Authentication Bypass
Monthly
Loose-mode Unicast Reverse Path Forwarding (uRPF) on certain Arista EOS platforms can fail to drop traffic that the configured source-address verification should have rejected, so packets that ought to be filtered are still processed and forwarded by the switch or router. Only devices running Arista EOS on one of the specific (unnamed) affected platforms and explicitly configured with loose uRPF are exposed - default deployments that do not enable uRPF are not affected, and there is no confidentiality or availability impact, only a loss of filter integrity. No public exploit code and no confirmed active exploitation have been identified at time of analysis; the vendor CVSS score of 5.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N) is well calibrated to this narrow, configuration-dependent filtering failure.
An authenticated user with gRPC/gNSI access on Arista EOS can retain permissions that a security policy rotation was supposed to revoke, because a race condition in the gNSI Authz service causes the policy rotation to fail silently when multiple gNSI transports are configured on the device. Only non-default deployments with more than one gNSI transport are affected, Bootz is explicitly out of scope, and the flaw does not grant new privileges - it merely preserves access the attacker already legitimately held, so the outcome is a stale authorization state rather than a privilege escalation. Exploitation requires the revocation and the race to coincide, making it opportunistic rather than attacker-triggerable on demand; Arista discovered the issue internally and reports no malicious exploitation, and no public exploit code has been identified at time of analysis. The vendor's CVSS 4.0 score of 6.0 is well-calibrated for a genuinely moderate, not critical, issue.
Improper authorization checks in GitLab CE/EE's Generic Package Registry (CWE-862) allow an authenticated user holding developer-role permissions to substitute the content of an existing package file and to hide packages from their legitimate owners. The flaw affects all GitLab Community and Enterprise Editions from 13.9 up to the fixed releases 19.1.8, 19.2.6 and 19.3.2, meaning the exposure window spans multiple major release lines and any long-lived install not patched in this cycle. Impact is integrity-only (CVSS 4.3, AV:N/PR:L/UI:N) - an attacker cannot read or delete data or crash the instance, but they can silently corrupt or conceal artifacts that downstream users and CI pipelines trust; publicly available exploit detail has been published via a HackerOne report.
GitLab CE/EE 13.0 and later (before 19.1.8, 19.2.6 and 19.3.2) fails to properly validate group URL slugs during namespace transfers, allowing any authenticated user to induce a slug collision that leaves the legitimate owners of another group unable to modify that group's settings. The flaw is an availability-only issue (CVSS 4.3, C:N/I:N/A:L) rather than a data-disclosure or code-execution bug, but publicly available exploit detail exists via the linked HackerOne report, and the CWE-862 classification indicates the transfer workflow bypasses the authorization checks that should protect the target namespace. No CISA KEV listing or EPSS score was supplied, so active exploitation is not confirmed.
Improper authorization controls in GitLab Enterprise Edition's compliance framework management allow an authenticated user holding the Security Manager role to execute arbitrary CI/CD jobs and reach protected CI/CD variables inside group projects. Affected are GitLab EE 18.11 through 19.1.7, 19.2.x before 19.2.6, and 19.3.x before 19.3.2, with fixes published in 19.1.8, 19.2.6, and 19.3.2. Exploit details are publicly available via a HackerOne report, and GitLab is credited as the reporter, though the issue is not listed in CISA KEV and no EPSS estimate was supplied.
Missing privilege verification in the FluentBoards WordPress plugin before 2.0.15 lets any authenticated member of a board perform manager-only board operations - adding or removing members and toggling a private board to public - because the affected endpoints check only that the caller belongs to the board rather than that they hold board-manager rights. The issue is remotely exploitable by an attacker with an existing low-privileged membership on the target board (assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), requires no user interaction and no administrative role, and is scoped to boards the attacker already belongs to, so it does not yield site-wide access. Publicly available exploit code exists and the vendor has released a patch in version 2.0.15; EPSS is very low (0.17%, ~6th percentile) and the flaw is not in CISA KEV, so this is a low-to-moderate priority issue best handled through routine plugin updating.
Comment authorship spoofing in the FluentBoards WordPress plugin before 2.0.15 allows any authenticated user who is already a member of a board to submit comments that are displayed as authored by a different user, including site administrators. The root cause is a missing check that the submitting user equals the author identity the comment is attributed to (CWE-290, authentication bypass by spoofing); the flaw is network-reachable, requires no victim interaction, and yields integrity-only impact with no confidentiality or availability loss. Publicly available exploit code exists (per the WPScan entry tagged as an exploit), but there is no CISA KEV confirmation of active exploitation, and EPSS is only 0.17% (6th percentile), consistent with a low-severity, low-likelihood issue. Vendor-released patch: 2.0.15.
Unauthenticated attackers can reset any existing order and its attendees to a pending state in the Eventin WordPress plugin before 4.1.24, invalidating already-paid tickets, when the plugin's offline (local) payment method is enabled. The finalisation routine relies on a nonce that the plugin exposes to unauthenticated visitors and never verifies that the caller owns the targeted order, making this a missing-authorization flaw rather than an authentication one. Exploitation is gated by configuration: the site must have the offline payment method active and at least one existing order to target, and publicly available exploit code exists, but there is no evidence of confirmed active exploitation (CISA KEV) and the EPSS score is very low at 0.18% (8th percentile). Impact is limited to integrity - order/attendee state is corrupted, with no data disclosure or service outage - so this is a genuine but low-priority issue. Fixed in Eventin 4.1.24.
Broken access control in the Eventin WordPress plugin before 4.1.24 lets an authenticated contributor (or any higher role) create brand-new WordPress user accounts through the plugin's add-speaker functionality, and by supplying an email address they control, convert that into a working login to an account holding capabilities greater than their own - notably publishing content and uploading files. The flaw is a missing-authorization issue (CWE-862), so valid low-privilege credentials are a prerequisite; the tag 'Authentication Bypass' overstates it, and the privilege gained is author-level rather than full site takeover. The vendor has released a fix (4.1.24) and publicly available exploit code exists, while the EPSS score remains low at 0.17% (7th percentile), consistent with a bounded-impact, authenticated attack surface.
Information disclosure in the Schema & Structured Data for WP & AMP WordPress plugin (versions 1.63 through 1.65) allows an authenticated user holding the WordPress contributor role or higher to retrieve the content of other users' draft, pending, private, and password-protected posts by invoking the plugin's schema-generation function against a post ID they are not permitted to edit. The root cause is a missing per-post edit-capability check, and impact is confidentiality-only - post content is exposed but cannot be modified. A public proof-of-concept is available, so exploitation is trivial for anyone with a contributor-level account on an affected site; EPSS is low at 0.17% (7th percentile) and there is no indication of confirmed active exploitation (not in CISA KEV).
Missing authorization in the Eventin WordPress plugin before 4.1.24 allows unauthenticated attackers to reuse the order-scoped token that the plugin itself issues during guest checkout to swap a paid ticket for a free one and then complete the order at no cost. The flaw is a business-logic/fraud issue rather than a site-compromise vector: it yields no data disclosure, no privilege escalation and no denial of service, and it only affects sites running Eventin with paid ticketing and guest checkout enabled, and only on the attacker's own order. Publicly available exploit code exists, and the vendor has released a fix in 4.1.24; EPSS is low (0.18%, 8th percentile), consistent with a narrowly targeted revenue-loss bug rather than a mass-exploited one.
Keycloak's first broker login flow leaves a temporary account-linking proof behind after a federated identity link is established or manually removed (CWE-613), allowing an attacker who controls the external identity to silently re-establish the link and authenticate as the victim without any further confirmation. The flaw affects Red Hat Build of Keycloak and Red Hat Single Sign-On 7 deployments that use identity brokering, and carries high confidentiality and integrity impact despite a moderate CVSS base of 6.4. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV.
The Ad Inserter – Ad Manager & AdSense Ads WordPress plugin (all versions up to and including 2.8.16) exposes administrator-configured header and footer code blocks to unauthenticated visitors through the `ai-debug-code` URL parameter, because the debug handler performs no capability check. An attacker who can reach a site running the vulnerable plugin can simply append that parameter to a request and read code fragments — ad scripts, analytics snippets, custom CSS/JS — that the site owner deliberately disabled from public display. The impact is confidentiality-only (CVSS 5.3, PR:N/UI:N), and there is no public exploit code or CISA KEV listing identified at time of analysis.
Unauthenticated attackers with adjacent network access to the mySCADA myPRO Manager notification gateway can send arbitrary SMS messages through its connected GSM modem by submitting a phone number and message text to an exposed HTTP endpoint that performs no authorization checks. The flaw is a missing-authorization weakness (CWE-862) affecting myPRO versions 0 through 2.1, rated CVSS 4.0 base 5.3. Impact is limited to SMS abuse and messaging-service integrity — no code execution, data disclosure, or process disruption — and no public exploit code or CISA KEV entry was identified at time of analysis.
An incorrect authorization flaw in the Netcore NR255-V router (firmware 1.5.130703) lets any authenticated user with a broad or low-privileged role pull live QoS/bandwidth telemetry from the mod_qos_bandwidth plan.json read routes, exposing network activity data they are not entitled to see. The bug is rooted in missing role checks within filter_conns_dump_cgi.c and IGD_CgiCall.c, so the endpoints return connection and bandwidth statistics regardless of the caller's privilege level. Impact is confidentiality-only and rated moderate (CVSS 4.0 base 5.3, AV:N/PR:L/UI:N/VC:L); no CISA KEV listing or confirmed public exploit code exists, though a public technical write-up of the QoS telemetry disclosure is referenced from the NVD entry.
VRRPv2 IP Authentication Header (IP-AH) authentication can be bypassed in affected versions of Arista EOS, allowing an unauthenticated attacker on the same Layer 2 segment as the VRRP group to impersonate the virtual router master. Successful takeover lets the attacker intercept, modify, or discard traffic that hosts send to the virtual gateway IP, effectively hijacking the default gateway for that VLAN. The issue is vendor-reported through Arista PSIRT (advisory 0157) and tracked as EUVD-2026-80009; no public exploit code or CISA KEV entry was present at time of analysis, and the CVSS 4.0 base score of 5.3 reflects adjacent-network access with no privileges or user interaction.
UI spoofing in Google Chrome's Transactions Platform component lets a remote attacker who has already compromised the browser's renderer process render crafted HTML as trusted interface elements, deceiving the user. The flaw is a missing authorization check (CWE-862) affecting Chrome versions prior to 153.0.8010.47, and it is not reachable on its own: exploitation requires a separate, earlier renderer compromise plus the victim loading and interacting with the attacker's page (UI:R, AC:H). Impact is limited to low-severity confidentiality and availability effects rather than code execution or sandbox escape, no public exploit code was identified at time of analysis, and the issue is fully resolved by Chrome 153.0.8010.47.
Information disclosure in Google Chrome for Android before 153.0.8010.47 allows a locally installed app on the same device to retrieve sensitive browser data because an authorization check is missing on an Android-exposed Chrome component. The flaw is local-only and rated AC:H, giving a modest CVSS 3.1 base of 5.1 (AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) even though the confidentiality impact is complete; Google's Chromium team nevertheless classifies it as High severity. Google has shipped a fix in 153.0.8010.47, there is no CISA KEV listing, and no public exploit code has been identified at time of analysis.
UI spoofing in Google Chrome versions prior to 153.0.8010.47 allows an attacker who has already compromised the browser's renderer process to draw convincing but fake interface elements in front of the user via a crafted HTML page. The flaw is a missing authorization check (CWE-862) on a browser-side privileged capability, rated Medium by the Chromium team and scored 4.2 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L), with impact limited to Low confidentiality and Low availability and no integrity effect. Exploitation is not possible as a standalone initial-access vector - renderer compromise is a mandatory precondition, user interaction is required, and attack complexity is High; no CISA KEV listing and no public exploit code were identified at time of analysis. A vendor-released patch exists in Chrome 153.0.8010.47.
Let me synthesize. CVE-2026-18426: Concrete CMS 9.0.0 through 9.5.2, missing block-level edit permission check on Express Form block control-management actions, relying solely on CSRF token validation. Token bound to user and action, not block/page/form. So authenticated user with edit access to one Express Form could reuse token to add/modify/delete controls on forms they aren't authorized to edit, including injecting control whose value later rendered as HTML → stored XSS. CVSS 4.0 2.0, AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:N/VA:N. CWE-862 missing authorization. Tags: XSS, Authentication Bypass, CSRF. Hmm — "Authentication Bypass" tag is arguably mislabeled since it's a missing authorization check (CWE-862), not authentication bypass. Actually that's a good candidate for data_quality_flags mislabeled_tag. The tag "Authentication Bypass" is wrong — this is an authorization flaw (CWE-862), not authentication bypass. Confidence: medium/high. I'd say medium-high. Let's use "high" given CWE-862 is explicitly missing authorization and PR:H required (authenticated user). Actually the tag list includes both XSS and CSRF — both apply somewhat (stored XSS outcome, CSRF token bypass). "Authentication Bypass" is the questionable one. I'll flag it with confidence "medium" or "high". I'll use "high" — the description explicitly says "did not enforce a block-level edit-permission check", which is authorization, and CVSS PR:H means authenticated. So "Authentication Bypass" is mislabeled. Suggest "Missing Authorization" — hmm, suggested field is "the correct/canonical slug if you know it". Perhaps suggested: "missing-authorization" or "authorization-bypass". I'll say "authorization-bypass". Missing tags? Maybe "concrete-cms" / "concrete5" vendor tag absent. Tags list: XSS, Authentication Bypass, CSRF. Missing tag candidates: "Concrete CMS" (vendor/product) — suggested "concrete-cms", high confidence from description. Also "CWE-862" / "Missing Authorization" technique tag. I'll add "
Authentication downgrade in the miniOrange JWT Authentication for WP REST APIs WordPress plugin (versions before 4.8.0) lets unauthenticated remote attackers force the plugin to fall back to Basic HTTP authentication by supplying a crafted GET parameter, overriding whatever JWT or API token configuration the site administrator set. Because the vulnerable code path performs no capability check or nonce verification, and the plugin returns distinguishable error codes without rate limiting, attackers can chain the bypass into unthrottled username enumeration and credential guessing against WordPress REST endpoints. Exploitation yields only low confidentiality and integrity impact (CVSS 4.0 base 6.9), and no public exploit code or active exploitation was identified in the supplied intelligence at time of analysis.
A locally reachable denial-of-service flaw in Oracle VM VirtualBox 7.2.16 (Core component) lets an attacker who already holds a high-privileged logon on the host crash or repeatedly hang the hypervisor, taking down all hosted virtual machines. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H, base 6.0) confirms the impact is availability-only and confined to already-privileged local users, but the scope-change flag indicates the resulting outage can extend to other workloads running on the same infrastructure. No EPSS score, KEV listing, or public exploit evidence was present in the supplied intelligence, so exploitation status is unknown and the flaw should be treated as a privilege-gated local availability risk rather than a remotely exploitable emergency.
Oracle VM VirtualBox 7.2.16 contains a flaw in the Core component that lets a high-privileged attacker who already has a logon on the host trigger a partial denial of service against the VirtualBox process itself. The attack is local (AV:L) and requires elevated privileges (PR:H), but carries a scope change (S:C), meaning the successful exploit can significantly affect additional products layered on the same infrastructure. CVSS 3.1 scores this 3.2 with availability-only impact; there is no public exploit identified at time of analysis and no CISA KEV listing, so real-world urgency is low for most deployments.
Denial of service in Oracle VM VirtualBox 7.2.16 (Core component) lets a locally logged-on attacker with high privileges hang or repeatedly crash the hypervisor, with the CVSS scope-change metric indicating the disruption can extend beyond VirtualBox to other products on the same host. Exploitation requires logon access to the infrastructure running VirtualBox and high privileges (PR:H, AV:L), so it is an insider/administrator-privileged availability attack rather than a remote one. No public exploit code has been identified and the flaw is not listed in CISA KEV; EPSS data was not supplied with this record.
Denial of service in Oracle VM VirtualBox 7.2.16 allows an attacker who already holds high privileges and can log on to the machine running the hypervisor to crash the product through its Core component, producing a hang or repeatable crash. The flaw is rated CVSS 3.1 6.0 (AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H), so it is purely an availability issue with no confidentiality or integrity impact, but the scope change flag means a successful attack can degrade other workloads running alongside VirtualBox — typically guest VMs and co-resident services. It is not remotely exploitable, no public exploit code or CISA KEV entry was identified at time of analysis, and the affected build is confirmed as 7.2.16 by both the vendor advisory and ENISA EUVD.
Oracle VM VirtualBox 7.2.16 (Core component) contains a low-severity information disclosure flaw that requires an attacker to already hold a high-privileged logon on the host where VirtualBox runs. A successful attack yields read access to a limited subset of VirtualBox-accessible data (C:L) and, per Oracle's scope-change rating, may affect components beyond the hypervisor boundary. No public exploit code and no CISA KEV listing were identified at time of analysis, and the CVSS 3.1 base score is only 3.2, so real-world prioritization should be low relative to other virtualization issues.
Oracle VM VirtualBox 7.2.16 can be hung or repeatedly crashed by a high-privileged attacker who already has an interactive logon on the host where the hypervisor runs, provided another person on the system performs an interaction such as opening or starting a crafted VM. The flaw sits in VirtualBox Core and yields availability-only impact: any hosted guest and the VirtualBox process itself can be taken down. It is scored 4.2 and the local-plus-privileged access requirement makes mass exploitation unlikely; no public exploit code or CISA KEV listing was present in the supplied intelligence at time of analysis.
A locally exploitable flaw in the Core component of Oracle VM VirtualBox 7.2.16 lets a low-privileged user who can log on to the host repeatedly crash the hypervisor process and tamper with some VirtualBox-accessible data. The issue requires only local logon with low privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N), no user interaction, and no network exposure, yielding a 6.1 base score driven by Availability (High) and Integrity (Low) impacts with no Confidentiality impact. There is no public exploit code identified and the CVE is not listed in CISA KEV, so current risk is concentrated in multi-user or shared-workstation deployments where untrusted users share a virtualization host.
Oracle VM VirtualBox 7.2.16 contains a Core-component flaw that lets an attacker who already has a logon on the host crash the hypervisor (complete denial of service) and make limited unauthorized modifications to VirtualBox-accessible data, provided they can induce a victim to perform a user action. The issue is local rather than network-reachable, requires no special privileges beyond an interactive session on the machine where VirtualBox runs, and is rated 6.1 on the CVSS 3.1 scale (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H). No public exploit code has been identified and the CVE is not listed in CISA KEV at time of analysis, but the integrity-plus-availability impact and the trivially low attack complexity make prompt patching worthwhile.
A locally exploitable flaw in the Core component of Oracle VM VirtualBox 7.2.16 lets an attacker who already holds a high-privileged logon on the host read a limited subset of VirtualBox-accessible data and trigger a partial denial of service against the hypervisor. The scope-change rating (S:C) indicates the impact can extend beyond VirtualBox itself to other products on or around the host, but exploitation requires local logon with elevated privileges and there is no indication of remote reach. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV, so real-world priority is driven by host-access hygiene rather than internet-facing exposure.
A crafted remote-desktop (RDP) interaction with Oracle VM VirtualBox 7.2.16 can hang or repeatedly crash the hypervisor's Core component, producing a complete denial of service against the affected VM sessions. Exploitation is rated difficult (AC:H) and requires a low-privileged account with network reachability to the virtual machine's remote display service, so it is not a drive-by or unauthenticated attack. Only availability is impacted — there is no confidentiality or integrity loss. No EPSS score, CISA KEV listing, or public exploit code was present in the supplied intelligence, so the vulnerability should be treated as a medium-priority patching item rather than an active emergency.
Unauthenticated attackers who can reach the Oracle Agile PLM Web Client over HTTP can read and tamper with a limited subset of PLM data, but only if they first persuade another user to interact with a crafted request. Oracle rates this 6.1 (medium) with a scope change, meaning a successful attack may also affect additional products reachable through the same component. No public exploit code, POC, or CISA KEV entry was identified in the supplied intelligence for this CVE.
Adjacent-network attackers can bypass authentication in Oracle Agile PLM 9.3.6 (Application Server component), gaining the ability to read, create, delete, or modify any data the PLM application can reach. The flaw is unauthenticated per its CVSS vector (PR:N) but only reachable from the physical communication segment attached to the host running Agile PLM, and Oracle rates it as difficult to exploit (AC:H) with a 6.8 base score affecting confidentiality and integrity only. No public exploit code or CISA KEV listing was present in the available intelligence, so active exploitation is unconfirmed.
Oracle Contract Lifecycle Management for Public Sector — specifically the Wage Determination Online component of Oracle E-Business Suite 12.2.3 through 12.2.15 — can be abused by an unauthenticated, network-based attacker who persuades another user to interact with a crafted HTTP request, yielding unauthorized read plus update/insert/delete access to module data. The CVSS 3.1 base score is 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), and the scope-change metric indicates the compromise may significantly impact additional products beyond the vulnerable module. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so this reads as a patch-cycle priority rather than an emergency.
Oracle iRecruitment, the recruitment module of Oracle E-Business Suite, exposes an access-control weakness in its Internal Operations component across versions 12.2.3 through 12.2.15 that lets an attacker on the same physical network segment read, create, modify, or delete recruitment data without authenticating. The flaw is rated difficult to exploit (CVSS 6.8, AV:A/AC:H/PR:N/UI:N) because it demands layer-2 adjacency to the application host and a race-prone or otherwise unreliable attack path, but it delivers high confidentiality and integrity impact with no availability loss. No public exploit code or CISA KEV entry was present in the supplied intelligence, so exploitation is not confirmed in the wild.
Oracle Helidon 4.0.0 through 4.5.4 contains an authorization weakness in the helidon-microprofile-security component that allows a low-privileged user with ordinary HTTP network access to read a subset of Helidon-accessible data and to insert, update or delete records they should not reach, with no user interaction required. The defect is trivially reachable (CVSS 3.1 base 5.4, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), meaning any valid low-privilege account is enough to over-reach, though availability is unaffected. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied, so the practical urgency rests on whether the affected microprofile-security module is exposed and whether low-privilege accounts are widely issued.
Unauthenticated network access to the Long Running Actions (LRA) component of Oracle Helidon 4.0.0 through 4.5.4 allows a remote attacker to read a subset of data and to insert, update, or delete records handled by the LRA coordinator without supplying credentials. The flaw is rated CVSS 6.5 with a network attack vector, low complexity, and no required privileges or user interaction, but it produces only partial confidentiality and integrity impact with no availability loss. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; EPSS data was not supplied in the input.
Oracle Assets, a module within Oracle E-Business Suite, exposes sensitive asset and financial data to any authenticated user with low privileges who can reach the module over HTTP. Versions 12.2.3 through 12.2.15 are affected; a successful attack yields high confidentiality impact (CVSS 3.1 base 6.5, AV:N/AC:L/PR:L/UI:N) with no integrity or availability effect. Oracle rates the flaw 'easily exploitable', but no EPSS score, KEV listing, or public exploit code was present in the supplied intelligence, so exploitation status is best described as no public exploit identified at time of analysis.
Oracle Product Hub, the product master-data component of Oracle E-Business Suite (versions 12.2.3 through 12.2.15), is exposed to a difficult-to-exploit flaw in its Internal Operations component that lets a low-privileged, network-positioned attacker read and tamper with critical product data via HTTP. The CVSS 3.1 base score is 6.8 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N), reflecting high confidentiality and integrity impact but no availability impact, with the high attack-complexity metric indicating exploitation depends on conditions outside the attacker's direct control. There is no public exploit identified at time of analysis and the flaw has not been listed in CISA KEV; Oracle's own advisory at cspusep2026.html is the authoritative remediation source.
High-privileged users of Oracle E-Business Suite Depot Repair 12.2.3 through 12.2.15 can exploit a flaw in the Depot Repair Diagnostics component over HTTP to read, create, modify, or delete any Depot Repair data they can reach. Oracle rates this CVSS 3.1 6.5 (AV:N/AC:L/PR:H/UI:N, C:H/I:H/A:N), meaning exploitation is network-reachable and low-complexity but requires an already-privileged EBS account; there is no integrity-verified public exploit code and no CISA KEV listing at time of analysis. The practical exposure is privilege escalation or lateral data compromise inside an EBS instance rather than a pre-authentication breach.
Authenticated attackers holding only low-privileged credentials in Oracle E-Business Suite can exploit a WebUI flaw in Oracle Product Workbench 12.2.3 through 12.2.15 to read and tamper with application data, provided they can convince another user to interact with a crafted request. The CVSS 3.1 base score is 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), with a scope change meaning downstream components of the E-Business Suite may also be affected. No public exploit code or active exploitation has been identified in the supplied intelligence, and no EPSS score was provided.
Oracle Communications Cloud Native Core Security Edge Protection Proxy (SEPP) versions 26.1.200 and 25.2.201 permit a low-privileged, network-positioned attacker to reach the SEPP over HTTP and read a subset of its accessible data while also updating, inserting, or deleting some of that data. The flaw is rated 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), meaning exploitation needs an existing low-privilege account but no user interaction and no special attack complexity. There is no CISA KEV listing and no public exploit code identified at time of analysis; the issue is addressed through Oracle's Critical Patch Update advisory cspusep2026.
Oracle Coherence 15.1.1.0.0 exposes a narrow local information-disclosure weakness in its Core component that lets an attacker who already holds a low-privileged operating-system logon on the Coherence host read a limited subset of data the process can access. The flaw is rated CVSS 3.1 base 2.5 (AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N), meaning high attack complexity, no integrity or availability impact, and no remote vector. There is no public exploit code and no CISA KEV listing, so this is a low-priority, defense-in-depth item rather than an emergency; Oracle published it through its Critical Patch Update advisory for Fusion Middleware.
Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 contain a flaw in the Core component that lets an attacker who already holds a high-privileged account and can log on to the host where Coherence runs make unauthorized updates, inserts or deletions against Coherence-accessible data. The CVSS 3.1 base score is only 1.9 (AV:L/AC:H/PR:H/UI:N, integrity-only), reflecting that exploitation demands local logon, elevated privileges and a difficult-to-achieve condition; confidentiality and availability are not impacted. No public exploit code or CISA KEV entry was present in the supplied intelligence, so this is assessed as a low-priority, defense-in-depth issue rather than an urgent patch item. The vendor-reported nature of the record and the presence of an 'Authentication Bypass' tag that conflicts with the PR:H, integrity-only vector are notable data-quality caveats.
Information disclosure in Oracle Coherence 15.1.1.0.0 lets a low-privileged attacker with HTTP network access read critical data or the entire contents of Coherence-accessible caches, and because the CVSS vector reports a scope change, products built on top of that grid can be exposed as well. Oracle scores it 6.3 with high attack complexity, so it is not a trivial drive-by exploit; the feed contains no public exploit code and no CISA KEV entry, and the only remediation reference is Oracle's Critical Security Patch Update advisory. Authentication is required per the PR:L metric, meaning the attacker needs an existing low-privilege foothold rather than being an anonymous internet client.
Oracle Fusion Middleware Control 12.2.1.4.0 and 14.1.2.0.0 contain a flaw in the Framework component that lets a low-privileged attacker with HTTP network access trick a privileged user into an interaction that results in unauthorized read and modification of data, with cross-scope impact on other Oracle products. Oracle rates it CVSS 3.1 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), meaning exploitation is easy but gated by an existing low-privileged account and victim user interaction. There is no public exploit code or CISA KEV entry in the provided data, and EPSS is not supplied; treat this as a patch-cycle item rather than an emergency.
Improper access control in the CAX Client component of the Oracle Agile PLM MCAD Connector 3.6 allows a locally logged-on, low-privileged user to read critical Agile PLM data, or all data the connector can reach. The flaw is confidentiality-only (CVSS 3.1 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so it is a post-logon insider/desktop compromise risk rather than a remote pre-auth issue. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; EPSS data was not supplied in the available intelligence.
Unauthenticated attackers positioned on the adjacent network segment of a host running Oracle Helidon can read and modify critical application data through a flaw in the helidon-integrations-neo4j component. Affected releases are Helidon 3.0.0 through 3.2.20 and 4.0.0 through 4.5.4; Oracle rates this CVSS 3.1 6.8 with an AV:A/AC:H profile, meaning the attacker needs layer-2 proximity and must satisfy non-trivial conditions, but needs no credentials and no user interaction. No public exploit code and no CISA KEV entry were identified at the time of analysis, and no EPSS score was supplied with the intelligence.
A locally exploitable information-disclosure flaw in the CAX Client component of Oracle Agile PLM MCAD Connector 3.6 lets any attacker who already holds a low-privileged logon on the host read data they should not be able to reach, including critical PLM content the connector can access. Confidentiality is the only impacted metric (CVSS 3.1 base 5.5, AV:L/PR:L/UI:N/C:H/I:N/A:N), so integrity and availability of the connector are untouched. There is no CISA KEV listing and no public exploit code identified at time of analysis, and Oracle has published a fix through its Supply Chain Critical Security Patch Update.
Unauthenticated attackers with network access to the HTTP interface of the Forge component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 can exploit a difficult-to-trigger flaw to read the full set of data the platform can reach and to partially degrade its availability. The vendor rates this 6.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L), so the damage ceiling is high confidentiality loss rather than code execution. No public exploit code and no CISA KEV entry appear in the supplied intelligence, and no EPSS score was provided, so active exploitation is unconfirmed — the practical driver for patching is the exposure of complete catalogue and index data, not observed attacks.
Unauthorized read access to critical data in Oracle Process Manufacturing Intelligence (part of Oracle E-Business Suite) is achievable by a low-privileged attacker over the network via Oracle Net, because the Internal Operations component fails to properly enforce authorization for 12.2.3 through 12.2.15. The flaw is rated CVSS 3.1 6.5 (AV:N/AC:L/PR:L/UI:N, confidentiality-only) and is trivially reachable by anyone holding a valid low-privileged account and network path to the Oracle Net listener. There is no CISA KEV listing and no public exploit identified at time of analysis, but Oracle shipped an official fix in its Critical Security Patch Update, so unpatched internet- or intranet-exposed EBS instances remain the exposure.
Oracle Field Service, a component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, can be compromised over HTTP by a low-privileged attacker who induces another person to interact with a crafted request. Successful exploitation gives the attacker unauthorized read access plus insert, update, or delete capability over a subset of Field Service data, and because the CVSS scope metric is Changed, the impact may extend into additional connected products. There is no public exploit code identified and no CISA KEV listing at time of analysis, so this rates as a moderate-priority patch item rather than an emergency, with a CVSS 3.1 base score of 5.4 reflecting limited confidentiality and integrity loss and no availability impact.
A low-privileged, authenticated attacker with HTTP network access can read all data accessible through the Oracle Application Object Library (Core) component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, resulting in a full confidentiality compromise of that component with no integrity or availability impact. Oracle rates it CVSS 3.1 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) and describes it as easily exploitable, meaning an existing low-privilege EBS account is enough to reach sensitive data beyond the account's intended scope. No public exploit code or active exploitation is indicated in the available intelligence, and the patch is delivered through Oracle's Critical Security Patch Update for E-Business Suite.
Improper authorization enforcement in the Internal Operations component of Oracle Field Service, part of Oracle E-Business Suite 12.2.3 through 12.2.15, lets a low-privileged user read data that the application should have kept out of reach. The attack is delivered over HTTP with no user interaction and no special complexity, but it does require a valid account on the affected system, so it is an authorization/confidentiality failure rather than a pre-authentication bypass. Impact is limited to confidentiality (CVSS 3.1 base 6.5, C:H/I:N/A:N); no public exploit code or CISA KEV entry was present in the supplied intelligence at time of analysis.
Unauthenticated attackers with HTTP access to Oracle Forms Services can read a limited subset of data the application exposes, per Oracle's Fusion Middleware security advisory affecting versions 12.2.1.19.0 and 14.1.2.0.0. The flaw is rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/C:L/I:N/A:N), meaning low-complexity, no-credential, no-user-interaction exploitation whose only impact is partial confidentiality loss - there is no integrity or availability impact and no scope change. No public exploit code, EPSS score, or CISA KEV listing is present in the supplied intelligence, so this should be treated as a patch-now confidentiality leak rather than an actively exploited emergency.
Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 contain an easily exploitable flaw in the Forms Services, C/S and Charmode components that lets a high-privileged attacker with network access over HTTP tamper with or destroy critical Forms data and repeatedly crash the service (complete denial of service). Oracle rated it 6.5 with integrity and availability impacts only, meaning confidentiality is untouched but data can be created, deleted or modified. No public exploit code or active exploitation has been identified at time of analysis, and no EPSS or CISA KEV signal was supplied with this record.
Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component), versions 22.3 through 26.7, permits low-privileged authenticated users with HTTP network access to reach functionality they should not control, enabling unauthorized read and modification of data and affecting systems beyond the vulnerable component (scope change). The flaw is rated CVSS 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting an easily automated but credential-gated attack with limited confidentiality and integrity impact. No public exploit code or CISA KEV entry is identified at time of analysis, and no CWE classification was assigned by the reporting source.
Oracle HR Intelligence, a component of Oracle E-Business Suite (versions 12.2.3 through 12.2.15), contains a difficult-to-exploit vulnerability in its Internal Operations component that lets a low-privileged, network-positioned attacker with an authenticated HTTP session tamper with or destroy critical HR data and repeatedly crash the service. Integrity and availability are both fully impacted while confidentiality is not, giving a CVSS 3.1 base score of 6.8 (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H). No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV, so the current exposure is driven by unpatched enterprise ERP deployments rather than active exploitation.
Unauthenticated memory disclosure in HPE Networking EdgeConnect SD-WAN Gateways lets an attacker on an adjacent network segment read portions of system memory, exposing internal service details and workflow information. All shipping 9.4.x, 9.5.x, 9.6.x and 9.7.0.0 branches are affected per the vendor-published version ranges. The CVSS score is only 4.3 (confidentiality-only, adjacent vector) and there is no public exploit code or CISA KEV listing, so this is best treated as a reconnaissance enabler rather than a standalone compromise — its value to an adversary is in chaining it with a separate privilege-escalation or authentication flaw.
Oracle Siebel CRM Deployment (Cloud Gateway component) versions 17.0 through 26.7 contains a hard-to-exploit flaw that lets a low-privileged attacker with HTTP network access read and modify critical CRM data, with Oracle rating both confidentiality and integrity impact as High. The vendor advisory does not disclose the root cause, and no public exploit code, EPSS score, or CISA KEV entry was supplied with this record, so real-world exploitation is unconfirmed. The associated 'Authentication Bypass' tag is not corroborated by the Oracle text, which describes unauthorized data creation, deletion, and modification rather than an explicit credential-check bypass.
Sensitive data disclosure in Oracle Web Applications Desktop Integrator (Web ADI), a component of Oracle E-Business Suite 12.2.3 through 12.2.15, where the 'File download' component fails to properly restrict which files a low-privileged user can retrieve over HTTP. An attacker holding any valid low-privileged EBS account can read files they do not own, resulting in unauthorized access to critical data (CVSS 6.5, high confidentiality impact, no integrity or availability impact). Exploitation is network-based, low complexity and requires no user interaction, making it highly automatable once credentials exist; no public exploit code has been identified and there is no CISA KEV listing at time of analysis.
Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 expose the Event Management component to low-privileged, network-positioned attackers who can abuse SOAP requests to create, delete, or modify event and management data without authorization. The flaw is rated CVSS 3.1 6.5 (AV:N/AC:L/PR:L/UI:N, integrity-only impact) and is addressed in Oracle's September 2026 Critical Security Patch Update. No EPSS score, CISA KEV listing, or public exploit code was provided in the source data, so active exploitation is unconfirmed at time of analysis.
Concrete CMS 9.0.0 through 9.5.2 contains an insecure direct object reference in the Express saved search preset delete and edit dialogs, letting any authenticated user who holds only view permission on a single Express entity permanently delete (with no undo) or rename saved search presets owned by Express entities they have no permission over. Because a renamed preset is rendered back to users of the targeted entity, the flaw enables content defacement or social-engineering-style manipulation of other teams' saved searches. The vendor scored it CVSS 4.0 2.1 (Low) with PR:H and AT:P; no public exploit code, EPSS score, or CISA KEV listing was identified at time of analysis.
Concrete CMS 9.5.2 and earlier fail to enforce a destination-side authorization check and omit CSRF token validation in the multilingual page-assignment backend action (Backend\Page\Multilingual::assign), letting an authenticated editor who holds the Edit Page Multilingual Settings permission on just one page rebind an arbitrary page from another locale as that page's translation and delete legitimate translation pairs maintained by other editors. The result is silent manipulation of public-facing language routing across the site, with no confidentiality impact and only limited integrity/availability damage. The vendor scores this 2.1 (CVSS v4.0) because the actor must already be an authenticated, privileged editor; no public exploit code and no active exploitation have been reported.
Let me synthesize. CVE-2026-86465: Apache Airflow Akeyless provider secrets backend team-scope guard bypass via user-controlled key. Affected: apache-airflow-providers-akeyless before 0.3.1. Fix: 0.3.1. PR: https://github.com/apache/airflow/pull/72646. Similar class to Azure Key Vault, Yandex Lockbox, Amazon secrets backends CVEs. Multi-team deployments using Akeyless secrets backend; single-team not affected. Reachable from ordinary DAG code via Execution API Variables route accepting path-shaped key. DAG author scoped to one team can read secrets belonging to another team — info disclosure (cross-tenant secret access). CVSS: N/A provided. My assessed vector: PR:L (requires DAG author privileges / authenticated user), AV:N, AC:L, UI:N, S:C? Scope change — impacts another team's secrets, but scope change in CVSS terms means authorization scope. Cross-team boundary crossing could be S:C. Impact C:H, I:N, A:N. So CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. That's ~8.3? Let's compute: S:C base... Actually with S:C, PR:L: exploitability = 8.22*AV(0.85)*AC(0.77)*PR(0.68)*UI(0.85) = 8.22*0.85=6.987; *0.77=5.380; *0.68=3.658; *0.85=3.110. Impact: ISCBase = 1 - (1-C)(1-I)(1-A) = 1 - (1-0.56)(1)(1) = 0.56. Scope changed: Impact = 7.52*(ISC-0.029) - 3.25*(ISC-0.02)^15 = 7.52*(0.531) - 3.25*(0.54)^15 ≈ 3.993 - ~0 = 3.993. Base = roundup(min(1.08*(3.110+3.993),10)) = roundup(7.67) = 7.7. Hmm, 7.7 High. Maybe S:C is arguable. Alternatively S:U with C:H gives: Impact = 6.42*0.56 = 3.595; exploitability 3.110; base = roundup(min(1.08*6.705,10)) = roundup(7.24)=7.3. Either way ~7.3-7.7. Actually, "moderate" severity per Apache. Hmm. Apache's own severity is "moderate". But my assessment... I'll go with S:C? Let's think: the vulnerable component is the Akeyless backend; the impact is a different team's secrets. CVSS scope change refers to impact on components beyond the vulnerable component's security authority. The secrets backend... Hmm. This is a classic cross-tenant autho
Unauthenticated attackers can push files of the component's choosing onto a Joomla site running the JoomGallery extension (all versions below 4.4.1) by abusing the extension's TUS resumable-upload endpoint, which fails to enforce access control. The practical impact is bounded — neither the file name nor the extension is attacker-controlled — and turning the upload into code execution requires an unusual web-server configuration that maps the stored artefacts to an executable handler, which is why the CVSS 4.0 base score lands at 6.3 rather than critical. No CISA KEV entry or EPSS score accompanies this CVE in the supplied data, but the CVSS 4.0 vector carries an E:A (Attacked) supplemental metric indicating the scoring source has observed exploitation activity.
Concrete CMS versions before 9.5.3 contain a missing-authorization flaw in the SEO Bulk Update Meta Tags editor: the saveRecord() action validated the per-page CSRF token but never invoked canEditPageProperties() for the target page. As a result, an authenticated user who was granted access to the bulk SEO tool and could merely view a page could rewrite that page's meta title, meta description, and URL handle, tampering with presentation content and live URLs outside their intended edit scope. The vendor rates this only 2.1 (CVSS v4.0, integrity-only), there is no public exploit code identified at time of analysis, and the issue is not known to be actively exploited (no CISA KEV listing).
Request smuggling in http4s Ember affects ember-core (server and client) before 0.23.35 and 1.0.0-M47 because the chunked decoder trims chunk-size tokens and accepts leading '+' or '-' signs instead of requiring hexadecimal digits followed by the mandatory CRLF. When Ember runs behind an intermediary that forwards chunked bodies without re-encoding and parses chunk boundaries differently, an unauthenticated attacker can achieve TE.TE request smuggling that bypasses intermediary controls, poisons shared caches, or hijacks queued requests; the same response-path leniency enables response smuggling when ember-client is used as a gateway in front of a malicious or compromised upstream. No public exploit code or CISA KEV entry is associated with this issue at time of analysis, and no EPSS score was supplied in the source data.
Broken authorization in the Concrete CMS 9 Boards dashboard area (versions 9 through 9.5.2) lets any user who has been granted edit_board_settings on a single board view, refresh, regenerate, or delete board instances belonging to entirely different boards by supplying those boards' instance IDs. The affected single-page controllers resolve an instance directly from the attacker-supplied ID and validate only an action-scoped CSRF token — which is bound to the action name, not to the target object, and is therefore reusable across boards — while skipping the permission-checked accessor that runs canEditBoardSettings on the parent board for the read view. The vendor rates this CVSS v4.0 2.1 (AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:L); no public exploit code or CISA KEV listing was identified at time of analysis.
Missing authorization in the Express entries advanced-search dashboard action of Concrete CMS 9.0.0 through 9.5.2 lets any authenticated dashboard user who holds view_express_entries on just one Express entity read the entries and secret attribute values of every other Express entity. The advanced_search() method resolves the target entity directly from a user-supplied entity ID and skips the canViewExpressEntries() check that the sibling results() action enforces, crossing the per-entity permission boundary Express is designed to guarantee. The vendor rates this CVSS v4.0 2.1 (AV:N/AC:L/AT:P/PR:H/UI:N/VC:L), reflecting a low-impact but real confidentiality breach limited to authenticated staff; no public exploit code or CISA KEV entry was identified at time of analysis.
Concrete CMS 9 through 9.5.2 fails to verify ownership when processing three Boards data-source dashboard actions (update, update_data_source, delete_data_source), so an authenticated user with edit_board_settings on just one board can modify or permanently delete the configured data sources of any other board on the site. Successful abuse halts the victim board's content feed and resets its custom weighting, with no confidentiality impact. The vendor-assigned CVSS v4.0 base score is a low 2.1 (PR:H, AT:P), no public exploit code or CISA KEV entry was provided in the intelligence feed, and the referenced fix is the Concrete CMS 9.5.3 release notes.
Missing per-page authorization in the Concrete CMS sitemap controller (all versions before 9.5.3) lets any authenticated dashboard user who can reach the sitemap reorder pages they have no edit or arrange rights over, silently altering the site's global navigation order. The send_to_top and send_to_bottom tasks trust the attacker-supplied cNodeID parameter and load/update the target page without verifying move permission on that specific node (CWE-862); impact is integrity-only (CVSS v4.0 2.1, PR:H, VI:L). No public exploit code or CISA KEV entry was identified at time of analysis, and a vendor fix is available in Concrete CMS 9.5.3.
Concrete CMS 8.5.3 through 9.5.2 lets a suspended or deactivated user keep minting valid OAuth 2.0 access tokens through the refresh-token grant, because the grant never re-checks the account's active flag (uIsActive=0) before issuing new tokens. Anyone who legitimately obtained a refresh token while their account was active retains API access after offboarding, so deactivation alone no longer revokes API credentials. The vendor assigned a low CVSS v4.0 base score of 2.3 (AV:N/AC:L/AT:P/PR:L/UI:N, all impacts Low); no public exploit code or CISA KEV listing was provided at time of analysis.
Local privilege escalation in the Android bootloader lets a caller that already holds System execution privileges bypass a missing permission check and reach higher-privileged bootloader operations on affected Android devices. The CVSS vector (AV:L/PR:H/UI:N) makes clear this is a second-stage escalation that requires both local access and an existing high-privileged foothold, not a remote or unprivileged-app vector, and it needs no user interaction. Google resolves it through the September 2026 Android/Pixel security bulletin; EPSS is very low (0.11%, 2nd percentile) and no public exploit has been identified at time of analysis.
Concrete CMS versions below 9.5.3 import files uploaded through the conversation attachment endpoint into the site's file manager before verifying the 'Add Message Attachments' permission, so the authorization check happens only after the file has already been stored. A low-privileged authenticated user who has been explicitly denied that permission — or an unauthenticated visitor on a site configured to allow guest posting — can therefore inject files of allowed types into the file manager, altering stored content or consuming storage. The vendor rates this CVSS v4.0 2.3 (AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L), indicating limited integrity and availability impact rather than code execution, and there is no public exploit code identified at time of analysis.
An improper authentication flaw (CWE-287) in Dell Wyse Management Suite versions prior to 2605.0.3.683 lets an unauthenticated remote attacker bypass the login mechanism and gain unauthorized access to the management console or API. The CVSS 3.1 base score is 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), reflecting low confidentiality and integrity impact but no availability impact, which is unusually low for a full authentication bypass and suggests the exposed functionality is a constrained subset of the console. No EPSS score, CISA KEV listing, or public exploit code was present in the provided intelligence, so there is no public exploit identified at time of analysis and no confirmed active exploitation.
GitLab CE/EE instances that enforce SAML single sign-on can be bypassed by an authenticated user who signs in through another authentication path, because the sign-in enforcement check is missing (CWE-306). Affected releases are all versions from 18.6 up to 19.1.7, 19.2.x through 19.2.5, and 19.3.0/19.3.1; GitLab has published fixes in 19.1.8, 19.2.6 and 19.3.2. Publicly available exploit code exists (a HackerOne report is linked), but the issue is not listed in CISA KEV and no active exploitation has been confirmed; CVSS is a moderate 5.4 and impact is limited to partial confidentiality and integrity loss, not remote code execution or full account takeover of the platform.
Authenticated users of IBM ContextForge MCP Gateway through v1.0.4 can bypass the gateway's payload protection mechanisms because its recursive content inspection does not fully traverse deeply nested or embedded payload structures. Successful abuse yields limited but real integrity and confidentiality impact (CVSS 5.4, AV:N/AC:L/PR:L/UI:N) by allowing disallowed content or instructions to pass through the filter that is meant to stop them, undermining the gateway's role as a security boundary between MCP clients and downstream tool servers. There is no public exploit code or CISA KEV entry at time of analysis, and IBM has published a fix via its support portal, so exposure is limited to unpatched deployments reachable by an authenticated account.
IBM Business Automation Workflow (both containerized and traditional deployments) fails to enforce authorization checks on certain import operations, letting an authenticated user invoke restricted import actions they should not be permitted to perform. Successful abuse yields limited confidentiality and integrity impact (CVSS 5.4, AV:N/AC:L/PR:L/UI:N) rather than full system compromise. No public exploit code has been identified and the flaw is not listed in CISA KEV, but IBM has published a vendor patch, so unpatched deployments remain exposed to any user holding a valid low-privileged account.
Tornado 6.5.5 through 6.5.7 allows attackers to inject arbitrary Set-Cookie attributes because the fix for CVE-2026-35536 only validated the documented lowercase keyword arguments (name/domain/path/samesite). The deprecated and still-live **kwargs path in RequestHandler.set_cookie writes values straight into the Morsel without character validation, and because Morsel.__setitem__ is case-insensitive, a capitalized kwarg such as Domain=, Path=, SameSite= or Max-Age= routes to the same reserved attribute while bypassing the filter. Any application that passes attacker-influenced data into a capitalized/legacy kwarg can be made to emit cookies with attacker-controlled Domain, Path, Secure, HttpOnly or SameSite directives; no public exploit code or CISA KEV entry has been identified at time of analysis.
Broken object-level authorization in Vikunja before 2.6.0 lets any authenticated user write task-position records into project views belonging to other tenants by supplying a project_view_id that is never checked against the target task's project. Because only integrity of view ordering is affected (no read, no availability impact), the practical damage is cross-tenant data corruption and ordering manipulation rather than data theft. A vendor patch (2.6.0) and a GitHub security advisory are available; the issue is not listed in CISA KEV and no public exploit code was identified at time of analysis.
An API token scope bypass in Vikunja before 2.6.0 allows a holder of a deliberately limited-scope API token to read task data outside that token's permissions — specifically comments, reactions, and time entries — by adding the 'expand' query string parameter to task read requests, because the authorization layer never inspects query parameters. Exploitation requires an already-valid low-privilege token (CVSS 4.0 PR:L) and only results in limited confidentiality loss, giving a modest base score of 5.3; there is no public exploit and no evidence of active exploitation at time of analysis. The vendor has released a fix in Vikunja 2.6.0.
Mitigation bypass in the Widget: Win32 component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.
Mitigation bypass in the Networking component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.
Mitigation bypass in the Popup Blocker component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.
Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.
Mitigation bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.
Mitigation bypass in the DOM: Notifications component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.
Mitigation bypass in the Remote Settings Client component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.
Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, and Firefox ESR 153.3.
Loose-mode Unicast Reverse Path Forwarding (uRPF) on certain Arista EOS platforms can fail to drop traffic that the configured source-address verification should have rejected, so packets that ought to be filtered are still processed and forwarded by the switch or router. Only devices running Arista EOS on one of the specific (unnamed) affected platforms and explicitly configured with loose uRPF are exposed - default deployments that do not enable uRPF are not affected, and there is no confidentiality or availability impact, only a loss of filter integrity. No public exploit code and no confirmed active exploitation have been identified at time of analysis; the vendor CVSS score of 5.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N) is well calibrated to this narrow, configuration-dependent filtering failure.
An authenticated user with gRPC/gNSI access on Arista EOS can retain permissions that a security policy rotation was supposed to revoke, because a race condition in the gNSI Authz service causes the policy rotation to fail silently when multiple gNSI transports are configured on the device. Only non-default deployments with more than one gNSI transport are affected, Bootz is explicitly out of scope, and the flaw does not grant new privileges - it merely preserves access the attacker already legitimately held, so the outcome is a stale authorization state rather than a privilege escalation. Exploitation requires the revocation and the race to coincide, making it opportunistic rather than attacker-triggerable on demand; Arista discovered the issue internally and reports no malicious exploitation, and no public exploit code has been identified at time of analysis. The vendor's CVSS 4.0 score of 6.0 is well-calibrated for a genuinely moderate, not critical, issue.
Improper authorization checks in GitLab CE/EE's Generic Package Registry (CWE-862) allow an authenticated user holding developer-role permissions to substitute the content of an existing package file and to hide packages from their legitimate owners. The flaw affects all GitLab Community and Enterprise Editions from 13.9 up to the fixed releases 19.1.8, 19.2.6 and 19.3.2, meaning the exposure window spans multiple major release lines and any long-lived install not patched in this cycle. Impact is integrity-only (CVSS 4.3, AV:N/PR:L/UI:N) - an attacker cannot read or delete data or crash the instance, but they can silently corrupt or conceal artifacts that downstream users and CI pipelines trust; publicly available exploit detail has been published via a HackerOne report.
GitLab CE/EE 13.0 and later (before 19.1.8, 19.2.6 and 19.3.2) fails to properly validate group URL slugs during namespace transfers, allowing any authenticated user to induce a slug collision that leaves the legitimate owners of another group unable to modify that group's settings. The flaw is an availability-only issue (CVSS 4.3, C:N/I:N/A:L) rather than a data-disclosure or code-execution bug, but publicly available exploit detail exists via the linked HackerOne report, and the CWE-862 classification indicates the transfer workflow bypasses the authorization checks that should protect the target namespace. No CISA KEV listing or EPSS score was supplied, so active exploitation is not confirmed.
Improper authorization controls in GitLab Enterprise Edition's compliance framework management allow an authenticated user holding the Security Manager role to execute arbitrary CI/CD jobs and reach protected CI/CD variables inside group projects. Affected are GitLab EE 18.11 through 19.1.7, 19.2.x before 19.2.6, and 19.3.x before 19.3.2, with fixes published in 19.1.8, 19.2.6, and 19.3.2. Exploit details are publicly available via a HackerOne report, and GitLab is credited as the reporter, though the issue is not listed in CISA KEV and no EPSS estimate was supplied.
Missing privilege verification in the FluentBoards WordPress plugin before 2.0.15 lets any authenticated member of a board perform manager-only board operations - adding or removing members and toggling a private board to public - because the affected endpoints check only that the caller belongs to the board rather than that they hold board-manager rights. The issue is remotely exploitable by an attacker with an existing low-privileged membership on the target board (assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), requires no user interaction and no administrative role, and is scoped to boards the attacker already belongs to, so it does not yield site-wide access. Publicly available exploit code exists and the vendor has released a patch in version 2.0.15; EPSS is very low (0.17%, ~6th percentile) and the flaw is not in CISA KEV, so this is a low-to-moderate priority issue best handled through routine plugin updating.
Comment authorship spoofing in the FluentBoards WordPress plugin before 2.0.15 allows any authenticated user who is already a member of a board to submit comments that are displayed as authored by a different user, including site administrators. The root cause is a missing check that the submitting user equals the author identity the comment is attributed to (CWE-290, authentication bypass by spoofing); the flaw is network-reachable, requires no victim interaction, and yields integrity-only impact with no confidentiality or availability loss. Publicly available exploit code exists (per the WPScan entry tagged as an exploit), but there is no CISA KEV confirmation of active exploitation, and EPSS is only 0.17% (6th percentile), consistent with a low-severity, low-likelihood issue. Vendor-released patch: 2.0.15.
Unauthenticated attackers can reset any existing order and its attendees to a pending state in the Eventin WordPress plugin before 4.1.24, invalidating already-paid tickets, when the plugin's offline (local) payment method is enabled. The finalisation routine relies on a nonce that the plugin exposes to unauthenticated visitors and never verifies that the caller owns the targeted order, making this a missing-authorization flaw rather than an authentication one. Exploitation is gated by configuration: the site must have the offline payment method active and at least one existing order to target, and publicly available exploit code exists, but there is no evidence of confirmed active exploitation (CISA KEV) and the EPSS score is very low at 0.18% (8th percentile). Impact is limited to integrity - order/attendee state is corrupted, with no data disclosure or service outage - so this is a genuine but low-priority issue. Fixed in Eventin 4.1.24.
Broken access control in the Eventin WordPress plugin before 4.1.24 lets an authenticated contributor (or any higher role) create brand-new WordPress user accounts through the plugin's add-speaker functionality, and by supplying an email address they control, convert that into a working login to an account holding capabilities greater than their own - notably publishing content and uploading files. The flaw is a missing-authorization issue (CWE-862), so valid low-privilege credentials are a prerequisite; the tag 'Authentication Bypass' overstates it, and the privilege gained is author-level rather than full site takeover. The vendor has released a fix (4.1.24) and publicly available exploit code exists, while the EPSS score remains low at 0.17% (7th percentile), consistent with a bounded-impact, authenticated attack surface.
Information disclosure in the Schema & Structured Data for WP & AMP WordPress plugin (versions 1.63 through 1.65) allows an authenticated user holding the WordPress contributor role or higher to retrieve the content of other users' draft, pending, private, and password-protected posts by invoking the plugin's schema-generation function against a post ID they are not permitted to edit. The root cause is a missing per-post edit-capability check, and impact is confidentiality-only - post content is exposed but cannot be modified. A public proof-of-concept is available, so exploitation is trivial for anyone with a contributor-level account on an affected site; EPSS is low at 0.17% (7th percentile) and there is no indication of confirmed active exploitation (not in CISA KEV).
Missing authorization in the Eventin WordPress plugin before 4.1.24 allows unauthenticated attackers to reuse the order-scoped token that the plugin itself issues during guest checkout to swap a paid ticket for a free one and then complete the order at no cost. The flaw is a business-logic/fraud issue rather than a site-compromise vector: it yields no data disclosure, no privilege escalation and no denial of service, and it only affects sites running Eventin with paid ticketing and guest checkout enabled, and only on the attacker's own order. Publicly available exploit code exists, and the vendor has released a fix in 4.1.24; EPSS is low (0.18%, 8th percentile), consistent with a narrowly targeted revenue-loss bug rather than a mass-exploited one.
Keycloak's first broker login flow leaves a temporary account-linking proof behind after a federated identity link is established or manually removed (CWE-613), allowing an attacker who controls the external identity to silently re-establish the link and authenticate as the victim without any further confirmation. The flaw affects Red Hat Build of Keycloak and Red Hat Single Sign-On 7 deployments that use identity brokering, and carries high confidentiality and integrity impact despite a moderate CVSS base of 6.4. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV.
The Ad Inserter – Ad Manager & AdSense Ads WordPress plugin (all versions up to and including 2.8.16) exposes administrator-configured header and footer code blocks to unauthenticated visitors through the `ai-debug-code` URL parameter, because the debug handler performs no capability check. An attacker who can reach a site running the vulnerable plugin can simply append that parameter to a request and read code fragments — ad scripts, analytics snippets, custom CSS/JS — that the site owner deliberately disabled from public display. The impact is confidentiality-only (CVSS 5.3, PR:N/UI:N), and there is no public exploit code or CISA KEV listing identified at time of analysis.
Unauthenticated attackers with adjacent network access to the mySCADA myPRO Manager notification gateway can send arbitrary SMS messages through its connected GSM modem by submitting a phone number and message text to an exposed HTTP endpoint that performs no authorization checks. The flaw is a missing-authorization weakness (CWE-862) affecting myPRO versions 0 through 2.1, rated CVSS 4.0 base 5.3. Impact is limited to SMS abuse and messaging-service integrity — no code execution, data disclosure, or process disruption — and no public exploit code or CISA KEV entry was identified at time of analysis.
An incorrect authorization flaw in the Netcore NR255-V router (firmware 1.5.130703) lets any authenticated user with a broad or low-privileged role pull live QoS/bandwidth telemetry from the mod_qos_bandwidth plan.json read routes, exposing network activity data they are not entitled to see. The bug is rooted in missing role checks within filter_conns_dump_cgi.c and IGD_CgiCall.c, so the endpoints return connection and bandwidth statistics regardless of the caller's privilege level. Impact is confidentiality-only and rated moderate (CVSS 4.0 base 5.3, AV:N/PR:L/UI:N/VC:L); no CISA KEV listing or confirmed public exploit code exists, though a public technical write-up of the QoS telemetry disclosure is referenced from the NVD entry.
VRRPv2 IP Authentication Header (IP-AH) authentication can be bypassed in affected versions of Arista EOS, allowing an unauthenticated attacker on the same Layer 2 segment as the VRRP group to impersonate the virtual router master. Successful takeover lets the attacker intercept, modify, or discard traffic that hosts send to the virtual gateway IP, effectively hijacking the default gateway for that VLAN. The issue is vendor-reported through Arista PSIRT (advisory 0157) and tracked as EUVD-2026-80009; no public exploit code or CISA KEV entry was present at time of analysis, and the CVSS 4.0 base score of 5.3 reflects adjacent-network access with no privileges or user interaction.
UI spoofing in Google Chrome's Transactions Platform component lets a remote attacker who has already compromised the browser's renderer process render crafted HTML as trusted interface elements, deceiving the user. The flaw is a missing authorization check (CWE-862) affecting Chrome versions prior to 153.0.8010.47, and it is not reachable on its own: exploitation requires a separate, earlier renderer compromise plus the victim loading and interacting with the attacker's page (UI:R, AC:H). Impact is limited to low-severity confidentiality and availability effects rather than code execution or sandbox escape, no public exploit code was identified at time of analysis, and the issue is fully resolved by Chrome 153.0.8010.47.
Information disclosure in Google Chrome for Android before 153.0.8010.47 allows a locally installed app on the same device to retrieve sensitive browser data because an authorization check is missing on an Android-exposed Chrome component. The flaw is local-only and rated AC:H, giving a modest CVSS 3.1 base of 5.1 (AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) even though the confidentiality impact is complete; Google's Chromium team nevertheless classifies it as High severity. Google has shipped a fix in 153.0.8010.47, there is no CISA KEV listing, and no public exploit code has been identified at time of analysis.
UI spoofing in Google Chrome versions prior to 153.0.8010.47 allows an attacker who has already compromised the browser's renderer process to draw convincing but fake interface elements in front of the user via a crafted HTML page. The flaw is a missing authorization check (CWE-862) on a browser-side privileged capability, rated Medium by the Chromium team and scored 4.2 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L), with impact limited to Low confidentiality and Low availability and no integrity effect. Exploitation is not possible as a standalone initial-access vector - renderer compromise is a mandatory precondition, user interaction is required, and attack complexity is High; no CISA KEV listing and no public exploit code were identified at time of analysis. A vendor-released patch exists in Chrome 153.0.8010.47.
Let me synthesize. CVE-2026-18426: Concrete CMS 9.0.0 through 9.5.2, missing block-level edit permission check on Express Form block control-management actions, relying solely on CSRF token validation. Token bound to user and action, not block/page/form. So authenticated user with edit access to one Express Form could reuse token to add/modify/delete controls on forms they aren't authorized to edit, including injecting control whose value later rendered as HTML → stored XSS. CVSS 4.0 2.0, AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:N/VA:N. CWE-862 missing authorization. Tags: XSS, Authentication Bypass, CSRF. Hmm — "Authentication Bypass" tag is arguably mislabeled since it's a missing authorization check (CWE-862), not authentication bypass. Actually that's a good candidate for data_quality_flags mislabeled_tag. The tag "Authentication Bypass" is wrong — this is an authorization flaw (CWE-862), not authentication bypass. Confidence: medium/high. I'd say medium-high. Let's use "high" given CWE-862 is explicitly missing authorization and PR:H required (authenticated user). Actually the tag list includes both XSS and CSRF — both apply somewhat (stored XSS outcome, CSRF token bypass). "Authentication Bypass" is the questionable one. I'll flag it with confidence "medium" or "high". I'll use "high" — the description explicitly says "did not enforce a block-level edit-permission check", which is authorization, and CVSS PR:H means authenticated. So "Authentication Bypass" is mislabeled. Suggest "Missing Authorization" — hmm, suggested field is "the correct/canonical slug if you know it". Perhaps suggested: "missing-authorization" or "authorization-bypass". I'll say "authorization-bypass". Missing tags? Maybe "concrete-cms" / "concrete5" vendor tag absent. Tags list: XSS, Authentication Bypass, CSRF. Missing tag candidates: "Concrete CMS" (vendor/product) — suggested "concrete-cms", high confidence from description. Also "CWE-862" / "Missing Authorization" technique tag. I'll add "
Authentication downgrade in the miniOrange JWT Authentication for WP REST APIs WordPress plugin (versions before 4.8.0) lets unauthenticated remote attackers force the plugin to fall back to Basic HTTP authentication by supplying a crafted GET parameter, overriding whatever JWT or API token configuration the site administrator set. Because the vulnerable code path performs no capability check or nonce verification, and the plugin returns distinguishable error codes without rate limiting, attackers can chain the bypass into unthrottled username enumeration and credential guessing against WordPress REST endpoints. Exploitation yields only low confidentiality and integrity impact (CVSS 4.0 base 6.9), and no public exploit code or active exploitation was identified in the supplied intelligence at time of analysis.
A locally reachable denial-of-service flaw in Oracle VM VirtualBox 7.2.16 (Core component) lets an attacker who already holds a high-privileged logon on the host crash or repeatedly hang the hypervisor, taking down all hosted virtual machines. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H, base 6.0) confirms the impact is availability-only and confined to already-privileged local users, but the scope-change flag indicates the resulting outage can extend to other workloads running on the same infrastructure. No EPSS score, KEV listing, or public exploit evidence was present in the supplied intelligence, so exploitation status is unknown and the flaw should be treated as a privilege-gated local availability risk rather than a remotely exploitable emergency.
Oracle VM VirtualBox 7.2.16 contains a flaw in the Core component that lets a high-privileged attacker who already has a logon on the host trigger a partial denial of service against the VirtualBox process itself. The attack is local (AV:L) and requires elevated privileges (PR:H), but carries a scope change (S:C), meaning the successful exploit can significantly affect additional products layered on the same infrastructure. CVSS 3.1 scores this 3.2 with availability-only impact; there is no public exploit identified at time of analysis and no CISA KEV listing, so real-world urgency is low for most deployments.
Denial of service in Oracle VM VirtualBox 7.2.16 (Core component) lets a locally logged-on attacker with high privileges hang or repeatedly crash the hypervisor, with the CVSS scope-change metric indicating the disruption can extend beyond VirtualBox to other products on the same host. Exploitation requires logon access to the infrastructure running VirtualBox and high privileges (PR:H, AV:L), so it is an insider/administrator-privileged availability attack rather than a remote one. No public exploit code has been identified and the flaw is not listed in CISA KEV; EPSS data was not supplied with this record.
Denial of service in Oracle VM VirtualBox 7.2.16 allows an attacker who already holds high privileges and can log on to the machine running the hypervisor to crash the product through its Core component, producing a hang or repeatable crash. The flaw is rated CVSS 3.1 6.0 (AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H), so it is purely an availability issue with no confidentiality or integrity impact, but the scope change flag means a successful attack can degrade other workloads running alongside VirtualBox — typically guest VMs and co-resident services. It is not remotely exploitable, no public exploit code or CISA KEV entry was identified at time of analysis, and the affected build is confirmed as 7.2.16 by both the vendor advisory and ENISA EUVD.
Oracle VM VirtualBox 7.2.16 (Core component) contains a low-severity information disclosure flaw that requires an attacker to already hold a high-privileged logon on the host where VirtualBox runs. A successful attack yields read access to a limited subset of VirtualBox-accessible data (C:L) and, per Oracle's scope-change rating, may affect components beyond the hypervisor boundary. No public exploit code and no CISA KEV listing were identified at time of analysis, and the CVSS 3.1 base score is only 3.2, so real-world prioritization should be low relative to other virtualization issues.
Oracle VM VirtualBox 7.2.16 can be hung or repeatedly crashed by a high-privileged attacker who already has an interactive logon on the host where the hypervisor runs, provided another person on the system performs an interaction such as opening or starting a crafted VM. The flaw sits in VirtualBox Core and yields availability-only impact: any hosted guest and the VirtualBox process itself can be taken down. It is scored 4.2 and the local-plus-privileged access requirement makes mass exploitation unlikely; no public exploit code or CISA KEV listing was present in the supplied intelligence at time of analysis.
A locally exploitable flaw in the Core component of Oracle VM VirtualBox 7.2.16 lets a low-privileged user who can log on to the host repeatedly crash the hypervisor process and tamper with some VirtualBox-accessible data. The issue requires only local logon with low privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N), no user interaction, and no network exposure, yielding a 6.1 base score driven by Availability (High) and Integrity (Low) impacts with no Confidentiality impact. There is no public exploit code identified and the CVE is not listed in CISA KEV, so current risk is concentrated in multi-user or shared-workstation deployments where untrusted users share a virtualization host.
Oracle VM VirtualBox 7.2.16 contains a Core-component flaw that lets an attacker who already has a logon on the host crash the hypervisor (complete denial of service) and make limited unauthorized modifications to VirtualBox-accessible data, provided they can induce a victim to perform a user action. The issue is local rather than network-reachable, requires no special privileges beyond an interactive session on the machine where VirtualBox runs, and is rated 6.1 on the CVSS 3.1 scale (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H). No public exploit code has been identified and the CVE is not listed in CISA KEV at time of analysis, but the integrity-plus-availability impact and the trivially low attack complexity make prompt patching worthwhile.
A locally exploitable flaw in the Core component of Oracle VM VirtualBox 7.2.16 lets an attacker who already holds a high-privileged logon on the host read a limited subset of VirtualBox-accessible data and trigger a partial denial of service against the hypervisor. The scope-change rating (S:C) indicates the impact can extend beyond VirtualBox itself to other products on or around the host, but exploitation requires local logon with elevated privileges and there is no indication of remote reach. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV, so real-world priority is driven by host-access hygiene rather than internet-facing exposure.
A crafted remote-desktop (RDP) interaction with Oracle VM VirtualBox 7.2.16 can hang or repeatedly crash the hypervisor's Core component, producing a complete denial of service against the affected VM sessions. Exploitation is rated difficult (AC:H) and requires a low-privileged account with network reachability to the virtual machine's remote display service, so it is not a drive-by or unauthenticated attack. Only availability is impacted — there is no confidentiality or integrity loss. No EPSS score, CISA KEV listing, or public exploit code was present in the supplied intelligence, so the vulnerability should be treated as a medium-priority patching item rather than an active emergency.
Unauthenticated attackers who can reach the Oracle Agile PLM Web Client over HTTP can read and tamper with a limited subset of PLM data, but only if they first persuade another user to interact with a crafted request. Oracle rates this 6.1 (medium) with a scope change, meaning a successful attack may also affect additional products reachable through the same component. No public exploit code, POC, or CISA KEV entry was identified in the supplied intelligence for this CVE.
Adjacent-network attackers can bypass authentication in Oracle Agile PLM 9.3.6 (Application Server component), gaining the ability to read, create, delete, or modify any data the PLM application can reach. The flaw is unauthenticated per its CVSS vector (PR:N) but only reachable from the physical communication segment attached to the host running Agile PLM, and Oracle rates it as difficult to exploit (AC:H) with a 6.8 base score affecting confidentiality and integrity only. No public exploit code or CISA KEV listing was present in the available intelligence, so active exploitation is unconfirmed.
Oracle Contract Lifecycle Management for Public Sector — specifically the Wage Determination Online component of Oracle E-Business Suite 12.2.3 through 12.2.15 — can be abused by an unauthenticated, network-based attacker who persuades another user to interact with a crafted HTTP request, yielding unauthorized read plus update/insert/delete access to module data. The CVSS 3.1 base score is 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), and the scope-change metric indicates the compromise may significantly impact additional products beyond the vulnerable module. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so this reads as a patch-cycle priority rather than an emergency.
Oracle iRecruitment, the recruitment module of Oracle E-Business Suite, exposes an access-control weakness in its Internal Operations component across versions 12.2.3 through 12.2.15 that lets an attacker on the same physical network segment read, create, modify, or delete recruitment data without authenticating. The flaw is rated difficult to exploit (CVSS 6.8, AV:A/AC:H/PR:N/UI:N) because it demands layer-2 adjacency to the application host and a race-prone or otherwise unreliable attack path, but it delivers high confidentiality and integrity impact with no availability loss. No public exploit code or CISA KEV entry was present in the supplied intelligence, so exploitation is not confirmed in the wild.
Oracle Helidon 4.0.0 through 4.5.4 contains an authorization weakness in the helidon-microprofile-security component that allows a low-privileged user with ordinary HTTP network access to read a subset of Helidon-accessible data and to insert, update or delete records they should not reach, with no user interaction required. The defect is trivially reachable (CVSS 3.1 base 5.4, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), meaning any valid low-privilege account is enough to over-reach, though availability is unaffected. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied, so the practical urgency rests on whether the affected microprofile-security module is exposed and whether low-privilege accounts are widely issued.
Unauthenticated network access to the Long Running Actions (LRA) component of Oracle Helidon 4.0.0 through 4.5.4 allows a remote attacker to read a subset of data and to insert, update, or delete records handled by the LRA coordinator without supplying credentials. The flaw is rated CVSS 6.5 with a network attack vector, low complexity, and no required privileges or user interaction, but it produces only partial confidentiality and integrity impact with no availability loss. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; EPSS data was not supplied in the input.
Oracle Assets, a module within Oracle E-Business Suite, exposes sensitive asset and financial data to any authenticated user with low privileges who can reach the module over HTTP. Versions 12.2.3 through 12.2.15 are affected; a successful attack yields high confidentiality impact (CVSS 3.1 base 6.5, AV:N/AC:L/PR:L/UI:N) with no integrity or availability effect. Oracle rates the flaw 'easily exploitable', but no EPSS score, KEV listing, or public exploit code was present in the supplied intelligence, so exploitation status is best described as no public exploit identified at time of analysis.
Oracle Product Hub, the product master-data component of Oracle E-Business Suite (versions 12.2.3 through 12.2.15), is exposed to a difficult-to-exploit flaw in its Internal Operations component that lets a low-privileged, network-positioned attacker read and tamper with critical product data via HTTP. The CVSS 3.1 base score is 6.8 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N), reflecting high confidentiality and integrity impact but no availability impact, with the high attack-complexity metric indicating exploitation depends on conditions outside the attacker's direct control. There is no public exploit identified at time of analysis and the flaw has not been listed in CISA KEV; Oracle's own advisory at cspusep2026.html is the authoritative remediation source.
High-privileged users of Oracle E-Business Suite Depot Repair 12.2.3 through 12.2.15 can exploit a flaw in the Depot Repair Diagnostics component over HTTP to read, create, modify, or delete any Depot Repair data they can reach. Oracle rates this CVSS 3.1 6.5 (AV:N/AC:L/PR:H/UI:N, C:H/I:H/A:N), meaning exploitation is network-reachable and low-complexity but requires an already-privileged EBS account; there is no integrity-verified public exploit code and no CISA KEV listing at time of analysis. The practical exposure is privilege escalation or lateral data compromise inside an EBS instance rather than a pre-authentication breach.
Authenticated attackers holding only low-privileged credentials in Oracle E-Business Suite can exploit a WebUI flaw in Oracle Product Workbench 12.2.3 through 12.2.15 to read and tamper with application data, provided they can convince another user to interact with a crafted request. The CVSS 3.1 base score is 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), with a scope change meaning downstream components of the E-Business Suite may also be affected. No public exploit code or active exploitation has been identified in the supplied intelligence, and no EPSS score was provided.
Oracle Communications Cloud Native Core Security Edge Protection Proxy (SEPP) versions 26.1.200 and 25.2.201 permit a low-privileged, network-positioned attacker to reach the SEPP over HTTP and read a subset of its accessible data while also updating, inserting, or deleting some of that data. The flaw is rated 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), meaning exploitation needs an existing low-privilege account but no user interaction and no special attack complexity. There is no CISA KEV listing and no public exploit code identified at time of analysis; the issue is addressed through Oracle's Critical Patch Update advisory cspusep2026.
Oracle Coherence 15.1.1.0.0 exposes a narrow local information-disclosure weakness in its Core component that lets an attacker who already holds a low-privileged operating-system logon on the Coherence host read a limited subset of data the process can access. The flaw is rated CVSS 3.1 base 2.5 (AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N), meaning high attack complexity, no integrity or availability impact, and no remote vector. There is no public exploit code and no CISA KEV listing, so this is a low-priority, defense-in-depth item rather than an emergency; Oracle published it through its Critical Patch Update advisory for Fusion Middleware.
Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 contain a flaw in the Core component that lets an attacker who already holds a high-privileged account and can log on to the host where Coherence runs make unauthorized updates, inserts or deletions against Coherence-accessible data. The CVSS 3.1 base score is only 1.9 (AV:L/AC:H/PR:H/UI:N, integrity-only), reflecting that exploitation demands local logon, elevated privileges and a difficult-to-achieve condition; confidentiality and availability are not impacted. No public exploit code or CISA KEV entry was present in the supplied intelligence, so this is assessed as a low-priority, defense-in-depth issue rather than an urgent patch item. The vendor-reported nature of the record and the presence of an 'Authentication Bypass' tag that conflicts with the PR:H, integrity-only vector are notable data-quality caveats.
Information disclosure in Oracle Coherence 15.1.1.0.0 lets a low-privileged attacker with HTTP network access read critical data or the entire contents of Coherence-accessible caches, and because the CVSS vector reports a scope change, products built on top of that grid can be exposed as well. Oracle scores it 6.3 with high attack complexity, so it is not a trivial drive-by exploit; the feed contains no public exploit code and no CISA KEV entry, and the only remediation reference is Oracle's Critical Security Patch Update advisory. Authentication is required per the PR:L metric, meaning the attacker needs an existing low-privilege foothold rather than being an anonymous internet client.
Oracle Fusion Middleware Control 12.2.1.4.0 and 14.1.2.0.0 contain a flaw in the Framework component that lets a low-privileged attacker with HTTP network access trick a privileged user into an interaction that results in unauthorized read and modification of data, with cross-scope impact on other Oracle products. Oracle rates it CVSS 3.1 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), meaning exploitation is easy but gated by an existing low-privileged account and victim user interaction. There is no public exploit code or CISA KEV entry in the provided data, and EPSS is not supplied; treat this as a patch-cycle item rather than an emergency.
Improper access control in the CAX Client component of the Oracle Agile PLM MCAD Connector 3.6 allows a locally logged-on, low-privileged user to read critical Agile PLM data, or all data the connector can reach. The flaw is confidentiality-only (CVSS 3.1 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so it is a post-logon insider/desktop compromise risk rather than a remote pre-auth issue. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; EPSS data was not supplied in the available intelligence.
Unauthenticated attackers positioned on the adjacent network segment of a host running Oracle Helidon can read and modify critical application data through a flaw in the helidon-integrations-neo4j component. Affected releases are Helidon 3.0.0 through 3.2.20 and 4.0.0 through 4.5.4; Oracle rates this CVSS 3.1 6.8 with an AV:A/AC:H profile, meaning the attacker needs layer-2 proximity and must satisfy non-trivial conditions, but needs no credentials and no user interaction. No public exploit code and no CISA KEV entry were identified at the time of analysis, and no EPSS score was supplied with the intelligence.
A locally exploitable information-disclosure flaw in the CAX Client component of Oracle Agile PLM MCAD Connector 3.6 lets any attacker who already holds a low-privileged logon on the host read data they should not be able to reach, including critical PLM content the connector can access. Confidentiality is the only impacted metric (CVSS 3.1 base 5.5, AV:L/PR:L/UI:N/C:H/I:N/A:N), so integrity and availability of the connector are untouched. There is no CISA KEV listing and no public exploit code identified at time of analysis, and Oracle has published a fix through its Supply Chain Critical Security Patch Update.
Unauthenticated attackers with network access to the HTTP interface of the Forge component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 can exploit a difficult-to-trigger flaw to read the full set of data the platform can reach and to partially degrade its availability. The vendor rates this 6.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L), so the damage ceiling is high confidentiality loss rather than code execution. No public exploit code and no CISA KEV entry appear in the supplied intelligence, and no EPSS score was provided, so active exploitation is unconfirmed — the practical driver for patching is the exposure of complete catalogue and index data, not observed attacks.
Unauthorized read access to critical data in Oracle Process Manufacturing Intelligence (part of Oracle E-Business Suite) is achievable by a low-privileged attacker over the network via Oracle Net, because the Internal Operations component fails to properly enforce authorization for 12.2.3 through 12.2.15. The flaw is rated CVSS 3.1 6.5 (AV:N/AC:L/PR:L/UI:N, confidentiality-only) and is trivially reachable by anyone holding a valid low-privileged account and network path to the Oracle Net listener. There is no CISA KEV listing and no public exploit identified at time of analysis, but Oracle shipped an official fix in its Critical Security Patch Update, so unpatched internet- or intranet-exposed EBS instances remain the exposure.
Oracle Field Service, a component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, can be compromised over HTTP by a low-privileged attacker who induces another person to interact with a crafted request. Successful exploitation gives the attacker unauthorized read access plus insert, update, or delete capability over a subset of Field Service data, and because the CVSS scope metric is Changed, the impact may extend into additional connected products. There is no public exploit code identified and no CISA KEV listing at time of analysis, so this rates as a moderate-priority patch item rather than an emergency, with a CVSS 3.1 base score of 5.4 reflecting limited confidentiality and integrity loss and no availability impact.
A low-privileged, authenticated attacker with HTTP network access can read all data accessible through the Oracle Application Object Library (Core) component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, resulting in a full confidentiality compromise of that component with no integrity or availability impact. Oracle rates it CVSS 3.1 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) and describes it as easily exploitable, meaning an existing low-privilege EBS account is enough to reach sensitive data beyond the account's intended scope. No public exploit code or active exploitation is indicated in the available intelligence, and the patch is delivered through Oracle's Critical Security Patch Update for E-Business Suite.
Improper authorization enforcement in the Internal Operations component of Oracle Field Service, part of Oracle E-Business Suite 12.2.3 through 12.2.15, lets a low-privileged user read data that the application should have kept out of reach. The attack is delivered over HTTP with no user interaction and no special complexity, but it does require a valid account on the affected system, so it is an authorization/confidentiality failure rather than a pre-authentication bypass. Impact is limited to confidentiality (CVSS 3.1 base 6.5, C:H/I:N/A:N); no public exploit code or CISA KEV entry was present in the supplied intelligence at time of analysis.
Unauthenticated attackers with HTTP access to Oracle Forms Services can read a limited subset of data the application exposes, per Oracle's Fusion Middleware security advisory affecting versions 12.2.1.19.0 and 14.1.2.0.0. The flaw is rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/C:L/I:N/A:N), meaning low-complexity, no-credential, no-user-interaction exploitation whose only impact is partial confidentiality loss - there is no integrity or availability impact and no scope change. No public exploit code, EPSS score, or CISA KEV listing is present in the supplied intelligence, so this should be treated as a patch-now confidentiality leak rather than an actively exploited emergency.
Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 contain an easily exploitable flaw in the Forms Services, C/S and Charmode components that lets a high-privileged attacker with network access over HTTP tamper with or destroy critical Forms data and repeatedly crash the service (complete denial of service). Oracle rated it 6.5 with integrity and availability impacts only, meaning confidentiality is untouched but data can be created, deleted or modified. No public exploit code or active exploitation has been identified at time of analysis, and no EPSS or CISA KEV signal was supplied with this record.
Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component), versions 22.3 through 26.7, permits low-privileged authenticated users with HTTP network access to reach functionality they should not control, enabling unauthorized read and modification of data and affecting systems beyond the vulnerable component (scope change). The flaw is rated CVSS 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting an easily automated but credential-gated attack with limited confidentiality and integrity impact. No public exploit code or CISA KEV entry is identified at time of analysis, and no CWE classification was assigned by the reporting source.
Oracle HR Intelligence, a component of Oracle E-Business Suite (versions 12.2.3 through 12.2.15), contains a difficult-to-exploit vulnerability in its Internal Operations component that lets a low-privileged, network-positioned attacker with an authenticated HTTP session tamper with or destroy critical HR data and repeatedly crash the service. Integrity and availability are both fully impacted while confidentiality is not, giving a CVSS 3.1 base score of 6.8 (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H). No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV, so the current exposure is driven by unpatched enterprise ERP deployments rather than active exploitation.
Unauthenticated memory disclosure in HPE Networking EdgeConnect SD-WAN Gateways lets an attacker on an adjacent network segment read portions of system memory, exposing internal service details and workflow information. All shipping 9.4.x, 9.5.x, 9.6.x and 9.7.0.0 branches are affected per the vendor-published version ranges. The CVSS score is only 4.3 (confidentiality-only, adjacent vector) and there is no public exploit code or CISA KEV listing, so this is best treated as a reconnaissance enabler rather than a standalone compromise — its value to an adversary is in chaining it with a separate privilege-escalation or authentication flaw.
Oracle Siebel CRM Deployment (Cloud Gateway component) versions 17.0 through 26.7 contains a hard-to-exploit flaw that lets a low-privileged attacker with HTTP network access read and modify critical CRM data, with Oracle rating both confidentiality and integrity impact as High. The vendor advisory does not disclose the root cause, and no public exploit code, EPSS score, or CISA KEV entry was supplied with this record, so real-world exploitation is unconfirmed. The associated 'Authentication Bypass' tag is not corroborated by the Oracle text, which describes unauthorized data creation, deletion, and modification rather than an explicit credential-check bypass.
Sensitive data disclosure in Oracle Web Applications Desktop Integrator (Web ADI), a component of Oracle E-Business Suite 12.2.3 through 12.2.15, where the 'File download' component fails to properly restrict which files a low-privileged user can retrieve over HTTP. An attacker holding any valid low-privileged EBS account can read files they do not own, resulting in unauthorized access to critical data (CVSS 6.5, high confidentiality impact, no integrity or availability impact). Exploitation is network-based, low complexity and requires no user interaction, making it highly automatable once credentials exist; no public exploit code has been identified and there is no CISA KEV listing at time of analysis.
Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 expose the Event Management component to low-privileged, network-positioned attackers who can abuse SOAP requests to create, delete, or modify event and management data without authorization. The flaw is rated CVSS 3.1 6.5 (AV:N/AC:L/PR:L/UI:N, integrity-only impact) and is addressed in Oracle's September 2026 Critical Security Patch Update. No EPSS score, CISA KEV listing, or public exploit code was provided in the source data, so active exploitation is unconfirmed at time of analysis.
Concrete CMS 9.0.0 through 9.5.2 contains an insecure direct object reference in the Express saved search preset delete and edit dialogs, letting any authenticated user who holds only view permission on a single Express entity permanently delete (with no undo) or rename saved search presets owned by Express entities they have no permission over. Because a renamed preset is rendered back to users of the targeted entity, the flaw enables content defacement or social-engineering-style manipulation of other teams' saved searches. The vendor scored it CVSS 4.0 2.1 (Low) with PR:H and AT:P; no public exploit code, EPSS score, or CISA KEV listing was identified at time of analysis.
Concrete CMS 9.5.2 and earlier fail to enforce a destination-side authorization check and omit CSRF token validation in the multilingual page-assignment backend action (Backend\Page\Multilingual::assign), letting an authenticated editor who holds the Edit Page Multilingual Settings permission on just one page rebind an arbitrary page from another locale as that page's translation and delete legitimate translation pairs maintained by other editors. The result is silent manipulation of public-facing language routing across the site, with no confidentiality impact and only limited integrity/availability damage. The vendor scores this 2.1 (CVSS v4.0) because the actor must already be an authenticated, privileged editor; no public exploit code and no active exploitation have been reported.
Let me synthesize. CVE-2026-86465: Apache Airflow Akeyless provider secrets backend team-scope guard bypass via user-controlled key. Affected: apache-airflow-providers-akeyless before 0.3.1. Fix: 0.3.1. PR: https://github.com/apache/airflow/pull/72646. Similar class to Azure Key Vault, Yandex Lockbox, Amazon secrets backends CVEs. Multi-team deployments using Akeyless secrets backend; single-team not affected. Reachable from ordinary DAG code via Execution API Variables route accepting path-shaped key. DAG author scoped to one team can read secrets belonging to another team — info disclosure (cross-tenant secret access). CVSS: N/A provided. My assessed vector: PR:L (requires DAG author privileges / authenticated user), AV:N, AC:L, UI:N, S:C? Scope change — impacts another team's secrets, but scope change in CVSS terms means authorization scope. Cross-team boundary crossing could be S:C. Impact C:H, I:N, A:N. So CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. That's ~8.3? Let's compute: S:C base... Actually with S:C, PR:L: exploitability = 8.22*AV(0.85)*AC(0.77)*PR(0.68)*UI(0.85) = 8.22*0.85=6.987; *0.77=5.380; *0.68=3.658; *0.85=3.110. Impact: ISCBase = 1 - (1-C)(1-I)(1-A) = 1 - (1-0.56)(1)(1) = 0.56. Scope changed: Impact = 7.52*(ISC-0.029) - 3.25*(ISC-0.02)^15 = 7.52*(0.531) - 3.25*(0.54)^15 ≈ 3.993 - ~0 = 3.993. Base = roundup(min(1.08*(3.110+3.993),10)) = roundup(7.67) = 7.7. Hmm, 7.7 High. Maybe S:C is arguable. Alternatively S:U with C:H gives: Impact = 6.42*0.56 = 3.595; exploitability 3.110; base = roundup(min(1.08*6.705,10)) = roundup(7.24)=7.3. Either way ~7.3-7.7. Actually, "moderate" severity per Apache. Hmm. Apache's own severity is "moderate". But my assessment... I'll go with S:C? Let's think: the vulnerable component is the Akeyless backend; the impact is a different team's secrets. CVSS scope change refers to impact on components beyond the vulnerable component's security authority. The secrets backend... Hmm. This is a classic cross-tenant autho
Unauthenticated attackers can push files of the component's choosing onto a Joomla site running the JoomGallery extension (all versions below 4.4.1) by abusing the extension's TUS resumable-upload endpoint, which fails to enforce access control. The practical impact is bounded — neither the file name nor the extension is attacker-controlled — and turning the upload into code execution requires an unusual web-server configuration that maps the stored artefacts to an executable handler, which is why the CVSS 4.0 base score lands at 6.3 rather than critical. No CISA KEV entry or EPSS score accompanies this CVE in the supplied data, but the CVSS 4.0 vector carries an E:A (Attacked) supplemental metric indicating the scoring source has observed exploitation activity.
Concrete CMS versions before 9.5.3 contain a missing-authorization flaw in the SEO Bulk Update Meta Tags editor: the saveRecord() action validated the per-page CSRF token but never invoked canEditPageProperties() for the target page. As a result, an authenticated user who was granted access to the bulk SEO tool and could merely view a page could rewrite that page's meta title, meta description, and URL handle, tampering with presentation content and live URLs outside their intended edit scope. The vendor rates this only 2.1 (CVSS v4.0, integrity-only), there is no public exploit code identified at time of analysis, and the issue is not known to be actively exploited (no CISA KEV listing).
Request smuggling in http4s Ember affects ember-core (server and client) before 0.23.35 and 1.0.0-M47 because the chunked decoder trims chunk-size tokens and accepts leading '+' or '-' signs instead of requiring hexadecimal digits followed by the mandatory CRLF. When Ember runs behind an intermediary that forwards chunked bodies without re-encoding and parses chunk boundaries differently, an unauthenticated attacker can achieve TE.TE request smuggling that bypasses intermediary controls, poisons shared caches, or hijacks queued requests; the same response-path leniency enables response smuggling when ember-client is used as a gateway in front of a malicious or compromised upstream. No public exploit code or CISA KEV entry is associated with this issue at time of analysis, and no EPSS score was supplied in the source data.
Broken authorization in the Concrete CMS 9 Boards dashboard area (versions 9 through 9.5.2) lets any user who has been granted edit_board_settings on a single board view, refresh, regenerate, or delete board instances belonging to entirely different boards by supplying those boards' instance IDs. The affected single-page controllers resolve an instance directly from the attacker-supplied ID and validate only an action-scoped CSRF token — which is bound to the action name, not to the target object, and is therefore reusable across boards — while skipping the permission-checked accessor that runs canEditBoardSettings on the parent board for the read view. The vendor rates this CVSS v4.0 2.1 (AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:L); no public exploit code or CISA KEV listing was identified at time of analysis.
Missing authorization in the Express entries advanced-search dashboard action of Concrete CMS 9.0.0 through 9.5.2 lets any authenticated dashboard user who holds view_express_entries on just one Express entity read the entries and secret attribute values of every other Express entity. The advanced_search() method resolves the target entity directly from a user-supplied entity ID and skips the canViewExpressEntries() check that the sibling results() action enforces, crossing the per-entity permission boundary Express is designed to guarantee. The vendor rates this CVSS v4.0 2.1 (AV:N/AC:L/AT:P/PR:H/UI:N/VC:L), reflecting a low-impact but real confidentiality breach limited to authenticated staff; no public exploit code or CISA KEV entry was identified at time of analysis.
Concrete CMS 9 through 9.5.2 fails to verify ownership when processing three Boards data-source dashboard actions (update, update_data_source, delete_data_source), so an authenticated user with edit_board_settings on just one board can modify or permanently delete the configured data sources of any other board on the site. Successful abuse halts the victim board's content feed and resets its custom weighting, with no confidentiality impact. The vendor-assigned CVSS v4.0 base score is a low 2.1 (PR:H, AT:P), no public exploit code or CISA KEV entry was provided in the intelligence feed, and the referenced fix is the Concrete CMS 9.5.3 release notes.
Missing per-page authorization in the Concrete CMS sitemap controller (all versions before 9.5.3) lets any authenticated dashboard user who can reach the sitemap reorder pages they have no edit or arrange rights over, silently altering the site's global navigation order. The send_to_top and send_to_bottom tasks trust the attacker-supplied cNodeID parameter and load/update the target page without verifying move permission on that specific node (CWE-862); impact is integrity-only (CVSS v4.0 2.1, PR:H, VI:L). No public exploit code or CISA KEV entry was identified at time of analysis, and a vendor fix is available in Concrete CMS 9.5.3.
Concrete CMS 8.5.3 through 9.5.2 lets a suspended or deactivated user keep minting valid OAuth 2.0 access tokens through the refresh-token grant, because the grant never re-checks the account's active flag (uIsActive=0) before issuing new tokens. Anyone who legitimately obtained a refresh token while their account was active retains API access after offboarding, so deactivation alone no longer revokes API credentials. The vendor assigned a low CVSS v4.0 base score of 2.3 (AV:N/AC:L/AT:P/PR:L/UI:N, all impacts Low); no public exploit code or CISA KEV listing was provided at time of analysis.
Local privilege escalation in the Android bootloader lets a caller that already holds System execution privileges bypass a missing permission check and reach higher-privileged bootloader operations on affected Android devices. The CVSS vector (AV:L/PR:H/UI:N) makes clear this is a second-stage escalation that requires both local access and an existing high-privileged foothold, not a remote or unprivileged-app vector, and it needs no user interaction. Google resolves it through the September 2026 Android/Pixel security bulletin; EPSS is very low (0.11%, 2nd percentile) and no public exploit has been identified at time of analysis.
Concrete CMS versions below 9.5.3 import files uploaded through the conversation attachment endpoint into the site's file manager before verifying the 'Add Message Attachments' permission, so the authorization check happens only after the file has already been stored. A low-privileged authenticated user who has been explicitly denied that permission — or an unauthenticated visitor on a site configured to allow guest posting — can therefore inject files of allowed types into the file manager, altering stored content or consuming storage. The vendor rates this CVSS v4.0 2.3 (AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L), indicating limited integrity and availability impact rather than code execution, and there is no public exploit code identified at time of analysis.
An improper authentication flaw (CWE-287) in Dell Wyse Management Suite versions prior to 2605.0.3.683 lets an unauthenticated remote attacker bypass the login mechanism and gain unauthorized access to the management console or API. The CVSS 3.1 base score is 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), reflecting low confidentiality and integrity impact but no availability impact, which is unusually low for a full authentication bypass and suggests the exposed functionality is a constrained subset of the console. No EPSS score, CISA KEV listing, or public exploit code was present in the provided intelligence, so there is no public exploit identified at time of analysis and no confirmed active exploitation.
GitLab CE/EE instances that enforce SAML single sign-on can be bypassed by an authenticated user who signs in through another authentication path, because the sign-in enforcement check is missing (CWE-306). Affected releases are all versions from 18.6 up to 19.1.7, 19.2.x through 19.2.5, and 19.3.0/19.3.1; GitLab has published fixes in 19.1.8, 19.2.6 and 19.3.2. Publicly available exploit code exists (a HackerOne report is linked), but the issue is not listed in CISA KEV and no active exploitation has been confirmed; CVSS is a moderate 5.4 and impact is limited to partial confidentiality and integrity loss, not remote code execution or full account takeover of the platform.
Authenticated users of IBM ContextForge MCP Gateway through v1.0.4 can bypass the gateway's payload protection mechanisms because its recursive content inspection does not fully traverse deeply nested or embedded payload structures. Successful abuse yields limited but real integrity and confidentiality impact (CVSS 5.4, AV:N/AC:L/PR:L/UI:N) by allowing disallowed content or instructions to pass through the filter that is meant to stop them, undermining the gateway's role as a security boundary between MCP clients and downstream tool servers. There is no public exploit code or CISA KEV entry at time of analysis, and IBM has published a fix via its support portal, so exposure is limited to unpatched deployments reachable by an authenticated account.
IBM Business Automation Workflow (both containerized and traditional deployments) fails to enforce authorization checks on certain import operations, letting an authenticated user invoke restricted import actions they should not be permitted to perform. Successful abuse yields limited confidentiality and integrity impact (CVSS 5.4, AV:N/AC:L/PR:L/UI:N) rather than full system compromise. No public exploit code has been identified and the flaw is not listed in CISA KEV, but IBM has published a vendor patch, so unpatched deployments remain exposed to any user holding a valid low-privileged account.
Tornado 6.5.5 through 6.5.7 allows attackers to inject arbitrary Set-Cookie attributes because the fix for CVE-2026-35536 only validated the documented lowercase keyword arguments (name/domain/path/samesite). The deprecated and still-live **kwargs path in RequestHandler.set_cookie writes values straight into the Morsel without character validation, and because Morsel.__setitem__ is case-insensitive, a capitalized kwarg such as Domain=, Path=, SameSite= or Max-Age= routes to the same reserved attribute while bypassing the filter. Any application that passes attacker-influenced data into a capitalized/legacy kwarg can be made to emit cookies with attacker-controlled Domain, Path, Secure, HttpOnly or SameSite directives; no public exploit code or CISA KEV entry has been identified at time of analysis.
Broken object-level authorization in Vikunja before 2.6.0 lets any authenticated user write task-position records into project views belonging to other tenants by supplying a project_view_id that is never checked against the target task's project. Because only integrity of view ordering is affected (no read, no availability impact), the practical damage is cross-tenant data corruption and ordering manipulation rather than data theft. A vendor patch (2.6.0) and a GitHub security advisory are available; the issue is not listed in CISA KEV and no public exploit code was identified at time of analysis.
An API token scope bypass in Vikunja before 2.6.0 allows a holder of a deliberately limited-scope API token to read task data outside that token's permissions — specifically comments, reactions, and time entries — by adding the 'expand' query string parameter to task read requests, because the authorization layer never inspects query parameters. Exploitation requires an already-valid low-privilege token (CVSS 4.0 PR:L) and only results in limited confidentiality loss, giving a modest base score of 5.3; there is no public exploit and no evidence of active exploitation at time of analysis. The vendor has released a fix in Vikunja 2.6.0.
Mitigation bypass in the Widget: Win32 component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.
Mitigation bypass in the Networking component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.
Mitigation bypass in the Popup Blocker component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.
Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.
Mitigation bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.
Mitigation bypass in the DOM: Notifications component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.
Mitigation bypass in the Remote Settings Client component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.
Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, and Firefox ESR 153.3.