Cross-tenant container access in LangAlpha through 2026.09.07 allows an authenticated tenant who can execute code inside their own sandbox container to reach peer tenants' containers over Docker's shared default bridge network and read sensitive data such as vault secrets. Because inter-container communication is enabled by default and every tenant sandbox sits on that same bridge, the platform's require_workspace_owner authorization checks are effectively bypassed for traffic originating from a sibling container. Publicly available exploit code exists and the flaw is tracked as CWE-653 (Improper Isolation or Compartmentalization); exploitation requires a multi-tenant deployment, prior code execution in one's own sandbox (PR:L), and a co-tenant running an exposed, network-listening service that holds secrets, so this is best treated as a medium-priority, conditional isolation defect rather than an emergency.
aaPanel through 8.25.0 derives the client IP in GetClientIp (class/public/common.py) from the attacker-controllable X-Real-Ip request header, allowing remote unauthenticated attackers to spoof their source address and slip past IP-based access restrictions or poison IP-based logging. The impact is bounded - confidentiality-only at low severity per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) - and only materializes where IP allowlisting is actually used as a security boundary and no trusted proxy strips or rewrites the header. Publicly available exploit code exists (a GitHub PoC targeting the X-Real-Ip bypass), and the vendor states the issue has already been fixed.
A crafted AC-4 audio bitstream can crash GPAC's media tools and libraries before release 2.5, giving a local attacker a denial-of-service condition against MP4Box or any GPAC-based application that parses untrusted media. The flaw is an out-of-bounds / memory-safety defect (CWE-119) in gf_ac4_parser_bs() in media_tools/av_parsers.c, where sampling-frequency, frame-rate and substream-group indexes are used without sufficient validation; impact per the assessed CVSS:3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) is availability-only, with no disclosure or code execution established. It is not listed in CISA KEV, EPSS is low at roughly 0.23% (13th percentile), and a public PoC reference exists but is not verified as working exploit code; no authentication is required, but the attack is local and needs the victim to open or process the malicious file.
Denial of service in GPAC MP4Box before 2.5 occurs when a crafted MP4 file drives the reframer path to a floating-point exception, crashing the process. The issue is local-only (AV:L), requires the victim to open or process the file (UI:R), and affects availability only; environments that ingest untrusted MP4s, such as transcoding or upload pipelines, are the relevant exposure. A public PoC reference exists; it is not verified as working exploit code, no CISA KEV status is indicated, and EPSS is low at 0.20% (9th percentile), so priority is this_month rather than emergency.
Denial of service in GPAC MP4Box before 2.5 occurs when a user locally processes a crafted data file, triggering an out-of-bounds read and process crash in gf_props_equal_internal. The vector is local and requires user interaction; there is no remote or network-facing trigger and no code execution or data disclosure is established by the available data. The issue is moderate and low priority rather than an emergency; a public PoC reference exists, it is not verified as working exploit code, and EPSS is low at 0.20%.
Unauthenticated attackers can forge Embedded Console session tokens against MinIO deployments built up to RELEASE.2025-10-15T17-29-55Z because the globalDeploymentID/SessionTokenAuthenticate path in cmd/common-main.go signs and validates those tokens with a hard-coded cryptographic key. Per the assessed vector (PR:N/UI:N) no credentials or user interaction are required, and the disclosed proof-of-concept demonstrates an unauthenticated admin takeover rather than mere information disclosure. Publicly available exploit code exists (linked from the VulDB entry), no CISA KEV listing is present, and the maintainer states the affected branch is end-of-life, so only unsupported installations with a network-reachable console are exposed.
Unauthenticated information disclosure in the Easy Property Listings WordPress plugin before 3.5.28 causes listing fields that site owners intentionally hide from the public front end - asking price, sold price, street address and exact map coordinates - to still be returned in the plugin's public REST API output. Any remote visitor can query that REST output without credentials or user interaction and read values the site chose to suppress, though only the configured-as-hidden fields of published listings are exposed; there is no write, authentication-bypass or code-execution impact. Publicly available exploit code exists and the WPScan team is credited with the report, but EPSS is low at 0.18% (8th percentile) and there is no CISA KEV confirmation of active exploitation, so this is a low-to-moderate priority issue principally relevant to sites that deliberately conceal price or address data.
An authorization bypass (IDOR) in EspoCRM's PDF rendering pipeline lets an authenticated low-privilege user read attachments they should not be able to access by supplying an arbitrary attachment ID as the image source of a PDF template. Affected versions are EspoCRM up to 9.3.10 and 10.0.10; the flaw resides in ImageSourceProvider::get (application/Espo/Tools/Pdf/Dompdf/ImageSourceProvider.php) and is reached simply by rendering a template to PDF. Impact is limited to confidentiality of attachment data (CVSS 5.3, PR:L, no victim interaction), publicly available exploit code exists, and there is no indication of active exploitation in the wild.
Memory corruption in the PEAK-System PCAN Windows CAN device drivers allows local low-privileged attackers to overflow a fixed-size stack buffer by delivering a crafted record whose DLC field exceeds 0x0f, which the parser uses unchecked to index a length table before copying attacker-controlled data from record+0x1c. Exploitation gives high integrity and availability impact (arbitrary stack memory corruption, likely crash or controlled writes) but no confidentiality impact, and it requires local access with low privileges and no user interaction. No public exploit code or confirmed active exploitation was identified at time of analysis.
PEAK-System PCAN Windows CAN device drivers and the PEAK-System Device Driver Setup package contain an output-buffer validation flaw in the PCAN diagnostic call, where the driver writes its diagnostic output record without confirming the caller-supplied buffer is large enough. A local user with existing privileges who can reach the driver interface and supplies an undersized buffer can trigger memory corruption that crashes the driver or service, degrading availability; there is no disclosed path to code execution, data disclosure, or integrity loss. The CISA ICS advisory (ICSA-26-293-01) covers this issue, no public exploit code or confirmed active exploitation was identified at time of analysis, and the flaw carries a moderate EPSS-style risk profile given its local attack vector and privileges required.
Local denial of service in the PEAK-System PCAN Windows CAN device driver can be triggered when a record list contains a malformed record: although the parser rejects the record, the processing loop still advances its processed-bytes counter, desynchronizing parsing and producing an out-of-bounds write (CWE-787). The issue affects PEAK-System Device Driver Setup and PCAN Windows CAN device drivers distributed through HMS Networks, and exploitation requires local access with low privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). No public exploit was identified at time of analysis, and there is no CISA KEV confirmation; the assessed impact is availability loss, such as a driver or system crash, rather than code execution or data compromise.
Local denial-of-service in PEAK-System PCAN Windows CAN device drivers and Device Driver Setup packages allows a low-privileged local user who can open the driver device to supply a receive-record count exceeding the caller-supplied output buffer length, causing an insufficiently bounded copy and potentially crashing the driver or system. The flaw is local only (AV:L) and affects Windows hosts with the PEAK PCAN driver installed; no public exploit was identified at time of analysis, and the assessed impact is availability only, with no confirmed confidentiality or integrity impact.
Locally exploitable denial-of-service in PEAK-System PCAN Windows CAN device drivers can crash the driver or system when a crafted type 0x4030 processing path selects or returns an object pointer that is dereferenced without validation. Affected systems are Windows hosts running the PEAK-System PCAN Windows CAN device drivers or PEAK-System Device Driver Setup, and exploitation requires local access plus low-level privileges (CVSS 5.5, AV:L/PR:L/UI:N, A:H). No public exploit was identified at time of analysis and no KEV confirmation is present in the provided data; the expected impact is availability loss, not remote compromise or confirmed data theft.
Easy Property Listings before 3.5.27 exposes CRM contact, lead, and private activity-note data to any authenticated WordPress user with a role as low as subscriber because several contact-management read AJAX actions omit authorization checks. An attacker who can obtain or self-register a subscriber account can query those actions remotely without victim interaction, resulting in read-only information disclosure rather than modification or denial of service. Publicly available exploit code exists, but EPSS is low at 0.14% (3rd percentile), and no CISA KEV active-exploitation flag is present in the supplied data.
Server-side request forgery in a2a-rs 0.4.0 through 0.4.3 lets unauthenticated remote clients steer the A2A server's push-notification sender at arbitrary destinations - loopback (127.0.0.1/::1/localhost), RFC 1918 and IPv6 ULA private ranges, link-local and multicast addresses, cloud metadata endpoints such as 169.254.169.254 and metadata.google.internal, or non-HTTP schemes - by submitting a crafted TaskPushNotificationConfig. The CNA rates it 6.9, and exploitation is conditional on push notifications actually being enabled via with_push_notifications, with the SSRF being effectively blind because the outbound webhook response is not reflected back to the attacker. An upstream fix exists as commit 2ba50176 (PR #124); no public exploit code or CISA KEV entry was identified at time of analysis.
Heap memory disclosure in Advantech ADAM-3600 industrial remote terminal units lets remote attackers read beyond the bounds of allocated heap buffers and exfiltrate whatever sensitive data resides in adjacent memory. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:L only) indicates the flaw is reachable over the network without authentication or user interaction against an exposed device, but impact is confined to confidentiality - no integrity or availability effect. No public exploit code and no confirmed active exploitation were identified at time of analysis; realistic risk is governed less by the software flaw than by whether the RTU is reachable from an untrusted network, since these OT devices are normally shielded by ICS segmentation.
Server-side request forgery in the TYPO3 extension Kitodo.Presentation allows unauthenticated remote attackers to make the web server issue arbitrary HTTP requests through the extension's public URL-fetching proxy endpoint, because one HTTP request method skips the authorization check that guards the other methods. The attacker controls the target URL and receives back the resulting status code and a limited set of response headers, which is enough to probe internal hosts and ports and map reachable services, though response bodies are explicitly not returned. Scored 6.9 under CVSS 4.0 (AV:N/AC:L/AT:N/PR:N/UI:N, with only low confidentiality impact), the flaw is trivially triggerable by remote attackers who can reach the endpoint; no public exploit code or confirmed active exploitation was identified at time of analysis.
CAPTCHA bypass in the TYPO3 accessible_form_captcha extension allows automated clients to defeat the challenge by extracting the correct answer from the CAPTCHA image data, because the audio accessibility feature that embeds the answer is enabled by default. Any TYPO3 form that relies on this extension as its sole anti-automation control is exposed to bot-driven abuse; impact is limited to integrity of the CAPTCHA check (no data disclosure or service disruption), and no public exploit code was identified at time of analysis. The flaw is rated moderate severity (CVSS 3.1: 6.9, AV:N/AC:L/PR:N/UI:N with I:L only).
The coding.ms 'typo3_shop' extension for TYPO3 lets any unauthenticated site visitor force orders that are still awaiting payment into the 'canceled' state by supplying an order identifier to the cancellation function, which performs no ownership check (CWE-862, IDOR-style missing authorization, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). The exposure is conditional on the site publishing a page that hosts the shop's order/cancellation plugin - without that reachable plugin the endpoint cannot be invoked - and already-paid orders are explicitly unaffected, so impact is confined to integrity of pending, unpaid transactions that the attacker can enumerate or guess. No public exploit code was identified at time of analysis and the issue is not in CISA KEV, so exploitation would be opportunistic rather than confirmed in the wild; successful abuse is a low-complexity, unauthenticated nuisance/fraud vector that can disrupt live storefronts by silently invalidating unpaid checkouts.
Unauthenticated attackers can overwrite the stored PayPal payment notification for an unpaid order on TYPO3 sites running the coding.ms shop extension when a page exposes the shop's order plugin. The endpoint accepts notification data without verifying its origin, so the impact is limited to integrity of the notification content for orders still awaiting payment; paid orders are unaffected, and confidentiality and availability are not impacted. No public exploit code or CISA KEV entry was identified in the provided data at time of analysis.
Deleted Outline administrators keep receiving the contents of workspace documents through webhook subscriptions their accounts created, because account deletion never disables those subscriptions. In Outline releases before 1.8.0, a privileged user who registered a WebhookSubscription pointing at an endpoint they control continues to receive DeliverWebhookTask payloads - including full document Markdown bodies and Yjs collaborative state - for every matching workspace event after the account is permanently removed, and this requires prior administrator-level privileges (PR:H in both the CVSS 4.0 and assessed CVSS 3.1 vectors) plus the webhook having been created before deletion. Confidentiality impact is high while integrity and availability are unaffected, making this a bounded post-offboarding data-exposure issue rather than an unauthenticated entry point, and no public exploit code was identified at time of analysis.
Error-message information disclosure in the a2a-rs Rust agent-to-agent server (a2a-server component) versions 0.4.0 through 0.4.3 lets remote, unauthenticated clients learn internal server detail when the framework returns raw diagnostic text in INTERNAL_ERROR responses. The leak surfaces only when the server itself faults - ProtoJSON stream serialization failures, HttpPushSender errors, extended-agent-card handler faults, or broadcast subscription lag - where pre-patch code passed the underlying detail (the project's own tests use a leaked filesystem path such as /etc/server/keys.pem as the example) straight to the caller instead of a generic message. Impact is limited to low-sensitivity diagnostic and implementation detail, not guaranteed credentials or user data, and no public exploit was identified at time of analysis; the issue is fixed by the sanitized_internal_error refactor in commit 713b943af94ab2d521d483b841618b97a2e78a4d (PR #127).
Payment bypass in the x402 Sign-In-With-X (SIWX) server extension lets a client that has paid for one cheap protected route unlock a more expensive route by supplying a mismatched PaymentPayload.resource URL and then reusing only its SIGN-IN-WITH-X header for repeat access. The flaw spans three implementations of the same extension - the npm package @x402/extensions 2.3.1 through 2.28.0, the x402 PyPI package 2.11.0 through 2.25.0, and the Go module github.com/x402-foundation/x402/go/v2 2.16.0 through 2.28.0 - and only manifests when at least two SIWX-protected routes exist at different price points. Exploitation is not anonymous: the attacker must complete a genuine payment for the cheapest route and hold a valid SIWX session, and no public exploit code or confirmed active exploitation was identified at time of analysis; an upstream fix exists in pull request #3840.
Unauthenticated remote attackers can crash the bulk port configuration service on Advantech ADAM-3600 edge controllers, causing a limited denial-of-service condition with no confidentiality or integrity impact. The flaw is network-reachable and requires no user interaction, but practical risk depends on whether the device's configuration service is exposed beyond properly segmented ICS/OT networks. No public exploit code has been identified at time of analysis, and the issue is availability-only rather than remote code execution.
Denial of service in Advantech ADAM-3600's license manager service allows unauthenticated network attackers to crash the service by triggering an integer overflow. The CVSS 4.0 score of 6.9 reflects network reachability with low availability impact only-no confidentiality or integrity effect-and no public exploit code or CISA KEV entry was identified at time of analysis. Because ADAM-3600 is an industrial RTU typically placed on segmented OT/field networks, realistic exploitation depends on attacker access to a connected control network or poor segmentation.
Unauthenticated remote attackers who can reach the Advantech ADAM-3600 license manager RPC service can crash it by sending a crafted message with msglen set to 0, triggering a NULL pointer dereference in rpc_rx_fsm. The flaw affects ADAM-3600 industrial RTUs and is availability-only, with no code execution, data disclosure, or integrity impact; no public exploit identified at time of analysis. Because the device is typically deployed on segmented ICS/OT networks, exposure is usually limited, making this a medium-severity denial-of-service issue rather than a critical compromise vector.
Unauthenticated remote attackers can crash the license manager service on Advantech ADAM-3600 by sending crafted RPC messages that trigger a NULL pointer dereference in the rpc_rx_fsm function, causing an availability-only denial of service. The provided CVSS 4.0 score is 6.9, while the assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, reinforcing that confidentiality and integrity are not affected. No public exploit was identified at time of analysis, and practical risk depends on whether the device's license manager RPC service is reachable from untrusted networks.
Denial of service in Advantech ADAM-3600 can be triggered by an unauthenticated remote attacker who opens and then disconnects a connection to the license manager service, invoking the on_disconnected callback and causing a NULL pointer dereference that crashes the service. The supplied CVSS 4.0 score is 6.9 (AV:N/AC:L/PR:N/UI:N/VA:L), and the independent assessment rates availability impact as Low with no confidentiality or integrity impact; this is a moderate-severity availability issue rather than a code-execution or data-access flaw. No public exploit identified at time of analysis.
FacturaScripts 2025.61 can disclose valid usernames through observable differences in login responses, such as error-message text, HTTP status codes, or response timing. This is a low-to-moderate information-disclosure issue: it does not grant access or code execution by itself, but it can feed targeted brute-force, password-spraying, credential-stuffing, or social-engineering attempts. No public exploit was identified at time of analysis, and the vendor has released a patch according to the INCIBE advisory.
Oracle WebCenter Content 14.1.2.0.0 allows unauthenticated network attackers to access critical data and make limited unauthorized changes through HTTP if they can induce a victim to perform a crafted action. The CVSS 3.1 score is 6.9 (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N), and no public exploit was identified at time of analysis. Mandatory user interaction and high attack complexity constrain reliable exploitation, but the scope change means connected products and trust relationships may also be affected.
Siebel CRM Integration versions 17.0 through 26.9 contain an EAI HTTP-facing weakness that lets an unauthenticated remote attacker, provided a legitimate user is induced to interact and other high-complexity conditions align, obtain scope-changing access to critical integration data and limited ability to modify it. The assessed CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N (6.9), reflecting mandatory victim interaction and high attack complexity rather than an easily repeatable default exploit. No public exploit was identified at time of analysis, and there is no CISA KEV confirmation of active exploitation.
Stored cross-site scripting (CWE-79) in FacturaScripts 2025.61 lets authenticated low-privilege users inject JavaScript through the 'city' and 'province' fields handled by the ListAlmacen endpoint, with execution occurring when another user-realistically an administrator-views the affected warehouse listing. Successful exploitation can steal session/CSRF material even when cookies are HttpOnly, or enable privilege escalation from a normal user to administrator; however, the attack is conditional on victim interaction and warehouse-edit access, and no public exploit code was identified at time of analysis. The vendor reports a patch, and the issue is rated moderate severity (CVSS 4.0: 6.9).
Oracle REST Data Services versions 24.2.0 through 26.1.0 expose an unauthenticated HTTP attack path in the Core component that, when a legitimate user is induced to interact with attacker-supplied content, can bypass authentication and permit unauthorized creation, deletion, or modification of critical data plus limited read access; the scope change means impact may extend to integrated products beyond ORDS itself. Exploitation is high-complexity and user-interaction-dependent (AC:H/UI:R), has no availability impact, and no public exploit identified at time of analysis.
Atsumi Electric ADX-series DVRs expose hidden firmware-upgrade functionality that lets an authenticated administrator load unauthorized firmware, compromising device integrity while leaving confidentiality and availability unaffected. The issue affects ADX5004, ADX5008, ADX404, ADX3004, ADX3008, ADX3016, ADX204, ADX1004, ADX1008, and ADX2016 devices and requires a valid administrator login over the network (CVSS 4.9). No public exploit was identified at time of analysis, and the main risk is exposure of weakly protected or internet-facing management interfaces.
Unauthenticated network attackers can exploit Helidon's OIDC component to read critical data and make limited unauthorized data changes, but only when high-complexity conditions are met and a victim is induced to interact during an authentication flow (CVSS 3.1 base 6.9). Affected releases are Helidon 4.0.0 through 4.5.5 and 27.0.0; the scope change means products integrated with the affected Helidon service may also be impacted. No public exploit identified at time of analysis and no CISA KEV entry is present; Oracle's October 2026 Critical Patch Update is the vendor patch reference.
High-privileged local attackers can corrupt or destroy critical PeopleSoft data and repeatedly crash the application in Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 by abusing the SQR reporting component. The attack is rated difficult to exploit and requires a privileged logon to the host running PeopleTools plus a triggering action from a separate legitimate user, so realistic exposure is limited to privileged insiders or post-compromise activity rather than remote opportunists; due to a scope change, a successful attack can also affect dependent products beyond PeopleTools itself. No public exploit code was identified at time of analysis and the issue is not in CISA KEV, so despite the 6.9 base score the practical priority is moderate-to-low and driven by the stacked prerequisites (AV:L/AC:H/PR:H/UI:R) rather than by broad exploitability.
ApostropheCMS versions prior to 4.33.0 fail to enforce the viewRole permission for anonymous visitors, allowing user-object fields to be disclosed when a developer has deliberately published user documents through a rendered relationship or an expressly enabled public API. The exposure is unauthenticated and low-complexity where it exists, but it is conditional on developer configuration - relationships do not automatically publish full user objects, and password hashes are stored separately and are never disclosed - so a default installation is not affected. The issue is fixed in 4.33.0; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Strict-mode input validation in json-smart through 2.6.0 can be bypassed by inserting a literal 0x1A (SUB) control character before malformed trailing data, causing JSONValue.parseStrict and isValidJsonStrict to accept payloads that downstream parsers such as Jackson or Gson reject or interpret differently. The flaw is unauthenticated (CVSS PR:N) and network-reachable, but it only matters where an application uses json-smart strict mode as a validation or trust gate and then passes the same raw bytes to a second parser; in that configuration it yields integrity impact through parser differentials, not code execution or data disclosure in json-smart itself. No public exploit code was identified at time of analysis, and the issue is assessed as medium-severity integrity-only rather than a top remediation priority.
HTTP request smuggling in Eclipse ThreadX NetX Duo's optional Web add-on allows unauthenticated remote clients to influence request-framing decisions by placing header-like field names in the request body; the embedded HTTP server scans the entire packet for headers instead of stopping at the end of the header section. The CVSS 4.0 score is 6.9, with low integrity and availability impact and no confidentiality impact, and exposure is limited to devices that enable and network-expose the Web add-on. No public exploit code or CISA KEV confirmation is present in the provided data; no public exploit identified at time of analysis.
A crafted ThreadX module can permanently hang the entire kernel by abusing the Module Manager's object-lookup path: the search name for a memory-protected module is validated on only one byte and then walked in privileged mode for as far as the module declares. Both lookup dispatchers are affected - the recommended txm_module_object_pointer_get_extended accepts a length argument but never uses it to bound the buffer, while the deprecated txm_module_object_pointer_get passes the maximum UINT value, removing the bound entirely - so a hostile module forces an out-of-bounds read (CWE-125) without needing to know anything about the memory it reaches. Because the walk happens with the kernel's preemption count raised, an unrecoverable read fault leaves the scheduler disabled for the remainder of the device's uptime, making this a durable denial of service rather than privilege escalation or code execution. The local attack vector (CVSS 4.0 base 6.9; assessed 3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H) requires the attacker to already be able to load or compromise a module in a build that enables the Module Manager; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (no CISA KEV listing).
Eclipse ThreadX deployments that use the Module Manager to load untrusted or mixed-trust modules let a module destroy kernel objects it does not own: the privileged dispatcher validates only that a pointer targets memory outside the caller's own code and data, which is the correct policy for *using* a shared object but not for deleting one. Any code running inside a loaded module, having obtained a pointer (for example via txm_module_object_pointer_get_extended name lookup) to an application- or peer-module-owned queue, semaphore, or mutex, can route that pointer to the kernel object delete service and have it torn down, yielding a local integrity and availability impact (CVSS 4.0 6.9; CVSS 3.1 AV:L/PR:L/UI:N/I:H/A:H, no confidentiality impact). Exploitation requires the module feature to be enabled with more than one trust domain, is local only, and does not apply to firmware built as a single monolithic trusted image; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV.
Eclipse CSI PIA executes its pre-authentication OIDC discovery and JWKS fetch operations synchronously directly on the asyncio event loop, so a single unauthenticated request can stall the entire service for every connected user. Any network-reachable deployment that has the OIDC authentication flow enabled is affected, and exploitation needs no credentials, privileges, or user interaction (CVSS 4.0 base 6.9, AV:N/AC:L/PR:N/UI:N, availability-only with VA:L). Impact is confined to denial of service with no confidentiality or integrity effect, and no public exploit code was identified at time of analysis.
Arbitrary code execution in IBM Cyber Fraud 1.0.0 through 1.0.2 requires an authenticated low-privilege user to upload a file with a dangerous type and then depends on a victim interacting with that file; the upload handler does not restrict dangerous file types (CWE-434). The vendor CVSS score is 6.8, while the independent assessment rates confidentiality, integrity, and availability impact as high with scope unchanged; the mandatory authentication (PR:L) and user interaction (UI:R) limit anonymous, fully automated exploitation. No public exploit code or CISA KEV entry was identified at time of analysis, and the realistic risk is moderate and context-dependent rather than an emergency.
Oracle One-to-One Fulfillment in Oracle E-Business Suite 12.2.3 through 12.2.15 exposes an authenticated, low-privileged attacker with HTTP access to integrity and availability impact in the Documents component; successful exploitation can cause unauthorized creation, deletion, or modification of critical fulfillment data and can trigger a hang or frequently repeatable crash. The CVSS 3.1 score is 6.8 with AC:H, indicating difficult exploitation that requires specific non-default timing, state, or module configuration conditions, and no public exploit was identified at time of analysis (not CISA KEV). This is a moderate-severity, moderate-priority issue rather than an urgent one.
Unauthenticated data exposure in the Report Distribution component of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 lets a network-positioned attacker read critical application data over HTTP, with the scope flag indicating that exposed data may extend into other PeopleSoft products built on the same platform. The 6.8 CVSS 3.1 score (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N) is driven by a high attack-complexity metric - Oracle describes the flaw as difficult to exploit, so success depends on server state, timing, or other conditions the attacker does not fully control rather than a single crafted request - and there is no integrity or availability impact. No public exploit identified at time of analysis, the issue is not on CISA KEV, and no EPSS score was supplied; practical risk concentrates on internet-reachable PeopleTools deployments rather than a broad mass-exploitation threat.
Unauthorized access to critical data in Oracle Demand Planning 12.1 and 12.2 requires a low-privileged authenticated attacker and a separate victim's interaction, yet successful exploitation can cross scope boundaries and expose data in connected Oracle Supply Chain products. The issue is scored CVSS 3.1 6.8 with confidentiality-only impact; no public exploit identified at time of analysis and no confirmed active exploitation was reported in the provided intelligence. Realistic risk is social-engineering-assisted data disclosure against logged-in users rather than autonomous compromise.
Oracle Payroll 12.2.3 through 12.2.15 allows a low-privileged authenticated attacker with HTTP access to the Internal Operations component to create, delete, modify, or read critical Payroll data, with high confidentiality and integrity impact and no availability impact. Oracle rates exploitation as difficult (AC:H), and no public exploit code or CISA KEV entry was identified at time of analysis.
Authenticated low-privileged users can read and modify critical data in Oracle Public Sector Human Resources (Regression Testing component) on Oracle E-Business Suite 12.2.3 through 12.2.15, with high confidentiality and integrity impact but high attack complexity. Exploitation requires HTTP network access and a valid low-privileged EBS account, and no user interaction is needed. This is a moderate, authenticated-only risk; no public exploit or active exploitation was identified at time of analysis.
Oracle E-Business Suite 12.2.3 through 12.2.15 has an unauthenticated HTTP attack path in the Application Object Library Core component that can lead to unauthorized creation, deletion, or modification of critical data and unauthorized read access. The vendor vector requires a non-attacker user to interact with the application and rates exploitation as high complexity (CVSS 3.1 6.8, AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N), so practical risk is constrained by the need to lure or socially engineer a legitimate user; no public exploit has been identified at time of analysis.
MySQL Router 26.7.0 allows unauthenticated network attackers to read and modify critical router-accessible data via its HTTPS interface, but successful exploitation is rated high-complexity and requires human interaction from someone other than the attacker. Oracle's October 2026 Critical Patch Update assigns CVSS 3.1 6.8 (C:H/I:H/A:N, AC:H, UI:R, PR:N), making this a genuine but medium-priority issue rather than a top-tier emergency; no public exploit code or CISA KEV entry was identified at time of analysis.