Authentication Bypass
Monthly
Denial-of-service exposure in MySQL Server and MySQL Cluster's Replication component allows a high-privileged local attacker to repeatedly crash or hang the database service under difficult-to-reproduce conditions. Affected are MySQL Server versions 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. Oracle addressed this in the July 2026 Critical Patch Update; no public exploit code or active exploitation has been identified at time of analysis.
Partial denial-of-service in Oracle MySQL Server and MySQL Cluster's Replication component affects multiple supported release lines, exploitable only by highly privileged, authenticated attackers over the network under difficult conditions. The attack yields only a partial availability impact with no confidentiality or integrity exposure, and no public exploit code has been identified at time of analysis. Given the CVSS score of 2.2 and the combination of high complexity and high privilege requirements, this represents a low-priority, low-impact finding in the context of Oracle's July 2026 Critical Patch Update.
Denial of service in Oracle MySQL Server and MySQL Cluster's Replication component allows a high-privileged network attacker to cause a complete, repeatable crash or hang of the database service. Affected are MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. No public exploit identified at time of analysis; the CVSS 3.1 score of 4.4 (Medium) accurately reflects the high privilege requirement and elevated attack complexity that substantially constrain real-world risk.
Denial of service in Oracle MySQL Server and MySQL Cluster's replication component allows a high-privileged network attacker to cause a complete hang or repeatedly crash the database server. Affected deployments span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, as well as MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. No public exploit code and no confirmed active exploitation have been identified; the high privilege and high complexity requirements substantially constrain real-world risk to insider threats or compromised DBA-level accounts.
Full takeover of MySQL Server and MySQL Cluster 9.7.0-9.7.1 is achievable via a local, low-privileged attacker exploiting a flaw in the Server: Configurator component, provided a second user interacts during the attack window. The CVSS 3.1 score of 6.7 reflects the high attack complexity and local-only vector, which meaningfully constrain real-world exploitability despite the high-impact outcome (C:H/I:H/A:H). No public exploit code has been identified at time of analysis, and CISA KEV confirmation is absent.
Full takeover of MySQL Server and MySQL Cluster is possible through a difficult-to-exploit vulnerability in the Clone Plugin component, requiring a high-privileged attacker with network access via multiple protocols. Affected are MySQL Server versions 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster versions 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. No public exploit code or CISA KEV listing has been identified at time of analysis; risk is tempered by the AC:H/PR:H exploitation prerequisites, though the full CIA:H/H/H impact warrants priority patching in environments using the Clone Plugin.
Full takeover of Oracle Autonomous Health Framework is achievable by a highly privileged local attacker under difficult exploitation conditions in versions 26.0.0 through 26.2.0, specifically within the Developer triaging platform component. Successful exploitation requires both high infrastructure privileges and active human interaction from a separate user, making opportunistic attacks unlikely. No public exploit code or CISA KEV listing has been identified; this vulnerability appears to be a low-frequency, targeted risk rather than a widespread exploitation concern.
JavaFX in Oracle Java SE 8u491 exposes a limited confidentiality breach to unauthenticated network attackers who can induce a user into executing untrusted Java content within a sandboxed client environment. The impact is strictly read-only access to a subset of sandbox-accessible data - no integrity or availability consequences are present. No public exploit has been identified at time of analysis, CISA has not listed this in KEV, and the high attack complexity alongside mandatory user interaction makes opportunistic or automated exploitation unlikely.
Oracle Cost Management V16 (Enterprise Command Center component) exposes critical data to compromise by network-accessible, high-privileged attackers over HTTP. Successful exploitation grants unauthorized read access to all accessible data and the ability to create, delete, or modify critical records within the application - a dual confidentiality and integrity impact. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog, though it was disclosed as part of Oracle's CPU July 2026 advisory cycle.
Unauthorized data read in the JavaFX component of Oracle Java SE 8u491 allows a remote unauthenticated attacker to access a subset of Oracle Java SE data by luring a victim into interacting with a malicious sandboxed Java Web Start application or Java applet. The attack is constrained exclusively to client-side Java deployments that run untrusted code within the Java sandbox, with high exploitation complexity (AC:H) and mandatory user interaction (UI:R) further limiting real-world reach. No public exploit code and no CISA KEV listing have been identified at time of analysis; the CVSS 3.1 score of 3.1 (Low) accurately reflects the narrow, confidentiality-only impact.
Oracle VM VirtualBox 7.2.12 contains a Core component vulnerability exploitable by high-privileged local attackers that produces a scope change, potentially compromising systems beyond VirtualBox itself. Successful exploitation yields complete confidentiality loss of all VirtualBox-accessible data and a partial denial of service, making this an isolation-breach risk in multi-tenant or shared virtualization environments. No public exploit identified at time of analysis, and the AC:H rating signals difficult exploitation, but the scope change (S:C) elevates real-world concern for environments where VirtualBox hosts sensitive guest workloads.
Oracle VM VirtualBox 7.2.12 Core component allows a low-privileged local attacker, under high-complexity conditions, to break VM isolation boundaries and compromise data integrity of the hypervisor and potentially adjacent systems. Successful exploitation can result in unauthorized creation, deletion, or modification of critical VirtualBox-accessible data, along with partial denial of service. No public exploit has been identified and this CVE is not listed in CISA KEV at time of analysis, but the scope change (S:C) elevates priority in multi-tenant or shared-host VirtualBox deployments where VM boundary integrity is a security guarantee.
Oracle Application Object Library (AOL), the foundational Core framework component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, permits a network-authenticated low-privileged user to bypass authorization controls and perform unauthorized read, insert, update, or delete operations on data outside their assigned access scope. Tagged as an Authentication Bypass by ENISA EUVD-2026-46560, the flaw is reachable over HTTP with no attack complexity and no user interaction required beyond a valid low-privilege session. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the low-complexity, broadly network-accessible nature of the flaw in a widely deployed enterprise ERP platform warrants prompt application of Oracle's July 2026 Critical Patch Update.
Cross-site or client-side injection in Oracle PeopleSoft Enterprise PeopleTools Panel Processor (versions 8.61 and 8.62) enables unauthenticated remote attackers to achieve limited unauthorized data read and write access by luring an authenticated user into interacting with a crafted HTTP request. The attack requires no privileges and no special configuration, but depends on human interaction from a victim - consistent with a reflected attack surface in the Panel Processor UI component. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog. Despite the 'Authentication Bypass' tag, the CVSS vector and impact scope indicate this is a partial, integrity-and-confidentiality-affecting client-side flaw rather than a full authentication bypass.
Oracle Workflow Notification Mailer in E-Business Suite versions 12.2.3 through 12.2.15 exposes a denial-of-service and limited data manipulation condition exploitable only by a high-privileged, local attacker under complex circumstances. Successful exploitation can cause a complete hang or repeatable crash of the Workflow service, alongside minor unauthorized read and write access to a subset of its data. No public exploit or active exploitation has been identified at time of analysis, and Oracle classifies this as difficult to exploit.
Oracle Java SE's Security component across versions 8u491 through 26.0.1 - and GraalVM for JDK/Enterprise Edition counterparts - contains an authentication bypass that allows unauthenticated network attackers to perform unauthorized read and write operations against data accessible by the Java runtime. Oracle classifies this as 'easily exploitable' via multiple protocols with no user interaction required, reachable either through server-side web services consuming Security APIs or through sandboxed Java Web Start and applet clients loading untrusted code. No public exploit code or CISA KEV listing has been identified at time of analysis, but the no-complexity network vector across a ubiquitous technology warrants priority patching.
Unauthorized read and write access to Oracle Access Manager data is achievable by unauthenticated remote attackers through a network-accessible HTTP attack against the Authentication Engine component, affecting versions 12.2.1.4.0 and 14.1.2.1.0. The vulnerability carries a scope change, meaning successful exploitation can impact products beyond Oracle Access Manager itself - consistent with an authentication-layer flaw such as open redirect or reflected cross-site scripting that can compromise dependent applications sharing the SSO context. No public exploit code has been identified at time of analysis, and this CVE is not currently listed in the CISA KEV catalog.
MySQL Server and MySQL Cluster's Optimizer component can be crashed or hung by a high-privileged attacker with network access, resulting in complete denial of service. Affected deployments span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, as well as MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, per Oracle's July 2026 Critical Patch Update. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, making real-world exploitation contingent on access to high-privileged database credentials.
Oracle Workflow's Notification Mailer component within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) contains a locally-exploitable flaw that enables a low-privileged attacker with infrastructure logon access to partially corrupt workflow data and degrade service availability. The CVSS score of 3.6 reflects the real-world difficulty: local access is mandatory, attack complexity is rated High, and no confidentiality exposure exists. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, making this a low-priority operational finding relative to typical enterprise vulnerability backlogs.
Denial of service in Oracle MySQL Server and MySQL Cluster allows any low-privileged authenticated attacker with network access to hang or repeatably crash the database service by exploiting a flaw in the Optimizer component. Affected deployments span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, per Oracle's July 2026 Critical Patch Update. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, the low attack complexity and minimal privilege requirement make this a credible availability risk for any deployment with externally or internally accessible database accounts.
Oracle VM VirtualBox 7.2.12 Core component allows a low-privileged local user to repeatedly crash or hang the hypervisor, causing a complete denial of service against all guest virtual machines running on the affected host. This vulnerability is not listed in the CISA KEV catalog and no public exploit code has been identified at time of analysis. The practical blast radius is limited to shared-access VirtualBox hosts where untrusted or semi-trusted local accounts exist, which is more common in developer workstations than hardened production environments.
Confidentiality breach in the JDBC component of Oracle Database Server allows an unauthenticated attacker positioned on the same physical communication segment to bypass authentication and gain complete read access to JDBC-accessible data, including critical database contents. Affected deployments span three major release lines: 19c (19.3-19.31), 21c (21.3-21.22), and 23ai (23.4.0-23.26.2). Exploitation requires both network adjacency and human interaction from a legitimate user, and a successful attack can extend its impact beyond JDBC itself to additional connected products due to a scope change. No public exploit code or CISA KEV listing has been identified at time of analysis.
Integrity compromise in Oracle Database Server's JDBC component allows unauthenticated network attackers to create, delete, or modify critical data or all JDBC-accessible data via Oracle Net. Affected releases span three supported branches: 19.3-19.31, 21.3-21.22, and 23.4.0-23.26.2. Exploitation requires human interaction from a party other than the attacker, limiting opportunistic mass exploitation; no public exploit code or CISA KEV listing has been identified at time of analysis.
Partial denial-of-service in the 2D component of Oracle Java SE and GraalVM platforms allows unauthenticated remote attackers to degrade availability via multiple network protocols. Affected versions span Java SE 8u491 through 26.0.1 and GraalVM for JDK 17.0.19/21.0.11, but exploitation is restricted to sandboxed client-side deployments - specifically Java Web Start applications or applets loading untrusted code - making the practical attack surface narrow given the near-obsolescence of these technologies. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV.
Oracle VM VirtualBox 7.2.12 Core component contains a local integrity vulnerability enabling a highly privileged attacker with host logon access to make unauthorized modifications to VirtualBox-accessible data, with potential cross-boundary impact on additional products due to scope change (S:C). The constraint to local, high-privilege access (AV:L/PR:H) limits the realistic threat surface to insider threats or post-compromise scenarios on hypervisor hosts. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Local exploitation of the Core component in Oracle VM VirtualBox 7.2.12 allows a low-privileged attacker to perform unauthorized creation, deletion, or modification of critical VirtualBox data and cause a partial denial of service - provided a second user's interaction can be induced. Oracle disclosed this in the July 2026 Critical Patch Update (CPU), classifying it as easily exploitable under those local conditions. No public exploit code or active exploitation has been identified at time of analysis, and the mandatory human-interaction requirement (UI:R) materially constrains unassisted or automated attacks.
Unauthorized data disclosure in Oracle PeopleSoft Enterprise PeopleTools (PIA Core Technology component) allows a high-privileged attacker with HTTP network access to read critical or all accessible PeopleSoft data. Affecting supported versions 8.61 and 8.62, Oracle classifies this as easily exploitable despite the PR:H requirement, yielding a CVSS 3.1 score of 4.9 with confidentiality-only impact. No public exploit code and no CISA KEV listing exist at time of analysis; however, the 'Authentication Bypass' tag in the advisory metadata warrants attention in environments with multiple admin-tier users.
Integrity compromise in Oracle Database Server's embedded Java VM component allows network-connected attackers holding only the Create Session privilege to arbitrarily create, delete, or modify critical data or all Java VM-accessible data within the database. All three actively supported release lines are affected - 19.3 through 19.31, 21.3 through 21.22, and 23.4.0 through 23.26.2 - as confirmed in Oracle's July 2026 Critical Patch Update. Oracle explicitly characterizes this as 'easily exploitable,' and no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthorized data manipulation in Oracle Database Server's RDBMS component allows a highly privileged, network-connected attacker to perform insert, update, or delete operations against a subset of data accessible within the database. Affected versions span the 19.3-19.31, 21.3-21.22, and 23.4.0-23.26.2 release trains, all reachable over Oracle Net without user interaction. No public exploit has been identified at time of analysis; with a CVSS 3.1 score of 2.7 and integrity-only impact, the risk is primarily relevant to environments where high-privileged database credentials may be compromised or misused.
Limited integrity compromise in the JavaFX component of Oracle Java SE 8u491 allows unauthenticated remote attackers to perform unauthorized data manipulation through a high-complexity, user-interaction-dependent attack path. The attack surface is narrowly scoped to client-side deployments - specifically sandboxed Java Web Start applications or Java applets that load and run untrusted code from the internet; server-side deployments loading only trusted code are explicitly excluded. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, consistent with its low CVSS score of 3.1 and the demanding exploitation prerequisites.
Integrity bypass in Oracle Java SE's JavaFX component (version 8u491) allows a network-reachable unauthenticated attacker to perform limited unauthorized data modifications against clients running sandboxed Java Web Start applications or sandboxed Java applets. The attack requires high complexity and mandatory user interaction, constraining its practical impact to low-severity integrity effects (CVSS 3.1 score: 3.1). No public exploit code or active exploitation via CISA KEV has been identified at time of analysis; server-side Java deployments are explicitly excluded from the attack surface by Oracle.
Partial availability disruption in Oracle Siebel CRM End User (Redwood UI component, versions 24.4 through 26.3) can be triggered by a highly privileged network attacker over HTTP under difficult exploitation conditions that also require victim interaction, potentially causing cascading availability degradation in interconnected systems due to a confirmed scope change. The CVSS 3.1 base score of 2.6 (Low) reflects the extremely restrictive prerequisite chain - high privileges, user interaction, and high attack complexity must all align. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Sandbox integrity bypass in the JavaFX component of Oracle Java SE 8u491 allows network-reachable unauthenticated attackers to perform unauthorized write, insert, or delete operations against data accessible within the Java security context. Exploitation is structurally constrained to client-side deployments running sandboxed Java Web Start applications or Java applets that load and execute untrusted code from the internet - server-side Java deployments running only administrator-installed code are explicitly outside the attack surface. No public exploit code exists and this CVE is not listed in the CISA KEV catalog; the low CVSS 3.1 score of 3.1 accurately reflects the narrow, integrity-only impact combined with high attack complexity and mandatory user interaction.
Partial denial-of-service in Oracle Java SE's Libraries component allows unauthenticated network attackers to disrupt availability across a broad range of supported versions, including the current releases 25.0.3 and 26.0.1. The attack surface is unusually wide: exploitation is possible through any protocol supported by the JVM, via APIs exposed in the Libraries component, through web services that internally invoke those APIs, and through the sandboxed Java Web Start or applet execution path when loading untrusted code. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the trivial exploitation conditions (AC:L/PR:N/UI:N) and the ubiquity of Java deployments elevate realistic risk beyond the moderate CVSS score alone.
Cross-site scripting or client-side injection in the Panel Processor component of Oracle PeopleSoft Enterprise PeopleTools 8.62 permits a low-privileged, authenticated network attacker to compromise confidentiality and integrity of accessible PeopleTools data - and, due to a scope change, potentially additional Oracle products - when a victim user interacts with attacker-controlled content. The attack vector is HTTP, requires no elevated complexity, and is classified as easily exploitable. No public exploit code or active exploitation has been identified at time of analysis; Oracle disclosed this via the Critical Patch Update for July 2026.
Unauthorized partial data read in Oracle Siebel CRM Deployment (Application Interface component) is achievable by low-privileged, network-adjacent authenticated attackers over HTTP across versions 17.0 through 26.4. Exploitation is difficult due to high attack complexity and a mandatory human-interaction requirement, limiting exposure to targeted scenarios rather than opportunistic mass exploitation. No public exploit code or active exploitation has been identified at time of analysis; the low CVSS score of 2.6 reflects the constrained, confidentiality-only impact.
Integrity compromise in Oracle Java SE's ImageIO component allows unauthenticated remote attackers to perform unauthorized data modification against a broad range of Java SE and GraalVM versions. Exploitation requires high attack complexity, limiting opportunistic mass exploitation, but the scope spans ten distinct supported releases across Java SE 8 through 26 and both GraalVM product lines. No public exploit has been identified and this vulnerability is not listed in CISA KEV; however, the low CVSS score of 3.7 belies a moderately wide attack surface given Java's deployment footprint.
Unauthorized data exposure in Oracle Agile PLM 9.3.6 allows a remote unauthenticated attacker to compromise the confidentiality of all PLM-accessible data via HTTP, provided human interaction from a victim user is achieved. The vulnerability resides in the Folders, Files & Attachments component and is tagged as an Authentication Bypass, meaning access controls protecting sensitive product lifecycle and supply chain data can be circumvented without credentials. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero privilege requirement make this a meaningful risk for Oracle Agile PLM deployments exposed to untrusted networks.
Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 expose an authentication bypass in the UI Framework component, reachable over HTTPS without credentials. Unauthenticated remote attackers who satisfy the high-complexity attack precondition can gain complete read access to all data visible within the OEM platform - a significant exposure given OEM's privileged visibility into monitored databases, hosts, and infrastructure credentials. No public exploit has been identified at time of analysis, and no CISA KEV listing exists, but the Authentication Bypass classification warrants prioritized patching in environments where the OEM console is network-accessible.
Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 expose an authorization bypass in the Web Services Framework component, allowing low-privileged authenticated attackers to access and manipulate restricted data over HTTPS. Despite requiring valid credentials, the flaw circumvents authorization controls, enabling unauthorized read of a subset of platform data and unauthorized write/insert/delete operations against accessible records. No public exploit code or active CISA KEV listing has been identified at time of analysis.
Unauthorized data manipulation in Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 is achievable by any low-privileged user with network HTTPS access, specifically through the Metadata Plugin component. The flaw - tagged as an authentication bypass - enables arbitrary creation, deletion, or modification of critical OEM metadata, potentially affecting all data accessible within the platform. No public exploit code or CISA KEV listing exists at time of analysis, but the low attack complexity (AC:L) and absence of required user interaction (UI:N) make this a credible insider or compromised-credential threat in any organization with OEM deployed.
Local access control weakness in Oracle Enterprise Manager Base Platform's Enterprise Config Management component allows low-privileged users with host logon rights to read a subset of OEM-accessible data and perform unauthorized inserts, updates, or deletes against accessible data records. Versions 13.5 and 24.1 are confirmed affected per Oracle's July 2026 Critical Patch Update. No public exploit code and no CISA KEV listing have been identified at time of analysis, and the local-only attack vector substantially constrains real-world exploitation to insider threats or previously compromised accounts.
Unauthenticated information disclosure in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) allows remote attackers to read a subset of accessible platform data via the Agent Next Gen component over HTTPS without credentials. Tagged as an Authentication Bypass, this network-accessible flaw carries a low-complexity attack profile (AV:N/AC:L/PR:N/UI:N), meaning any network-reachable adversary can exploit it with minimal effort. No public exploit code or CISA KEV listing is confirmed at time of analysis, but the absence of authentication requirements and zero attack complexity make this straightforward to operationalize, particularly given that OEM manages critical enterprise infrastructure.
Unauthenticated information disclosure in Oracle Enterprise Manager Base Platform's Agent Next Gen component permits remote attackers to read a subset of platform-accessible data over HTTPS without credentials. Versions 13.5 and 24.1 are confirmed affected per Oracle's Critical Patch Update for July 2026. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis, though the Authentication Bypass tag suggests a structural access control failure rather than a simple misconfiguration.
Unauthenticated information disclosure in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) exposes a subset of platform data to remote attackers via HTTPS. The vulnerability resides in the Agent Next Gen component and is classified as an authentication bypass, enabling network-accessible exploitation without credentials or user interaction. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, its low complexity and zero-authentication requirement make it straightforwardly exploitable by any internet-accessible instance.
Unauthorized data read in Oracle Utilities Network Management System's Mobile component allows low-privileged, network-adjacent attackers to access a subset of confidential NMS data via HTTP. Affected are five distinct version branches spanning 2.5.0.1.x through 25.12.0.0.x, as detailed in Oracle's July 2026 Critical Patch Update. Oracle classifies this as 'easily exploitable,' and the 'Authentication Bypass' tag suggests authorization control weaknesses beyond the low-privilege requirement implied by PR:L; no public exploit or CISA KEV listing exists at time of analysis.
Unauthenticated remote exploitation of the RDBMS component in Oracle Database Server 19c, 21c, and 23ai allows network-accessible attackers to perform unauthorized data manipulation - INSERT, UPDATE, or DELETE - against RDBMS-accessible data via Oracle Net. The CVSS vector (S:C) confirms a scope change, meaning successful exploitation may cascade to additional products or components beyond the targeted database instance. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the zero-barrier network entry (PR:N, AC:L, UI:N) across three actively supported Oracle release families represents a meaningful priority for internet-exposed or multi-tenant Oracle Database environments.
Integrity compromise via TLS in Oracle Java SE's JSSE component allows an unauthenticated remote attacker to perform unauthorized creation, deletion, or modification of critical application data across seven affected Java SE releases and three GraalVM variants. The attack targets the TLS stack directly - not through applets or Web Start - and is tagged as an authentication bypass, suggesting the flaw undermines TLS-level authentication controls within JSSE. No public exploit code and no CISA KEV listing have been identified at time of analysis; the AC:H metric constrains real-world risk to adversaries capable of achieving precise network positioning or TLS session manipulation.
Unauthorized data access and manipulation in Oracle Utilities Network Management System exposes the Security component across five supported release trains to network-based exploitation by low-privileged authenticated users. A successful attack requires human interaction from a victim other than the attacker, enabling partial confidentiality and integrity compromise - specifically unauthorized read access to a subset of NMS data and unauthorized insert, update, or delete operations. No public exploit code exists and this CVE is not listed in the CISA KEV catalog at time of analysis; the 'Authentication Bypass' tag in source intelligence appears to describe privilege escalation within the application rather than full authentication circumvention, given the CVSS PR:L metric.
Denial-of-service in Oracle MySQL Server and MySQL Cluster's DDL component allows a high-privileged, network-connected attacker to cause a complete server hang or repeatable crash under difficult-to-reproduce conditions. Affected product lines span MySQL Server 8.4.x and 9.7.x and MySQL Cluster 8.0.x through 9.7.x, as confirmed in Oracle's July 2026 Critical Patch Update (EUVD-2026-46462). No public exploit or confirmed active exploitation has been identified at time of analysis.
Partial denial-of-service exposure in the JSSE component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows unauthenticated remote attackers to degrade service availability by supplying malformed data via TLS. Affected releases span five Oracle Java SE versions (11.0.31 through 26.0.1) and both GraalVM product lines, as disclosed in Oracle's CPU July 2026 advisory (EUVD-2026-46459). No public exploit identified at time of analysis and no CISA KEV listing; the CVSS 5.3 rating reflects a genuine but bounded availability impact rather than a critical or confidentiality-affecting risk.
Oracle Commerce Service Center 11.4.0 exposes an unauthenticated network-exploitable vulnerability that requires victim interaction and produces a scope change, consistent with a client-side injection or authentication-bypass pattern affecting additional downstream products. Tagged as an authentication bypass by the reporting source, the flaw allows a remote unauthenticated attacker to achieve unauthorized read access to a subset of Commerce Service Center data and unauthorized write, insert, or delete access to some accessible data - outcomes typical of session hijacking or reflected injection chains. No public exploit code has been identified at time of analysis, and this CVE has not been added to the CISA Known Exploited Vulnerabilities catalog.
Unauthorized data disclosure in Oracle Retail Xstore Point of Service 21.0.3 allows a network-based, low-privileged attacker to read a subset of application data via the Xstore Mobile component over HTTP. Tagged as an Authentication Bypass, the flaw suggests a low-privileged authenticated session can exceed its authorized data access scope without elevated rights. No public exploit or active exploitation has been identified at time of analysis, and the CVSS score of 4.3 reflects a moderate, bounded confidentiality risk.
Local privilege information disclosure in Oracle Retail Xstore Point of Service 21.0.3 allows low-privileged users with system logon access to read a subset of Xstore data they are not authorized to view via the Xstore Mobile component. Despite carrying the 'Authentication Bypass' tag, the CVSS vector (AV:L/PR:L) confirms exploitation requires existing local infrastructure access - the bypass likely permits an authenticated low-privilege user to circumvent authorization controls and access restricted data segments. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog, making active exploitation unlikely in the near term.
Missing authorization controls in Kibana's Cloud Connect endpoints allow any authenticated low-privilege user to read and modify Cloud Connect configuration and service settings that should be restricted to users with specific feature privileges. Exploitation occurs via direct HTTP requests to insufficiently protected internal API endpoints, bypassing Kibana's privilege enforcement layer entirely. No public exploit code exists and this vulnerability is not listed in CISA KEV; however, the low barrier - requiring only a valid Kibana account - elevates practical risk in multi-tenant or externally accessible deployments.
kirby-modules through version 5.5.7 exposes the complete plaintext commercial license key to any authenticated Kirby Panel user - including non-admin roles such as editors and authors - via a single GET request to the modules/activate dialog endpoint. The root cause is a missing authorization check (CWE-862) in lib/areas.php: the handler calls ModulesLicense::readKey() without verifying administrator status, relying instead on the access.system permission that defaults to true for all non-admin Panel roles. No active exploitation is confirmed by CISA KEV and no public exploit code has been identified, but the CVSS 4.0 vector (PR:L, AC:L, AV:N) indicates this is trivially reproducible by any Panel account holder, with the primary downstream consequence being unauthorized activation of the plugin on third-party Kirby installations.
Unauthenticated information disclosure in Taiga 6.10.1 exposes the full member roster and internal workflow configuration of private projects to any network-reachable attacker. The filters_data endpoints on four viewsets - UserStory, Task, Issue, and Epic - fail to enforce the authorization controls correctly applied elsewhere in the project API, allowing unauthenticated GET requests parameterized with sequential integer project IDs to return user IDs, full names, and gravatar hashes of private project members. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the trivially automatable enumeration path elevates practical risk for externally accessible deployments.
Token scope enforcement is bypassed on Gitea's repository home page handler (`repo.Home`), exposing private repository README, root file/directory tree, description, language statistics, license, and latest-release data to any authenticated PAT or OAuth2 token that lacks the `repository` scope or is marked `public-only`. This is the third in a series of related incomplete fixes - CVE-2026-20706 and CVE-2026-27761 patched sibling routes (archive download and RSS/Atom feeds) but the home route was overlooked, leaving it without the `CheckRepoScopedToken` guard applied to every neighboring handler. Publicly available exploit code exists in the form of a self-contained Docker-based proof-of-concept published in the vendor advisory; no active exploitation has been confirmed by CISA KEV.
Cross-repository attachment re-linking in Gitea exposes private issue and comment attachments to authenticated attackers who know a victim's attachment UUID. An attacker with issue-editing rights in any repository they can access can inject a victim UUID into the files[] parameter of an issue or comment edit request, causing Gitea to re-link that attachment into the attacker's authorization context; subsequent requests to /attachments/{uuid} then resolve access against the attacker's repository rather than the victim's, delivering the private file. No public exploit code has been identified at time of analysis, but the GHSA advisory (GHSA-6c6r-5xr4-cr5m) includes a detailed step-by-step reproduction runbook. The vendor-released fix is Gitea v1.27.0.
Private repository metadata and issue titles leak to revoked Gitea users via two REST API endpoints that omit post-revocation authorization checks, constituting an incomplete fix relative to CVE-2026-20800. Former collaborators with a still-valid API token can call `GET /api/v1/user/starred` to receive full repository objects - including `clone_url` and `ssh_url` - for private repos they starred, and `GET /api/v1/user/times` to retrieve private issue titles and states for issues on which they logged time, indefinitely after repo access is revoked. Impact is metadata-only; no public exploit code has been identified at time of analysis and no CISA KEV listing exists.
Webhook persistence after collaborator revocation in Gitea (versions prior to 1.27.0) enables a former admin collaborator to receive ongoing real-time exfiltration of private repository content indefinitely after their access is removed. The `DeleteCollaboration()` function cleans watches and assignees but never removes or disables webhooks created by the departing user, and the webhook delivery subsystem fires payloads on every subsequent repository event without re-validating the creator's current access. The attack is invisible to the repository owner, requires no further action by the attacker post-revocation, and was runtime-confirmed on gitea/gitea:1.25.4; no public exploit has been identified at time of analysis.
Incorrect Authorization (CWE-863) in Kibana's Entity Analytics Watchlist feature allows low-privileged authenticated users with read-only Security Solution access to perform unauthorized write operations against watchlist configuration endpoints that should require elevated privileges. The CVSS 5.4 vector (AV:N/AC:L/PR:L/UI:N) confirms network-exploitable but credential-gated exploitation with limited confidentiality and integrity impact; under specific deployment conditions, affected users may additionally access data outside their authorized scope. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Incorrect Authorization (CWE-863) in Elasticsearch's ingest simulation feature allows authenticated users with limited index privileges to bypass per-index access controls and trigger ingest pipeline execution on indices they are not authorized to access directly. Pipeline output - potentially containing enriched or processed sensitive data - is returned to the requestor, and index mapping metadata for restricted indices can also be retrieved through the same mechanism. No public exploit code has been identified at time of analysis; vendor-released fixes are available in versions 8.19.18, 9.3.7, and 9.4.4.
Kibana's authorization layer fails to enforce ACLs correctly in certain code paths, allowing a lower-privileged authenticated user to cause data from restricted Elasticsearch sources to be processed under another user's elevated privileges - effectively a confused deputy attack resulting in unauthorized information disclosure. The CVSS 4.3 (Medium) rating reflects low confidentiality impact and the requirement for a valid Kibana account, but the real-world risk is material in multi-tenant or role-segregated deployments where data isolation is a compliance requirement. No active exploitation confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Concurrent Login Vulnerability in HCL MyCloud permits authenticated users to sustain multiple simultaneous active sessions without invalidation, enabling session hijacking and unauthorized account access. The CVSS score of 3.1 (Low) reflects high attack complexity, a prerequisite of authenticated access, and impact confined to partial confidentiality - no integrity or availability impact applies. No public exploit code and no confirmed active exploitation (CISA KEV) have been identified at time of analysis.
Session cookie exposure in HCL MyCloud arises from the cookie Path attribute not being set, causing authentication tokens to be transmitted to all paths within the application domain rather than restricted to intended endpoints. The CVSS 2.6 score reflects a genuinely limited-impact finding requiring both high attack complexity and authenticated user interaction to exploit, with only low confidentiality impact and no integrity or availability consequences. No public exploit code or active exploitation has been identified at time of analysis.
Privilege escalation in Eclipse hawkBit's Direct Device Integration (DDI) Controller allows any authenticated device to download firmware artifacts beyond those explicitly assigned to it, within the same tenant. The flaw - rooted in missing object-level authorization (CWE-284/CWE-862) - means a valid device credential is sufficient to access arbitrary firmware artifacts belonging to other devices in the same tenant, not just the device's own assigned updates. A secondary enumeration weakness in the software modules listing endpoint compounds the issue by enabling targeted discovery of available artifacts. No public exploit has been identified at time of analysis, and no CISA KEV listing is present.
Authorization bypass in ZS-Admin's multi-tenant API layer allows authenticated remote attackers to read department listing data belonging to other tenants by supplying an arbitrary value in the X-Tenant-Id HTTP header against the /api/system/sys/dept/page endpoint. The root cause is the getTenantId function of the MyBatis-Plus Tenant Plugin trusting a client-controlled header rather than deriving tenant scope from the authenticated session server-side. A public proof-of-concept is available via GitHub issue #5; no vendor patch or acknowledgment has been issued and the project has not responded to the disclosure.
Clickjacking exposure in HCL IntelliOps Event Management (IEM) allows network-based attackers to embed the application inside a malicious webpage via an iframe and deceive authenticated users into performing unintended administrative or operational actions. All tracked versions under the CPE wildcard are affected, per HCL advisory KB0132378. No public exploit identified at time of analysis, and the CVSS score of 3.1 (Low) reflects the non-trivial attack complexity and limited integrity-only impact.
Validation bypass in Ninja Forms WordPress plugin 3.14.8 allows unauthenticated remote attackers to submit arbitrary content to any form by overriding server-side field definitions at the client layer before validation executes. By crafting a malicious AJAX payload targeting the WordPress nopriv (unauthenticated) AJAX endpoint, an attacker can strip required-field flags, override field types, and neutralize CAPTCHA protections - causing form actions such as email notifications and database writes to fire with fully attacker-controlled data. No public exploit code has been identified at time of analysis, and this vulnerability is not currently listed in the CISA KEV catalog, though the trivial attack complexity and zero-authentication requirement make opportunistic abuse straightforward.
Missing RBAC authorization on the ZenML 0.94.2 `get_deployed_stack` endpoint allows any authenticated user to enumerate all deployed stacks across all users and tenants. The root failure is twofold: the HTTP handler lacks endpoint-level authorization, and the internal server-side `Client()` object bypasses the RBAC enforcement layer by querying `SqlZenStore` directly, making tenant isolation ineffective. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified, but the low attack complexity and cross-tenant data exposure make this a meaningful risk in ZenML Pro/Cloud multi-tenant deployments.
Missing authorization in Universal Software Inc. FlexCity (versions 5.536.0 through 11052026) exposes sensitive data to low-privileged authenticated users who can bypass access control security levels. The vulnerability (CWE-862) allows network-accessible exploitation with low attack complexity, resulting in high confidentiality impact with no integrity or availability loss. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the low-privilege network vector makes this a realistic internal threat in any environment running affected versions.
Missing capability checks in the Tutor LMS Elementor Addons WordPress plugin (Themeum) allow any authenticated WordPress user with Subscriber-level access or higher to activate the Tutor LMS and Elementor plugins without administrative authorization. Affected are all versions through 4.0.0, confirmed by Wordfence threat intelligence. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, and real-world impact is constrained by the requirement for a valid WordPress account.
Improper permission enforcement in Checkmk's Business Intelligence (BI) module allows any authenticated low-privileged user to view and modify BI packs and rules regardless of their assigned permission set. Affected versions span four release branches - 2.5.0 through 2.5.0p8, 2.4.0 through 2.4.0p33, 2.3.0 through 2.3.0p48, and the end-of-life 2.2.0 branch - creating an access control bypass in a core monitoring configuration surface. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Subscriber-level users on WordPress sites running WPBot before 8.2.0 can modify the plugin's retrieval-augmented-generation (RAG) configuration without authorization, because the relevant settings handler performs neither a WordPress capability check nor a nonce validation. A publicly available proof-of-concept lowers the exploitation bar significantly, making this actionable for any low-skill attacker who holds or can self-register a subscriber account on the target site. No public exploit identified at time of analysis by CISA KEV, but POC availability combined with low access requirements makes remediation a priority for sites with open user registration.
Academy LMS WordPress plugin versions prior to 3.8.1 exposes an Insecure Direct Object Reference (IDOR) flaw across multiple lesson AJAX handlers, allowing any subscriber-level authenticated user to read and overwrite other users' lesson notes and fraudulently mark course content as completed on their behalf. The vulnerability affects all Academy LMS installations running an unpatched version and is worsened by a publicly available exploit published via WPScan, though no active exploitation has been confirmed through CISA KEV. In environments where course completion carries compliance, certification, or audit significance, the integrity impact exceeds what the Medium CVSS score alone conveys.
Insecure Direct Object Reference (IDOR) in the Classified Listing WordPress plugin before 5.3.9 exposes payment receipt data across arbitrary user accounts. Any authenticated user holding subscriber-level access - the default role assigned upon registration on most WordPress sites - can query the payment-receipt handler with any order ID and receive full receipt details belonging to another user, because no ownership check is performed. A publicly available exploit exists per WPScan, and a vendor-released patch at version 5.3.9 is available; no KEV listing is present at time of analysis.
Unauthenticated workflow replay in the Bit Form WordPress plugin (versions before 3.1.0) allows external attackers to re-trigger any form's configured workflow actions - including notification emails and third-party service integrations - by submitting an expired workflow-trigger token that the plugin fails to properly reject. The root cause is missing authorization enforcement at the token-validation layer after WordPress transient expiry, classified under CWE-862. No public exploitation in CISA KEV is recorded, but a publicly available proof-of-concept exists per WPScan, elevating operational risk for sites with high-value workflow integrations such as CRM hooks or payment notifications.
ACL bypass in kronosnet (versions ≤ 1.34) allows remote unauthenticated attackers to inject arbitrary data packets into cluster communication channels under a specific dual-condition deployment configuration. By spoofing a valid link ID in crafted network frames, an attacker circumvents the ACL subsystem entirely, potentially causing data corruption or service instabilities in clustering stacks shipped with Red Hat Enterprise Linux 8, 9, 10 and OpenShift Container Platform 4. No public exploit code and no active exploitation have been identified at time of analysis.
Apple's Find My backend service allows an attacker who holds a valid PET (Private Endpoint Token) to enumerate devices on an Apple ID account and silently remove offline devices without triggering two-factor authentication or ownership verification - a CWE-287 Improper Authentication flaw. The vulnerability affects the service through at least December 17, 2025, with researcher-published proof-of-concept code on GitHub demonstrating the technique. EPSS sits at 0.19% (9th percentile) and the vulnerability is not listed in CISA KEV, pointing toward targeted rather than opportunistic exploitation; however, the account-manipulation impact makes it meaningful for high-value Apple ID targets.
Cross-tenant self-service signup bypass in Microsoft Azure API Management (through 2025-10-17) lets remote unauthenticated actors register developer-portal accounts against a tenant where signup was disabled in the UI, by swapping the Host header or tenant identifier to reuse another tenant's still-live registration endpoint. Publicly available proof-of-concept exploit code exists (GHSA-vcwf-73jp-r7mv), but Microsoft evaluated the report and determined the behavior did not cross a security boundary, calling it a configuration/state issue rather than a product vulnerability affecting tenant isolation. No public in-the-wild exploitation has been identified, and the EPSS probability is low (0.18%, 7th percentile).
Unauthenticated triggering of all configured scheduled jobs in Grav CMS's scheduler-webhook plugin is possible due to a null short-circuit logic flaw in webhook token validation, allowing any network-reachable attacker to execute operator-defined commands under the web server process account via a single POST request. The affected component is the scheduler-webhook plugin for Grav CMS, a PHP flat-file CMS; the CVSS 4.0 vector (AC:H/AT:P) confirms exploitation requires the plugin to be installed with configured jobs and an exposed endpoint - not a default Grav deployment. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Rsync daemon before version 3.4.3 allows hostname-based access control rules to be silently bypassed when the daemon is configured with chroot and the chroot directory lacks the files glibc requires for DNS resolution. When resolution fails inside the chroot, the client hostname is set to "UNKNOWN", which never matches administrator-defined "hosts deny" hostname patterns, effectively nullifying those rules. An attacker who controls the PTR record for their source IP can exploit this to connect to an rsync module they were explicitly denied access to; no public exploit code is identified and this is not listed in CISA KEV.
Incorrect authorization in Vercel's @ai-sdk/harness-codex package (prior to 1.0.29) allows untrusted code executing inside a Codex CLI sandbox to invoke arbitrary host-exposed tools - including secret lookups, deployment operations, and cloud API calls - without a corresponding model-authorized tool-call event. The relay server validates incoming requests solely by checking whether the requesting process's command line contains the Codex CLI shim path via Linux /proc, a condition any sandbox process can trivially forge by including the shim path in its own argv. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but the supply-chain threat vector via malicious npm lifecycle hooks or build scripts is realistic for developer environments processing untrusted repositories.
Sandbox authorization bypass in Vercel's `@ai-sdk/harness-opencode` (all versions prior to 1.0.28) permits untrusted code executing inside the OpenCode sandbox to invoke arbitrary host-exposed tools — including secret lookups, deployment operations, and cloud API calls — without a corresponding model-authorized tool-call event. The flawed process-path fallback reads `/proc/<pid>/cmdline` on Linux to verify the requesting process's command line contains the `host-tool-mcp.mjs` script path, a check that sandboxed attacker-controlled code can satisfy or spoof. No public exploit code has been identified at time of analysis, and the issue is remediated in v1.0.28 by replacing the path check with short-lived one-time authorization tokens bound to bridge-observed model events.
Cookie injection in Adminer before 5.4.3 allows network-accessible, unauthenticated attackers to manipulate Set-Cookie path attributes by injecting arbitrary values through the unsanitized X-Forwarded-Prefix HTTP header, enabling downgrade of SameSite protection and subsequent cross-origin authenticated requests against victim sessions. Exploitation is gated on a misconfigured reverse proxy that forwards attacker-controlled header values and requires passive user interaction (UI:P per CVSS 4.0), making this a realistic but non-trivial attack path. No active exploitation confirmed (not in CISA KEV) and no public exploit code identified at time of analysis; vendor-released patch is available as version 5.4.3.
Unauthenticated access to FreeScout's email open-tracking endpoint (`GET /thread/read/{conversation_id}/{thread_id}`) allows remote attackers to enumerate valid conversation and thread IDs and manipulate the `opened_at` timestamp on arbitrary threads. All FreeScout deployments prior to version 1.8.219 are affected. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Two-factor authentication bypass in Webmin prior to version 2.640 allows a network attacker holding valid username and password credentials to gain full administrative access by sending requests via the HTTP Basic authentication code path, which skips TOTP enforcement entirely. All Unix-like systems running Webmin with 2FA enabled on any account are affected, making this particularly dangerous in environments where 2FA was deployed as the primary compensating control against credential exposure. No active exploitation has been confirmed via CISA KEV, and no public exploit code was identified in the provided data at time of analysis.
Improper authorization in dataCycle-CORE versions up to and including 25.07.3 allows any Standard user to enumerate the full names and email addresses of other users - including internal staff, guest accounts, and external test accounts - via the `/users/search` endpoint, bypassing access controls that correctly deny direct user profile access. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms low-complexity network exploitation by any authenticated Standard user with no user interaction required. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.
Authorization bypass in SurrealDB's KILL statement before version 3.1.0 allows any authenticated database-level user to silently terminate other users' LIVE SELECT real-time subscriptions by targeting their live query UUIDs, with no ownership verification performed. The affected user receives no notification of termination, breaking real-time data pipelines and multi-tenant isolation guarantees - a low-privilege record-scoped user can disrupt a root user's monitoring subscriptions within the same database. Discovered during a cure53 code audit and penetration test; no public exploit code or CISA KEV listing exists at time of analysis.
Denial-of-service exposure in MySQL Server and MySQL Cluster's Replication component allows a high-privileged local attacker to repeatedly crash or hang the database service under difficult-to-reproduce conditions. Affected are MySQL Server versions 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. Oracle addressed this in the July 2026 Critical Patch Update; no public exploit code or active exploitation has been identified at time of analysis.
Partial denial-of-service in Oracle MySQL Server and MySQL Cluster's Replication component affects multiple supported release lines, exploitable only by highly privileged, authenticated attackers over the network under difficult conditions. The attack yields only a partial availability impact with no confidentiality or integrity exposure, and no public exploit code has been identified at time of analysis. Given the CVSS score of 2.2 and the combination of high complexity and high privilege requirements, this represents a low-priority, low-impact finding in the context of Oracle's July 2026 Critical Patch Update.
Denial of service in Oracle MySQL Server and MySQL Cluster's Replication component allows a high-privileged network attacker to cause a complete, repeatable crash or hang of the database service. Affected are MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. No public exploit identified at time of analysis; the CVSS 3.1 score of 4.4 (Medium) accurately reflects the high privilege requirement and elevated attack complexity that substantially constrain real-world risk.
Denial of service in Oracle MySQL Server and MySQL Cluster's replication component allows a high-privileged network attacker to cause a complete hang or repeatedly crash the database server. Affected deployments span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, as well as MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. No public exploit code and no confirmed active exploitation have been identified; the high privilege and high complexity requirements substantially constrain real-world risk to insider threats or compromised DBA-level accounts.
Full takeover of MySQL Server and MySQL Cluster 9.7.0-9.7.1 is achievable via a local, low-privileged attacker exploiting a flaw in the Server: Configurator component, provided a second user interacts during the attack window. The CVSS 3.1 score of 6.7 reflects the high attack complexity and local-only vector, which meaningfully constrain real-world exploitability despite the high-impact outcome (C:H/I:H/A:H). No public exploit code has been identified at time of analysis, and CISA KEV confirmation is absent.
Full takeover of MySQL Server and MySQL Cluster is possible through a difficult-to-exploit vulnerability in the Clone Plugin component, requiring a high-privileged attacker with network access via multiple protocols. Affected are MySQL Server versions 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster versions 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. No public exploit code or CISA KEV listing has been identified at time of analysis; risk is tempered by the AC:H/PR:H exploitation prerequisites, though the full CIA:H/H/H impact warrants priority patching in environments using the Clone Plugin.
Full takeover of Oracle Autonomous Health Framework is achievable by a highly privileged local attacker under difficult exploitation conditions in versions 26.0.0 through 26.2.0, specifically within the Developer triaging platform component. Successful exploitation requires both high infrastructure privileges and active human interaction from a separate user, making opportunistic attacks unlikely. No public exploit code or CISA KEV listing has been identified; this vulnerability appears to be a low-frequency, targeted risk rather than a widespread exploitation concern.
JavaFX in Oracle Java SE 8u491 exposes a limited confidentiality breach to unauthenticated network attackers who can induce a user into executing untrusted Java content within a sandboxed client environment. The impact is strictly read-only access to a subset of sandbox-accessible data - no integrity or availability consequences are present. No public exploit has been identified at time of analysis, CISA has not listed this in KEV, and the high attack complexity alongside mandatory user interaction makes opportunistic or automated exploitation unlikely.
Oracle Cost Management V16 (Enterprise Command Center component) exposes critical data to compromise by network-accessible, high-privileged attackers over HTTP. Successful exploitation grants unauthorized read access to all accessible data and the ability to create, delete, or modify critical records within the application - a dual confidentiality and integrity impact. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog, though it was disclosed as part of Oracle's CPU July 2026 advisory cycle.
Unauthorized data read in the JavaFX component of Oracle Java SE 8u491 allows a remote unauthenticated attacker to access a subset of Oracle Java SE data by luring a victim into interacting with a malicious sandboxed Java Web Start application or Java applet. The attack is constrained exclusively to client-side Java deployments that run untrusted code within the Java sandbox, with high exploitation complexity (AC:H) and mandatory user interaction (UI:R) further limiting real-world reach. No public exploit code and no CISA KEV listing have been identified at time of analysis; the CVSS 3.1 score of 3.1 (Low) accurately reflects the narrow, confidentiality-only impact.
Oracle VM VirtualBox 7.2.12 contains a Core component vulnerability exploitable by high-privileged local attackers that produces a scope change, potentially compromising systems beyond VirtualBox itself. Successful exploitation yields complete confidentiality loss of all VirtualBox-accessible data and a partial denial of service, making this an isolation-breach risk in multi-tenant or shared virtualization environments. No public exploit identified at time of analysis, and the AC:H rating signals difficult exploitation, but the scope change (S:C) elevates real-world concern for environments where VirtualBox hosts sensitive guest workloads.
Oracle VM VirtualBox 7.2.12 Core component allows a low-privileged local attacker, under high-complexity conditions, to break VM isolation boundaries and compromise data integrity of the hypervisor and potentially adjacent systems. Successful exploitation can result in unauthorized creation, deletion, or modification of critical VirtualBox-accessible data, along with partial denial of service. No public exploit has been identified and this CVE is not listed in CISA KEV at time of analysis, but the scope change (S:C) elevates priority in multi-tenant or shared-host VirtualBox deployments where VM boundary integrity is a security guarantee.
Oracle Application Object Library (AOL), the foundational Core framework component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, permits a network-authenticated low-privileged user to bypass authorization controls and perform unauthorized read, insert, update, or delete operations on data outside their assigned access scope. Tagged as an Authentication Bypass by ENISA EUVD-2026-46560, the flaw is reachable over HTTP with no attack complexity and no user interaction required beyond a valid low-privilege session. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the low-complexity, broadly network-accessible nature of the flaw in a widely deployed enterprise ERP platform warrants prompt application of Oracle's July 2026 Critical Patch Update.
Cross-site or client-side injection in Oracle PeopleSoft Enterprise PeopleTools Panel Processor (versions 8.61 and 8.62) enables unauthenticated remote attackers to achieve limited unauthorized data read and write access by luring an authenticated user into interacting with a crafted HTTP request. The attack requires no privileges and no special configuration, but depends on human interaction from a victim - consistent with a reflected attack surface in the Panel Processor UI component. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog. Despite the 'Authentication Bypass' tag, the CVSS vector and impact scope indicate this is a partial, integrity-and-confidentiality-affecting client-side flaw rather than a full authentication bypass.
Oracle Workflow Notification Mailer in E-Business Suite versions 12.2.3 through 12.2.15 exposes a denial-of-service and limited data manipulation condition exploitable only by a high-privileged, local attacker under complex circumstances. Successful exploitation can cause a complete hang or repeatable crash of the Workflow service, alongside minor unauthorized read and write access to a subset of its data. No public exploit or active exploitation has been identified at time of analysis, and Oracle classifies this as difficult to exploit.
Oracle Java SE's Security component across versions 8u491 through 26.0.1 - and GraalVM for JDK/Enterprise Edition counterparts - contains an authentication bypass that allows unauthenticated network attackers to perform unauthorized read and write operations against data accessible by the Java runtime. Oracle classifies this as 'easily exploitable' via multiple protocols with no user interaction required, reachable either through server-side web services consuming Security APIs or through sandboxed Java Web Start and applet clients loading untrusted code. No public exploit code or CISA KEV listing has been identified at time of analysis, but the no-complexity network vector across a ubiquitous technology warrants priority patching.
Unauthorized read and write access to Oracle Access Manager data is achievable by unauthenticated remote attackers through a network-accessible HTTP attack against the Authentication Engine component, affecting versions 12.2.1.4.0 and 14.1.2.1.0. The vulnerability carries a scope change, meaning successful exploitation can impact products beyond Oracle Access Manager itself - consistent with an authentication-layer flaw such as open redirect or reflected cross-site scripting that can compromise dependent applications sharing the SSO context. No public exploit code has been identified at time of analysis, and this CVE is not currently listed in the CISA KEV catalog.
MySQL Server and MySQL Cluster's Optimizer component can be crashed or hung by a high-privileged attacker with network access, resulting in complete denial of service. Affected deployments span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, as well as MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, per Oracle's July 2026 Critical Patch Update. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, making real-world exploitation contingent on access to high-privileged database credentials.
Oracle Workflow's Notification Mailer component within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) contains a locally-exploitable flaw that enables a low-privileged attacker with infrastructure logon access to partially corrupt workflow data and degrade service availability. The CVSS score of 3.6 reflects the real-world difficulty: local access is mandatory, attack complexity is rated High, and no confidentiality exposure exists. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, making this a low-priority operational finding relative to typical enterprise vulnerability backlogs.
Denial of service in Oracle MySQL Server and MySQL Cluster allows any low-privileged authenticated attacker with network access to hang or repeatably crash the database service by exploiting a flaw in the Optimizer component. Affected deployments span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, per Oracle's July 2026 Critical Patch Update. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, the low attack complexity and minimal privilege requirement make this a credible availability risk for any deployment with externally or internally accessible database accounts.
Oracle VM VirtualBox 7.2.12 Core component allows a low-privileged local user to repeatedly crash or hang the hypervisor, causing a complete denial of service against all guest virtual machines running on the affected host. This vulnerability is not listed in the CISA KEV catalog and no public exploit code has been identified at time of analysis. The practical blast radius is limited to shared-access VirtualBox hosts where untrusted or semi-trusted local accounts exist, which is more common in developer workstations than hardened production environments.
Confidentiality breach in the JDBC component of Oracle Database Server allows an unauthenticated attacker positioned on the same physical communication segment to bypass authentication and gain complete read access to JDBC-accessible data, including critical database contents. Affected deployments span three major release lines: 19c (19.3-19.31), 21c (21.3-21.22), and 23ai (23.4.0-23.26.2). Exploitation requires both network adjacency and human interaction from a legitimate user, and a successful attack can extend its impact beyond JDBC itself to additional connected products due to a scope change. No public exploit code or CISA KEV listing has been identified at time of analysis.
Integrity compromise in Oracle Database Server's JDBC component allows unauthenticated network attackers to create, delete, or modify critical data or all JDBC-accessible data via Oracle Net. Affected releases span three supported branches: 19.3-19.31, 21.3-21.22, and 23.4.0-23.26.2. Exploitation requires human interaction from a party other than the attacker, limiting opportunistic mass exploitation; no public exploit code or CISA KEV listing has been identified at time of analysis.
Partial denial-of-service in the 2D component of Oracle Java SE and GraalVM platforms allows unauthenticated remote attackers to degrade availability via multiple network protocols. Affected versions span Java SE 8u491 through 26.0.1 and GraalVM for JDK 17.0.19/21.0.11, but exploitation is restricted to sandboxed client-side deployments - specifically Java Web Start applications or applets loading untrusted code - making the practical attack surface narrow given the near-obsolescence of these technologies. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV.
Oracle VM VirtualBox 7.2.12 Core component contains a local integrity vulnerability enabling a highly privileged attacker with host logon access to make unauthorized modifications to VirtualBox-accessible data, with potential cross-boundary impact on additional products due to scope change (S:C). The constraint to local, high-privilege access (AV:L/PR:H) limits the realistic threat surface to insider threats or post-compromise scenarios on hypervisor hosts. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Local exploitation of the Core component in Oracle VM VirtualBox 7.2.12 allows a low-privileged attacker to perform unauthorized creation, deletion, or modification of critical VirtualBox data and cause a partial denial of service - provided a second user's interaction can be induced. Oracle disclosed this in the July 2026 Critical Patch Update (CPU), classifying it as easily exploitable under those local conditions. No public exploit code or active exploitation has been identified at time of analysis, and the mandatory human-interaction requirement (UI:R) materially constrains unassisted or automated attacks.
Unauthorized data disclosure in Oracle PeopleSoft Enterprise PeopleTools (PIA Core Technology component) allows a high-privileged attacker with HTTP network access to read critical or all accessible PeopleSoft data. Affecting supported versions 8.61 and 8.62, Oracle classifies this as easily exploitable despite the PR:H requirement, yielding a CVSS 3.1 score of 4.9 with confidentiality-only impact. No public exploit code and no CISA KEV listing exist at time of analysis; however, the 'Authentication Bypass' tag in the advisory metadata warrants attention in environments with multiple admin-tier users.
Integrity compromise in Oracle Database Server's embedded Java VM component allows network-connected attackers holding only the Create Session privilege to arbitrarily create, delete, or modify critical data or all Java VM-accessible data within the database. All three actively supported release lines are affected - 19.3 through 19.31, 21.3 through 21.22, and 23.4.0 through 23.26.2 - as confirmed in Oracle's July 2026 Critical Patch Update. Oracle explicitly characterizes this as 'easily exploitable,' and no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthorized data manipulation in Oracle Database Server's RDBMS component allows a highly privileged, network-connected attacker to perform insert, update, or delete operations against a subset of data accessible within the database. Affected versions span the 19.3-19.31, 21.3-21.22, and 23.4.0-23.26.2 release trains, all reachable over Oracle Net without user interaction. No public exploit has been identified at time of analysis; with a CVSS 3.1 score of 2.7 and integrity-only impact, the risk is primarily relevant to environments where high-privileged database credentials may be compromised or misused.
Limited integrity compromise in the JavaFX component of Oracle Java SE 8u491 allows unauthenticated remote attackers to perform unauthorized data manipulation through a high-complexity, user-interaction-dependent attack path. The attack surface is narrowly scoped to client-side deployments - specifically sandboxed Java Web Start applications or Java applets that load and run untrusted code from the internet; server-side deployments loading only trusted code are explicitly excluded. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, consistent with its low CVSS score of 3.1 and the demanding exploitation prerequisites.
Integrity bypass in Oracle Java SE's JavaFX component (version 8u491) allows a network-reachable unauthenticated attacker to perform limited unauthorized data modifications against clients running sandboxed Java Web Start applications or sandboxed Java applets. The attack requires high complexity and mandatory user interaction, constraining its practical impact to low-severity integrity effects (CVSS 3.1 score: 3.1). No public exploit code or active exploitation via CISA KEV has been identified at time of analysis; server-side Java deployments are explicitly excluded from the attack surface by Oracle.
Partial availability disruption in Oracle Siebel CRM End User (Redwood UI component, versions 24.4 through 26.3) can be triggered by a highly privileged network attacker over HTTP under difficult exploitation conditions that also require victim interaction, potentially causing cascading availability degradation in interconnected systems due to a confirmed scope change. The CVSS 3.1 base score of 2.6 (Low) reflects the extremely restrictive prerequisite chain - high privileges, user interaction, and high attack complexity must all align. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Sandbox integrity bypass in the JavaFX component of Oracle Java SE 8u491 allows network-reachable unauthenticated attackers to perform unauthorized write, insert, or delete operations against data accessible within the Java security context. Exploitation is structurally constrained to client-side deployments running sandboxed Java Web Start applications or Java applets that load and execute untrusted code from the internet - server-side Java deployments running only administrator-installed code are explicitly outside the attack surface. No public exploit code exists and this CVE is not listed in the CISA KEV catalog; the low CVSS 3.1 score of 3.1 accurately reflects the narrow, integrity-only impact combined with high attack complexity and mandatory user interaction.
Partial denial-of-service in Oracle Java SE's Libraries component allows unauthenticated network attackers to disrupt availability across a broad range of supported versions, including the current releases 25.0.3 and 26.0.1. The attack surface is unusually wide: exploitation is possible through any protocol supported by the JVM, via APIs exposed in the Libraries component, through web services that internally invoke those APIs, and through the sandboxed Java Web Start or applet execution path when loading untrusted code. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the trivial exploitation conditions (AC:L/PR:N/UI:N) and the ubiquity of Java deployments elevate realistic risk beyond the moderate CVSS score alone.
Cross-site scripting or client-side injection in the Panel Processor component of Oracle PeopleSoft Enterprise PeopleTools 8.62 permits a low-privileged, authenticated network attacker to compromise confidentiality and integrity of accessible PeopleTools data - and, due to a scope change, potentially additional Oracle products - when a victim user interacts with attacker-controlled content. The attack vector is HTTP, requires no elevated complexity, and is classified as easily exploitable. No public exploit code or active exploitation has been identified at time of analysis; Oracle disclosed this via the Critical Patch Update for July 2026.
Unauthorized partial data read in Oracle Siebel CRM Deployment (Application Interface component) is achievable by low-privileged, network-adjacent authenticated attackers over HTTP across versions 17.0 through 26.4. Exploitation is difficult due to high attack complexity and a mandatory human-interaction requirement, limiting exposure to targeted scenarios rather than opportunistic mass exploitation. No public exploit code or active exploitation has been identified at time of analysis; the low CVSS score of 2.6 reflects the constrained, confidentiality-only impact.
Integrity compromise in Oracle Java SE's ImageIO component allows unauthenticated remote attackers to perform unauthorized data modification against a broad range of Java SE and GraalVM versions. Exploitation requires high attack complexity, limiting opportunistic mass exploitation, but the scope spans ten distinct supported releases across Java SE 8 through 26 and both GraalVM product lines. No public exploit has been identified and this vulnerability is not listed in CISA KEV; however, the low CVSS score of 3.7 belies a moderately wide attack surface given Java's deployment footprint.
Unauthorized data exposure in Oracle Agile PLM 9.3.6 allows a remote unauthenticated attacker to compromise the confidentiality of all PLM-accessible data via HTTP, provided human interaction from a victim user is achieved. The vulnerability resides in the Folders, Files & Attachments component and is tagged as an Authentication Bypass, meaning access controls protecting sensitive product lifecycle and supply chain data can be circumvented without credentials. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero privilege requirement make this a meaningful risk for Oracle Agile PLM deployments exposed to untrusted networks.
Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 expose an authentication bypass in the UI Framework component, reachable over HTTPS without credentials. Unauthenticated remote attackers who satisfy the high-complexity attack precondition can gain complete read access to all data visible within the OEM platform - a significant exposure given OEM's privileged visibility into monitored databases, hosts, and infrastructure credentials. No public exploit has been identified at time of analysis, and no CISA KEV listing exists, but the Authentication Bypass classification warrants prioritized patching in environments where the OEM console is network-accessible.
Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 expose an authorization bypass in the Web Services Framework component, allowing low-privileged authenticated attackers to access and manipulate restricted data over HTTPS. Despite requiring valid credentials, the flaw circumvents authorization controls, enabling unauthorized read of a subset of platform data and unauthorized write/insert/delete operations against accessible records. No public exploit code or active CISA KEV listing has been identified at time of analysis.
Unauthorized data manipulation in Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 is achievable by any low-privileged user with network HTTPS access, specifically through the Metadata Plugin component. The flaw - tagged as an authentication bypass - enables arbitrary creation, deletion, or modification of critical OEM metadata, potentially affecting all data accessible within the platform. No public exploit code or CISA KEV listing exists at time of analysis, but the low attack complexity (AC:L) and absence of required user interaction (UI:N) make this a credible insider or compromised-credential threat in any organization with OEM deployed.
Local access control weakness in Oracle Enterprise Manager Base Platform's Enterprise Config Management component allows low-privileged users with host logon rights to read a subset of OEM-accessible data and perform unauthorized inserts, updates, or deletes against accessible data records. Versions 13.5 and 24.1 are confirmed affected per Oracle's July 2026 Critical Patch Update. No public exploit code and no CISA KEV listing have been identified at time of analysis, and the local-only attack vector substantially constrains real-world exploitation to insider threats or previously compromised accounts.
Unauthenticated information disclosure in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) allows remote attackers to read a subset of accessible platform data via the Agent Next Gen component over HTTPS without credentials. Tagged as an Authentication Bypass, this network-accessible flaw carries a low-complexity attack profile (AV:N/AC:L/PR:N/UI:N), meaning any network-reachable adversary can exploit it with minimal effort. No public exploit code or CISA KEV listing is confirmed at time of analysis, but the absence of authentication requirements and zero attack complexity make this straightforward to operationalize, particularly given that OEM manages critical enterprise infrastructure.
Unauthenticated information disclosure in Oracle Enterprise Manager Base Platform's Agent Next Gen component permits remote attackers to read a subset of platform-accessible data over HTTPS without credentials. Versions 13.5 and 24.1 are confirmed affected per Oracle's Critical Patch Update for July 2026. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis, though the Authentication Bypass tag suggests a structural access control failure rather than a simple misconfiguration.
Unauthenticated information disclosure in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) exposes a subset of platform data to remote attackers via HTTPS. The vulnerability resides in the Agent Next Gen component and is classified as an authentication bypass, enabling network-accessible exploitation without credentials or user interaction. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, its low complexity and zero-authentication requirement make it straightforwardly exploitable by any internet-accessible instance.
Unauthorized data read in Oracle Utilities Network Management System's Mobile component allows low-privileged, network-adjacent attackers to access a subset of confidential NMS data via HTTP. Affected are five distinct version branches spanning 2.5.0.1.x through 25.12.0.0.x, as detailed in Oracle's July 2026 Critical Patch Update. Oracle classifies this as 'easily exploitable,' and the 'Authentication Bypass' tag suggests authorization control weaknesses beyond the low-privilege requirement implied by PR:L; no public exploit or CISA KEV listing exists at time of analysis.
Unauthenticated remote exploitation of the RDBMS component in Oracle Database Server 19c, 21c, and 23ai allows network-accessible attackers to perform unauthorized data manipulation - INSERT, UPDATE, or DELETE - against RDBMS-accessible data via Oracle Net. The CVSS vector (S:C) confirms a scope change, meaning successful exploitation may cascade to additional products or components beyond the targeted database instance. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the zero-barrier network entry (PR:N, AC:L, UI:N) across three actively supported Oracle release families represents a meaningful priority for internet-exposed or multi-tenant Oracle Database environments.
Integrity compromise via TLS in Oracle Java SE's JSSE component allows an unauthenticated remote attacker to perform unauthorized creation, deletion, or modification of critical application data across seven affected Java SE releases and three GraalVM variants. The attack targets the TLS stack directly - not through applets or Web Start - and is tagged as an authentication bypass, suggesting the flaw undermines TLS-level authentication controls within JSSE. No public exploit code and no CISA KEV listing have been identified at time of analysis; the AC:H metric constrains real-world risk to adversaries capable of achieving precise network positioning or TLS session manipulation.
Unauthorized data access and manipulation in Oracle Utilities Network Management System exposes the Security component across five supported release trains to network-based exploitation by low-privileged authenticated users. A successful attack requires human interaction from a victim other than the attacker, enabling partial confidentiality and integrity compromise - specifically unauthorized read access to a subset of NMS data and unauthorized insert, update, or delete operations. No public exploit code exists and this CVE is not listed in the CISA KEV catalog at time of analysis; the 'Authentication Bypass' tag in source intelligence appears to describe privilege escalation within the application rather than full authentication circumvention, given the CVSS PR:L metric.
Denial-of-service in Oracle MySQL Server and MySQL Cluster's DDL component allows a high-privileged, network-connected attacker to cause a complete server hang or repeatable crash under difficult-to-reproduce conditions. Affected product lines span MySQL Server 8.4.x and 9.7.x and MySQL Cluster 8.0.x through 9.7.x, as confirmed in Oracle's July 2026 Critical Patch Update (EUVD-2026-46462). No public exploit or confirmed active exploitation has been identified at time of analysis.
Partial denial-of-service exposure in the JSSE component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows unauthenticated remote attackers to degrade service availability by supplying malformed data via TLS. Affected releases span five Oracle Java SE versions (11.0.31 through 26.0.1) and both GraalVM product lines, as disclosed in Oracle's CPU July 2026 advisory (EUVD-2026-46459). No public exploit identified at time of analysis and no CISA KEV listing; the CVSS 5.3 rating reflects a genuine but bounded availability impact rather than a critical or confidentiality-affecting risk.
Oracle Commerce Service Center 11.4.0 exposes an unauthenticated network-exploitable vulnerability that requires victim interaction and produces a scope change, consistent with a client-side injection or authentication-bypass pattern affecting additional downstream products. Tagged as an authentication bypass by the reporting source, the flaw allows a remote unauthenticated attacker to achieve unauthorized read access to a subset of Commerce Service Center data and unauthorized write, insert, or delete access to some accessible data - outcomes typical of session hijacking or reflected injection chains. No public exploit code has been identified at time of analysis, and this CVE has not been added to the CISA Known Exploited Vulnerabilities catalog.
Unauthorized data disclosure in Oracle Retail Xstore Point of Service 21.0.3 allows a network-based, low-privileged attacker to read a subset of application data via the Xstore Mobile component over HTTP. Tagged as an Authentication Bypass, the flaw suggests a low-privileged authenticated session can exceed its authorized data access scope without elevated rights. No public exploit or active exploitation has been identified at time of analysis, and the CVSS score of 4.3 reflects a moderate, bounded confidentiality risk.
Local privilege information disclosure in Oracle Retail Xstore Point of Service 21.0.3 allows low-privileged users with system logon access to read a subset of Xstore data they are not authorized to view via the Xstore Mobile component. Despite carrying the 'Authentication Bypass' tag, the CVSS vector (AV:L/PR:L) confirms exploitation requires existing local infrastructure access - the bypass likely permits an authenticated low-privilege user to circumvent authorization controls and access restricted data segments. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog, making active exploitation unlikely in the near term.
Missing authorization controls in Kibana's Cloud Connect endpoints allow any authenticated low-privilege user to read and modify Cloud Connect configuration and service settings that should be restricted to users with specific feature privileges. Exploitation occurs via direct HTTP requests to insufficiently protected internal API endpoints, bypassing Kibana's privilege enforcement layer entirely. No public exploit code exists and this vulnerability is not listed in CISA KEV; however, the low barrier - requiring only a valid Kibana account - elevates practical risk in multi-tenant or externally accessible deployments.
kirby-modules through version 5.5.7 exposes the complete plaintext commercial license key to any authenticated Kirby Panel user - including non-admin roles such as editors and authors - via a single GET request to the modules/activate dialog endpoint. The root cause is a missing authorization check (CWE-862) in lib/areas.php: the handler calls ModulesLicense::readKey() without verifying administrator status, relying instead on the access.system permission that defaults to true for all non-admin Panel roles. No active exploitation is confirmed by CISA KEV and no public exploit code has been identified, but the CVSS 4.0 vector (PR:L, AC:L, AV:N) indicates this is trivially reproducible by any Panel account holder, with the primary downstream consequence being unauthorized activation of the plugin on third-party Kirby installations.
Unauthenticated information disclosure in Taiga 6.10.1 exposes the full member roster and internal workflow configuration of private projects to any network-reachable attacker. The filters_data endpoints on four viewsets - UserStory, Task, Issue, and Epic - fail to enforce the authorization controls correctly applied elsewhere in the project API, allowing unauthenticated GET requests parameterized with sequential integer project IDs to return user IDs, full names, and gravatar hashes of private project members. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the trivially automatable enumeration path elevates practical risk for externally accessible deployments.
Token scope enforcement is bypassed on Gitea's repository home page handler (`repo.Home`), exposing private repository README, root file/directory tree, description, language statistics, license, and latest-release data to any authenticated PAT or OAuth2 token that lacks the `repository` scope or is marked `public-only`. This is the third in a series of related incomplete fixes - CVE-2026-20706 and CVE-2026-27761 patched sibling routes (archive download and RSS/Atom feeds) but the home route was overlooked, leaving it without the `CheckRepoScopedToken` guard applied to every neighboring handler. Publicly available exploit code exists in the form of a self-contained Docker-based proof-of-concept published in the vendor advisory; no active exploitation has been confirmed by CISA KEV.
Cross-repository attachment re-linking in Gitea exposes private issue and comment attachments to authenticated attackers who know a victim's attachment UUID. An attacker with issue-editing rights in any repository they can access can inject a victim UUID into the files[] parameter of an issue or comment edit request, causing Gitea to re-link that attachment into the attacker's authorization context; subsequent requests to /attachments/{uuid} then resolve access against the attacker's repository rather than the victim's, delivering the private file. No public exploit code has been identified at time of analysis, but the GHSA advisory (GHSA-6c6r-5xr4-cr5m) includes a detailed step-by-step reproduction runbook. The vendor-released fix is Gitea v1.27.0.
Private repository metadata and issue titles leak to revoked Gitea users via two REST API endpoints that omit post-revocation authorization checks, constituting an incomplete fix relative to CVE-2026-20800. Former collaborators with a still-valid API token can call `GET /api/v1/user/starred` to receive full repository objects - including `clone_url` and `ssh_url` - for private repos they starred, and `GET /api/v1/user/times` to retrieve private issue titles and states for issues on which they logged time, indefinitely after repo access is revoked. Impact is metadata-only; no public exploit code has been identified at time of analysis and no CISA KEV listing exists.
Webhook persistence after collaborator revocation in Gitea (versions prior to 1.27.0) enables a former admin collaborator to receive ongoing real-time exfiltration of private repository content indefinitely after their access is removed. The `DeleteCollaboration()` function cleans watches and assignees but never removes or disables webhooks created by the departing user, and the webhook delivery subsystem fires payloads on every subsequent repository event without re-validating the creator's current access. The attack is invisible to the repository owner, requires no further action by the attacker post-revocation, and was runtime-confirmed on gitea/gitea:1.25.4; no public exploit has been identified at time of analysis.
Incorrect Authorization (CWE-863) in Kibana's Entity Analytics Watchlist feature allows low-privileged authenticated users with read-only Security Solution access to perform unauthorized write operations against watchlist configuration endpoints that should require elevated privileges. The CVSS 5.4 vector (AV:N/AC:L/PR:L/UI:N) confirms network-exploitable but credential-gated exploitation with limited confidentiality and integrity impact; under specific deployment conditions, affected users may additionally access data outside their authorized scope. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Incorrect Authorization (CWE-863) in Elasticsearch's ingest simulation feature allows authenticated users with limited index privileges to bypass per-index access controls and trigger ingest pipeline execution on indices they are not authorized to access directly. Pipeline output - potentially containing enriched or processed sensitive data - is returned to the requestor, and index mapping metadata for restricted indices can also be retrieved through the same mechanism. No public exploit code has been identified at time of analysis; vendor-released fixes are available in versions 8.19.18, 9.3.7, and 9.4.4.
Kibana's authorization layer fails to enforce ACLs correctly in certain code paths, allowing a lower-privileged authenticated user to cause data from restricted Elasticsearch sources to be processed under another user's elevated privileges - effectively a confused deputy attack resulting in unauthorized information disclosure. The CVSS 4.3 (Medium) rating reflects low confidentiality impact and the requirement for a valid Kibana account, but the real-world risk is material in multi-tenant or role-segregated deployments where data isolation is a compliance requirement. No active exploitation confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Concurrent Login Vulnerability in HCL MyCloud permits authenticated users to sustain multiple simultaneous active sessions without invalidation, enabling session hijacking and unauthorized account access. The CVSS score of 3.1 (Low) reflects high attack complexity, a prerequisite of authenticated access, and impact confined to partial confidentiality - no integrity or availability impact applies. No public exploit code and no confirmed active exploitation (CISA KEV) have been identified at time of analysis.
Session cookie exposure in HCL MyCloud arises from the cookie Path attribute not being set, causing authentication tokens to be transmitted to all paths within the application domain rather than restricted to intended endpoints. The CVSS 2.6 score reflects a genuinely limited-impact finding requiring both high attack complexity and authenticated user interaction to exploit, with only low confidentiality impact and no integrity or availability consequences. No public exploit code or active exploitation has been identified at time of analysis.
Privilege escalation in Eclipse hawkBit's Direct Device Integration (DDI) Controller allows any authenticated device to download firmware artifacts beyond those explicitly assigned to it, within the same tenant. The flaw - rooted in missing object-level authorization (CWE-284/CWE-862) - means a valid device credential is sufficient to access arbitrary firmware artifacts belonging to other devices in the same tenant, not just the device's own assigned updates. A secondary enumeration weakness in the software modules listing endpoint compounds the issue by enabling targeted discovery of available artifacts. No public exploit has been identified at time of analysis, and no CISA KEV listing is present.
Authorization bypass in ZS-Admin's multi-tenant API layer allows authenticated remote attackers to read department listing data belonging to other tenants by supplying an arbitrary value in the X-Tenant-Id HTTP header against the /api/system/sys/dept/page endpoint. The root cause is the getTenantId function of the MyBatis-Plus Tenant Plugin trusting a client-controlled header rather than deriving tenant scope from the authenticated session server-side. A public proof-of-concept is available via GitHub issue #5; no vendor patch or acknowledgment has been issued and the project has not responded to the disclosure.
Clickjacking exposure in HCL IntelliOps Event Management (IEM) allows network-based attackers to embed the application inside a malicious webpage via an iframe and deceive authenticated users into performing unintended administrative or operational actions. All tracked versions under the CPE wildcard are affected, per HCL advisory KB0132378. No public exploit identified at time of analysis, and the CVSS score of 3.1 (Low) reflects the non-trivial attack complexity and limited integrity-only impact.
Validation bypass in Ninja Forms WordPress plugin 3.14.8 allows unauthenticated remote attackers to submit arbitrary content to any form by overriding server-side field definitions at the client layer before validation executes. By crafting a malicious AJAX payload targeting the WordPress nopriv (unauthenticated) AJAX endpoint, an attacker can strip required-field flags, override field types, and neutralize CAPTCHA protections - causing form actions such as email notifications and database writes to fire with fully attacker-controlled data. No public exploit code has been identified at time of analysis, and this vulnerability is not currently listed in the CISA KEV catalog, though the trivial attack complexity and zero-authentication requirement make opportunistic abuse straightforward.
Missing RBAC authorization on the ZenML 0.94.2 `get_deployed_stack` endpoint allows any authenticated user to enumerate all deployed stacks across all users and tenants. The root failure is twofold: the HTTP handler lacks endpoint-level authorization, and the internal server-side `Client()` object bypasses the RBAC enforcement layer by querying `SqlZenStore` directly, making tenant isolation ineffective. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified, but the low attack complexity and cross-tenant data exposure make this a meaningful risk in ZenML Pro/Cloud multi-tenant deployments.
Missing authorization in Universal Software Inc. FlexCity (versions 5.536.0 through 11052026) exposes sensitive data to low-privileged authenticated users who can bypass access control security levels. The vulnerability (CWE-862) allows network-accessible exploitation with low attack complexity, resulting in high confidentiality impact with no integrity or availability loss. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the low-privilege network vector makes this a realistic internal threat in any environment running affected versions.
Missing capability checks in the Tutor LMS Elementor Addons WordPress plugin (Themeum) allow any authenticated WordPress user with Subscriber-level access or higher to activate the Tutor LMS and Elementor plugins without administrative authorization. Affected are all versions through 4.0.0, confirmed by Wordfence threat intelligence. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, and real-world impact is constrained by the requirement for a valid WordPress account.
Improper permission enforcement in Checkmk's Business Intelligence (BI) module allows any authenticated low-privileged user to view and modify BI packs and rules regardless of their assigned permission set. Affected versions span four release branches - 2.5.0 through 2.5.0p8, 2.4.0 through 2.4.0p33, 2.3.0 through 2.3.0p48, and the end-of-life 2.2.0 branch - creating an access control bypass in a core monitoring configuration surface. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Subscriber-level users on WordPress sites running WPBot before 8.2.0 can modify the plugin's retrieval-augmented-generation (RAG) configuration without authorization, because the relevant settings handler performs neither a WordPress capability check nor a nonce validation. A publicly available proof-of-concept lowers the exploitation bar significantly, making this actionable for any low-skill attacker who holds or can self-register a subscriber account on the target site. No public exploit identified at time of analysis by CISA KEV, but POC availability combined with low access requirements makes remediation a priority for sites with open user registration.
Academy LMS WordPress plugin versions prior to 3.8.1 exposes an Insecure Direct Object Reference (IDOR) flaw across multiple lesson AJAX handlers, allowing any subscriber-level authenticated user to read and overwrite other users' lesson notes and fraudulently mark course content as completed on their behalf. The vulnerability affects all Academy LMS installations running an unpatched version and is worsened by a publicly available exploit published via WPScan, though no active exploitation has been confirmed through CISA KEV. In environments where course completion carries compliance, certification, or audit significance, the integrity impact exceeds what the Medium CVSS score alone conveys.
Insecure Direct Object Reference (IDOR) in the Classified Listing WordPress plugin before 5.3.9 exposes payment receipt data across arbitrary user accounts. Any authenticated user holding subscriber-level access - the default role assigned upon registration on most WordPress sites - can query the payment-receipt handler with any order ID and receive full receipt details belonging to another user, because no ownership check is performed. A publicly available exploit exists per WPScan, and a vendor-released patch at version 5.3.9 is available; no KEV listing is present at time of analysis.
Unauthenticated workflow replay in the Bit Form WordPress plugin (versions before 3.1.0) allows external attackers to re-trigger any form's configured workflow actions - including notification emails and third-party service integrations - by submitting an expired workflow-trigger token that the plugin fails to properly reject. The root cause is missing authorization enforcement at the token-validation layer after WordPress transient expiry, classified under CWE-862. No public exploitation in CISA KEV is recorded, but a publicly available proof-of-concept exists per WPScan, elevating operational risk for sites with high-value workflow integrations such as CRM hooks or payment notifications.
ACL bypass in kronosnet (versions ≤ 1.34) allows remote unauthenticated attackers to inject arbitrary data packets into cluster communication channels under a specific dual-condition deployment configuration. By spoofing a valid link ID in crafted network frames, an attacker circumvents the ACL subsystem entirely, potentially causing data corruption or service instabilities in clustering stacks shipped with Red Hat Enterprise Linux 8, 9, 10 and OpenShift Container Platform 4. No public exploit code and no active exploitation have been identified at time of analysis.
Apple's Find My backend service allows an attacker who holds a valid PET (Private Endpoint Token) to enumerate devices on an Apple ID account and silently remove offline devices without triggering two-factor authentication or ownership verification - a CWE-287 Improper Authentication flaw. The vulnerability affects the service through at least December 17, 2025, with researcher-published proof-of-concept code on GitHub demonstrating the technique. EPSS sits at 0.19% (9th percentile) and the vulnerability is not listed in CISA KEV, pointing toward targeted rather than opportunistic exploitation; however, the account-manipulation impact makes it meaningful for high-value Apple ID targets.
Cross-tenant self-service signup bypass in Microsoft Azure API Management (through 2025-10-17) lets remote unauthenticated actors register developer-portal accounts against a tenant where signup was disabled in the UI, by swapping the Host header or tenant identifier to reuse another tenant's still-live registration endpoint. Publicly available proof-of-concept exploit code exists (GHSA-vcwf-73jp-r7mv), but Microsoft evaluated the report and determined the behavior did not cross a security boundary, calling it a configuration/state issue rather than a product vulnerability affecting tenant isolation. No public in-the-wild exploitation has been identified, and the EPSS probability is low (0.18%, 7th percentile).
Unauthenticated triggering of all configured scheduled jobs in Grav CMS's scheduler-webhook plugin is possible due to a null short-circuit logic flaw in webhook token validation, allowing any network-reachable attacker to execute operator-defined commands under the web server process account via a single POST request. The affected component is the scheduler-webhook plugin for Grav CMS, a PHP flat-file CMS; the CVSS 4.0 vector (AC:H/AT:P) confirms exploitation requires the plugin to be installed with configured jobs and an exposed endpoint - not a default Grav deployment. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Rsync daemon before version 3.4.3 allows hostname-based access control rules to be silently bypassed when the daemon is configured with chroot and the chroot directory lacks the files glibc requires for DNS resolution. When resolution fails inside the chroot, the client hostname is set to "UNKNOWN", which never matches administrator-defined "hosts deny" hostname patterns, effectively nullifying those rules. An attacker who controls the PTR record for their source IP can exploit this to connect to an rsync module they were explicitly denied access to; no public exploit code is identified and this is not listed in CISA KEV.
Incorrect authorization in Vercel's @ai-sdk/harness-codex package (prior to 1.0.29) allows untrusted code executing inside a Codex CLI sandbox to invoke arbitrary host-exposed tools - including secret lookups, deployment operations, and cloud API calls - without a corresponding model-authorized tool-call event. The relay server validates incoming requests solely by checking whether the requesting process's command line contains the Codex CLI shim path via Linux /proc, a condition any sandbox process can trivially forge by including the shim path in its own argv. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but the supply-chain threat vector via malicious npm lifecycle hooks or build scripts is realistic for developer environments processing untrusted repositories.
Sandbox authorization bypass in Vercel's `@ai-sdk/harness-opencode` (all versions prior to 1.0.28) permits untrusted code executing inside the OpenCode sandbox to invoke arbitrary host-exposed tools — including secret lookups, deployment operations, and cloud API calls — without a corresponding model-authorized tool-call event. The flawed process-path fallback reads `/proc/<pid>/cmdline` on Linux to verify the requesting process's command line contains the `host-tool-mcp.mjs` script path, a check that sandboxed attacker-controlled code can satisfy or spoof. No public exploit code has been identified at time of analysis, and the issue is remediated in v1.0.28 by replacing the path check with short-lived one-time authorization tokens bound to bridge-observed model events.
Cookie injection in Adminer before 5.4.3 allows network-accessible, unauthenticated attackers to manipulate Set-Cookie path attributes by injecting arbitrary values through the unsanitized X-Forwarded-Prefix HTTP header, enabling downgrade of SameSite protection and subsequent cross-origin authenticated requests against victim sessions. Exploitation is gated on a misconfigured reverse proxy that forwards attacker-controlled header values and requires passive user interaction (UI:P per CVSS 4.0), making this a realistic but non-trivial attack path. No active exploitation confirmed (not in CISA KEV) and no public exploit code identified at time of analysis; vendor-released patch is available as version 5.4.3.
Unauthenticated access to FreeScout's email open-tracking endpoint (`GET /thread/read/{conversation_id}/{thread_id}`) allows remote attackers to enumerate valid conversation and thread IDs and manipulate the `opened_at` timestamp on arbitrary threads. All FreeScout deployments prior to version 1.8.219 are affected. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Two-factor authentication bypass in Webmin prior to version 2.640 allows a network attacker holding valid username and password credentials to gain full administrative access by sending requests via the HTTP Basic authentication code path, which skips TOTP enforcement entirely. All Unix-like systems running Webmin with 2FA enabled on any account are affected, making this particularly dangerous in environments where 2FA was deployed as the primary compensating control against credential exposure. No active exploitation has been confirmed via CISA KEV, and no public exploit code was identified in the provided data at time of analysis.
Improper authorization in dataCycle-CORE versions up to and including 25.07.3 allows any Standard user to enumerate the full names and email addresses of other users - including internal staff, guest accounts, and external test accounts - via the `/users/search` endpoint, bypassing access controls that correctly deny direct user profile access. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms low-complexity network exploitation by any authenticated Standard user with no user interaction required. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.
Authorization bypass in SurrealDB's KILL statement before version 3.1.0 allows any authenticated database-level user to silently terminate other users' LIVE SELECT real-time subscriptions by targeting their live query UUIDs, with no ownership verification performed. The affected user receives no notification of termination, breaking real-time data pipelines and multi-tenant isolation guarantees - a low-privilege record-scoped user can disrupt a root user's monitoring subscriptions within the same database. Discovered during a cure53 code audit and penetration test; no public exploit code or CISA KEV listing exists at time of analysis.