Essbase
Monthly
Remote unauthenticated takeover of Oracle Essbase 21.8.3.0.0 is possible through the TCP-exposed Security component, with CVSS 3.1 scoring 9.8 and high confidentiality, integrity, and availability impact. Exploitation needs only network reachability to the affected service, no credentials, and no user interaction, so internet-facing or broadly reachable Essbase deployments carry the greatest risk. No public exploit code or CISA KEV entry was identified in the supplied intelligence at time of analysis.
Low-privileged authenticated users of Oracle Essbase 21.8.3.0.0 can reach beyond their assigned privilege boundary through the Security component over HTTP and read critical data they should not be able to see, including data exposed in downstream products because the vulnerability crosses a security scope boundary. Oracle scores this 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N): confidentiality-only, with no integrity or availability impact, and exploitation requires a valid low-privileged account rather than being unauthenticated. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, so risk is concentrated in internet- or network-reachable Essbase deployments where low-level credentials are broadly distributed.
Oracle Essbase 21.8.3.0.0 exposes an HTTP-reachable Security component flaw that unauthenticated remote attackers can use to read a subset of data, modify or delete some records, and partially disrupt availability. CVSS 3.1 rates it 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), with no public exploit identified at time of analysis. The practical risk is highest where Essbase HTTP services are reachable from untrusted networks, because no authentication, user interaction, or special conditions are required.
Complete takeover of Oracle Essbase 21.8.1.0.0 is possible by an unauthenticated remote attacker over HTTP, per Oracle's August 2026 Critical Patch Update. Oracle rates it CVSS 9.8 with full confidentiality, integrity, and availability impact and flags it as 'easily exploitable,' meaning no authentication, no user interaction, and low attack complexity are required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the combination of network reach and unauthenticated takeover makes it a high-priority patch candidate.
Full system takeover in Oracle Essbase 21.8.1.0.0 is achievable by any low-privileged authenticated user with network access via HTTP, targeting the Calculator component. The CVSS 3.1 score of 8.8 reflects complete impact across confidentiality, integrity, and availability (C:H/I:H/A:H), consistent with Oracle's own classification of this as 'easily exploitable.' No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and network vector make this a credible and accessible exploitation path for any valid account holder.
Improper access control in Oracle Essbase Web Platform 21.7.3.0.0 lets a low-privileged authenticated user with network HTTP access read and modify all Essbase-accessible data, including critical data, while availability is unaffected. The flaw has a CVSS 3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) and a low EPSS of about 0.27% (18th percentile). No public exploit code or CISA KEV entry was identified at time of analysis, and exploitation requires a valid low-privilege account on a network-exposed Essbase Web Platform.
Vulnerability in Oracle Essbase (component: Security and Provisioning). Rated low severity (CVSS 2.2), this vulnerability is remotely exploitable.
Vulnerability in Oracle Essbase (component: Security and Provisioning). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Vulnerability in Oracle Essbase (component: Security and Provisioning). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Vulnerability in Oracle Essbase (component: Security and Provisioning). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, no authentication required. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.
In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Buffer Copy without Size Check vulnerability could allow attackers to overflow a buffer to corrupt adjacent memory.
curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET. Rated low severity (CVSS 3.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
mod_auth_openidc 2.4.0 to 2.4.7 allows a remote attacker to cause a denial-of-service (DoS) condition via unspecified vectors. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
curl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicious HTTPS proxy to MITM a connection due to bad handling of TLS 1.3 session tickets. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Actor" by leaking credentials in the HTTP Referer: header. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. This NULL Pointer Dereference vulnerability could allow attackers to crash the application by dereferencing a null pointer.
The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. This NULL Pointer Dereference vulnerability could allow attackers to crash the application by dereferencing a null pointer.
curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable, no authentication required. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
The X.509 GeneralName type is a generic type for representing different types of names. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. This NULL Pointer Dereference vulnerability could allow attackers to crash the application by dereferencing a null pointer.
This affects the package codemirror before 5.58.2; the package org.apache.marmotta.webjars:codemirror before 5.58.2. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Remote unauthenticated takeover of Oracle Essbase 21.8.3.0.0 is possible through the TCP-exposed Security component, with CVSS 3.1 scoring 9.8 and high confidentiality, integrity, and availability impact. Exploitation needs only network reachability to the affected service, no credentials, and no user interaction, so internet-facing or broadly reachable Essbase deployments carry the greatest risk. No public exploit code or CISA KEV entry was identified in the supplied intelligence at time of analysis.
Low-privileged authenticated users of Oracle Essbase 21.8.3.0.0 can reach beyond their assigned privilege boundary through the Security component over HTTP and read critical data they should not be able to see, including data exposed in downstream products because the vulnerability crosses a security scope boundary. Oracle scores this 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N): confidentiality-only, with no integrity or availability impact, and exploitation requires a valid low-privileged account rather than being unauthenticated. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, so risk is concentrated in internet- or network-reachable Essbase deployments where low-level credentials are broadly distributed.
Oracle Essbase 21.8.3.0.0 exposes an HTTP-reachable Security component flaw that unauthenticated remote attackers can use to read a subset of data, modify or delete some records, and partially disrupt availability. CVSS 3.1 rates it 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), with no public exploit identified at time of analysis. The practical risk is highest where Essbase HTTP services are reachable from untrusted networks, because no authentication, user interaction, or special conditions are required.
Complete takeover of Oracle Essbase 21.8.1.0.0 is possible by an unauthenticated remote attacker over HTTP, per Oracle's August 2026 Critical Patch Update. Oracle rates it CVSS 9.8 with full confidentiality, integrity, and availability impact and flags it as 'easily exploitable,' meaning no authentication, no user interaction, and low attack complexity are required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the combination of network reach and unauthenticated takeover makes it a high-priority patch candidate.
Full system takeover in Oracle Essbase 21.8.1.0.0 is achievable by any low-privileged authenticated user with network access via HTTP, targeting the Calculator component. The CVSS 3.1 score of 8.8 reflects complete impact across confidentiality, integrity, and availability (C:H/I:H/A:H), consistent with Oracle's own classification of this as 'easily exploitable.' No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and network vector make this a credible and accessible exploitation path for any valid account holder.
Improper access control in Oracle Essbase Web Platform 21.7.3.0.0 lets a low-privileged authenticated user with network HTTP access read and modify all Essbase-accessible data, including critical data, while availability is unaffected. The flaw has a CVSS 3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) and a low EPSS of about 0.27% (18th percentile). No public exploit code or CISA KEV entry was identified at time of analysis, and exploitation requires a valid low-privilege account on a network-exposed Essbase Web Platform.
Vulnerability in Oracle Essbase (component: Security and Provisioning). Rated low severity (CVSS 2.2), this vulnerability is remotely exploitable.
Vulnerability in Oracle Essbase (component: Security and Provisioning). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Vulnerability in Oracle Essbase (component: Security and Provisioning). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Vulnerability in Oracle Essbase (component: Security and Provisioning). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, no authentication required. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.
In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Buffer Copy without Size Check vulnerability could allow attackers to overflow a buffer to corrupt adjacent memory.
curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET. Rated low severity (CVSS 3.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
mod_auth_openidc 2.4.0 to 2.4.7 allows a remote attacker to cause a denial-of-service (DoS) condition via unspecified vectors. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
curl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicious HTTPS proxy to MITM a connection due to bad handling of TLS 1.3 session tickets. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Actor" by leaking credentials in the HTTP Referer: header. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. This NULL Pointer Dereference vulnerability could allow attackers to crash the application by dereferencing a null pointer.
The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. This NULL Pointer Dereference vulnerability could allow attackers to crash the application by dereferencing a null pointer.
curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable, no authentication required. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
The X.509 GeneralName type is a generic type for representing different types of names. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. This NULL Pointer Dereference vulnerability could allow attackers to crash the application by dereferencing a null pointer.
This affects the package codemirror before 5.58.2; the package org.apache.marmotta.webjars:codemirror before 5.58.2. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.