Authentication Bypass
Monthly
Broken object level authorization (BOLA) in Splunk Enterprise's data management orchestrator allows authenticated low-privileged users to delete SPL2 modules owned by other users. Affected versions are Splunk Enterprise 10.2.x before 10.2.6 and 10.4.x before 10.4.2; the feature is absent in versions prior to 10.2, so those are unaffected. No public exploit code or active exploitation has been identified at time of analysis, and a vendor-released patch is available.
Unauthorized access to Mobile Device Management signing secrets in Splunk Secure Gateway allows a low-privileged Splunk user to compromise all mobile-device enrollment trust. Affected are Splunk Enterprise below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway below 3.10.10, 3.9.24, and 3.8.71. An attacker holding only the 'list storage passwords' role permission - without Secure Gateway administration privileges - can invoke unprotected REST API endpoints (deployment bundle, SAML setup, companion app workflows) to retrieve MDM signing secrets, enabling enrollment of unauthorized or attacker-controlled mobile devices. No public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-site scripting in Splunk Enterprise (below versions 10.4.2, 10.2.6, 10.0.9, and 9.4.13) enables an unauthenticated attacker to execute arbitrary JavaScript in an authenticated user's browser by tricking that user into visiting a malicious web page. Splunk Web's page message handler processes incoming postMessage events without validating their origin or source, allowing cross-origin script injection into the victim's active Splunk session. Successful exploitation can expose all data accessible to the victim user and permit unauthorized actions affecting system integrity; no public exploit code or CISA KEV listing has been identified at time of analysis.
Broken access control across all four first-party TinaCMS production media adapters (next-tinacms-s3, next-tinacms-dos, next-tinacms-azure, next-tinacms-cloudinary) allows any authenticated CMS editor to write or delete storage objects outside the operator-configured mediaRoot boundary. The handlers pass attacker-controlled query parameters (req.query.key for presigned S3 PUTs, req.query.media for DELETEs) directly to storage SDK operations without validating that the resulting key falls within the permitted path prefix, giving editors write and delete authority over the entire storage bucket or container reachable by the deployment's IAM or service credential. Vendor-released patches exist in all four packages; no public exploit or CISA KEV listing has been identified at time of analysis.
Coturn STUN/TURN server prior to version 4.15.0 allows an on-path attacker to tamper with authenticated STUN messages over plain UDP or TCP by appending arbitrary attributes after the MESSAGE-INTEGRITY field and recomputing the unkeyed FINGERPRINT. Because Coturn's server-side attribute iterator did not stop at the MESSAGE-INTEGRITY boundary as required by RFC 8489 Section 9, injected LIFETIME, XOR-PEER-ADDRESS, or ORIGIN attributes were processed as legitimate, enabling allocation lifetime manipulation, unauthorized permission injection, or origin-check bypass. TLS and DTLS deployments are entirely unaffected; no public exploit has been identified at time of analysis.
Rate limit bypass in Lemmy prior to 0.19.19 and 1.0.0-beta.1 allows unauthenticated remote attackers to circumvent all IP-based throttling by injecting a spoofed address as the first value of the X-Forwarded-For header. Because the bundled docker/nginx.conf forwards XFF headers using $proxy_add_x_forwarded_for rather than $remote_addr, attackers control the address that actix-web's ConnectionInfo::realip_remote_addr reads, receiving a fresh rate-limit bucket per request. No public exploit or CISA KEV listing exists, but exploitation is trivially automated and directly enables account registration spam, credential brute-forcing, comment spam, content scraping, bulk uploads, and repeated settings imports.
Cross-community post featuring abuse in Lemmy allows authenticated community moderators to manipulate post visibility across unrelated communities via crafted federated ActivityPub activities. Affected versions span 0.19.0 through 0.19.18 (stable) and all alpha builds prior to 1.0.0-alpha.20. A moderator legitimate in one community can send crafted CollectionAdd or CollectionRemove activities targeting posts in communities they have no authority over, injecting content into or removing it from featured feeds without authorization. No public exploit has been identified and the issue is absent from CISA KEV; vendor-released patches are available in 0.19.19 and 1.0.0-alpha.20.
Missing moderator rank authorization in Lemmy's ActivityPub federation layer allows a lower-ranked remote moderator to forcibly remove a higher-ranked moderator from a community by sending a crafted signed Remove activity. Affected versions prior to 0.19.19 and 1.0.0-alpha.18 enforce hierarchy correctly in the local REST API via LocalUser::is_higher_mod_or_admin_check, but CollectionRemove::verify in the federation path skips this rank check entirely, trusting only that the actor holds some moderator role. An authenticated moderator on any federated remote instance can therefore subvert community governance on the victim instance without the local API's protections. No public exploit code has been identified at time of analysis, and patches are available in both stable and alpha release lines.
Private message block enforcement in Lemmy is bypassed by the edit path, allowing a blocked sender to keep modifying old messages visible to the recipient. All Lemmy instances running versions prior to 0.19.19 (stable) and 1.0.0-alpha.18 (alpha) are affected. An authenticated attacker who has been blocked by a recipient can repeatedly call the edit endpoint on any previously sent message, delivering new content and providing a post-block harassment channel - defeating the intent of Lemmy's block feature. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Broken access control in Wekan's Excel export REST endpoint exposes private board contents to any authenticated user, regardless of board membership. Wekan versions 9.57 through 9.73 failed to await the async authorization guard in models/exportExcel.js, causing the Promise return value to always evaluate as truthy and bypass the board.isVisibleBy(user) check entirely. Any authenticated user can enumerate and download card titles, descriptions, lists, swimlanes, members, and metadata from private boards they are not a member of via GET /api/boards/:boardId/exportExcel. A read-only proof-of-concept was confirmed by the reporter (sec-reex) through responsible disclosure; no KEV listing at time of analysis.
Incomplete assistant authorization in langgraph-api (LangGraph Server) versions before 0.10.0 allows an authenticated low-privileged user to bypass ownership controls during run creation and access private assistants belonging to other users. The flaw arises because the run-creation code path dispatched the wrong authorization event (`assistants.search` instead of `assistants.read`), causing custom auth handlers registered only for `assistants.read` to be silently bypassed, the ownership filter to be omitted from the database query, and sensitive assistant `metadata`, `config`, and `context` to be returned in plaintext via the API response. No public exploit code exists and the vendor reports no evidence of exploitation in the wild.
LangGraph Server (langgraph-api < 0.10.0) allows an authenticated user to bypass per-user authorization by specifying a relative webhook URL when creating a run or cron job, enabling cross-user thread access in multi-tenant deployments. The server's webhook delivery subsystem routes relative targets through an in-process loopback transport that the authentication middleware treats as internal and exempts from authentication, allowing the request to execute against another user's thread routes without the originating user's authorization context. No public exploit code exists and no active exploitation has been identified; the vendor explicitly states no evidence of this behavior occurring in the wild.
IBM Power Systems Firmware across four firmware release trains (FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80, and FW950.00-FW950.H2) exposes a missing authorization flaw (CWE-862) on the Flexible Service Processor (FSP) that allows an authenticated administrator to transition the managed POWER system into a persistent non-production operational mode, selectively disabling system components. Critically, this condition survives FSP resets and requires deliberate operator intervention to reverse, converting a single privileged action into a sustained denial-of-service against production workloads. IBM has released a patch; no public exploit code or active exploitation has been identified at time of analysis.
Horizontal privilege escalation in Snipe-IT prior to 8.6.3 allows any authenticated company user to read asset maintenance records - including purchase costs, supplier details, asset tags, and notes - without holding asset view or maintenance permissions. The root cause is a missing `authorize()` call in `MaintenancesController.php show()`, which the company-scoped route-model binding did not compensate for since it only blocks cross-company access, not intra-company unauthorized reads. No public exploit has been identified at time of analysis; vendor-released patch is available in version 8.6.3.
Authorization bypass in the Grav Flex Objects Plugin prior to version 1.4.3 permits an authenticated user holding only the api.access permission to invoke all admin API handlers - index, show, create, update, delete, export, and media - against any Flex Objects directory whose blueprint omits the config.admin.permissions field. The root cause is a logic inversion in requireFlexPermission() inside FlexApiController.php: when no blueprint permissions are defined, the original code iterated over an empty set and silently returned without throwing a ForbiddenException, bypassing the core admin.flex-object authorization fallback that would otherwise deny the same actions. No public exploit code or CISA KEV listing is identified at time of analysis; a vendor-released patch is available as version 1.4.3.
Elevation of privilege in Dell Command Update (DCU) versions prior to 5.7.1 allows a local low-privileged attacker to gain elevated permissions through an Incorrect Authorization flaw (CWE-863). The vulnerability does not require user interaction or special configuration beyond the presence of a low-privileged local account on a Dell system running a vulnerable DCU version. Dell has released a fix in version 5.7.1 via advisory DSA-2026-309, and no public exploit has been identified at time of analysis.
Insecure Direct Object Reference (IDOR) in J-BusinessDirectory versions below 6.2.3 allows unauthenticated remote attackers to access and modify business directory records belonging to other users across multiple frontend and API endpoints. The CVSS 4.0 vector (PR:N, AV:N, AC:L) confirms no authentication is required, meaning any internet-connected user can exploit the flaw against a default installation. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Unauthenticated listing ownership takeover in J-BusinessDirectory (a Joomla extension by cmsjunkie.com) prior to version 6.2.3 permits any remote unauthenticated attacker to claim ownership of business directory listings - including listings already owned by legitimate users - by supplying attacker-controlled company and user IDs in HTTP requests. The vulnerability stems from improper access control (CWE-284): the ownership-assignment action is not bound to an authenticated session nor restricted to unowned listings. Version 6.2.3 corrects both deficiencies. No public exploit code has been identified at time of analysis, and this CVE has not been added to the CISA KEV catalog.
Registration bypass and authentication bypass in Talebook (MyBooks) 3.41.2 and earlier allow an unauthenticated remote attacker to create accounts on instances where the administrator has disabled public registration, and then immediately authenticate with those unactivated accounts to access user-level API functionality. The root cause is a server-side enforcement gap: the POST /api/user/sign_up handler in user.py ignores the ALLOW_REGISTER configuration flag entirely, relying on the frontend to suppress the UI - a classic CWE-602 client-side enforcement failure. A second flaw in process_auth_header (base.py) compounds the issue by skipping verification of the account active flag, so the freshly created account can authenticate without email confirmation. No public exploit code or CISA KEV listing has been identified at time of analysis. The issue is fixed in version 3.42.0.
Missing authorization in phpMyFAQ before 4.1.7 exposes restricted FAQ child resources - comments and attachments - to unauthenticated network attackers via unguarded API endpoints. The system applies visibility restrictions to parent FAQ records but omits equivalent checks when those records' associated comments and attachments are queried directly, leaking comment text, commenter email addresses, and attachment filenames. No public exploit code has been identified at time of analysis, and it is not listed in CISA KEV; the CVSS 4.0 score of 6.9 reflects the network-accessible, zero-authentication nature of the flaw tempered by its limited, low-confidentiality impact.
Broken access control in phpMyFAQ before 4.1.7 exposes sensitive infrastructure configuration to any authenticated user, regardless of permission level. Admin API read endpoints for LDAP, Elasticsearch, OpenSearch, and dashboard configuration fail to enforce the CONFIGURATION_EDIT permission check, meaning a low-privileged account holder can retrieve LDAP server topology, bind account names, search bases, index statistics, and site analytics. No public exploit or CISA KEV listing exists at time of analysis, but the low attack complexity and broad exposure to all authenticated users make this a meaningful reconnaissance risk in environments with LDAP or Elastic integrations.
Registration restriction bypass in phpMyFAQ before v4.1.6 enables network attackers to create user accounts even when administrators have explicitly disabled self-registration via the security.enableRegistration configuration flag. The REST API endpoints POST /api/register and POST /api/v3.1/register lack the server-side authorization check present in the HTML registration page, creating a security control gap (CWE-862). No public exploit has been identified and the vulnerability is not listed in CISA KEV; however, the mechanically trivial nature of the bypass - a standard HTTP POST - makes it low-effort to abuse once an attacker identifies an exposed phpMyFAQ instance.
Authentication bypass in phpMyFAQ's SetupController prior to version 4.1.7 allows unauthenticated network attackers to invoke privileged database setup API endpoints whenever the application is in maintenance mode. By sending unauthenticated POST requests to /api/setup/update-database and /api/setup/backup, an attacker can execute database schema migrations, toggle maintenance mode off, and retrieve plaintext database credentials bundled inside a generated ZIP archive. No public exploit has been identified at time of analysis, but the concrete endpoint paths and trivial HTTP-based trigger make independent rediscovery straightforward for any attacker monitoring a maintenance window.
Broken access control in the Taxi Booking Manager for WooCommerce WordPress plugin (versions prior to 2.0.8) enables attackers to perform unauthorized write operations against booking data or plugin configuration, resulting in high integrity impact with no confidentiality or availability loss. The flaw stems from missing authorization checks (CWE-862) on plugin endpoints, a class of vulnerability common in WooCommerce plugins where AJAX handlers or REST routes omit WordPress capability checks. No public exploit code or active exploitation has been identified at time of analysis, and the plugin's niche deployment base limits overall exposure, though the low attack complexity means exploitation is straightforward once a vulnerable installation is located.
Unauthenticated access to REST API routes in the Membership For WooCommerce WordPress plugin (all versions before 3.1.2) exposes any user's membership plan details due to a broken authentication pre-check. The plugin compares a supplied consumer secret against one that was never generated, meaning the authentication gate collapses entirely on sites where the API is enabled but no consumer key pairs have been created. No public exploit identified at time of analysis; EPSS at the 6th percentile confirms exploitation remains theoretical, though the attack path is trivially simple once the prerequisite configuration is confirmed.
Authenticated patient-level users in KiviCare WordPress plugin before 4.5.4 can download any file from the media library - including other patients' confidential medical reports - by exploiting a missing ownership verification on media file access (CWE-639 IDOR). The CVSS vector (PR:L, C:H, AV:N) confirms that any registered patient with network access can enumerate and retrieve arbitrary media objects without elevated privileges. No active exploitation is confirmed (EPSS 0.14%, no CISA KEV listing), but the exposure of protected health information creates significant regulatory liability under frameworks such as HIPAA and GDPR that the moderate CVSS score of 6.5 does not fully capture.
Insecure Direct Object Reference in the KiviCare WordPress plugin before 4.5.4 allows authenticated patient-level users to cancel or reschedule appointments belonging to other patients. The plugin fails to verify ownership of the appointment resource before permitting modification, enabling horizontal privilege escalation between patient accounts. No public exploit has been identified at time of analysis, and EPSS places exploitation probability at the 4th percentile.
Unauthenticated deletion of arbitrary appointment, booking, and payment records is possible in the TrueBooker WordPress plugin before version 1.2.7 due to a missing authorization check in an AJAX action handler. Any remote visitor - with no account or credentials - can target and permanently destroy booking data across the entire installation. No public exploit has been identified at time of analysis, and EPSS sits at 0.15% (4th percentile), consistent with the niche deployment footprint of this plugin; however, SSVC flags the attack as automatable, meaning mass-deletion of records across vulnerable sites via scripted requests is technically feasible.
TrueBooker WordPress plugin versions before 1.2.7 allows fully unauthenticated remote users to manipulate arbitrary appointment statuses and trigger notification emails to affected customers through an unprotected AJAX action. The CVSS vector (PR:N/AC:L/AV:N) confirms zero authentication or configuration prerequisites, making every active installation of the plugin a viable target. No public exploit has been identified at time of analysis, and the EPSS score of 0.15% at the 4th percentile indicates very low observed exploitation activity, consistent with the niche footprint of this specific booking plugin.
WP Maps WordPress plugin before version 4.9.8 allows any subscriber-level authenticated user to create an unlimited number of persistent database options via an unprotected AJAX endpoint lacking both capability checks and nonce validation. Because WordPress loads all options on every page request, mass option creation degrades site performance site-wide, yielding both integrity and availability impact. No public exploit has been identified and EPSS stands at 0.14% (4th percentile), indicating low real-world exploitation probability at this time.
Missing capability checks on two AJAX actions in the SmartCrawl SEO WordPress plugin (before 3.16.3) expose private and draft post titles and post-meta key names to any authenticated Subscriber-level user. The CVSS score of 4.3 (Medium) accurately reflects the constrained impact: exploitation requires a valid site account, and the disclosed data is limited to content metadata rather than full post bodies or credentials. No public exploit or CISA KEV listing exists at time of analysis, and EPSS of 0.14% (4th percentile) confirms negligible current exploitation interest.
Unauthenticated financial data exposure in the YayCurrency WordPress plugin (all versions before 3.3.5) allows any remote attacker to enumerate store order totals, vendor earnings, balance ledgers, and withdrawal histories without credentials. The vulnerability stems from missing capability and ownership checks on multiple multi-vendor integration REST or AJAX handlers, which are fully reachable by unauthenticated users. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, but the automatable nature of the attack - iterating numeric identifiers - makes mass enumeration trivially scriptable.
Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 exposes quiz email-notification and results-page configurations to unauthorized lateral reading by any authenticated contributor-level user on the same WordPress installation. The missing per-object ownership check on QSM REST API routes (CWE-639 IDOR) allows a contributor to query configuration data, including notification recipient email addresses, for quizzes created by other site users. No public exploit has been identified and SSVC classifies exploitation status as none, but the flaw represents a meaningful privacy control gap in multi-author WordPress environments where quiz surveys may collect sensitive respondent data.
Improper per-object authorization in the Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 permits any contributor-level (or higher) authenticated user to overwrite the front-end text settings of quizzes owned by other users. The flaw stems from a missing ownership check on the save action for quiz front-end text settings, meaning a contributor on a multi-author site can silently tamper with quiz content they did not create. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog; however, a vendor patch is available and should be applied promptly on any multi-author WordPress deployment running QSM.
Insecure direct object reference in WCFM Marketplace WordPress plugin before 3.8.1 allows any authenticated vendor to unapprove or permanently delete reviews belonging to other vendors' storefronts. The plugin fails to verify review ownership before processing modification or deletion requests, meaning any low-privilege vendor account can manipulate competitor reviews by supplying arbitrary review IDs. No active exploitation has been confirmed (not in CISA KEV), no public exploit code has been identified, and the CVSS score of 4.3 reflects a moderate-severity, limited-integrity-impact issue.
Eventin WordPress plugin before 4.1.21 fails to verify record ownership before permitting schedule modifications or deletions, enabling any contributor-level (or higher) authenticated user to alter or destroy schedule entries belonging to other users. The flaw is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), an IDOR-class weakness where the plugin relies solely on a user-supplied record identifier without confirming the requesting user is the legitimate owner. No public exploit code has been identified at time of analysis, and a vendor-released patch is available in version 4.1.21.
Missing authorization in the Eventin WordPress plugin (versions before 4.1.21) permits any authenticated contributor-level user to overwrite other users' WordPress roles and metadata via the speaker creation feature, bypassing the platform's native capability enforcement. The vendor has released a patch in version 4.1.21 addressing the missing permission check. No public exploit code or active exploitation has been identified at time of analysis; however, the practical barrier to exploitation is lower than the published CVSS 2.7 score implies, because contributor accounts are commonly available on sites with open registration.
Incorrect authorization in FreeBSD's ZFS_IOC_SET_PROP ioctl allows any local unprivileged user to set the internal '$hasrecvd' metadata flag on ZFS datasets - a capability that should be restricted to privileged ZFS receive operations. Affected release lines span FreeBSD 14.3, 14.4, 15.0, and 15.1 prior to their respective patch levels, as confirmed by FreeBSD Security Advisory FreeBSD-SA-26:40.zfs. No public exploit code exists and EPSS probability is 0.18% (8th percentile), indicating very low real-world exploitation pressure; no confirmed active exploitation or CISA KEV listing applies.
Improper authorization in the PPWP - Password Protect Pages WordPress plugin (all versions ≤1.9.15) allows authenticated Contributor-level users to invoke the vulnerable `can_access` function, retrieve the site's master password, and bypass protection on any password-gated page, post, or partial content. The CVSS vector (PR:L) confirms exploitation requires at minimum a valid WordPress account with Contributor privileges, limiting but not eliminating real-world risk given that Contributor accounts are often granted to guest authors or untrusted parties. No active exploitation confirmed (not listed in CISA KEV); no public exploit code status confirmed from available data.
Secure boot bypass in Ingenic T41, T32, T40, and A1 SoC boot ROMs allows an attacker with physical write access to boot media to permanently disable secure boot enforcement and execute unsigned or modified firmware. The boot ROM's init table parser applies full 32-bit SRAM write operations from the SPL header before evaluating the secure boot state or invoking signature verification - an ordering flaw that permits an attacker-crafted init-table entry to corrupt the SRAM-resident flag that governs the verification decision. No public exploit identified at time of analysis, though the opensensor.io research disclosure constitutes detailed technical findings including hardware-validated proof of concept on a T41 device with secure boot provisioned; because the flaw resides in mask ROM, no firmware patch is possible for hardware already in the field.
Missing authorization in the B2BKing WordPress/WooCommerce plugin (versions through 5.2.30) allows authenticated low-privilege users to exploit incorrectly configured access control security levels, potentially accessing B2B wholesale pricing tiers, customer group data, or restricted functionality reserved for higher-privilege roles. Reported by Patchstack's audit team under ENISA EUVD-2026-62211, this broken access control flaw (CWE-862) carries a CVSS 5.4 Medium score. No public exploit code or CISA KEV listing is identified at time of analysis, limiting immediate threat urgency.
Site isolation bypass in Google Chrome prior to 151.0.7922.169 enables a renderer-compromised attacker to cross origin boundaries via a flawed CORS implementation, reading or modifying data from otherwise isolated sites. This is a chained exploitation scenario: it requires a preceding renderer compromise as a prerequisite, making it a sandbox-escape-class vulnerability rather than a standalone browser attack. No public exploit code or active exploitation has been identified at the time of analysis, and a vendor patch is available in the 151.0.7922.169 stable channel release.
Partial denial of service in Oracle Helidon 4.5.3 is reachable by unauthenticated network attackers over HTTP, targeting the Imperative Web Server component within Oracle Fusion Middleware. Successful exploitation degrades availability without compromising confidentiality or integrity. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS score of 5.3 (Medium) reflects a bounded, availability-only impact.
Integrity compromise in Oracle Helidon 1.4.20's Imperative Web Server component enables unauthenticated remote attackers to perform limited unauthorized data modifications via HTTP under high-complexity conditions. The vulnerability, tagged as an authentication bypass, allows circumvention of access controls to execute unauthorized update, insert, or delete operations on Helidon-accessible data without requiring credentials or user interaction. No public exploit code has been identified and no active exploitation is confirmed; the CVSS 3.7 Low score combined with high attack complexity (AC:H) significantly constrain real-world risk.
Unauthorized data access in Oracle Helidon 3.2.18's Imperative Web Server component allows low-privileged network attackers to read a subset of accessible data and perform unauthorized insert, update, or delete operations via HTTP. Tagged as an authentication bypass by Oracle, the flaw presents a moderate but concrete integrity and confidentiality risk for organizations running this specific microservice framework version. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the low attack complexity and no user interaction requirement lower the barrier for exploitation by any authenticated user.
Unauthenticated remote exploitation of Oracle Helidon 4.5.0's Imperative Web Server component allows attackers with HTTP network access to read a subset of application-accessible data and trigger partial denial of service conditions. The CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L vector confirms low-complexity, zero-authentication exploitation with no user interaction required. No public exploit code or CISA KEV listing has been identified at time of analysis; this issue was disclosed through Oracle's Critical Security Patch Update for August 2026 (EUVD-2026-62158).
Unauthorized data access in Oracle Helidon 4.5.0's Imperative Web Server component allows low-privileged network attackers to read a subset of accessible data and perform unauthorized insert, update, or delete operations via HTTP. Tagged as an Authentication Bypass by Oracle Security, the flaw is rated Medium (CVSS 5.4) with low attack complexity, meaning any attacker holding even minimal credentials can trivially exploit it without user interaction. No public exploit code or CISA KEV listing is associated at time of analysis, though the straightforward exploitation conditions make this a credible threat in multi-tenant or shared-access Helidon deployments.
Unauthorized data access and manipulation in Oracle Helidon 4.5.0's Imperative Web Server allows low-privileged network attackers to read restricted data and perform unauthorized insert, update, or delete operations via HTTP. Tagged as an authentication bypass, the flaw enables authenticated users to exceed their intended authorization scope within the Helidon application. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog at time of analysis, though Oracle's August 2026 Critical Patch Update confirms the issue.
Unauthorized read access to data in Oracle Helidon 4.5.1's Imperative Web Server component is achievable by unauthenticated network attackers via HTTP, exploiting what the vendor tags as an authentication bypass condition. The affected version is precisely 4.5.1 of Oracle's Java microservices framework, and the vulnerability exposes a subset of data accessible to the server without requiring any credentials or user interaction. No public exploit has been identified at time of analysis, and Oracle has disclosed this issue as part of its August 2026 Critical Patch Update.
Authentication bypass in Oracle Helidon 3.2.19 Imperative Web Server exposes critical data to unauthenticated network attackers via HTTP. The flaw, tagged as an Authentication Bypass by the reporter, allows a remote attacker without credentials to gain complete read access to all data accessible by the Helidon server instance. No public exploit code or active exploitation has been identified at time of analysis; however, the high confidentiality impact warrants timely patching in any environment running this specific version.
The Imperative Web Server in Oracle Helidon 4.5.0 exposes an authentication bypass that permits remote unauthenticated HTTP attackers to read a subset of application-accessible data. Tagged by Oracle CSIRT as an authentication bypass and disclosed in the August 2026 Critical Patch Update, the flaw carries a CVSS 5.3 Medium score with network-accessible, zero-complexity exploitation conditions - conditions that may understate practical risk given the complete absence of authentication prerequisites. No active exploitation has been confirmed via CISA KEV, and no public exploit code was identified at time of analysis.
Unauthorized data access and modification is possible in Oracle Helidon 4.5.1 via a flaw in its Imperative Web Server component, classified under the Authentication Bypass tag. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms that unauthenticated remote attackers can exploit this over HTTP with no user interaction and low attack complexity. Successful exploitation results in partial confidentiality and integrity compromise of Helidon-accessible data; no patch version has been independently confirmed beyond the Oracle August 2026 CPU advisory.
Unauthorized data access in Oracle Helidon 4.5.1's Imperative Web Server component allows unauthenticated network-based attackers to read a subset of Helidon-accessible data and perform unauthorized insert, update, or delete operations against the same data store. The 'Authentication Bypass' tag in the intelligence feeds indicates the underlying mechanism circumvents expected access controls on HTTP endpoints. With AC:H, exploitation is non-trivial - specific conditions must be met - and no active exploitation has been identified; however, the unauthenticated network vector warrants patching in production deployments.
Unauthorized read access to application data is achievable against Oracle Helidon 4.5.1's Imperative Web Server component via unauthenticated HTTP requests. The vulnerability, tagged as an Authentication Bypass, allows remote attackers with network access to retrieve a subset of data without credentials, as confirmed by the CVSS vector (AV:N/AC:L/PR:N/UI:N). No public exploit has been identified at time of analysis, and the issue is addressed in Oracle's Critical Patch Update for August 2026.
Unauthorized data read in Oracle Helidon 3.2.19's Imperative Web Server component allows unauthenticated remote attackers to access a subset of protected application data via HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial network-level exploitation with no credentials or user interaction required, consistent with the intelligence tag of Authentication Bypass. Impact is bounded to confidentiality only (C:L, I:N, A:N), suggesting an access control bypass that exposes a partial data view rather than full system compromise. No public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-site scripting or client-side injection in Oracle Helidon 4.5.0's Imperative Web Server component enables unauthenticated, network-accessible attacks that produce partial confidentiality and integrity impacts while extending harm to additional products through a scope change. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) is the canonical fingerprint of reflected or stored XSS - an attacker delivers a crafted HTTP payload that, once interacted with by a victim user, executes within a different security scope such as a browser session. No public exploit code has been identified and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog; Oracle disclosed it through the August 2026 Critical Patch Update.
Unauthenticated remote exploitation of Oracle Helidon 4.1.0's Imperative Web Server component allows network-accessible attackers to bypass authentication controls via HTTP, resulting in unauthorized partial read and write access to application data. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is trivially exploitable with no prerequisites beyond network reachability, and the 'Authentication Bypass' tag corroborates an access-control failure in the web server layer. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low complexity and zero-authentication requirement make this an attractive target for automated scanning.
Remote unauthenticated exploitation of Oracle Helidon 4.5.0's Imperative Web Server component via HTTP/2 permits partial data disclosure and partial denial of service without any credentials or user interaction. Oracle's own advisory characterizes this as 'easily exploitable', and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms zero-prerequisite network reachability. No public exploit code or CISA KEV listing has been identified at time of analysis, and impact is bounded to partial confidentiality and availability degradation rather than full system compromise.
Unauthorized data exposure in Oracle Helidon 3.2.18's Imperative Web Server component allows unauthenticated network attackers to read a subset of application-accessible data via HTTP. Tagged as an authentication bypass, the vulnerability is trivially exploitable with no complexity barriers - any attacker with HTTP access to the service can trigger it. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and impact is constrained to partial confidentiality loss with no integrity or availability consequences.
Unauthenticated remote exploitation of Oracle Helidon 4.5.0's Imperative Web Server component allows network-adjacent attackers to bypass authentication and perform unauthorized read and write operations on application data over HTTP. Tagged explicitly as an Authentication Bypass by Oracle's security team, this vulnerability exposes a subset of Helidon-accessible data to disclosure and tampering without requiring credentials or user interaction. No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV, but the low attack complexity and zero-privilege requirement make it a straightforward target for automated scanning.
Unauthorized data access in Oracle Helidon 4.5.0's Imperative Web Server component allows unauthenticated network attackers to read a subset of application-accessible data and perform unauthorized insert, update, or delete operations via HTTP. The vulnerability, tagged as an Authentication Bypass by Oracle, is remotely exploitable without credentials or user interaction against the affected version. No public exploit code or active exploitation has been identified at time of analysis, though the low attack complexity and absence of authentication requirements make this straightforward to exploit once a target instance is identified.
Unauthorized data exposure in Oracle Helidon 4.5.0's Imperative Web Server component allows unauthenticated remote attackers to read a subset of application-accessible data via HTTP. The vulnerability is tagged as an authentication bypass, meaning protections that should gate read access can be circumvented without credentials. No public exploit code has been identified at time of analysis, and it has not been listed in the CISA KEV catalog, though Oracle disclosed this via their August 2026 Critical Patch Update (CPU).
Unauthorized data exposure in Oracle Helidon 4.5.0's Imperative Web Server enables unauthenticated remote attackers to read a subset of application-accessible data via HTTP, confirmed by Oracle's August 2026 Critical Patch Update. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivially exploitable, zero-complexity network access requiring no authentication or user interaction. No public exploit has been identified at time of analysis, though the 'Authentication Bypass' tag from multi-source intelligence indicates a structural access control failure in the HTTP request handling pipeline.
Authentication bypass in Oracle Helidon 4.5.0's Imperative Web Server component allows a low-privileged, network-adjacent attacker to read unauthorized data subsets and perform unauthorized insert, update, or delete operations via HTTP. Rated CVSS 5.4 Medium with low attack complexity and no user interaction required, this flaw is tagged as an authentication bypass by multi-source intelligence, suggesting a low-privileged user can exceed their authorized scope within the Helidon web layer. No public exploit code or CISA KEV listing has been identified at time of analysis.
Local high-privilege information disclosure in Oracle Helidon 4.5.1's Imperative Web Server component allows an attacker with OS-level logon access to the hosting infrastructure to read all data accessible to the Helidon process. The CVSS vector (AV:L/AC:L/PR:H) confirms exploitation is constrained to local infrastructure access with elevated credentials, resulting in complete confidentiality loss (C:H) with no integrity or availability impact. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.
Authentication bypass in Helidon 3.2.18's Imperative Web Server component allows unauthenticated remote attackers to read a subset of data accessible within the Helidon service over HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is trivially exploitable from any network location against default deployments without credentials. Impact is limited to partial confidentiality loss (C:L) with no integrity or availability consequence, though the 'Authentication Bypass' tag suggests access-control logic failures that may expose protected endpoints. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthorized data access in Oracle Helidon 4.5.0's Imperative Web Server component allows a low-privileged, network-authenticated attacker to read a subset of accessible data and perform unauthorized insert, update, or delete operations via HTTP. The vulnerability is tagged as an authentication bypass, suggesting that existing access controls within the Imperative Web Server can be circumvented by an attacker who holds any valid low-privilege credential. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Authentication bypass in Oracle Helidon 3.2.18's Imperative Web Server component allows low-privileged network attackers to read a subset of accessible data and perform unauthorized write, insert, or delete operations. Exploitation via HTTP requires high attack complexity and at least low-level authentication, limiting opportunistic mass exploitation. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthorized data disclosure in Oracle Helidon 4.5.0 affects the Imperative Web Server component, enabling unauthenticated network attackers to read a subset of accessible application data via HTTP. Tagged as an authentication bypass, the flaw requires no privileges or user interaction, making it trivially reachable from any network vantage point. No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog at time of analysis, though its zero-authentication, low-complexity profile warrants timely patching in network-exposed deployments.
Unauthorized data read in Oracle Helidon 3.2.18 allows unauthenticated remote attackers to access a subset of data served by the Imperative Web Server component over HTTP, with no credentials or user interaction required. Tagged as an Authentication Bypass by Oracle CERT, the flaw is classified as 'easily exploitable' in Oracle's August 2026 Critical Patch Update advisory. No public exploit code or active exploitation has been identified at time of analysis, but the absence of any authentication prerequisite lowers the bar for opportunistic reconnaissance.
Cross-site scripting or authentication bypass in Oracle Helidon 4.1 Imperative Web Server (version 4.5.0) allows unauthenticated remote attackers to perform unauthorized read and write operations against Helidon-accessible data, with scope change extending impact to additional dependent products. Exploitation requires victim interaction, consistent with a reflected XSS or similar client-side injection pattern in the HTTP server component. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-privilege requirement make this accessible to unsophisticated attackers once a victim is lured.
Cross-site scripting or equivalent client-side injection in Oracle Helidon 3.2.18's Imperative Web Server component allows unauthenticated remote attackers to compromise confidentiality and integrity of Helidon-accessible data when a victim user interacts with attacker-controlled content. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) is a canonical XSS fingerprint - scope change combined with user interaction and partial C/I impact - despite the 'Authentication Bypass' tag in the intelligence metadata, which may indicate a secondary or misclassified characteristic. No public exploit code or CISA KEV listing has been identified at time of analysis.
Authentication bypass in Oracle Helidon 4.5.0's Imperative Web Server component exposes HTTP endpoints to unauthenticated network attackers, enabling unauthorized read access to a subset of application data and unauthorized write, insert, or delete operations on accessible data. The flaw, tagged as an Authentication Bypass by Oracle and reported via the August 2026 Critical Patch Update, is reachable by any attacker with HTTP connectivity to the service with no complexity barriers. No public exploit code has been identified and the vulnerability is not currently listed in CISA KEV, but the zero-authentication network attack vector warrants prompt patching of affected Helidon 4.5.0 deployments.
Unauthenticated network exploitation of Oracle Helidon 3.2.18's Imperative Web Server component allows remote attackers to bypass authentication controls, gaining unauthorized read access to a subset of application data and unauthorized write/insert/delete capability against some accessible data. Tagged as an authentication bypass by Oracle Security (secalert_us@oracle.com), the vulnerability requires no privileges and no user interaction, making it trivially automatable over HTTP. No public exploit code or CISA KEV listing has been identified at time of analysis, though Oracle has disclosed this via their August 2026 Critical Patch Update.
Unauthorized data access in Oracle Helidon 3.2.18 (Imperative Web Server component) allows a low-privileged, network-adjacent attacker to read a subset of accessible data and perform unauthorized insert, update, or delete operations via HTTP. Tagged as an authentication bypass, the flaw enables privilege escalation beyond the attacker's authorized scope within the web server layer. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS data was not provided in source intelligence.
Authentication bypass in Oracle Helidon 3.2.18's Imperative Web Server component exposes sensitive application data to unauthenticated network attackers over HTTP. Successful exploitation yields complete read access to all Helidon-accessible data and limited write capability (insert, update, delete), with no availability impact. No active exploitation or public proof-of-concept code has been identified at time of analysis, and the high attack complexity rating tempers immediate mass-exploitation risk, though the confidentiality impact warrants prompt patching for internet-exposed deployments.
Helidon 3.2.18's Imperative Web Server component exposes an unauthenticated, network-accessible denial-of-service condition via HTTP that allows remote attackers to partially degrade service availability without any credentials or user interaction. Only the Availability dimension is affected - Confidentiality and Integrity remain intact - classifying this as a medium-severity partial DoS. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this in a lower operational priority tier despite its trivial exploitation conditions.
Unauthorized data read in Oracle Helidon 4.5.0's Imperative Web Server component exposes a subset of server-accessible data to unauthenticated remote attackers over HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is trivially exploitable without credentials, and the 'Authentication Bypass' tag from intelligence sources suggests access controls within the Imperative Web Server are being circumvented rather than simply an information leak. No active exploitation is confirmed in CISA KEV and no public exploit code has been identified at time of analysis.
Unauthenticated remote data modification is possible in Oracle Helidon 3.2.19 via its Imperative Web Server component, exploitable over HTTP with no credentials or user interaction required. Successful exploitation allows an attacker to perform unauthorized insert, update, or delete operations on data accessible to the Helidon instance, with no confidentiality or availability impact. No public exploit code or active exploitation has been identified at time of analysis.
Local exploitation of Oracle Helidon 4.5.0's Imperative Web Server component enables a low-privileged attacker with infrastructure logon to bypass authentication controls and gain unauthorized access to all data accessible by the Helidon process, with limited write capability. Confirmed by Oracle's Critical Patch Update for August 2026 and corroborated by EUVD-2026-62096, this carries a CVSS 3.1 score of 6.1. No public exploit code or active exploitation has been identified at time of analysis.
Oracle VM VirtualBox 7.2.14 Core component allows a low-privileged local attacker to read critical data, with the impact scope extending beyond the VirtualBox instance itself - potentially exposing host system or cross-VM sensitive data. Exploitation is constrained by high attack complexity and mandatory local access, making mass exploitation impractical; targeted insider or post-compromise scenarios represent the realistic threat model. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; the official Oracle CPU advisory for August 2026 is the authoritative source.
Oracle Hyperion Financial Management version 11.2.25.0.000 exposes a local privilege-assisted attack in its Security component, allowing a low-privileged authenticated user who can log on to the host infrastructure to partially compromise confidentiality, integrity, and availability. The attack demands high complexity and requires interaction from a secondary human actor, placing it firmly in the category of difficult, opportunistic local exploitation. No public exploit code or active exploitation has been identified at time of analysis; the vulnerability was disclosed by Oracle via the August 2026 Critical Security Patch Update.
Unauthenticated read-access exposure in Oracle Hyperion Financial Management 11.2.25.0.000 allows remote attackers to retrieve a subset of application data via HTTP without any credentials. The flaw resides in the Security component and is tagged as an Authentication Bypass, meaning the component fails to enforce proper access controls on at least one HTTP-accessible endpoint. No public exploit code or confirmed active exploitation has been identified at time of analysis, though the trivial attack conditions (AC:L/PR:N/UI:N) lower the bar for opportunistic reconnaissance.
Partial integrity and availability compromise in Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a remote, unauthenticated attacker over HTTP, provided high attack complexity conditions are met and a victim user interacts during the attack. Successful exploitation allows unauthorized modification or deletion of a subset of accessible data and can cause a partial denial of service. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Oracle Hyperion Financial Management version 11.2.25.0.000 exposes a local availability vulnerability in its Security component, allowing a high-privileged attacker already logged on to the host infrastructure to cause a partial denial of service. The attack is difficult to execute, requires existing elevated local access, and results only in limited availability degradation with no confidentiality or integrity impact. No public exploit or active exploitation has been identified; CVSS 3.1 Base Score is 1.9, placing this among the lowest-severity tracked vulnerabilities.
Oracle Hyperion Financial Management version 11.2.25.0.000 exposes a network-accessible vulnerability in its Security component that allows a low-privileged, authenticated attacker to partially compromise data confidentiality and integrity across product boundaries via HTTP. Exploitation requires both high attack complexity and victim interaction, limiting opportunistic exploitation but not eliminating targeted risk in enterprise financial environments. No public exploit code has been identified at time of analysis, and the vulnerability is tagged as an Authentication Bypass by the reporting source, suggesting the Security component may fail to enforce authorization boundaries under specific conditions.
Local privilege abuse in Oracle Hyperion Financial Management 11.2.25.0.000 allows a high-privileged attacker with logon access to the host infrastructure to read a subset of accessible data and perform unauthorized insert, update, or delete operations against that data. The vulnerability resides in the Security component and carries a CVSS 3.1 base score of 3.0, reflecting its constrained local attack vector, high complexity, and high privilege prerequisites. No public exploit code has been identified and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at time of analysis.
Oracle VM VirtualBox 7.2.14 (Core component) exposes a low-severity local vulnerability that permits a high-privileged attacker with logon access to the host infrastructure to perform unauthorized read and limited write operations against a subset of VirtualBox-accessible data. Confidentiality and integrity are partially affected; availability is not impacted. No public exploit has been identified at time of analysis, and the combination of local-only attack vector and required high-privilege access significantly narrows the realistic attacker population.
Denial-of-service in Oracle VM VirtualBox 7.2.14 Core component allows a high-privileged local attacker to repeatably crash or hang the hypervisor, taking down all hosted virtual machines. Exploitation requires high-privilege local logon access to the host, and Oracle's August 2026 CPU includes a fix. No public exploit code and no CISA KEV listing have been identified, keeping real-world risk limited despite the "easily exploitable" descriptor used by Oracle.
Oracle VM VirtualBox 7.2.14 contains a local privilege-escalation-to-DoS flaw in the Core component that allows a highly privileged host user to repeatedly crash or hang the hypervisor, with scope change meaning hosted guest VMs are also disrupted. The attack requires local logon and high privileges on the host infrastructure, substantially limiting the attacker pool to insiders or already-compromised privileged accounts. No public exploit code or active exploitation has been identified at time of analysis; EPSS data was not provided.
Broken object level authorization (BOLA) in Splunk Enterprise's data management orchestrator allows authenticated low-privileged users to delete SPL2 modules owned by other users. Affected versions are Splunk Enterprise 10.2.x before 10.2.6 and 10.4.x before 10.4.2; the feature is absent in versions prior to 10.2, so those are unaffected. No public exploit code or active exploitation has been identified at time of analysis, and a vendor-released patch is available.
Unauthorized access to Mobile Device Management signing secrets in Splunk Secure Gateway allows a low-privileged Splunk user to compromise all mobile-device enrollment trust. Affected are Splunk Enterprise below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway below 3.10.10, 3.9.24, and 3.8.71. An attacker holding only the 'list storage passwords' role permission - without Secure Gateway administration privileges - can invoke unprotected REST API endpoints (deployment bundle, SAML setup, companion app workflows) to retrieve MDM signing secrets, enabling enrollment of unauthorized or attacker-controlled mobile devices. No public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-site scripting in Splunk Enterprise (below versions 10.4.2, 10.2.6, 10.0.9, and 9.4.13) enables an unauthenticated attacker to execute arbitrary JavaScript in an authenticated user's browser by tricking that user into visiting a malicious web page. Splunk Web's page message handler processes incoming postMessage events without validating their origin or source, allowing cross-origin script injection into the victim's active Splunk session. Successful exploitation can expose all data accessible to the victim user and permit unauthorized actions affecting system integrity; no public exploit code or CISA KEV listing has been identified at time of analysis.
Broken access control across all four first-party TinaCMS production media adapters (next-tinacms-s3, next-tinacms-dos, next-tinacms-azure, next-tinacms-cloudinary) allows any authenticated CMS editor to write or delete storage objects outside the operator-configured mediaRoot boundary. The handlers pass attacker-controlled query parameters (req.query.key for presigned S3 PUTs, req.query.media for DELETEs) directly to storage SDK operations without validating that the resulting key falls within the permitted path prefix, giving editors write and delete authority over the entire storage bucket or container reachable by the deployment's IAM or service credential. Vendor-released patches exist in all four packages; no public exploit or CISA KEV listing has been identified at time of analysis.
Coturn STUN/TURN server prior to version 4.15.0 allows an on-path attacker to tamper with authenticated STUN messages over plain UDP or TCP by appending arbitrary attributes after the MESSAGE-INTEGRITY field and recomputing the unkeyed FINGERPRINT. Because Coturn's server-side attribute iterator did not stop at the MESSAGE-INTEGRITY boundary as required by RFC 8489 Section 9, injected LIFETIME, XOR-PEER-ADDRESS, or ORIGIN attributes were processed as legitimate, enabling allocation lifetime manipulation, unauthorized permission injection, or origin-check bypass. TLS and DTLS deployments are entirely unaffected; no public exploit has been identified at time of analysis.
Rate limit bypass in Lemmy prior to 0.19.19 and 1.0.0-beta.1 allows unauthenticated remote attackers to circumvent all IP-based throttling by injecting a spoofed address as the first value of the X-Forwarded-For header. Because the bundled docker/nginx.conf forwards XFF headers using $proxy_add_x_forwarded_for rather than $remote_addr, attackers control the address that actix-web's ConnectionInfo::realip_remote_addr reads, receiving a fresh rate-limit bucket per request. No public exploit or CISA KEV listing exists, but exploitation is trivially automated and directly enables account registration spam, credential brute-forcing, comment spam, content scraping, bulk uploads, and repeated settings imports.
Cross-community post featuring abuse in Lemmy allows authenticated community moderators to manipulate post visibility across unrelated communities via crafted federated ActivityPub activities. Affected versions span 0.19.0 through 0.19.18 (stable) and all alpha builds prior to 1.0.0-alpha.20. A moderator legitimate in one community can send crafted CollectionAdd or CollectionRemove activities targeting posts in communities they have no authority over, injecting content into or removing it from featured feeds without authorization. No public exploit has been identified and the issue is absent from CISA KEV; vendor-released patches are available in 0.19.19 and 1.0.0-alpha.20.
Missing moderator rank authorization in Lemmy's ActivityPub federation layer allows a lower-ranked remote moderator to forcibly remove a higher-ranked moderator from a community by sending a crafted signed Remove activity. Affected versions prior to 0.19.19 and 1.0.0-alpha.18 enforce hierarchy correctly in the local REST API via LocalUser::is_higher_mod_or_admin_check, but CollectionRemove::verify in the federation path skips this rank check entirely, trusting only that the actor holds some moderator role. An authenticated moderator on any federated remote instance can therefore subvert community governance on the victim instance without the local API's protections. No public exploit code has been identified at time of analysis, and patches are available in both stable and alpha release lines.
Private message block enforcement in Lemmy is bypassed by the edit path, allowing a blocked sender to keep modifying old messages visible to the recipient. All Lemmy instances running versions prior to 0.19.19 (stable) and 1.0.0-alpha.18 (alpha) are affected. An authenticated attacker who has been blocked by a recipient can repeatedly call the edit endpoint on any previously sent message, delivering new content and providing a post-block harassment channel - defeating the intent of Lemmy's block feature. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Broken access control in Wekan's Excel export REST endpoint exposes private board contents to any authenticated user, regardless of board membership. Wekan versions 9.57 through 9.73 failed to await the async authorization guard in models/exportExcel.js, causing the Promise return value to always evaluate as truthy and bypass the board.isVisibleBy(user) check entirely. Any authenticated user can enumerate and download card titles, descriptions, lists, swimlanes, members, and metadata from private boards they are not a member of via GET /api/boards/:boardId/exportExcel. A read-only proof-of-concept was confirmed by the reporter (sec-reex) through responsible disclosure; no KEV listing at time of analysis.
Incomplete assistant authorization in langgraph-api (LangGraph Server) versions before 0.10.0 allows an authenticated low-privileged user to bypass ownership controls during run creation and access private assistants belonging to other users. The flaw arises because the run-creation code path dispatched the wrong authorization event (`assistants.search` instead of `assistants.read`), causing custom auth handlers registered only for `assistants.read` to be silently bypassed, the ownership filter to be omitted from the database query, and sensitive assistant `metadata`, `config`, and `context` to be returned in plaintext via the API response. No public exploit code exists and the vendor reports no evidence of exploitation in the wild.
LangGraph Server (langgraph-api < 0.10.0) allows an authenticated user to bypass per-user authorization by specifying a relative webhook URL when creating a run or cron job, enabling cross-user thread access in multi-tenant deployments. The server's webhook delivery subsystem routes relative targets through an in-process loopback transport that the authentication middleware treats as internal and exempts from authentication, allowing the request to execute against another user's thread routes without the originating user's authorization context. No public exploit code exists and no active exploitation has been identified; the vendor explicitly states no evidence of this behavior occurring in the wild.
IBM Power Systems Firmware across four firmware release trains (FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80, and FW950.00-FW950.H2) exposes a missing authorization flaw (CWE-862) on the Flexible Service Processor (FSP) that allows an authenticated administrator to transition the managed POWER system into a persistent non-production operational mode, selectively disabling system components. Critically, this condition survives FSP resets and requires deliberate operator intervention to reverse, converting a single privileged action into a sustained denial-of-service against production workloads. IBM has released a patch; no public exploit code or active exploitation has been identified at time of analysis.
Horizontal privilege escalation in Snipe-IT prior to 8.6.3 allows any authenticated company user to read asset maintenance records - including purchase costs, supplier details, asset tags, and notes - without holding asset view or maintenance permissions. The root cause is a missing `authorize()` call in `MaintenancesController.php show()`, which the company-scoped route-model binding did not compensate for since it only blocks cross-company access, not intra-company unauthorized reads. No public exploit has been identified at time of analysis; vendor-released patch is available in version 8.6.3.
Authorization bypass in the Grav Flex Objects Plugin prior to version 1.4.3 permits an authenticated user holding only the api.access permission to invoke all admin API handlers - index, show, create, update, delete, export, and media - against any Flex Objects directory whose blueprint omits the config.admin.permissions field. The root cause is a logic inversion in requireFlexPermission() inside FlexApiController.php: when no blueprint permissions are defined, the original code iterated over an empty set and silently returned without throwing a ForbiddenException, bypassing the core admin.flex-object authorization fallback that would otherwise deny the same actions. No public exploit code or CISA KEV listing is identified at time of analysis; a vendor-released patch is available as version 1.4.3.
Elevation of privilege in Dell Command Update (DCU) versions prior to 5.7.1 allows a local low-privileged attacker to gain elevated permissions through an Incorrect Authorization flaw (CWE-863). The vulnerability does not require user interaction or special configuration beyond the presence of a low-privileged local account on a Dell system running a vulnerable DCU version. Dell has released a fix in version 5.7.1 via advisory DSA-2026-309, and no public exploit has been identified at time of analysis.
Insecure Direct Object Reference (IDOR) in J-BusinessDirectory versions below 6.2.3 allows unauthenticated remote attackers to access and modify business directory records belonging to other users across multiple frontend and API endpoints. The CVSS 4.0 vector (PR:N, AV:N, AC:L) confirms no authentication is required, meaning any internet-connected user can exploit the flaw against a default installation. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Unauthenticated listing ownership takeover in J-BusinessDirectory (a Joomla extension by cmsjunkie.com) prior to version 6.2.3 permits any remote unauthenticated attacker to claim ownership of business directory listings - including listings already owned by legitimate users - by supplying attacker-controlled company and user IDs in HTTP requests. The vulnerability stems from improper access control (CWE-284): the ownership-assignment action is not bound to an authenticated session nor restricted to unowned listings. Version 6.2.3 corrects both deficiencies. No public exploit code has been identified at time of analysis, and this CVE has not been added to the CISA KEV catalog.
Registration bypass and authentication bypass in Talebook (MyBooks) 3.41.2 and earlier allow an unauthenticated remote attacker to create accounts on instances where the administrator has disabled public registration, and then immediately authenticate with those unactivated accounts to access user-level API functionality. The root cause is a server-side enforcement gap: the POST /api/user/sign_up handler in user.py ignores the ALLOW_REGISTER configuration flag entirely, relying on the frontend to suppress the UI - a classic CWE-602 client-side enforcement failure. A second flaw in process_auth_header (base.py) compounds the issue by skipping verification of the account active flag, so the freshly created account can authenticate without email confirmation. No public exploit code or CISA KEV listing has been identified at time of analysis. The issue is fixed in version 3.42.0.
Missing authorization in phpMyFAQ before 4.1.7 exposes restricted FAQ child resources - comments and attachments - to unauthenticated network attackers via unguarded API endpoints. The system applies visibility restrictions to parent FAQ records but omits equivalent checks when those records' associated comments and attachments are queried directly, leaking comment text, commenter email addresses, and attachment filenames. No public exploit code has been identified at time of analysis, and it is not listed in CISA KEV; the CVSS 4.0 score of 6.9 reflects the network-accessible, zero-authentication nature of the flaw tempered by its limited, low-confidentiality impact.
Broken access control in phpMyFAQ before 4.1.7 exposes sensitive infrastructure configuration to any authenticated user, regardless of permission level. Admin API read endpoints for LDAP, Elasticsearch, OpenSearch, and dashboard configuration fail to enforce the CONFIGURATION_EDIT permission check, meaning a low-privileged account holder can retrieve LDAP server topology, bind account names, search bases, index statistics, and site analytics. No public exploit or CISA KEV listing exists at time of analysis, but the low attack complexity and broad exposure to all authenticated users make this a meaningful reconnaissance risk in environments with LDAP or Elastic integrations.
Registration restriction bypass in phpMyFAQ before v4.1.6 enables network attackers to create user accounts even when administrators have explicitly disabled self-registration via the security.enableRegistration configuration flag. The REST API endpoints POST /api/register and POST /api/v3.1/register lack the server-side authorization check present in the HTML registration page, creating a security control gap (CWE-862). No public exploit has been identified and the vulnerability is not listed in CISA KEV; however, the mechanically trivial nature of the bypass - a standard HTTP POST - makes it low-effort to abuse once an attacker identifies an exposed phpMyFAQ instance.
Authentication bypass in phpMyFAQ's SetupController prior to version 4.1.7 allows unauthenticated network attackers to invoke privileged database setup API endpoints whenever the application is in maintenance mode. By sending unauthenticated POST requests to /api/setup/update-database and /api/setup/backup, an attacker can execute database schema migrations, toggle maintenance mode off, and retrieve plaintext database credentials bundled inside a generated ZIP archive. No public exploit has been identified at time of analysis, but the concrete endpoint paths and trivial HTTP-based trigger make independent rediscovery straightforward for any attacker monitoring a maintenance window.
Broken access control in the Taxi Booking Manager for WooCommerce WordPress plugin (versions prior to 2.0.8) enables attackers to perform unauthorized write operations against booking data or plugin configuration, resulting in high integrity impact with no confidentiality or availability loss. The flaw stems from missing authorization checks (CWE-862) on plugin endpoints, a class of vulnerability common in WooCommerce plugins where AJAX handlers or REST routes omit WordPress capability checks. No public exploit code or active exploitation has been identified at time of analysis, and the plugin's niche deployment base limits overall exposure, though the low attack complexity means exploitation is straightforward once a vulnerable installation is located.
Unauthenticated access to REST API routes in the Membership For WooCommerce WordPress plugin (all versions before 3.1.2) exposes any user's membership plan details due to a broken authentication pre-check. The plugin compares a supplied consumer secret against one that was never generated, meaning the authentication gate collapses entirely on sites where the API is enabled but no consumer key pairs have been created. No public exploit identified at time of analysis; EPSS at the 6th percentile confirms exploitation remains theoretical, though the attack path is trivially simple once the prerequisite configuration is confirmed.
Authenticated patient-level users in KiviCare WordPress plugin before 4.5.4 can download any file from the media library - including other patients' confidential medical reports - by exploiting a missing ownership verification on media file access (CWE-639 IDOR). The CVSS vector (PR:L, C:H, AV:N) confirms that any registered patient with network access can enumerate and retrieve arbitrary media objects without elevated privileges. No active exploitation is confirmed (EPSS 0.14%, no CISA KEV listing), but the exposure of protected health information creates significant regulatory liability under frameworks such as HIPAA and GDPR that the moderate CVSS score of 6.5 does not fully capture.
Insecure Direct Object Reference in the KiviCare WordPress plugin before 4.5.4 allows authenticated patient-level users to cancel or reschedule appointments belonging to other patients. The plugin fails to verify ownership of the appointment resource before permitting modification, enabling horizontal privilege escalation between patient accounts. No public exploit has been identified at time of analysis, and EPSS places exploitation probability at the 4th percentile.
Unauthenticated deletion of arbitrary appointment, booking, and payment records is possible in the TrueBooker WordPress plugin before version 1.2.7 due to a missing authorization check in an AJAX action handler. Any remote visitor - with no account or credentials - can target and permanently destroy booking data across the entire installation. No public exploit has been identified at time of analysis, and EPSS sits at 0.15% (4th percentile), consistent with the niche deployment footprint of this plugin; however, SSVC flags the attack as automatable, meaning mass-deletion of records across vulnerable sites via scripted requests is technically feasible.
TrueBooker WordPress plugin versions before 1.2.7 allows fully unauthenticated remote users to manipulate arbitrary appointment statuses and trigger notification emails to affected customers through an unprotected AJAX action. The CVSS vector (PR:N/AC:L/AV:N) confirms zero authentication or configuration prerequisites, making every active installation of the plugin a viable target. No public exploit has been identified at time of analysis, and the EPSS score of 0.15% at the 4th percentile indicates very low observed exploitation activity, consistent with the niche footprint of this specific booking plugin.
WP Maps WordPress plugin before version 4.9.8 allows any subscriber-level authenticated user to create an unlimited number of persistent database options via an unprotected AJAX endpoint lacking both capability checks and nonce validation. Because WordPress loads all options on every page request, mass option creation degrades site performance site-wide, yielding both integrity and availability impact. No public exploit has been identified and EPSS stands at 0.14% (4th percentile), indicating low real-world exploitation probability at this time.
Missing capability checks on two AJAX actions in the SmartCrawl SEO WordPress plugin (before 3.16.3) expose private and draft post titles and post-meta key names to any authenticated Subscriber-level user. The CVSS score of 4.3 (Medium) accurately reflects the constrained impact: exploitation requires a valid site account, and the disclosed data is limited to content metadata rather than full post bodies or credentials. No public exploit or CISA KEV listing exists at time of analysis, and EPSS of 0.14% (4th percentile) confirms negligible current exploitation interest.
Unauthenticated financial data exposure in the YayCurrency WordPress plugin (all versions before 3.3.5) allows any remote attacker to enumerate store order totals, vendor earnings, balance ledgers, and withdrawal histories without credentials. The vulnerability stems from missing capability and ownership checks on multiple multi-vendor integration REST or AJAX handlers, which are fully reachable by unauthenticated users. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, but the automatable nature of the attack - iterating numeric identifiers - makes mass enumeration trivially scriptable.
Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 exposes quiz email-notification and results-page configurations to unauthorized lateral reading by any authenticated contributor-level user on the same WordPress installation. The missing per-object ownership check on QSM REST API routes (CWE-639 IDOR) allows a contributor to query configuration data, including notification recipient email addresses, for quizzes created by other site users. No public exploit has been identified and SSVC classifies exploitation status as none, but the flaw represents a meaningful privacy control gap in multi-author WordPress environments where quiz surveys may collect sensitive respondent data.
Improper per-object authorization in the Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 permits any contributor-level (or higher) authenticated user to overwrite the front-end text settings of quizzes owned by other users. The flaw stems from a missing ownership check on the save action for quiz front-end text settings, meaning a contributor on a multi-author site can silently tamper with quiz content they did not create. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog; however, a vendor patch is available and should be applied promptly on any multi-author WordPress deployment running QSM.
Insecure direct object reference in WCFM Marketplace WordPress plugin before 3.8.1 allows any authenticated vendor to unapprove or permanently delete reviews belonging to other vendors' storefronts. The plugin fails to verify review ownership before processing modification or deletion requests, meaning any low-privilege vendor account can manipulate competitor reviews by supplying arbitrary review IDs. No active exploitation has been confirmed (not in CISA KEV), no public exploit code has been identified, and the CVSS score of 4.3 reflects a moderate-severity, limited-integrity-impact issue.
Eventin WordPress plugin before 4.1.21 fails to verify record ownership before permitting schedule modifications or deletions, enabling any contributor-level (or higher) authenticated user to alter or destroy schedule entries belonging to other users. The flaw is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), an IDOR-class weakness where the plugin relies solely on a user-supplied record identifier without confirming the requesting user is the legitimate owner. No public exploit code has been identified at time of analysis, and a vendor-released patch is available in version 4.1.21.
Missing authorization in the Eventin WordPress plugin (versions before 4.1.21) permits any authenticated contributor-level user to overwrite other users' WordPress roles and metadata via the speaker creation feature, bypassing the platform's native capability enforcement. The vendor has released a patch in version 4.1.21 addressing the missing permission check. No public exploit code or active exploitation has been identified at time of analysis; however, the practical barrier to exploitation is lower than the published CVSS 2.7 score implies, because contributor accounts are commonly available on sites with open registration.
Incorrect authorization in FreeBSD's ZFS_IOC_SET_PROP ioctl allows any local unprivileged user to set the internal '$hasrecvd' metadata flag on ZFS datasets - a capability that should be restricted to privileged ZFS receive operations. Affected release lines span FreeBSD 14.3, 14.4, 15.0, and 15.1 prior to their respective patch levels, as confirmed by FreeBSD Security Advisory FreeBSD-SA-26:40.zfs. No public exploit code exists and EPSS probability is 0.18% (8th percentile), indicating very low real-world exploitation pressure; no confirmed active exploitation or CISA KEV listing applies.
Improper authorization in the PPWP - Password Protect Pages WordPress plugin (all versions ≤1.9.15) allows authenticated Contributor-level users to invoke the vulnerable `can_access` function, retrieve the site's master password, and bypass protection on any password-gated page, post, or partial content. The CVSS vector (PR:L) confirms exploitation requires at minimum a valid WordPress account with Contributor privileges, limiting but not eliminating real-world risk given that Contributor accounts are often granted to guest authors or untrusted parties. No active exploitation confirmed (not listed in CISA KEV); no public exploit code status confirmed from available data.
Secure boot bypass in Ingenic T41, T32, T40, and A1 SoC boot ROMs allows an attacker with physical write access to boot media to permanently disable secure boot enforcement and execute unsigned or modified firmware. The boot ROM's init table parser applies full 32-bit SRAM write operations from the SPL header before evaluating the secure boot state or invoking signature verification - an ordering flaw that permits an attacker-crafted init-table entry to corrupt the SRAM-resident flag that governs the verification decision. No public exploit identified at time of analysis, though the opensensor.io research disclosure constitutes detailed technical findings including hardware-validated proof of concept on a T41 device with secure boot provisioned; because the flaw resides in mask ROM, no firmware patch is possible for hardware already in the field.
Missing authorization in the B2BKing WordPress/WooCommerce plugin (versions through 5.2.30) allows authenticated low-privilege users to exploit incorrectly configured access control security levels, potentially accessing B2B wholesale pricing tiers, customer group data, or restricted functionality reserved for higher-privilege roles. Reported by Patchstack's audit team under ENISA EUVD-2026-62211, this broken access control flaw (CWE-862) carries a CVSS 5.4 Medium score. No public exploit code or CISA KEV listing is identified at time of analysis, limiting immediate threat urgency.
Site isolation bypass in Google Chrome prior to 151.0.7922.169 enables a renderer-compromised attacker to cross origin boundaries via a flawed CORS implementation, reading or modifying data from otherwise isolated sites. This is a chained exploitation scenario: it requires a preceding renderer compromise as a prerequisite, making it a sandbox-escape-class vulnerability rather than a standalone browser attack. No public exploit code or active exploitation has been identified at the time of analysis, and a vendor patch is available in the 151.0.7922.169 stable channel release.
Partial denial of service in Oracle Helidon 4.5.3 is reachable by unauthenticated network attackers over HTTP, targeting the Imperative Web Server component within Oracle Fusion Middleware. Successful exploitation degrades availability without compromising confidentiality or integrity. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS score of 5.3 (Medium) reflects a bounded, availability-only impact.
Integrity compromise in Oracle Helidon 1.4.20's Imperative Web Server component enables unauthenticated remote attackers to perform limited unauthorized data modifications via HTTP under high-complexity conditions. The vulnerability, tagged as an authentication bypass, allows circumvention of access controls to execute unauthorized update, insert, or delete operations on Helidon-accessible data without requiring credentials or user interaction. No public exploit code has been identified and no active exploitation is confirmed; the CVSS 3.7 Low score combined with high attack complexity (AC:H) significantly constrain real-world risk.
Unauthorized data access in Oracle Helidon 3.2.18's Imperative Web Server component allows low-privileged network attackers to read a subset of accessible data and perform unauthorized insert, update, or delete operations via HTTP. Tagged as an authentication bypass by Oracle, the flaw presents a moderate but concrete integrity and confidentiality risk for organizations running this specific microservice framework version. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the low attack complexity and no user interaction requirement lower the barrier for exploitation by any authenticated user.
Unauthenticated remote exploitation of Oracle Helidon 4.5.0's Imperative Web Server component allows attackers with HTTP network access to read a subset of application-accessible data and trigger partial denial of service conditions. The CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L vector confirms low-complexity, zero-authentication exploitation with no user interaction required. No public exploit code or CISA KEV listing has been identified at time of analysis; this issue was disclosed through Oracle's Critical Security Patch Update for August 2026 (EUVD-2026-62158).
Unauthorized data access in Oracle Helidon 4.5.0's Imperative Web Server component allows low-privileged network attackers to read a subset of accessible data and perform unauthorized insert, update, or delete operations via HTTP. Tagged as an Authentication Bypass by Oracle Security, the flaw is rated Medium (CVSS 5.4) with low attack complexity, meaning any attacker holding even minimal credentials can trivially exploit it without user interaction. No public exploit code or CISA KEV listing is associated at time of analysis, though the straightforward exploitation conditions make this a credible threat in multi-tenant or shared-access Helidon deployments.
Unauthorized data access and manipulation in Oracle Helidon 4.5.0's Imperative Web Server allows low-privileged network attackers to read restricted data and perform unauthorized insert, update, or delete operations via HTTP. Tagged as an authentication bypass, the flaw enables authenticated users to exceed their intended authorization scope within the Helidon application. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog at time of analysis, though Oracle's August 2026 Critical Patch Update confirms the issue.
Unauthorized read access to data in Oracle Helidon 4.5.1's Imperative Web Server component is achievable by unauthenticated network attackers via HTTP, exploiting what the vendor tags as an authentication bypass condition. The affected version is precisely 4.5.1 of Oracle's Java microservices framework, and the vulnerability exposes a subset of data accessible to the server without requiring any credentials or user interaction. No public exploit has been identified at time of analysis, and Oracle has disclosed this issue as part of its August 2026 Critical Patch Update.
Authentication bypass in Oracle Helidon 3.2.19 Imperative Web Server exposes critical data to unauthenticated network attackers via HTTP. The flaw, tagged as an Authentication Bypass by the reporter, allows a remote attacker without credentials to gain complete read access to all data accessible by the Helidon server instance. No public exploit code or active exploitation has been identified at time of analysis; however, the high confidentiality impact warrants timely patching in any environment running this specific version.
The Imperative Web Server in Oracle Helidon 4.5.0 exposes an authentication bypass that permits remote unauthenticated HTTP attackers to read a subset of application-accessible data. Tagged by Oracle CSIRT as an authentication bypass and disclosed in the August 2026 Critical Patch Update, the flaw carries a CVSS 5.3 Medium score with network-accessible, zero-complexity exploitation conditions - conditions that may understate practical risk given the complete absence of authentication prerequisites. No active exploitation has been confirmed via CISA KEV, and no public exploit code was identified at time of analysis.
Unauthorized data access and modification is possible in Oracle Helidon 4.5.1 via a flaw in its Imperative Web Server component, classified under the Authentication Bypass tag. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms that unauthenticated remote attackers can exploit this over HTTP with no user interaction and low attack complexity. Successful exploitation results in partial confidentiality and integrity compromise of Helidon-accessible data; no patch version has been independently confirmed beyond the Oracle August 2026 CPU advisory.
Unauthorized data access in Oracle Helidon 4.5.1's Imperative Web Server component allows unauthenticated network-based attackers to read a subset of Helidon-accessible data and perform unauthorized insert, update, or delete operations against the same data store. The 'Authentication Bypass' tag in the intelligence feeds indicates the underlying mechanism circumvents expected access controls on HTTP endpoints. With AC:H, exploitation is non-trivial - specific conditions must be met - and no active exploitation has been identified; however, the unauthenticated network vector warrants patching in production deployments.
Unauthorized read access to application data is achievable against Oracle Helidon 4.5.1's Imperative Web Server component via unauthenticated HTTP requests. The vulnerability, tagged as an Authentication Bypass, allows remote attackers with network access to retrieve a subset of data without credentials, as confirmed by the CVSS vector (AV:N/AC:L/PR:N/UI:N). No public exploit has been identified at time of analysis, and the issue is addressed in Oracle's Critical Patch Update for August 2026.
Unauthorized data read in Oracle Helidon 3.2.19's Imperative Web Server component allows unauthenticated remote attackers to access a subset of protected application data via HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial network-level exploitation with no credentials or user interaction required, consistent with the intelligence tag of Authentication Bypass. Impact is bounded to confidentiality only (C:L, I:N, A:N), suggesting an access control bypass that exposes a partial data view rather than full system compromise. No public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-site scripting or client-side injection in Oracle Helidon 4.5.0's Imperative Web Server component enables unauthenticated, network-accessible attacks that produce partial confidentiality and integrity impacts while extending harm to additional products through a scope change. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) is the canonical fingerprint of reflected or stored XSS - an attacker delivers a crafted HTTP payload that, once interacted with by a victim user, executes within a different security scope such as a browser session. No public exploit code has been identified and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog; Oracle disclosed it through the August 2026 Critical Patch Update.
Unauthenticated remote exploitation of Oracle Helidon 4.1.0's Imperative Web Server component allows network-accessible attackers to bypass authentication controls via HTTP, resulting in unauthorized partial read and write access to application data. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is trivially exploitable with no prerequisites beyond network reachability, and the 'Authentication Bypass' tag corroborates an access-control failure in the web server layer. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low complexity and zero-authentication requirement make this an attractive target for automated scanning.
Remote unauthenticated exploitation of Oracle Helidon 4.5.0's Imperative Web Server component via HTTP/2 permits partial data disclosure and partial denial of service without any credentials or user interaction. Oracle's own advisory characterizes this as 'easily exploitable', and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms zero-prerequisite network reachability. No public exploit code or CISA KEV listing has been identified at time of analysis, and impact is bounded to partial confidentiality and availability degradation rather than full system compromise.
Unauthorized data exposure in Oracle Helidon 3.2.18's Imperative Web Server component allows unauthenticated network attackers to read a subset of application-accessible data via HTTP. Tagged as an authentication bypass, the vulnerability is trivially exploitable with no complexity barriers - any attacker with HTTP access to the service can trigger it. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and impact is constrained to partial confidentiality loss with no integrity or availability consequences.
Unauthenticated remote exploitation of Oracle Helidon 4.5.0's Imperative Web Server component allows network-adjacent attackers to bypass authentication and perform unauthorized read and write operations on application data over HTTP. Tagged explicitly as an Authentication Bypass by Oracle's security team, this vulnerability exposes a subset of Helidon-accessible data to disclosure and tampering without requiring credentials or user interaction. No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV, but the low attack complexity and zero-privilege requirement make it a straightforward target for automated scanning.
Unauthorized data access in Oracle Helidon 4.5.0's Imperative Web Server component allows unauthenticated network attackers to read a subset of application-accessible data and perform unauthorized insert, update, or delete operations via HTTP. The vulnerability, tagged as an Authentication Bypass by Oracle, is remotely exploitable without credentials or user interaction against the affected version. No public exploit code or active exploitation has been identified at time of analysis, though the low attack complexity and absence of authentication requirements make this straightforward to exploit once a target instance is identified.
Unauthorized data exposure in Oracle Helidon 4.5.0's Imperative Web Server component allows unauthenticated remote attackers to read a subset of application-accessible data via HTTP. The vulnerability is tagged as an authentication bypass, meaning protections that should gate read access can be circumvented without credentials. No public exploit code has been identified at time of analysis, and it has not been listed in the CISA KEV catalog, though Oracle disclosed this via their August 2026 Critical Patch Update (CPU).
Unauthorized data exposure in Oracle Helidon 4.5.0's Imperative Web Server enables unauthenticated remote attackers to read a subset of application-accessible data via HTTP, confirmed by Oracle's August 2026 Critical Patch Update. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivially exploitable, zero-complexity network access requiring no authentication or user interaction. No public exploit has been identified at time of analysis, though the 'Authentication Bypass' tag from multi-source intelligence indicates a structural access control failure in the HTTP request handling pipeline.
Authentication bypass in Oracle Helidon 4.5.0's Imperative Web Server component allows a low-privileged, network-adjacent attacker to read unauthorized data subsets and perform unauthorized insert, update, or delete operations via HTTP. Rated CVSS 5.4 Medium with low attack complexity and no user interaction required, this flaw is tagged as an authentication bypass by multi-source intelligence, suggesting a low-privileged user can exceed their authorized scope within the Helidon web layer. No public exploit code or CISA KEV listing has been identified at time of analysis.
Local high-privilege information disclosure in Oracle Helidon 4.5.1's Imperative Web Server component allows an attacker with OS-level logon access to the hosting infrastructure to read all data accessible to the Helidon process. The CVSS vector (AV:L/AC:L/PR:H) confirms exploitation is constrained to local infrastructure access with elevated credentials, resulting in complete confidentiality loss (C:H) with no integrity or availability impact. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.
Authentication bypass in Helidon 3.2.18's Imperative Web Server component allows unauthenticated remote attackers to read a subset of data accessible within the Helidon service over HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is trivially exploitable from any network location against default deployments without credentials. Impact is limited to partial confidentiality loss (C:L) with no integrity or availability consequence, though the 'Authentication Bypass' tag suggests access-control logic failures that may expose protected endpoints. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthorized data access in Oracle Helidon 4.5.0's Imperative Web Server component allows a low-privileged, network-authenticated attacker to read a subset of accessible data and perform unauthorized insert, update, or delete operations via HTTP. The vulnerability is tagged as an authentication bypass, suggesting that existing access controls within the Imperative Web Server can be circumvented by an attacker who holds any valid low-privilege credential. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Authentication bypass in Oracle Helidon 3.2.18's Imperative Web Server component allows low-privileged network attackers to read a subset of accessible data and perform unauthorized write, insert, or delete operations. Exploitation via HTTP requires high attack complexity and at least low-level authentication, limiting opportunistic mass exploitation. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthorized data disclosure in Oracle Helidon 4.5.0 affects the Imperative Web Server component, enabling unauthenticated network attackers to read a subset of accessible application data via HTTP. Tagged as an authentication bypass, the flaw requires no privileges or user interaction, making it trivially reachable from any network vantage point. No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog at time of analysis, though its zero-authentication, low-complexity profile warrants timely patching in network-exposed deployments.
Unauthorized data read in Oracle Helidon 3.2.18 allows unauthenticated remote attackers to access a subset of data served by the Imperative Web Server component over HTTP, with no credentials or user interaction required. Tagged as an Authentication Bypass by Oracle CERT, the flaw is classified as 'easily exploitable' in Oracle's August 2026 Critical Patch Update advisory. No public exploit code or active exploitation has been identified at time of analysis, but the absence of any authentication prerequisite lowers the bar for opportunistic reconnaissance.
Cross-site scripting or authentication bypass in Oracle Helidon 4.1 Imperative Web Server (version 4.5.0) allows unauthenticated remote attackers to perform unauthorized read and write operations against Helidon-accessible data, with scope change extending impact to additional dependent products. Exploitation requires victim interaction, consistent with a reflected XSS or similar client-side injection pattern in the HTTP server component. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-privilege requirement make this accessible to unsophisticated attackers once a victim is lured.
Cross-site scripting or equivalent client-side injection in Oracle Helidon 3.2.18's Imperative Web Server component allows unauthenticated remote attackers to compromise confidentiality and integrity of Helidon-accessible data when a victim user interacts with attacker-controlled content. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) is a canonical XSS fingerprint - scope change combined with user interaction and partial C/I impact - despite the 'Authentication Bypass' tag in the intelligence metadata, which may indicate a secondary or misclassified characteristic. No public exploit code or CISA KEV listing has been identified at time of analysis.
Authentication bypass in Oracle Helidon 4.5.0's Imperative Web Server component exposes HTTP endpoints to unauthenticated network attackers, enabling unauthorized read access to a subset of application data and unauthorized write, insert, or delete operations on accessible data. The flaw, tagged as an Authentication Bypass by Oracle and reported via the August 2026 Critical Patch Update, is reachable by any attacker with HTTP connectivity to the service with no complexity barriers. No public exploit code has been identified and the vulnerability is not currently listed in CISA KEV, but the zero-authentication network attack vector warrants prompt patching of affected Helidon 4.5.0 deployments.
Unauthenticated network exploitation of Oracle Helidon 3.2.18's Imperative Web Server component allows remote attackers to bypass authentication controls, gaining unauthorized read access to a subset of application data and unauthorized write/insert/delete capability against some accessible data. Tagged as an authentication bypass by Oracle Security (secalert_us@oracle.com), the vulnerability requires no privileges and no user interaction, making it trivially automatable over HTTP. No public exploit code or CISA KEV listing has been identified at time of analysis, though Oracle has disclosed this via their August 2026 Critical Patch Update.
Unauthorized data access in Oracle Helidon 3.2.18 (Imperative Web Server component) allows a low-privileged, network-adjacent attacker to read a subset of accessible data and perform unauthorized insert, update, or delete operations via HTTP. Tagged as an authentication bypass, the flaw enables privilege escalation beyond the attacker's authorized scope within the web server layer. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS data was not provided in source intelligence.
Authentication bypass in Oracle Helidon 3.2.18's Imperative Web Server component exposes sensitive application data to unauthenticated network attackers over HTTP. Successful exploitation yields complete read access to all Helidon-accessible data and limited write capability (insert, update, delete), with no availability impact. No active exploitation or public proof-of-concept code has been identified at time of analysis, and the high attack complexity rating tempers immediate mass-exploitation risk, though the confidentiality impact warrants prompt patching for internet-exposed deployments.
Helidon 3.2.18's Imperative Web Server component exposes an unauthenticated, network-accessible denial-of-service condition via HTTP that allows remote attackers to partially degrade service availability without any credentials or user interaction. Only the Availability dimension is affected - Confidentiality and Integrity remain intact - classifying this as a medium-severity partial DoS. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this in a lower operational priority tier despite its trivial exploitation conditions.
Unauthorized data read in Oracle Helidon 4.5.0's Imperative Web Server component exposes a subset of server-accessible data to unauthenticated remote attackers over HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is trivially exploitable without credentials, and the 'Authentication Bypass' tag from intelligence sources suggests access controls within the Imperative Web Server are being circumvented rather than simply an information leak. No active exploitation is confirmed in CISA KEV and no public exploit code has been identified at time of analysis.
Unauthenticated remote data modification is possible in Oracle Helidon 3.2.19 via its Imperative Web Server component, exploitable over HTTP with no credentials or user interaction required. Successful exploitation allows an attacker to perform unauthorized insert, update, or delete operations on data accessible to the Helidon instance, with no confidentiality or availability impact. No public exploit code or active exploitation has been identified at time of analysis.
Local exploitation of Oracle Helidon 4.5.0's Imperative Web Server component enables a low-privileged attacker with infrastructure logon to bypass authentication controls and gain unauthorized access to all data accessible by the Helidon process, with limited write capability. Confirmed by Oracle's Critical Patch Update for August 2026 and corroborated by EUVD-2026-62096, this carries a CVSS 3.1 score of 6.1. No public exploit code or active exploitation has been identified at time of analysis.
Oracle VM VirtualBox 7.2.14 Core component allows a low-privileged local attacker to read critical data, with the impact scope extending beyond the VirtualBox instance itself - potentially exposing host system or cross-VM sensitive data. Exploitation is constrained by high attack complexity and mandatory local access, making mass exploitation impractical; targeted insider or post-compromise scenarios represent the realistic threat model. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; the official Oracle CPU advisory for August 2026 is the authoritative source.
Oracle Hyperion Financial Management version 11.2.25.0.000 exposes a local privilege-assisted attack in its Security component, allowing a low-privileged authenticated user who can log on to the host infrastructure to partially compromise confidentiality, integrity, and availability. The attack demands high complexity and requires interaction from a secondary human actor, placing it firmly in the category of difficult, opportunistic local exploitation. No public exploit code or active exploitation has been identified at time of analysis; the vulnerability was disclosed by Oracle via the August 2026 Critical Security Patch Update.
Unauthenticated read-access exposure in Oracle Hyperion Financial Management 11.2.25.0.000 allows remote attackers to retrieve a subset of application data via HTTP without any credentials. The flaw resides in the Security component and is tagged as an Authentication Bypass, meaning the component fails to enforce proper access controls on at least one HTTP-accessible endpoint. No public exploit code or confirmed active exploitation has been identified at time of analysis, though the trivial attack conditions (AC:L/PR:N/UI:N) lower the bar for opportunistic reconnaissance.
Partial integrity and availability compromise in Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a remote, unauthenticated attacker over HTTP, provided high attack complexity conditions are met and a victim user interacts during the attack. Successful exploitation allows unauthorized modification or deletion of a subset of accessible data and can cause a partial denial of service. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Oracle Hyperion Financial Management version 11.2.25.0.000 exposes a local availability vulnerability in its Security component, allowing a high-privileged attacker already logged on to the host infrastructure to cause a partial denial of service. The attack is difficult to execute, requires existing elevated local access, and results only in limited availability degradation with no confidentiality or integrity impact. No public exploit or active exploitation has been identified; CVSS 3.1 Base Score is 1.9, placing this among the lowest-severity tracked vulnerabilities.
Oracle Hyperion Financial Management version 11.2.25.0.000 exposes a network-accessible vulnerability in its Security component that allows a low-privileged, authenticated attacker to partially compromise data confidentiality and integrity across product boundaries via HTTP. Exploitation requires both high attack complexity and victim interaction, limiting opportunistic exploitation but not eliminating targeted risk in enterprise financial environments. No public exploit code has been identified at time of analysis, and the vulnerability is tagged as an Authentication Bypass by the reporting source, suggesting the Security component may fail to enforce authorization boundaries under specific conditions.
Local privilege abuse in Oracle Hyperion Financial Management 11.2.25.0.000 allows a high-privileged attacker with logon access to the host infrastructure to read a subset of accessible data and perform unauthorized insert, update, or delete operations against that data. The vulnerability resides in the Security component and carries a CVSS 3.1 base score of 3.0, reflecting its constrained local attack vector, high complexity, and high privilege prerequisites. No public exploit code has been identified and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at time of analysis.
Oracle VM VirtualBox 7.2.14 (Core component) exposes a low-severity local vulnerability that permits a high-privileged attacker with logon access to the host infrastructure to perform unauthorized read and limited write operations against a subset of VirtualBox-accessible data. Confidentiality and integrity are partially affected; availability is not impacted. No public exploit has been identified at time of analysis, and the combination of local-only attack vector and required high-privilege access significantly narrows the realistic attacker population.
Denial-of-service in Oracle VM VirtualBox 7.2.14 Core component allows a high-privileged local attacker to repeatably crash or hang the hypervisor, taking down all hosted virtual machines. Exploitation requires high-privilege local logon access to the host, and Oracle's August 2026 CPU includes a fix. No public exploit code and no CISA KEV listing have been identified, keeping real-world risk limited despite the "easily exploitable" descriptor used by Oracle.
Oracle VM VirtualBox 7.2.14 contains a local privilege-escalation-to-DoS flaw in the Core component that allows a highly privileged host user to repeatedly crash or hang the hypervisor, with scope change meaning hosted guest VMs are also disrupted. The attack requires local logon and high privileges on the host infrastructure, substantially limiting the attacker pool to insiders or already-compromised privileged accounts. No public exploit code or active exploitation has been identified at time of analysis; EPSS data was not provided.