Authentication Bypass
Monthly
Kimai's Team API endpoints fail to validate entity-level ownership due to incorrect Symfony IsGranted attribute syntax, allowing users with the edit_team permission to modify any team regardless of membership. The vulnerability arises because API endpoints use #[IsGranted('edit_team')] instead of #[IsGranted('edit', 'team')], causing the TeamVoter to abstain and fall back to role-only permission checks. In default configurations this is unexploitable since only admins hold edit_team permission, but if administrators grant edit_team to lower-privilege roles (such as ROLE_TEAMLEAD) via the permissions UI, those users can modify team memberships, customer assignments, project assignments, and activity assignments for any team without authorization. No public exploit code or active exploitation has been identified.
Liaison Site Prober plugin for WordPress allows unauthenticated attackers to retrieve sensitive audit log data including IP addresses, user IDs, usernames, and login events through an improperly secured REST API endpoint (/wp-json/site-prober/v1/logs) in all versions up to 1.2.1. The vulnerability stems from a permission callback that unconditionally returns true without validating user capabilities, enabling information disclosure with network-level access and no authentication required. No public exploit code or active exploitation has been identified at time of analysis.
HubSpot All-In-One Marketing plugin for WordPress (versions up to 11.3.32) exposes sensitive information via the class-adminconstants.php file, allowing authenticated users with Contributor-level access or higher to retrieve a complete list of installed plugins and their versions. This information disclosure enables reconnaissance for follow-on attacks targeting vulnerable plugins, though exploitation requires valid WordPress authentication and contributor-level privileges.
Insecure Direct Object Reference in Booking Calendar Contact Form plugin for WordPress (all versions up to 1.2.63) allows authenticated attackers with Subscriber-level privileges to hijack other users' calendars and access associated user data by exploiting missing validation on user-controlled keys in the dex_bccf_admin_int_calendar_list.inc.php file. The CVSS score of 5.3 reflects network-accessible exploitation without user interaction, though the vulnerability requires valid WordPress authentication at Subscriber level or higher.
Unauthenticated attackers can modify the custom post type slug for the HM Books Gallery plugin in WordPress versions up to 4.8.0 by submitting a crafted POST request to the admin_init hook, bypassing all capability and nonce checks. This vulnerability allows modification of the 'wbg_cpt_slug' option without authentication, changing the URL structure for all book entries, breaking existing links, and degrading SEO rankings. No public exploit code or active exploitation has been identified at the time of analysis.
MaxiBlocks Builder plugin for WordPress up to version 2.1.8 allows authenticated attackers with Author-level access to delete arbitrary files in the wp-content/uploads directory via the 'maxi_remove_custom_image_size' AJAX action due to insufficient file ownership validation. This enables deletion of media uploaded by other users and administrators without proper authorization checks, violating file integrity despite the CVSS 5.3 score reflecting limited direct impact.
ExactMetrics Google Analytics Dashboard for WordPress versions up to 9.1.2 allow authenticated subscribers to retrieve Google Ads access tokens and reset Google Ads integration settings through missing authorization checks in AJAX handlers. Although a nonce is verified, two AJAX endpoints (get_ads_access_token and reset_experience) lack the capability checks present in similar endpoints, enabling attackers with subscriber-level access to perform administrative actions. The CVSS vector (AV:N/AC:L/PR:N/UI:N) reflects network-accessible unauthenticated exploitation, but the description indicates authenticated subscriber access is required, creating a discrepancy between reported CVSS and actual attack prerequisites.
BetterDocs plugin for WordPress versions up to 4.3.11 allows authenticated subscribers and higher to trigger arbitrary OpenAI API calls using the site's configured API key due to missing capability checks in the generate_openai_content_callback() function. An attacker with subscriber-level access can supply arbitrary prompts to exhaust the site owner's paid AI API quota without authorization, resulting in unauthorized financial impact and service degradation. No public exploit code or active exploitation has been identified at time of analysis.
Xibo CMS before version 4.4.1 allows authenticated users to bypass access controls and view campaigns, regions, and reports belonging to other users by manually constructing preview URLs. The vulnerability affects any authenticated user with Layout Management, Campaign Management, or Report viewing privileges and results in unauthorized information disclosure with no impact on data integrity or availability.
Lightspeed Classroom v5.1.2.1763770643 contains a client-side authorization flaw that allows unauthenticated remote attackers to impersonate users and bypass integrity checks on client-generated authorization tokens, enabling unauthorized remote control and monitoring of student devices. The vulnerability requires high attack complexity and affects confidentiality and integrity with limited scope impact (CVSS 5.4). Despite a high CVSS score, the EPSS score of 0.03% indicates minimal real-world exploitation probability, suggesting this requires specific technical conditions or targeted attack scenarios rather than widespread automated exploitation.
Broken access control in ClassroomIO v0.1.13 allows authenticated low-privileged students to disclose sensitive course information including other students' details, tutor/admin profiles, and internal metadata by modifying API requests from POST to GET against the PostgREST endpoint. The vulnerability requires valid student account credentials but no special privileges, enabling unauthorized horizontal and vertical access escalation within course contexts.
Institution administrators with Site staff role in Mahara can impersonate institution members in other institutions where they lack administrative privileges, bypassing intended access controls on multi-tenanted deployments. Affects Mahara versions before 24.04.10 and 25.x before 25.04.1. This requires high-privilege authentication (Site staff role) and does not involve network exploitation of unauthenticated services, limiting real-world attack surface to insider threats within organizations running affected versions.
KDE Arianna's bookserver before version 26.04.1 allows local attackers to read arbitrary files over socket connections by guessing URLs without authentication, exploiting missing input validation on the bookserver endpoint. The vulnerability requires local access and does not affect confidentiality of other system components; no public exploit code or active exploitation has been identified.
Authenticated users in Rocket.Chat versions prior to 8.4.0, 8.3.2, 8.2.2, 8.1.3, 8.0.4, 7.13.6, 7.12.7, 7.11.7, and 7.10.10 can read application engine logs via the /api/apps/logs and /api/apps/:id/logs endpoints due to a typo in permission validation logic. The vulnerability allows authenticated attackers with insufficient privileges to bypass authorization checks and access sensitive logs containing partial information, with no public exploit confirmed at time of analysis.
Slack thread context injection in OpenClaw before 2026.4.2 allows non-allowlisted Slack users to insert arbitrary messages into the AI agent's model context by exploiting a gap in sender-allowlist enforcement on thread history. The sender allowlist - intended to gate which Slack users can interact with the agent - is applied to the triggering message but not to thread-starter or thread-history content fetched via the Slack conversations.replies API, enabling context manipulation when an allowlisted user replies in a thread containing the attacker's messages. A public proof-of-concept exists; however, no public exploit identified at time of analysis maps to confirmed active exploitation, and EPSS sits at 0.01% (2nd percentile).
OpenClaw's gateway `device.token.rotate` method rotates device credentials without disconnecting live WebSocket sessions authenticated under the old token, leaving a post-compromise revocation gap in all npm `openclaw` releases up to and including 2026.3.28. An attacker who has already obtained valid device credentials and established an active WebSocket connection can maintain unauthorized gateway access indefinitely after an operator rotates the token - effectively nullifying the revocation action. No public exploit exists and CISA SSVC rates exploitation as none with partial technical impact; the low CVSS 4.0 score of 2.3 and EPSS of 0.03% (7th percentile) confirm this as a low-priority, post-compromise control gap rather than an initial access vector.
Replay detection bypass in the OpenClaw npm package (versions ≤ 2026.3.28) allows an attacker who has previously captured a valid Telnyx-signed webhook to re-encode the Ed25519 signature from standard Base64 to Base64URL and resubmit the payload as an apparently unreplayed request. Because Ed25519 cryptographic verification operates on the decoded byte sequence, both encodings pass signature validation; only the replay cache lookup - keyed on the raw uncanonicalised header string - is defeated, enabling duplicate event processing. No public exploit has been identified at time of analysis and EPSS stands at 0.03% (8th percentile), consistent with SSVC Exploitation: none and the maintainer's own normalized severity of low.
Session visibility bypass in OpenClaw (npm) versions through 2026.3.28 permits authenticated agents to read session metadata beyond their authorized scope by invoking session_status outside a sandboxed context. The visibility guard in session-status-tool.ts was conditionally applied only for sandboxed invocations or session-ID-resolved lookups, leaving unsandboxed callers entirely ungated against the tools.sessions.visibility policy. The maintainer triaged this as a same-agent session-policy bypass rather than a host-boundary breach; no public exploit exists and SSVC/EPSS signals indicate no active exploitation pressure.
OpenClaw's Discord integration (npm package, versions <= 2026.3.28) exposes an authorization bypass where authenticated Discord users invoke slash commands or trigger autocomplete in group DM channels outside the configured allowlist, circumventing the `dm.groupChannels` restriction in both the command dispatch and autocomplete paths. The impact is bounded: exploitation requires an already-authorized Discord user and a deployment with group DM allowlisting actively configured, limiting the trust boundary crossed to channel-level access rather than a broader privilege escalation. EPSS is 0.03% (7th percentile) and SSVC classifies exploitation as none; no public exploit code exists and the issue is not in CISA KEV.
Privilege escalation in OpenClaw's chat.send gateway endpoint allows write-scoped API callers to bypass authorization controls and persist admin-only verboseLevel session overrides via the /verbose parameter. All OpenClaw npm package versions up to and including 2026.3.24 are affected; the vendor-released fix is version 2026.3.28. No public exploit code has been identified at time of analysis, and CISA SSVC assessment confirms no active exploitation with only partial technical impact, aligning with an EPSS score in the 14th percentile.
Incorrect channel type routing in OpenClaw's Discord extension (versions up to 2026.3.28) allows authenticated Group DM participants to bypass Group DM policy enforcement by exploiting a logic error that treats Group DMs as regular Direct Messages. The flaw in `extensions/discord/src/monitor/agent-components-helpers.ts` causes the `isDirectMessage` flag to be set based solely on the absence of a guild ID, which is also true for Group DM channels, causing all Group DM-specific authorization checks (the `groupEnabled` toggle and channel allowlist) to be silently skipped. No public exploit exists, this vulnerability is not in the CISA KEV catalog, and EPSS at 0.01% (2nd percentile) reflects negligible exploitation interest.
OpenClaw's Telegram legacy `allowFrom` migration incorrectly propagates default-account trust to all configured named Telegram accounts in npm package versions through 2026.3.28, enabling Telegram users previously trusted only on the default account to bypass authentication controls and interact with named accounts they were never explicitly authorized to access. The vendor-confirmed fix is present in version 2026.3.31, released 2026-03-31. No public exploit exists; EPSS is 0.06% and CISA SSVC records exploitation as none at time of analysis.
Sandbox file-operation escape in OpenClaw npm versions <= 2026.3.28 allows a local low-privileged attacker to delete or create files outside the designated workspace root by winning a symlink-rebind race between path validation and filesystem execution in apply_patch, remove, and mkdir operations. The GHSA maintainer triage confirms the scope is narrow - limited to workspace-only mutation operations - and the fix in 2026.3.31 replaces check-then-act enforcement with atomic fd-safe path-within-root helpers. No public exploit exists and SSVC confirms exploitation status as none, placing real-world priority low despite the high integrity impact rating.
Rate limiting bypass in OpenClaw's WebSocket gateway (npm package ≤ 2026.3.28) allows unauthenticated remote attackers to conduct unbounded brute-force attempts against shared-secret passwords by including a fake DeviceToken field in WebSocket handshake requests, suppressing the IP-based rate limiter. The maintainer's own triage classifies the practical risk as narrow, noting that only deployments relying on weak shared passwords face meaningful threat since high-entropy secrets remain non-bruteforceable regardless of rate limiting. No public exploit code exists, EPSS is 0.04%, and SSVC exploitation status is none - consistent with a low-priority patching target outside of weak-credential deployments.
Kirby CMS's REST API allows authenticated users with the `pages.create` permission to immediately publish pages by overriding the `isDraft` flag, bypassing the separate `pages.changeStatus` authorization check. This affects all 4.x releases before 4.9.0 and 5.x releases from 5.0.0 through 5.3.x, and is exploitable only by authenticated users in deployments where the two permissions are intentionally split. No public exploit code has been identified and EPSS sits at 0.03% (9th percentile), consistent with the SSVC assessment of no known active exploitation; the vulnerability is nevertheless a real workflow integrity bypass for editorial CMS environments.
Improper authorization in OpenClaw's paired-device pairing management (npm package, versions before 2026.4.20) allows authenticated paired devices with limited `operator.pairing` scope to enumerate global pairing state and approve or reject pending device requests belonging to other devices within the same gateway scope. This is a same-gateway, authenticated privilege escalation bug - not a remote unauthenticated issue. No public exploit code exists and CISA has not listed this in KEV; SSVC assesses exploitation as none and technical impact as partial, consistent with the low EPSS score of 0.03%.
Scope enforcement bypass in OpenClaw's Control UI assistant-media route allows authenticated trusted-proxy callers lacking the `operator.read` scope to read protected assistant-media files and metadata. Affected versions are all OpenClaw npm releases before 2026.4.20; deployments not using trusted-proxy authentication mode are unaffected. No active exploitation is confirmed (absent from CISA KEV), EPSS is 0.03% (7th percentile), and SSVC rates exploitation as none with only partial technical impact, making this a low-urgency patch cycle item.
Weak cryptography in the TDDPv2 debug protocol on TP-Link TL-WR841N v13 routers exposes devices left in default configuration to network-adjacent attackers. DES-CBC encryption - an algorithm deprecated for over a decade - is keyed from the device's default web management credentials, meaning the cryptographic secret is fully predictable without any credential theft. An attacker sharing the same network segment can exploit this to access the debug protocol unauthenticated, exfiltrate debug output, alter device configuration, and force reboots, resulting in integrity loss and denial of service. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation as none with partial technical impact.
WebKitGTK and WPE WebKit contain an API design flaw that allows untrusted web content to bypass the WebPage::send-request signal handler and perform unapproved network operations including IP connections, DNS lookups, and HTTP requests. The vulnerability affects applications across Red Hat Enterprise Linux 6-9 that rely on this signal to control network access. A remote attacker can trigger these bypassed requests via crafted web content with only user interaction (UI:R), resulting in limited confidentiality impact (C:L) without code execution.
Broken access control in Navneil Naicker ACF Galerie 4 plugin versions up to 1.4.2 allows authenticated users to modify content they should not have permission to access. The vulnerability stems from missing authorization checks in functionality protected only by authentication level, enabling privilege escalation or unauthorized data modification by low-privileged WordPress users.
Froxlor versions prior to 2.3.6 allow authenticated resellers to bypass domain quota restrictions by attributing newly created domains to arbitrary admins through unvalidated `adminid` parameter input in the `Domains.add()` function. This vulnerability enables quota exhaustion attacks against other administrators and domain creation beyond the attacker's assigned limits, with confirmed patch availability in version 2.3.6.
Froxlor versions prior to 2.3.6 fail to validate domain ownership correctly when adding full email sender aliases, allowing authenticated customers to add sender aliases for email addresses on domains belonging to other customers and subsequently send emails as those addresses via Postfix sender_login_maps authorization. The vulnerability stems from an array indexing error in EmailSender::add() that passes the local part of an email address instead of the domain to the ownership validation function, causing the check to pass for non-existent domains. No active exploitation has been confirmed at the time of analysis.
IBM Guardium Data Protection versions 12.0, 12.1, and 12.2 contain an authentication bypass vulnerability in the access management control panel that allows high-privilege users to circumvent business logic controls and modify access policies without proper authorization constraints. The vulnerability requires administrative credentials to trigger but results in unauthorized privilege escalation or policy modification within the management interface. No public exploit code or active exploitation has been identified at the time of analysis.
OpenLearn forum software with safeMode enabled allows unauthenticated attackers to bypass post approval restrictions and read unpublished content directly via post UUID, bypassing the public forum list filtering. The vulnerability affects all versions prior to commit 844b2a40a69d0c4911580fe501923f0b391313ab and is remotely exploitable without authentication or user interaction. A vendor patch is available.
Replay-based keyless entry bypass in Yadea T5 electric bicycles (2024 and later model years) lets a nearby attacker clone the RF signal from the key fob and take full control of the vehicle. Because the fob uses the EV1527 fixed-code protocol with no rolling codes or challenge-response, a single captured transmission can be rebroadcast to unlock and operate the bike. Publicly available exploit code exists (two GitHub repositories), though EPSS is very low (0.03%) and it is not listed in CISA KEV.
Nuclei v3.7.0 and earlier allow JavaScript templates to read arbitrary `.js` and `.json` files from the host filesystem via the `require()` function, bypassing the `allow-local-file-access` restriction. This enables unauthenticated local attackers or users running untrusted templates to extract sensitive data from configuration files, credential stores, and cloud credentials. The vulnerability is limited to these two file types but can expose secrets in `package.json`, environment configs, and similar files commonly present on developer or server systems.
The id utility in uutils coreutils miscalculates group membership by using real GID instead of effective GID, causing output divergence from GNU coreutils and potentially enabling unauthorized access when scripts rely on id output for access-control decisions. Affects local users with privileges to execute the id command. Proof-of-concept code exists but no active exploitation in the wild has been confirmed.
The mknod utility in uutils coreutils creates device nodes before atomically applying SELinux security labels, and fails to properly clean up mislabeled nodes if labeling operations fail. This leaves device nodes with incorrect default SELinux contexts, potentially bypassing mandatory access control restrictions on systems where SELinux is enforcing. Affects coreutils versions prior to 0.6.0; exploitation requires local root or elevated privileges and is not currently publicly exploited, though cleanup failures are guaranteed on labeling failure.
The mkdir utility in uutils coreutils creates directories with default umask-derived permissions (0755) before applying the requested mode via chmod, creating a race condition window where a directory intended to be private becomes briefly accessible to other local users. This affects uutils coreutils versions prior to 0.6.0 and requires local authenticated access to exploit, limiting real-world impact despite the CVSS score of 3.3.
Bypass of --preserve-root protection in uutils coreutils rm utility allows local users to recursively delete the root filesystem by supplying a symbolic link that resolves to the root directory, rather than relying on authentic root inode comparison. The vulnerability affects coreutils versions before 0.7.0 and requires local access with no special privileges, though successful exploitation is hindered by high complexity (AC:H). CISA exploitation status is none at time of analysis, and a vendor patch has been released.
mktemp utility in uutils coreutils mishandles empty TMPDIR environment variables by creating temporary files in the current working directory instead of falling back to /tmp, potentially exposing sensitive data if the CWD has overly permissive access controls. Affects uutils coreutils versions prior to 0.6.0 and requires local attacker with limited privileges to manipulate the environment or exploit overly accessible working directories; CVSS 3.3 reflects low severity (local access, limited confidentiality impact) despite information disclosure risk.
Authenticated project owners in GitLab CE/EE versions 11.2-18.9.5, 18.10-18.10.3, and 18.11-18.11.0 can bypass group fork prevention settings due to improper authorization checks, allowing them to create forks when they should be restricted. The vulnerability requires authentication and high-privilege access (project owner role), resulting in low severity (CVSS 2.7). Publicly available exploit code exists and patch versions have been released by the vendor.
GitLab CE/EE 18.11 before 18.11.1 allows authenticated users to bypass access controls and read titles of confidential or private issues in public projects through improper validation in the issue description rendering process. The vulnerability requires valid user credentials but no elevated privileges, affecting the confidentiality of issue metadata that should be restricted. Publicly available exploit code exists, and a vendor patch is available.
ThinkPHP 5.0.23 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by invoking functions through the routing parameter. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Terminal Services Manager 3.1 contains a stack-based buffer overflow vulnerability in the computer names field that allows local attackers to execute arbitrary code by triggering structured exception. Rated high severity (CVSS 8.6), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Insecure direct object references in Augmentt 1.0 allow unauthenticated remote attackers to access and modify sensitive tenant data across different organizational contexts, bypassing authentication mechanisms through direct manipulation of object identifiers. The vulnerability enables both unauthorized information disclosure and modification of tenant configuration with CVSS 6.5 (medium severity); no public exploit code has been identified at the time of analysis, though the attack is automatable and requires no user interaction.
Emailchef WordPress plugin versions up to 3.5.1 allow authenticated attackers with Subscriber-level access to delete plugin settings via an unprotected AJAX action due to missing capability checks. The vulnerability enables unauthorized modification of plugin configuration without administrative privileges, affecting any WordPress site using the affected plugin versions. No public exploit code or active exploitation has been identified at time of analysis.
Authenticated users with Subscriber-level access can modify the CalJ Shabbat Times plugin's API key and clear its cache due to missing authorization checks in the CalJSettingsPage class constructor. The vulnerability affects all versions up to and including 1.5, with no special network or interaction requirements beyond valid WordPress authentication. While CVSS 5.3 reflects moderate integrity impact, the practical risk depends on whether WordPress sites allow Subscriber-level registrations and whether the plugin's API key provides sensitive access to external services.
TP Restore Categories And Taxonomies WordPress plugin versions up to 1.0.1 lack capability checks in the delete_term() AJAX handler, allowing authenticated Subscriber-level users to permanently delete taxonomy terms from backup tables by reusing a nonce exposed to all authenticated users. The vulnerability bypasses authorization despite nonce validation, enabling low-privileged attackers to cause data loss via a simple crafted AJAX request.
Spring Security's DaoAuthenticationProvider can leak timing information about user account status when applications rely on UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked attributes for user validation. This allows remote attackers to enumerate disabled, expired, or locked accounts through timing analysis of authentication responses across affected versions 5.7.0-5.7.22, 5.8.0-5.8.24, 6.3.0-6.3.15, 6.5.0-6.5.9, and 7.0.0-7.0.4. No public exploit code or active exploitation has been identified at this time.
SQL injection in OwnTone Server 28.4 through 29.0 allows unauthenticated remote attackers to inject arbitrary SQL expressions via the query= and filter= parameters in DAAP requests, enabling bypass of access controls and unauthorized retrieval of media library data. The vulnerability stems from insufficient sanitization of integer-mapped DAAP field parameters and affects default network-accessible deployments without requiring user interaction.
Craft CMS versions 5.6.0 through 5.9.14 allow authenticated users with only viewUsers permission to remove arbitrary users from all user groups via the actionSavePermissions() endpoint, bypassing per-group authorization controls that protect group additions. An attacker can submit an empty groups value to strip all group memberships from any user, degrading access control integrity. The vulnerability has been patched in version 5.9.15.
BigBlueButton versions prior to 3.0.24 allow authenticated viewers to inject or overwrite captions due to missing authorization controls, enabling unauthorized modification of classroom content. The vulnerability requires an authenticated session but does not need user interaction, affecting the integrity of real-time collaboration in virtual classroom deployments. Version 3.0.24 restricts caption submission permissions to authorized roles only.
Authorization bypass in GitHub Enterprise Server allows a repository admin to hijack secret scanning push protection delegated bypass reviewer lists on repositories they do not administer. The server authorizes requests against the repository specified in the URL path but applies the configuration change to the repository identified by the attacker-controlled owner_id parameter in the request body - a classic IDOR pattern (CWE-639). Impact is constrained: an attacker can only assign existing trusted users within the instance as bypass reviewers, not introduce arbitrary external accounts. No public exploit exists and EPSS is 0.05% (14th percentile); patched releases are available for all supported GHES branches.
Improper access control (CWE-284) in the C Oracle SSL API component of Oracle Security Service 12.1.3.0.0 and 12.2.1.4.0 - part of Oracle Fusion Middleware - allows a low-privileged network attacker to compromise the service via HTTPS, resulting in unauthorized read access to all critical data and unauthorized creation, modification, or deletion of critical data. The attack is constrained by high complexity and mandatory human interaction from a third party, making automated or mass exploitation infeasible; EPSS exploitation probability is extremely low at 0.03% and CISA SSVC classifies exploitation as none. No public exploit has been identified at time of analysis.
Partial denial-of-service in Oracle VM VirtualBox 7.2.6 Core component allows a locally authenticated, high-privileged attacker to degrade availability of the hypervisor. Exploitation is limited to the local system and requires pre-existing administrative-level access, with no confidentiality or integrity impact. No public exploit code has been identified and CISA has not listed this in the Known Exploited Vulnerabilities catalog; EPSS at 0.01% (2nd percentile) reflects near-zero exploitation probability.
Improper access control in Oracle VM VirtualBox 7.2.6's Core component allows a high-privileged local attacker with logon access to the host infrastructure to perform unauthorized writes, inserts, or deletions against VirtualBox-accessible data. Notably, Oracle's advisory confirms a scope change - successful exploitation may affect additional products beyond VirtualBox itself, such as guest VM environments sharing the same host. No active exploitation is confirmed (SSVC: none; EPSS: 0.01%, 2nd percentile), and no public exploit or POC has been identified at time of analysis.
Oracle VM VirtualBox 7.2.6 contains an improper access control flaw in its Core component that enables a highly privileged local attacker to partially compromise confidentiality, integrity, and availability - with a scope change indicating potential bleed beyond the VirtualBox process boundary to adjacent products or guest VMs on the same host. Exploitation requires local logon with high privileges and high attack complexity, making opportunistic exploitation unlikely; EPSS at the 2nd percentile and SSVC exploitation status of 'none' corroborate low real-world risk. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog.
Confidentiality breach in Oracle VM VirtualBox 7.2.6 Core allows a high-privileged local attacker to gain complete read access to all data accessible by the VirtualBox process, with scope change indicating potential data leakage beyond the primary VM boundary into adjacent virtualized environments. The CVSS vector (AV:L/AC:L/PR:H/UI:N/S:C) confirms local-only exploitation requiring administrative-level host access, substantially limiting the realistic attacker pool. No active exploitation is confirmed - EPSS sits at 0.01% (2nd percentile), SSVC rates exploitation as none, and the vulnerability is absent from CISA KEV.
Improper access control in Oracle Hyperion Infrastructure Technology's Lifecycle Management component allows a network-reachable, high-privileged authenticated attacker to perform unauthorized creation, deletion, or modification of critical Hyperion data, while also gaining read access to a subset of accessible data. Affected is the single supported version 11.2.24.0.000, patched in Oracle's April 2026 Critical Patch Update. No public exploit or active exploitation has been identified; EPSS stands at 0.03% (7th percentile) and CISA's SSVC framework rates exploitation as none, placing this firmly in a low-urgency remediation tier despite the High integrity impact component.
Unauthorized read access to student records data in Oracle PeopleSoft Enterprise CS Student Records 9.2 (Research Tracking component) can be triggered by a low-privileged authenticated attacker over HTTP, provided a victim user interacts with attacker-controlled content. The flaw is rooted in improper access control (CWE-284), enabling horizontal or vertical privilege escalation within the application to expose the full scope of student records data. No public exploit exists and EPSS is extremely low at 0.03% (9th percentile), though the confidentiality impact is rated High by Oracle given the breadth of data potentially accessible.
Denial-of-service in MySQL Server's Optimizer component allows a high-privileged network attacker to hang or repeatedly crash the database engine across three major release branches (8.0.x through 8.0.45, 8.4.x through 8.4.8, and 9.0.x through 9.6.0). Exploitation requires a high-privilege database account (DBA-level), but once authenticated, the attack is low-complexity and requires no user interaction - Oracle's advisory describes it as 'easily exploitable' in that context. No public exploit code or active exploitation has been identified; EPSS of 0.04% (11th percentile) and SSVC exploitation rating of 'none' together indicate this poses negligible real-world exploitation risk at time of analysis.
Denial-of-service exposure in Oracle MySQL Server's DML (Data Manipulation Language) component allows a high-privileged, network-authenticated attacker to cause a complete, repeatable crash or hang of the database server. Affected across three active release trains - 8.0.0 through 8.0.45, 8.4.0 through 8.4.8, and 9.0.0 through 9.6.0 - the vulnerability is exploitable over multiple network protocols without user interaction. No public exploit exists and the vulnerability is not listed in CISA KEV; EPSS at 0.04% (11th percentile) confirms very low exploitation activity at time of analysis.
Denial-of-service in MySQL Server's InnoDB component allows a high-privileged authenticated attacker with network access to cause a hang or frequently repeatable crash of the database server across versions 8.0.0-8.0.45, 8.4.0-8.4.8, and 9.0.0-9.6.0. Impact is confined to availability - no data exfiltration or integrity compromise is possible through this vector. No public exploit has been identified at time of analysis, and EPSS probability of 0.04% (11th percentile) is consistent with SSVC's confirmed zero observed exploitation, placing this firmly in the lower-priority patch tier for most organizations.
Denial-of-service in MySQL Server's InnoDB storage engine allows a high-privileged, network-authenticated attacker to hang or repeatedly crash the database server across all major release trains (8.0.x, 8.4.x, and 9.x). The vulnerability is reachable over multiple network protocols without user interaction, making it exploitable by any account holding high database privileges (e.g., DBA or SUPER). No public exploit code has been identified and CISA has not added this to the Known Exploited Vulnerabilities catalog, consistent with an EPSS score of just 0.04%.
InnoDB component in MySQL Server versions 8.0.0-8.0.45, 8.4.0-8.4.8, and 9.0.0-9.6.0 exposes a denial-of-service condition reachable over the network by a highly privileged attacker, causing the database server to hang or crash repeatably. Disclosed as part of Oracle's April 2026 Critical Patch Update (CVSS 3.1: 4.9), the vulnerability has an EPSS of 0.04% (11th percentile), SSVC exploitation status of 'none', and no public exploit identified at time of analysis. Oracle has released a patch; risk is largely limited to scenarios involving compromised administrative credentials or malicious insiders.
Denial-of-service in Oracle MySQL Server's GIS (Geographic Information System) component allows a high-privileged, network-authenticated attacker to cause the database server to hang or repeatedly crash. Versions 9.0.0 through 9.6.0 are confirmed affected. No public exploit has been identified and EPSS probability stands at 0.04% (11th percentile), consistent with SSVC's exploitation rating of 'none' - real-world risk is confined primarily to insider threat or compromised DBA account scenarios.
Denial-of-service in Oracle MySQL Server's Partition component (versions 9.0.0-9.6.0) allows a high-privileged, network-connected attacker to cause a complete server hang or repeatable crash, resulting in full availability loss. Exploitation is constrained to authenticated users holding high database privileges (CVSS PR:H), sharply limiting the realistic attack surface. No public exploit code exists, EPSS is 0.04% (11th percentile), and SSVC confirms no known exploitation - placing this firmly in the low real-world priority tier despite its network-accessible vector.
Improper access control in the Dynamic Monitoring Service (DMS) component of Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0 enables low-privileged authenticated attackers to perform unauthorized read and write operations on accessible Fusion Middleware data over HTTP. The scope change in the CVSS vector (S:C) indicates successful exploitation can extend impact to additional co-deployed Oracle middleware components beyond DMS itself. No public exploit has been identified, EPSS stands at a low 0.03%, and SSVC records exploitation as none - positioning this as a normal-cycle patch priority rather than an emergency response.
Oracle Financial Services Analytical Applications Infrastructure (OFSAAI) versions 8.0.7.9, 8.0.8.7, and 8.1.2.5 contain an improper access control flaw (CWE-284) in the User Interface component that permits a locally authenticated low-privileged attacker - contingent on inducing a second user to interact - to bypass access controls and obtain complete read access to all OFSAAI-accessible financial data, perform limited data modification, and trigger a full denial-of-service by crashing or hanging the platform. Disclosed in Oracle's April 2026 Critical Patch Update, this vulnerability carries no public exploit code and no active exploitation per CISA KEV, SSVC, or EPSS (0.01%, 2nd percentile), situating it as a medium-priority insider threat relevant to financial institutions running these specific versions.
Unauthenticated network exploitation of the Oracle Life Sciences InForm App Server (versions 7.0.1.0 and 7.0.1.1) allows remote attackers to read a subset of clinical trial application data and perform unauthorized insert, update, or delete operations via HTTP - with no credentials or user interaction required. Rooted in CWE-284 (Improper Access Control) and tagged as an Authentication Bypass, the App Server fails to enforce access controls on certain endpoints, confirmed by Oracle in the April 2026 Critical Patch Update. No public exploit code or active exploitation has been identified; EPSS sits at 0.03% (8th percentile), though SSVC flags the attack as automatable.
Improper access control in the IDM Authentication component of Oracle Life Sciences InForm 7.0.1.0 and 7.0.1.1 exposes the platform to unauthenticated network-based attacks over HTTP that require victim user interaction to succeed. Successful exploitation yields unauthorized partial read, write/delete, and denial-of-service impact against InForm clinical trial data. No public exploit code exists and no active exploitation has been identified; EPSS at 0.03% (9th percentile) and SSVC exploitation status of 'none' confirm minimal real-world threat at this time.
Improper authorization in the User Interface component of Oracle Financial Services Analytical Applications Infrastructure (OFSAAI) exposes critical financial data to low-privileged network attackers. Affected versions 8.0.7.9, 8.0.8.7, and 8.1.2.5 allow an authenticated attacker to bypass authorization controls via HTTP, contingent on human interaction from a victim user, resulting in complete confidentiality compromise of all data accessible within the platform. No public exploit exists and EPSS sits at 0.03%, indicating negligible opportunistic exploitation pressure at time of analysis.
Confidentiality breach in Oracle MySQL Shell's Core Client component across three major version branches (8.0.x, 8.4.x, and 9.0.x) permits a high-privileged, network-connected attacker to gain unauthorized access to critical or complete MySQL Shell-accessible data, with a CVSS scope change (S:C) indicating potential impact on adjacent systems. No public exploit code has been identified at time of analysis, and an EPSS score of 0.03% at the 8th percentile reflects near-zero observed exploitation probability. SSVC classifies exploitation status as none and technical impact as only partial, underscoring that despite the scope-change flag and high confidentiality impact, real-world urgency is low given the steep access prerequisites.
Improper authorization in Oracle WebLogic Server's Web Services component allows unauthenticated remote attackers to perform unauthorized creation, deletion, or modification of critical data - but only when a victim user interacts with attacker-controlled content. Affecting four actively supported versions (12.2.1.4.0 through 15.1.1.0.0), this flaw carries a CVSS 6.5 Medium rating reflecting the mandatory human-interaction prerequisite that prevents fully automated exploitation. No public exploit code exists and CISA has not listed this in the Known Exploited Vulnerabilities catalog; SSVC assessment confirms exploitation status as none at time of analysis.
Improper access control in Oracle Financial Services Analytical Applications Infrastructure (OFSAAI) Platform component allows a low-privileged remote attacker to bypass authorization controls and gain unauthorized read and write access to all financial data managed by the platform. Versions 8.0.7.9, 8.0.8.7, and 8.1.2.5 are confirmed affected. No public exploit code has been identified at time of analysis, and EPSS at 0.03% (9th percentile) signals very low observed exploitation probability, though the SSVC technical impact is rated 'total' given the full confidentiality and integrity exposure.
Unauthorized data exposure in Oracle Financial Services Analytical Applications Infrastructure (OFSAAI) versions 8.0.7.9, 8.0.8.7, and 8.1.2.5 allows a low-privileged, network-authenticated attacker to read critical or complete data accessible within the platform via HTTP. The Platform component contains a CWE-200 information disclosure flaw that, per Oracle's April 2026 CPU, is classified as 'easily exploitable' under authenticated low-privilege conditions. No public exploit code has been identified and CISA has not listed this in KEV; EPSS at 0.03% (9th percentile) and SSVC exploitation status of 'none' indicate no observed active exploitation at time of analysis.
Unauthorized read access in Oracle Database Server's RDBMS component (versions 19.3-19.30) is achievable by a highly privileged attacker holding the Row Access Method privilege, via multiple network protocols, when a third party performs required human interaction. Impact is limited to a partial confidentiality disclosure of RDBMS-accessible data with no integrity or availability effects. No public exploit exists and EPSS at 0.03% (7th percentile) reflects near-zero exploitation likelihood; SSVC confirms exploitation status as none and the attack is not automatable.
Improper access control in the Workflow component of Oracle PeopleSoft Enterprise PeopleTools 8.61-8.62 allows a low-privileged, network-authenticated attacker to compromise confidentiality and integrity of accessible data when a victim user interacts with attacker-controlled content. The scope change (S:C) in the CVSS vector indicates successful exploitation can impact resources beyond the vulnerable component, consistent with client-side attack patterns such as stored or reflected XSS enabling cross-context data access. No public exploit code has been identified and EPSS sits at 0.03% (8th percentile), indicating negligible observed exploitation pressure at time of analysis.
Unauthorized full data disclosure in PeopleSoft Enterprise FIN Project Costing 9.2 allows a low-privileged authenticated attacker to read all data accessible to the Projects component via a network-reachable HTTP endpoint. The root cause is improper access control (CWE-284), tagged by Oracle as an authentication bypass - most likely an authorization boundary failure that permits privilege escalation within the application rather than a bypass of the initial login gate, consistent with a PR:L CVSS vector. No public exploit code has been identified and EPSS is 0.03% (9th percentile), indicating negligible automated exploitation activity at this time.
Oracle Workflow (E-Business Suite component, versions 12.2.3-12.2.15) exposes its Workflow Loader component to unauthorized data manipulation and partial denial of service by highly privileged network attackers over HTTP. The CVSS S:C (scope changed) designation confirms that a successful attack can cascade beyond Oracle Workflow itself to affect other products within the E-Business Suite application tier, amplifying the business impact beyond what the base score of 5.5 initially suggests. No public exploit has been identified and EPSS sits at 0.04% (11th percentile), indicating negligible exploitation probability at time of analysis; SSVC likewise assesses exploitation status as none.
Unauthorized data disclosure in Oracle PeopleSoft Enterprise FIN Maintenance Management 9.2 allows an authenticated low-privileged attacker with HTTP network access to read all data accessible within the Work Order Management component, including potentially sensitive financial maintenance records. The flaw is rooted in improper access control (CWE-284) and is tagged as an authentication bypass, suggesting a low-privileged session can circumvent authorization checks to access data scoped to higher-privilege roles. No active exploitation is confirmed (absent from CISA KEV), and EPSS of 0.03% at the 9th percentile indicates very low real-world exploitation probability; remediation is addressed in Oracle's April 2026 Critical Patch Update.
Unauthorized financial contract data disclosure in Oracle PeopleSoft Enterprise FIN Contracts 9.2 allows low-privileged authenticated users to access all contract records via HTTP without integrity or availability impact. The CWE-200 classification and 'Authentication Bypass' tag together suggest the flaw is an intra-session authorization control bypass - not a login bypass - permitting users to read contract data beyond their assigned permissions. No public exploit exists and EPSS sits at 0.03% (9th percentile), consistent with SSVC's 'Exploitation: none' assessment, though the high confidentiality impact to sensitive financial data warrants prompt patching for affected enterprises.
Unauthorized read access to sensitive financial data is possible in Oracle PeopleSoft Enterprise FIN Maintenance Management 9.2 through an improper access control flaw (CWE-284) in the Work Order Management component. An authenticated low-privileged attacker with network access over HTTP can exploit this to gain complete access to all data within the PeopleSoft FIN Maintenance Management system. No public exploit exists and SSVC classifies exploitation as 'none,' with EPSS at 0.03% (9th percentile), indicating negligible opportunistic exploitation risk despite Oracle's own classification of the vulnerability as 'easily exploitable.'
Oracle Applications Framework's Personalization component in E-Business Suite versions 12.2.9 through 12.2.15 allows an authenticated, high-privileged attacker to exceed intended authorization boundaries via HTTP, resulting in unauthorized data read, write, and partial denial of service against the framework. Root cause is CWE-284 (Improper Access Control), confirmed by Oracle's April 2026 Critical Patch Update. No public exploit code exists and EPSS sits at 0.03% (10th percentile), aligning with SSVC's 'Exploitation: none' assessment - this is a low-urgency, medium-severity finding gated entirely by the requirement for pre-existing high-privilege access.
PeopleSoft Enterprise SCM Purchasing 9.2 exposes critical procurement data to low-privileged authenticated attackers over HTTP, enabling complete unauthorized read access to all data within the Purchasing module. The flaw is rooted in improper access control (CWE-284), allowing a low-privileged PeopleSoft account holder to bypass post-authentication authorization restrictions and retrieve sensitive purchasing records they should not have access to. No public exploit code exists and EPSS sits at a very low 0.03%, but Oracle's April 2026 Critical Patch Update addresses the vulnerability and should be applied to any internet-facing or multi-tenant PeopleSoft deployment.
Improper access control in Oracle Identity Manager Connector 12.2.1.4.0 exposes the Microsoft Active Directory component to network-based exploitation via LDAP, enabling low-privileged authenticated attackers to perform unauthorized creation, deletion, or modification of critical data and read a subset of accessible data. The vulnerability carries a CVSS 3.1 score of 5.9 (Medium), tempered by high attack complexity (AC:H) and a near-zero EPSS of 0.03% (8th percentile). No public exploit code exists and no active exploitation has been reported; this is a real but difficult-to-trigger integrity-focused flaw in Oracle's enterprise identity management stack.
Oracle Identity Manager Connector 12.2.1.4.0 exposes a missing authentication control (CWE-306) in its Core component, reachable over HTTPS by unauthenticated network attackers. Successful exploitation yields unauthorized read access to critical data or complete access to all data accessible by the connector - a significant confidentiality breach in an identity governance system. No public exploit code has been identified at time of analysis, and EPSS at 0.03% (9th percentile) alongside SSVC's 'none' exploitation rating indicate low real-world exploitation pressure despite the network-accessible vector.
Unauthenticated network access to Oracle Identity Manager Connector 12.2.1.4.0 enables complete confidentiality compromise of all data accessible by the connector via an authentication bypass in its Core component. The flaw (CWE-306, Missing Authentication for Critical Function) is reachable over HTTP without credentials but carries high attack complexity, constraining exploitation to actors capable of meeting undisclosed preconditions. No active exploitation has been identified - EPSS sits at the 9th percentile (0.03%) and CISA SSVC rates it as non-automatable with partial technical impact - suggesting limited near-term risk despite the identity management context.
Cross-site scripting or improper access control in the Human Workflow component of Oracle Business Process Management Suite (versions 12.2.1.4.0 and 14.1.2.0.0) allows unauthenticated remote attackers to read a subset of BPM data and perform unauthorized data modifications via HTTP, provided a legitimate user interacts with attacker-controlled content. The attack carries a scope change, meaning successful exploitation can impact components beyond the BPM Suite itself within the Oracle Fusion Middleware stack. No public exploit code has been identified and CISA has not listed this in KEV; EPSS places exploitation probability at 0.03% (8th percentile), consistent with low near-term exploitation risk.
Kimai's Team API endpoints fail to validate entity-level ownership due to incorrect Symfony IsGranted attribute syntax, allowing users with the edit_team permission to modify any team regardless of membership. The vulnerability arises because API endpoints use #[IsGranted('edit_team')] instead of #[IsGranted('edit', 'team')], causing the TeamVoter to abstain and fall back to role-only permission checks. In default configurations this is unexploitable since only admins hold edit_team permission, but if administrators grant edit_team to lower-privilege roles (such as ROLE_TEAMLEAD) via the permissions UI, those users can modify team memberships, customer assignments, project assignments, and activity assignments for any team without authorization. No public exploit code or active exploitation has been identified.
Liaison Site Prober plugin for WordPress allows unauthenticated attackers to retrieve sensitive audit log data including IP addresses, user IDs, usernames, and login events through an improperly secured REST API endpoint (/wp-json/site-prober/v1/logs) in all versions up to 1.2.1. The vulnerability stems from a permission callback that unconditionally returns true without validating user capabilities, enabling information disclosure with network-level access and no authentication required. No public exploit code or active exploitation has been identified at time of analysis.
HubSpot All-In-One Marketing plugin for WordPress (versions up to 11.3.32) exposes sensitive information via the class-adminconstants.php file, allowing authenticated users with Contributor-level access or higher to retrieve a complete list of installed plugins and their versions. This information disclosure enables reconnaissance for follow-on attacks targeting vulnerable plugins, though exploitation requires valid WordPress authentication and contributor-level privileges.
Insecure Direct Object Reference in Booking Calendar Contact Form plugin for WordPress (all versions up to 1.2.63) allows authenticated attackers with Subscriber-level privileges to hijack other users' calendars and access associated user data by exploiting missing validation on user-controlled keys in the dex_bccf_admin_int_calendar_list.inc.php file. The CVSS score of 5.3 reflects network-accessible exploitation without user interaction, though the vulnerability requires valid WordPress authentication at Subscriber level or higher.
Unauthenticated attackers can modify the custom post type slug for the HM Books Gallery plugin in WordPress versions up to 4.8.0 by submitting a crafted POST request to the admin_init hook, bypassing all capability and nonce checks. This vulnerability allows modification of the 'wbg_cpt_slug' option without authentication, changing the URL structure for all book entries, breaking existing links, and degrading SEO rankings. No public exploit code or active exploitation has been identified at the time of analysis.
MaxiBlocks Builder plugin for WordPress up to version 2.1.8 allows authenticated attackers with Author-level access to delete arbitrary files in the wp-content/uploads directory via the 'maxi_remove_custom_image_size' AJAX action due to insufficient file ownership validation. This enables deletion of media uploaded by other users and administrators without proper authorization checks, violating file integrity despite the CVSS 5.3 score reflecting limited direct impact.
ExactMetrics Google Analytics Dashboard for WordPress versions up to 9.1.2 allow authenticated subscribers to retrieve Google Ads access tokens and reset Google Ads integration settings through missing authorization checks in AJAX handlers. Although a nonce is verified, two AJAX endpoints (get_ads_access_token and reset_experience) lack the capability checks present in similar endpoints, enabling attackers with subscriber-level access to perform administrative actions. The CVSS vector (AV:N/AC:L/PR:N/UI:N) reflects network-accessible unauthenticated exploitation, but the description indicates authenticated subscriber access is required, creating a discrepancy between reported CVSS and actual attack prerequisites.
BetterDocs plugin for WordPress versions up to 4.3.11 allows authenticated subscribers and higher to trigger arbitrary OpenAI API calls using the site's configured API key due to missing capability checks in the generate_openai_content_callback() function. An attacker with subscriber-level access can supply arbitrary prompts to exhaust the site owner's paid AI API quota without authorization, resulting in unauthorized financial impact and service degradation. No public exploit code or active exploitation has been identified at time of analysis.
Xibo CMS before version 4.4.1 allows authenticated users to bypass access controls and view campaigns, regions, and reports belonging to other users by manually constructing preview URLs. The vulnerability affects any authenticated user with Layout Management, Campaign Management, or Report viewing privileges and results in unauthorized information disclosure with no impact on data integrity or availability.
Lightspeed Classroom v5.1.2.1763770643 contains a client-side authorization flaw that allows unauthenticated remote attackers to impersonate users and bypass integrity checks on client-generated authorization tokens, enabling unauthorized remote control and monitoring of student devices. The vulnerability requires high attack complexity and affects confidentiality and integrity with limited scope impact (CVSS 5.4). Despite a high CVSS score, the EPSS score of 0.03% indicates minimal real-world exploitation probability, suggesting this requires specific technical conditions or targeted attack scenarios rather than widespread automated exploitation.
Broken access control in ClassroomIO v0.1.13 allows authenticated low-privileged students to disclose sensitive course information including other students' details, tutor/admin profiles, and internal metadata by modifying API requests from POST to GET against the PostgREST endpoint. The vulnerability requires valid student account credentials but no special privileges, enabling unauthorized horizontal and vertical access escalation within course contexts.
Institution administrators with Site staff role in Mahara can impersonate institution members in other institutions where they lack administrative privileges, bypassing intended access controls on multi-tenanted deployments. Affects Mahara versions before 24.04.10 and 25.x before 25.04.1. This requires high-privilege authentication (Site staff role) and does not involve network exploitation of unauthenticated services, limiting real-world attack surface to insider threats within organizations running affected versions.
KDE Arianna's bookserver before version 26.04.1 allows local attackers to read arbitrary files over socket connections by guessing URLs without authentication, exploiting missing input validation on the bookserver endpoint. The vulnerability requires local access and does not affect confidentiality of other system components; no public exploit code or active exploitation has been identified.
Authenticated users in Rocket.Chat versions prior to 8.4.0, 8.3.2, 8.2.2, 8.1.3, 8.0.4, 7.13.6, 7.12.7, 7.11.7, and 7.10.10 can read application engine logs via the /api/apps/logs and /api/apps/:id/logs endpoints due to a typo in permission validation logic. The vulnerability allows authenticated attackers with insufficient privileges to bypass authorization checks and access sensitive logs containing partial information, with no public exploit confirmed at time of analysis.
Slack thread context injection in OpenClaw before 2026.4.2 allows non-allowlisted Slack users to insert arbitrary messages into the AI agent's model context by exploiting a gap in sender-allowlist enforcement on thread history. The sender allowlist - intended to gate which Slack users can interact with the agent - is applied to the triggering message but not to thread-starter or thread-history content fetched via the Slack conversations.replies API, enabling context manipulation when an allowlisted user replies in a thread containing the attacker's messages. A public proof-of-concept exists; however, no public exploit identified at time of analysis maps to confirmed active exploitation, and EPSS sits at 0.01% (2nd percentile).
OpenClaw's gateway `device.token.rotate` method rotates device credentials without disconnecting live WebSocket sessions authenticated under the old token, leaving a post-compromise revocation gap in all npm `openclaw` releases up to and including 2026.3.28. An attacker who has already obtained valid device credentials and established an active WebSocket connection can maintain unauthorized gateway access indefinitely after an operator rotates the token - effectively nullifying the revocation action. No public exploit exists and CISA SSVC rates exploitation as none with partial technical impact; the low CVSS 4.0 score of 2.3 and EPSS of 0.03% (7th percentile) confirm this as a low-priority, post-compromise control gap rather than an initial access vector.
Replay detection bypass in the OpenClaw npm package (versions ≤ 2026.3.28) allows an attacker who has previously captured a valid Telnyx-signed webhook to re-encode the Ed25519 signature from standard Base64 to Base64URL and resubmit the payload as an apparently unreplayed request. Because Ed25519 cryptographic verification operates on the decoded byte sequence, both encodings pass signature validation; only the replay cache lookup - keyed on the raw uncanonicalised header string - is defeated, enabling duplicate event processing. No public exploit has been identified at time of analysis and EPSS stands at 0.03% (8th percentile), consistent with SSVC Exploitation: none and the maintainer's own normalized severity of low.
Session visibility bypass in OpenClaw (npm) versions through 2026.3.28 permits authenticated agents to read session metadata beyond their authorized scope by invoking session_status outside a sandboxed context. The visibility guard in session-status-tool.ts was conditionally applied only for sandboxed invocations or session-ID-resolved lookups, leaving unsandboxed callers entirely ungated against the tools.sessions.visibility policy. The maintainer triaged this as a same-agent session-policy bypass rather than a host-boundary breach; no public exploit exists and SSVC/EPSS signals indicate no active exploitation pressure.
OpenClaw's Discord integration (npm package, versions <= 2026.3.28) exposes an authorization bypass where authenticated Discord users invoke slash commands or trigger autocomplete in group DM channels outside the configured allowlist, circumventing the `dm.groupChannels` restriction in both the command dispatch and autocomplete paths. The impact is bounded: exploitation requires an already-authorized Discord user and a deployment with group DM allowlisting actively configured, limiting the trust boundary crossed to channel-level access rather than a broader privilege escalation. EPSS is 0.03% (7th percentile) and SSVC classifies exploitation as none; no public exploit code exists and the issue is not in CISA KEV.
Privilege escalation in OpenClaw's chat.send gateway endpoint allows write-scoped API callers to bypass authorization controls and persist admin-only verboseLevel session overrides via the /verbose parameter. All OpenClaw npm package versions up to and including 2026.3.24 are affected; the vendor-released fix is version 2026.3.28. No public exploit code has been identified at time of analysis, and CISA SSVC assessment confirms no active exploitation with only partial technical impact, aligning with an EPSS score in the 14th percentile.
Incorrect channel type routing in OpenClaw's Discord extension (versions up to 2026.3.28) allows authenticated Group DM participants to bypass Group DM policy enforcement by exploiting a logic error that treats Group DMs as regular Direct Messages. The flaw in `extensions/discord/src/monitor/agent-components-helpers.ts` causes the `isDirectMessage` flag to be set based solely on the absence of a guild ID, which is also true for Group DM channels, causing all Group DM-specific authorization checks (the `groupEnabled` toggle and channel allowlist) to be silently skipped. No public exploit exists, this vulnerability is not in the CISA KEV catalog, and EPSS at 0.01% (2nd percentile) reflects negligible exploitation interest.
OpenClaw's Telegram legacy `allowFrom` migration incorrectly propagates default-account trust to all configured named Telegram accounts in npm package versions through 2026.3.28, enabling Telegram users previously trusted only on the default account to bypass authentication controls and interact with named accounts they were never explicitly authorized to access. The vendor-confirmed fix is present in version 2026.3.31, released 2026-03-31. No public exploit exists; EPSS is 0.06% and CISA SSVC records exploitation as none at time of analysis.
Sandbox file-operation escape in OpenClaw npm versions <= 2026.3.28 allows a local low-privileged attacker to delete or create files outside the designated workspace root by winning a symlink-rebind race between path validation and filesystem execution in apply_patch, remove, and mkdir operations. The GHSA maintainer triage confirms the scope is narrow - limited to workspace-only mutation operations - and the fix in 2026.3.31 replaces check-then-act enforcement with atomic fd-safe path-within-root helpers. No public exploit exists and SSVC confirms exploitation status as none, placing real-world priority low despite the high integrity impact rating.
Rate limiting bypass in OpenClaw's WebSocket gateway (npm package ≤ 2026.3.28) allows unauthenticated remote attackers to conduct unbounded brute-force attempts against shared-secret passwords by including a fake DeviceToken field in WebSocket handshake requests, suppressing the IP-based rate limiter. The maintainer's own triage classifies the practical risk as narrow, noting that only deployments relying on weak shared passwords face meaningful threat since high-entropy secrets remain non-bruteforceable regardless of rate limiting. No public exploit code exists, EPSS is 0.04%, and SSVC exploitation status is none - consistent with a low-priority patching target outside of weak-credential deployments.
Kirby CMS's REST API allows authenticated users with the `pages.create` permission to immediately publish pages by overriding the `isDraft` flag, bypassing the separate `pages.changeStatus` authorization check. This affects all 4.x releases before 4.9.0 and 5.x releases from 5.0.0 through 5.3.x, and is exploitable only by authenticated users in deployments where the two permissions are intentionally split. No public exploit code has been identified and EPSS sits at 0.03% (9th percentile), consistent with the SSVC assessment of no known active exploitation; the vulnerability is nevertheless a real workflow integrity bypass for editorial CMS environments.
Improper authorization in OpenClaw's paired-device pairing management (npm package, versions before 2026.4.20) allows authenticated paired devices with limited `operator.pairing` scope to enumerate global pairing state and approve or reject pending device requests belonging to other devices within the same gateway scope. This is a same-gateway, authenticated privilege escalation bug - not a remote unauthenticated issue. No public exploit code exists and CISA has not listed this in KEV; SSVC assesses exploitation as none and technical impact as partial, consistent with the low EPSS score of 0.03%.
Scope enforcement bypass in OpenClaw's Control UI assistant-media route allows authenticated trusted-proxy callers lacking the `operator.read` scope to read protected assistant-media files and metadata. Affected versions are all OpenClaw npm releases before 2026.4.20; deployments not using trusted-proxy authentication mode are unaffected. No active exploitation is confirmed (absent from CISA KEV), EPSS is 0.03% (7th percentile), and SSVC rates exploitation as none with only partial technical impact, making this a low-urgency patch cycle item.
Weak cryptography in the TDDPv2 debug protocol on TP-Link TL-WR841N v13 routers exposes devices left in default configuration to network-adjacent attackers. DES-CBC encryption - an algorithm deprecated for over a decade - is keyed from the device's default web management credentials, meaning the cryptographic secret is fully predictable without any credential theft. An attacker sharing the same network segment can exploit this to access the debug protocol unauthenticated, exfiltrate debug output, alter device configuration, and force reboots, resulting in integrity loss and denial of service. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation as none with partial technical impact.
WebKitGTK and WPE WebKit contain an API design flaw that allows untrusted web content to bypass the WebPage::send-request signal handler and perform unapproved network operations including IP connections, DNS lookups, and HTTP requests. The vulnerability affects applications across Red Hat Enterprise Linux 6-9 that rely on this signal to control network access. A remote attacker can trigger these bypassed requests via crafted web content with only user interaction (UI:R), resulting in limited confidentiality impact (C:L) without code execution.
Broken access control in Navneil Naicker ACF Galerie 4 plugin versions up to 1.4.2 allows authenticated users to modify content they should not have permission to access. The vulnerability stems from missing authorization checks in functionality protected only by authentication level, enabling privilege escalation or unauthorized data modification by low-privileged WordPress users.
Froxlor versions prior to 2.3.6 allow authenticated resellers to bypass domain quota restrictions by attributing newly created domains to arbitrary admins through unvalidated `adminid` parameter input in the `Domains.add()` function. This vulnerability enables quota exhaustion attacks against other administrators and domain creation beyond the attacker's assigned limits, with confirmed patch availability in version 2.3.6.
Froxlor versions prior to 2.3.6 fail to validate domain ownership correctly when adding full email sender aliases, allowing authenticated customers to add sender aliases for email addresses on domains belonging to other customers and subsequently send emails as those addresses via Postfix sender_login_maps authorization. The vulnerability stems from an array indexing error in EmailSender::add() that passes the local part of an email address instead of the domain to the ownership validation function, causing the check to pass for non-existent domains. No active exploitation has been confirmed at the time of analysis.
IBM Guardium Data Protection versions 12.0, 12.1, and 12.2 contain an authentication bypass vulnerability in the access management control panel that allows high-privilege users to circumvent business logic controls and modify access policies without proper authorization constraints. The vulnerability requires administrative credentials to trigger but results in unauthorized privilege escalation or policy modification within the management interface. No public exploit code or active exploitation has been identified at the time of analysis.
OpenLearn forum software with safeMode enabled allows unauthenticated attackers to bypass post approval restrictions and read unpublished content directly via post UUID, bypassing the public forum list filtering. The vulnerability affects all versions prior to commit 844b2a40a69d0c4911580fe501923f0b391313ab and is remotely exploitable without authentication or user interaction. A vendor patch is available.
Replay-based keyless entry bypass in Yadea T5 electric bicycles (2024 and later model years) lets a nearby attacker clone the RF signal from the key fob and take full control of the vehicle. Because the fob uses the EV1527 fixed-code protocol with no rolling codes or challenge-response, a single captured transmission can be rebroadcast to unlock and operate the bike. Publicly available exploit code exists (two GitHub repositories), though EPSS is very low (0.03%) and it is not listed in CISA KEV.
Nuclei v3.7.0 and earlier allow JavaScript templates to read arbitrary `.js` and `.json` files from the host filesystem via the `require()` function, bypassing the `allow-local-file-access` restriction. This enables unauthenticated local attackers or users running untrusted templates to extract sensitive data from configuration files, credential stores, and cloud credentials. The vulnerability is limited to these two file types but can expose secrets in `package.json`, environment configs, and similar files commonly present on developer or server systems.
The id utility in uutils coreutils miscalculates group membership by using real GID instead of effective GID, causing output divergence from GNU coreutils and potentially enabling unauthorized access when scripts rely on id output for access-control decisions. Affects local users with privileges to execute the id command. Proof-of-concept code exists but no active exploitation in the wild has been confirmed.
The mknod utility in uutils coreutils creates device nodes before atomically applying SELinux security labels, and fails to properly clean up mislabeled nodes if labeling operations fail. This leaves device nodes with incorrect default SELinux contexts, potentially bypassing mandatory access control restrictions on systems where SELinux is enforcing. Affects coreutils versions prior to 0.6.0; exploitation requires local root or elevated privileges and is not currently publicly exploited, though cleanup failures are guaranteed on labeling failure.
The mkdir utility in uutils coreutils creates directories with default umask-derived permissions (0755) before applying the requested mode via chmod, creating a race condition window where a directory intended to be private becomes briefly accessible to other local users. This affects uutils coreutils versions prior to 0.6.0 and requires local authenticated access to exploit, limiting real-world impact despite the CVSS score of 3.3.
Bypass of --preserve-root protection in uutils coreutils rm utility allows local users to recursively delete the root filesystem by supplying a symbolic link that resolves to the root directory, rather than relying on authentic root inode comparison. The vulnerability affects coreutils versions before 0.7.0 and requires local access with no special privileges, though successful exploitation is hindered by high complexity (AC:H). CISA exploitation status is none at time of analysis, and a vendor patch has been released.
mktemp utility in uutils coreutils mishandles empty TMPDIR environment variables by creating temporary files in the current working directory instead of falling back to /tmp, potentially exposing sensitive data if the CWD has overly permissive access controls. Affects uutils coreutils versions prior to 0.6.0 and requires local attacker with limited privileges to manipulate the environment or exploit overly accessible working directories; CVSS 3.3 reflects low severity (local access, limited confidentiality impact) despite information disclosure risk.
Authenticated project owners in GitLab CE/EE versions 11.2-18.9.5, 18.10-18.10.3, and 18.11-18.11.0 can bypass group fork prevention settings due to improper authorization checks, allowing them to create forks when they should be restricted. The vulnerability requires authentication and high-privilege access (project owner role), resulting in low severity (CVSS 2.7). Publicly available exploit code exists and patch versions have been released by the vendor.
GitLab CE/EE 18.11 before 18.11.1 allows authenticated users to bypass access controls and read titles of confidential or private issues in public projects through improper validation in the issue description rendering process. The vulnerability requires valid user credentials but no elevated privileges, affecting the confidentiality of issue metadata that should be restricted. Publicly available exploit code exists, and a vendor patch is available.
ThinkPHP 5.0.23 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by invoking functions through the routing parameter. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Terminal Services Manager 3.1 contains a stack-based buffer overflow vulnerability in the computer names field that allows local attackers to execute arbitrary code by triggering structured exception. Rated high severity (CVSS 8.6), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Insecure direct object references in Augmentt 1.0 allow unauthenticated remote attackers to access and modify sensitive tenant data across different organizational contexts, bypassing authentication mechanisms through direct manipulation of object identifiers. The vulnerability enables both unauthorized information disclosure and modification of tenant configuration with CVSS 6.5 (medium severity); no public exploit code has been identified at the time of analysis, though the attack is automatable and requires no user interaction.
Emailchef WordPress plugin versions up to 3.5.1 allow authenticated attackers with Subscriber-level access to delete plugin settings via an unprotected AJAX action due to missing capability checks. The vulnerability enables unauthorized modification of plugin configuration without administrative privileges, affecting any WordPress site using the affected plugin versions. No public exploit code or active exploitation has been identified at time of analysis.
Authenticated users with Subscriber-level access can modify the CalJ Shabbat Times plugin's API key and clear its cache due to missing authorization checks in the CalJSettingsPage class constructor. The vulnerability affects all versions up to and including 1.5, with no special network or interaction requirements beyond valid WordPress authentication. While CVSS 5.3 reflects moderate integrity impact, the practical risk depends on whether WordPress sites allow Subscriber-level registrations and whether the plugin's API key provides sensitive access to external services.
TP Restore Categories And Taxonomies WordPress plugin versions up to 1.0.1 lack capability checks in the delete_term() AJAX handler, allowing authenticated Subscriber-level users to permanently delete taxonomy terms from backup tables by reusing a nonce exposed to all authenticated users. The vulnerability bypasses authorization despite nonce validation, enabling low-privileged attackers to cause data loss via a simple crafted AJAX request.
Spring Security's DaoAuthenticationProvider can leak timing information about user account status when applications rely on UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked attributes for user validation. This allows remote attackers to enumerate disabled, expired, or locked accounts through timing analysis of authentication responses across affected versions 5.7.0-5.7.22, 5.8.0-5.8.24, 6.3.0-6.3.15, 6.5.0-6.5.9, and 7.0.0-7.0.4. No public exploit code or active exploitation has been identified at this time.
SQL injection in OwnTone Server 28.4 through 29.0 allows unauthenticated remote attackers to inject arbitrary SQL expressions via the query= and filter= parameters in DAAP requests, enabling bypass of access controls and unauthorized retrieval of media library data. The vulnerability stems from insufficient sanitization of integer-mapped DAAP field parameters and affects default network-accessible deployments without requiring user interaction.
Craft CMS versions 5.6.0 through 5.9.14 allow authenticated users with only viewUsers permission to remove arbitrary users from all user groups via the actionSavePermissions() endpoint, bypassing per-group authorization controls that protect group additions. An attacker can submit an empty groups value to strip all group memberships from any user, degrading access control integrity. The vulnerability has been patched in version 5.9.15.
BigBlueButton versions prior to 3.0.24 allow authenticated viewers to inject or overwrite captions due to missing authorization controls, enabling unauthorized modification of classroom content. The vulnerability requires an authenticated session but does not need user interaction, affecting the integrity of real-time collaboration in virtual classroom deployments. Version 3.0.24 restricts caption submission permissions to authorized roles only.
Authorization bypass in GitHub Enterprise Server allows a repository admin to hijack secret scanning push protection delegated bypass reviewer lists on repositories they do not administer. The server authorizes requests against the repository specified in the URL path but applies the configuration change to the repository identified by the attacker-controlled owner_id parameter in the request body - a classic IDOR pattern (CWE-639). Impact is constrained: an attacker can only assign existing trusted users within the instance as bypass reviewers, not introduce arbitrary external accounts. No public exploit exists and EPSS is 0.05% (14th percentile); patched releases are available for all supported GHES branches.
Improper access control (CWE-284) in the C Oracle SSL API component of Oracle Security Service 12.1.3.0.0 and 12.2.1.4.0 - part of Oracle Fusion Middleware - allows a low-privileged network attacker to compromise the service via HTTPS, resulting in unauthorized read access to all critical data and unauthorized creation, modification, or deletion of critical data. The attack is constrained by high complexity and mandatory human interaction from a third party, making automated or mass exploitation infeasible; EPSS exploitation probability is extremely low at 0.03% and CISA SSVC classifies exploitation as none. No public exploit has been identified at time of analysis.
Partial denial-of-service in Oracle VM VirtualBox 7.2.6 Core component allows a locally authenticated, high-privileged attacker to degrade availability of the hypervisor. Exploitation is limited to the local system and requires pre-existing administrative-level access, with no confidentiality or integrity impact. No public exploit code has been identified and CISA has not listed this in the Known Exploited Vulnerabilities catalog; EPSS at 0.01% (2nd percentile) reflects near-zero exploitation probability.
Improper access control in Oracle VM VirtualBox 7.2.6's Core component allows a high-privileged local attacker with logon access to the host infrastructure to perform unauthorized writes, inserts, or deletions against VirtualBox-accessible data. Notably, Oracle's advisory confirms a scope change - successful exploitation may affect additional products beyond VirtualBox itself, such as guest VM environments sharing the same host. No active exploitation is confirmed (SSVC: none; EPSS: 0.01%, 2nd percentile), and no public exploit or POC has been identified at time of analysis.
Oracle VM VirtualBox 7.2.6 contains an improper access control flaw in its Core component that enables a highly privileged local attacker to partially compromise confidentiality, integrity, and availability - with a scope change indicating potential bleed beyond the VirtualBox process boundary to adjacent products or guest VMs on the same host. Exploitation requires local logon with high privileges and high attack complexity, making opportunistic exploitation unlikely; EPSS at the 2nd percentile and SSVC exploitation status of 'none' corroborate low real-world risk. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog.
Confidentiality breach in Oracle VM VirtualBox 7.2.6 Core allows a high-privileged local attacker to gain complete read access to all data accessible by the VirtualBox process, with scope change indicating potential data leakage beyond the primary VM boundary into adjacent virtualized environments. The CVSS vector (AV:L/AC:L/PR:H/UI:N/S:C) confirms local-only exploitation requiring administrative-level host access, substantially limiting the realistic attacker pool. No active exploitation is confirmed - EPSS sits at 0.01% (2nd percentile), SSVC rates exploitation as none, and the vulnerability is absent from CISA KEV.
Improper access control in Oracle Hyperion Infrastructure Technology's Lifecycle Management component allows a network-reachable, high-privileged authenticated attacker to perform unauthorized creation, deletion, or modification of critical Hyperion data, while also gaining read access to a subset of accessible data. Affected is the single supported version 11.2.24.0.000, patched in Oracle's April 2026 Critical Patch Update. No public exploit or active exploitation has been identified; EPSS stands at 0.03% (7th percentile) and CISA's SSVC framework rates exploitation as none, placing this firmly in a low-urgency remediation tier despite the High integrity impact component.
Unauthorized read access to student records data in Oracle PeopleSoft Enterprise CS Student Records 9.2 (Research Tracking component) can be triggered by a low-privileged authenticated attacker over HTTP, provided a victim user interacts with attacker-controlled content. The flaw is rooted in improper access control (CWE-284), enabling horizontal or vertical privilege escalation within the application to expose the full scope of student records data. No public exploit exists and EPSS is extremely low at 0.03% (9th percentile), though the confidentiality impact is rated High by Oracle given the breadth of data potentially accessible.
Denial-of-service in MySQL Server's Optimizer component allows a high-privileged network attacker to hang or repeatedly crash the database engine across three major release branches (8.0.x through 8.0.45, 8.4.x through 8.4.8, and 9.0.x through 9.6.0). Exploitation requires a high-privilege database account (DBA-level), but once authenticated, the attack is low-complexity and requires no user interaction - Oracle's advisory describes it as 'easily exploitable' in that context. No public exploit code or active exploitation has been identified; EPSS of 0.04% (11th percentile) and SSVC exploitation rating of 'none' together indicate this poses negligible real-world exploitation risk at time of analysis.
Denial-of-service exposure in Oracle MySQL Server's DML (Data Manipulation Language) component allows a high-privileged, network-authenticated attacker to cause a complete, repeatable crash or hang of the database server. Affected across three active release trains - 8.0.0 through 8.0.45, 8.4.0 through 8.4.8, and 9.0.0 through 9.6.0 - the vulnerability is exploitable over multiple network protocols without user interaction. No public exploit exists and the vulnerability is not listed in CISA KEV; EPSS at 0.04% (11th percentile) confirms very low exploitation activity at time of analysis.
Denial-of-service in MySQL Server's InnoDB component allows a high-privileged authenticated attacker with network access to cause a hang or frequently repeatable crash of the database server across versions 8.0.0-8.0.45, 8.4.0-8.4.8, and 9.0.0-9.6.0. Impact is confined to availability - no data exfiltration or integrity compromise is possible through this vector. No public exploit has been identified at time of analysis, and EPSS probability of 0.04% (11th percentile) is consistent with SSVC's confirmed zero observed exploitation, placing this firmly in the lower-priority patch tier for most organizations.
Denial-of-service in MySQL Server's InnoDB storage engine allows a high-privileged, network-authenticated attacker to hang or repeatedly crash the database server across all major release trains (8.0.x, 8.4.x, and 9.x). The vulnerability is reachable over multiple network protocols without user interaction, making it exploitable by any account holding high database privileges (e.g., DBA or SUPER). No public exploit code has been identified and CISA has not added this to the Known Exploited Vulnerabilities catalog, consistent with an EPSS score of just 0.04%.
InnoDB component in MySQL Server versions 8.0.0-8.0.45, 8.4.0-8.4.8, and 9.0.0-9.6.0 exposes a denial-of-service condition reachable over the network by a highly privileged attacker, causing the database server to hang or crash repeatably. Disclosed as part of Oracle's April 2026 Critical Patch Update (CVSS 3.1: 4.9), the vulnerability has an EPSS of 0.04% (11th percentile), SSVC exploitation status of 'none', and no public exploit identified at time of analysis. Oracle has released a patch; risk is largely limited to scenarios involving compromised administrative credentials or malicious insiders.
Denial-of-service in Oracle MySQL Server's GIS (Geographic Information System) component allows a high-privileged, network-authenticated attacker to cause the database server to hang or repeatedly crash. Versions 9.0.0 through 9.6.0 are confirmed affected. No public exploit has been identified and EPSS probability stands at 0.04% (11th percentile), consistent with SSVC's exploitation rating of 'none' - real-world risk is confined primarily to insider threat or compromised DBA account scenarios.
Denial-of-service in Oracle MySQL Server's Partition component (versions 9.0.0-9.6.0) allows a high-privileged, network-connected attacker to cause a complete server hang or repeatable crash, resulting in full availability loss. Exploitation is constrained to authenticated users holding high database privileges (CVSS PR:H), sharply limiting the realistic attack surface. No public exploit code exists, EPSS is 0.04% (11th percentile), and SSVC confirms no known exploitation - placing this firmly in the low real-world priority tier despite its network-accessible vector.
Improper access control in the Dynamic Monitoring Service (DMS) component of Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0 enables low-privileged authenticated attackers to perform unauthorized read and write operations on accessible Fusion Middleware data over HTTP. The scope change in the CVSS vector (S:C) indicates successful exploitation can extend impact to additional co-deployed Oracle middleware components beyond DMS itself. No public exploit has been identified, EPSS stands at a low 0.03%, and SSVC records exploitation as none - positioning this as a normal-cycle patch priority rather than an emergency response.
Oracle Financial Services Analytical Applications Infrastructure (OFSAAI) versions 8.0.7.9, 8.0.8.7, and 8.1.2.5 contain an improper access control flaw (CWE-284) in the User Interface component that permits a locally authenticated low-privileged attacker - contingent on inducing a second user to interact - to bypass access controls and obtain complete read access to all OFSAAI-accessible financial data, perform limited data modification, and trigger a full denial-of-service by crashing or hanging the platform. Disclosed in Oracle's April 2026 Critical Patch Update, this vulnerability carries no public exploit code and no active exploitation per CISA KEV, SSVC, or EPSS (0.01%, 2nd percentile), situating it as a medium-priority insider threat relevant to financial institutions running these specific versions.
Unauthenticated network exploitation of the Oracle Life Sciences InForm App Server (versions 7.0.1.0 and 7.0.1.1) allows remote attackers to read a subset of clinical trial application data and perform unauthorized insert, update, or delete operations via HTTP - with no credentials or user interaction required. Rooted in CWE-284 (Improper Access Control) and tagged as an Authentication Bypass, the App Server fails to enforce access controls on certain endpoints, confirmed by Oracle in the April 2026 Critical Patch Update. No public exploit code or active exploitation has been identified; EPSS sits at 0.03% (8th percentile), though SSVC flags the attack as automatable.
Improper access control in the IDM Authentication component of Oracle Life Sciences InForm 7.0.1.0 and 7.0.1.1 exposes the platform to unauthenticated network-based attacks over HTTP that require victim user interaction to succeed. Successful exploitation yields unauthorized partial read, write/delete, and denial-of-service impact against InForm clinical trial data. No public exploit code exists and no active exploitation has been identified; EPSS at 0.03% (9th percentile) and SSVC exploitation status of 'none' confirm minimal real-world threat at this time.
Improper authorization in the User Interface component of Oracle Financial Services Analytical Applications Infrastructure (OFSAAI) exposes critical financial data to low-privileged network attackers. Affected versions 8.0.7.9, 8.0.8.7, and 8.1.2.5 allow an authenticated attacker to bypass authorization controls via HTTP, contingent on human interaction from a victim user, resulting in complete confidentiality compromise of all data accessible within the platform. No public exploit exists and EPSS sits at 0.03%, indicating negligible opportunistic exploitation pressure at time of analysis.
Confidentiality breach in Oracle MySQL Shell's Core Client component across three major version branches (8.0.x, 8.4.x, and 9.0.x) permits a high-privileged, network-connected attacker to gain unauthorized access to critical or complete MySQL Shell-accessible data, with a CVSS scope change (S:C) indicating potential impact on adjacent systems. No public exploit code has been identified at time of analysis, and an EPSS score of 0.03% at the 8th percentile reflects near-zero observed exploitation probability. SSVC classifies exploitation status as none and technical impact as only partial, underscoring that despite the scope-change flag and high confidentiality impact, real-world urgency is low given the steep access prerequisites.
Improper authorization in Oracle WebLogic Server's Web Services component allows unauthenticated remote attackers to perform unauthorized creation, deletion, or modification of critical data - but only when a victim user interacts with attacker-controlled content. Affecting four actively supported versions (12.2.1.4.0 through 15.1.1.0.0), this flaw carries a CVSS 6.5 Medium rating reflecting the mandatory human-interaction prerequisite that prevents fully automated exploitation. No public exploit code exists and CISA has not listed this in the Known Exploited Vulnerabilities catalog; SSVC assessment confirms exploitation status as none at time of analysis.
Improper access control in Oracle Financial Services Analytical Applications Infrastructure (OFSAAI) Platform component allows a low-privileged remote attacker to bypass authorization controls and gain unauthorized read and write access to all financial data managed by the platform. Versions 8.0.7.9, 8.0.8.7, and 8.1.2.5 are confirmed affected. No public exploit code has been identified at time of analysis, and EPSS at 0.03% (9th percentile) signals very low observed exploitation probability, though the SSVC technical impact is rated 'total' given the full confidentiality and integrity exposure.
Unauthorized data exposure in Oracle Financial Services Analytical Applications Infrastructure (OFSAAI) versions 8.0.7.9, 8.0.8.7, and 8.1.2.5 allows a low-privileged, network-authenticated attacker to read critical or complete data accessible within the platform via HTTP. The Platform component contains a CWE-200 information disclosure flaw that, per Oracle's April 2026 CPU, is classified as 'easily exploitable' under authenticated low-privilege conditions. No public exploit code has been identified and CISA has not listed this in KEV; EPSS at 0.03% (9th percentile) and SSVC exploitation status of 'none' indicate no observed active exploitation at time of analysis.
Unauthorized read access in Oracle Database Server's RDBMS component (versions 19.3-19.30) is achievable by a highly privileged attacker holding the Row Access Method privilege, via multiple network protocols, when a third party performs required human interaction. Impact is limited to a partial confidentiality disclosure of RDBMS-accessible data with no integrity or availability effects. No public exploit exists and EPSS at 0.03% (7th percentile) reflects near-zero exploitation likelihood; SSVC confirms exploitation status as none and the attack is not automatable.
Improper access control in the Workflow component of Oracle PeopleSoft Enterprise PeopleTools 8.61-8.62 allows a low-privileged, network-authenticated attacker to compromise confidentiality and integrity of accessible data when a victim user interacts with attacker-controlled content. The scope change (S:C) in the CVSS vector indicates successful exploitation can impact resources beyond the vulnerable component, consistent with client-side attack patterns such as stored or reflected XSS enabling cross-context data access. No public exploit code has been identified and EPSS sits at 0.03% (8th percentile), indicating negligible observed exploitation pressure at time of analysis.
Unauthorized full data disclosure in PeopleSoft Enterprise FIN Project Costing 9.2 allows a low-privileged authenticated attacker to read all data accessible to the Projects component via a network-reachable HTTP endpoint. The root cause is improper access control (CWE-284), tagged by Oracle as an authentication bypass - most likely an authorization boundary failure that permits privilege escalation within the application rather than a bypass of the initial login gate, consistent with a PR:L CVSS vector. No public exploit code has been identified and EPSS is 0.03% (9th percentile), indicating negligible automated exploitation activity at this time.
Oracle Workflow (E-Business Suite component, versions 12.2.3-12.2.15) exposes its Workflow Loader component to unauthorized data manipulation and partial denial of service by highly privileged network attackers over HTTP. The CVSS S:C (scope changed) designation confirms that a successful attack can cascade beyond Oracle Workflow itself to affect other products within the E-Business Suite application tier, amplifying the business impact beyond what the base score of 5.5 initially suggests. No public exploit has been identified and EPSS sits at 0.04% (11th percentile), indicating negligible exploitation probability at time of analysis; SSVC likewise assesses exploitation status as none.
Unauthorized data disclosure in Oracle PeopleSoft Enterprise FIN Maintenance Management 9.2 allows an authenticated low-privileged attacker with HTTP network access to read all data accessible within the Work Order Management component, including potentially sensitive financial maintenance records. The flaw is rooted in improper access control (CWE-284) and is tagged as an authentication bypass, suggesting a low-privileged session can circumvent authorization checks to access data scoped to higher-privilege roles. No active exploitation is confirmed (absent from CISA KEV), and EPSS of 0.03% at the 9th percentile indicates very low real-world exploitation probability; remediation is addressed in Oracle's April 2026 Critical Patch Update.
Unauthorized financial contract data disclosure in Oracle PeopleSoft Enterprise FIN Contracts 9.2 allows low-privileged authenticated users to access all contract records via HTTP without integrity or availability impact. The CWE-200 classification and 'Authentication Bypass' tag together suggest the flaw is an intra-session authorization control bypass - not a login bypass - permitting users to read contract data beyond their assigned permissions. No public exploit exists and EPSS sits at 0.03% (9th percentile), consistent with SSVC's 'Exploitation: none' assessment, though the high confidentiality impact to sensitive financial data warrants prompt patching for affected enterprises.
Unauthorized read access to sensitive financial data is possible in Oracle PeopleSoft Enterprise FIN Maintenance Management 9.2 through an improper access control flaw (CWE-284) in the Work Order Management component. An authenticated low-privileged attacker with network access over HTTP can exploit this to gain complete access to all data within the PeopleSoft FIN Maintenance Management system. No public exploit exists and SSVC classifies exploitation as 'none,' with EPSS at 0.03% (9th percentile), indicating negligible opportunistic exploitation risk despite Oracle's own classification of the vulnerability as 'easily exploitable.'
Oracle Applications Framework's Personalization component in E-Business Suite versions 12.2.9 through 12.2.15 allows an authenticated, high-privileged attacker to exceed intended authorization boundaries via HTTP, resulting in unauthorized data read, write, and partial denial of service against the framework. Root cause is CWE-284 (Improper Access Control), confirmed by Oracle's April 2026 Critical Patch Update. No public exploit code exists and EPSS sits at 0.03% (10th percentile), aligning with SSVC's 'Exploitation: none' assessment - this is a low-urgency, medium-severity finding gated entirely by the requirement for pre-existing high-privilege access.
PeopleSoft Enterprise SCM Purchasing 9.2 exposes critical procurement data to low-privileged authenticated attackers over HTTP, enabling complete unauthorized read access to all data within the Purchasing module. The flaw is rooted in improper access control (CWE-284), allowing a low-privileged PeopleSoft account holder to bypass post-authentication authorization restrictions and retrieve sensitive purchasing records they should not have access to. No public exploit code exists and EPSS sits at a very low 0.03%, but Oracle's April 2026 Critical Patch Update addresses the vulnerability and should be applied to any internet-facing or multi-tenant PeopleSoft deployment.
Improper access control in Oracle Identity Manager Connector 12.2.1.4.0 exposes the Microsoft Active Directory component to network-based exploitation via LDAP, enabling low-privileged authenticated attackers to perform unauthorized creation, deletion, or modification of critical data and read a subset of accessible data. The vulnerability carries a CVSS 3.1 score of 5.9 (Medium), tempered by high attack complexity (AC:H) and a near-zero EPSS of 0.03% (8th percentile). No public exploit code exists and no active exploitation has been reported; this is a real but difficult-to-trigger integrity-focused flaw in Oracle's enterprise identity management stack.
Oracle Identity Manager Connector 12.2.1.4.0 exposes a missing authentication control (CWE-306) in its Core component, reachable over HTTPS by unauthenticated network attackers. Successful exploitation yields unauthorized read access to critical data or complete access to all data accessible by the connector - a significant confidentiality breach in an identity governance system. No public exploit code has been identified at time of analysis, and EPSS at 0.03% (9th percentile) alongside SSVC's 'none' exploitation rating indicate low real-world exploitation pressure despite the network-accessible vector.
Unauthenticated network access to Oracle Identity Manager Connector 12.2.1.4.0 enables complete confidentiality compromise of all data accessible by the connector via an authentication bypass in its Core component. The flaw (CWE-306, Missing Authentication for Critical Function) is reachable over HTTP without credentials but carries high attack complexity, constraining exploitation to actors capable of meeting undisclosed preconditions. No active exploitation has been identified - EPSS sits at the 9th percentile (0.03%) and CISA SSVC rates it as non-automatable with partial technical impact - suggesting limited near-term risk despite the identity management context.
Cross-site scripting or improper access control in the Human Workflow component of Oracle Business Process Management Suite (versions 12.2.1.4.0 and 14.1.2.0.0) allows unauthenticated remote attackers to read a subset of BPM data and perform unauthorized data modifications via HTTP, provided a legitimate user interacts with attacker-controlled content. The attack carries a scope change, meaning successful exploitation can impact components beyond the BPM Suite itself within the Oracle Fusion Middleware stack. No public exploit code has been identified and CISA has not listed this in KEV; EPSS places exploitation probability at 0.03% (8th percentile), consistent with low near-term exploitation risk.