prior authenticated access to the infrastructure where Siebel Cloud Manager runs.