Oracle
Monthly
Password hash extraction from any Dolibarr 24.0.0 user account, including administrators, is possible for authenticated low-privileged users via a case-sensitivity mismatch in the sqlfilters API parameter denylist. The PHP guard in dolForgeSQLCriteriaCallback() performs case-sensitive string matching against forbidden field names, while the underlying database resolves column names case-insensitively, allowing bypasses using uppercase variants such as PASSWORD instead of password. By submitting prefix-matching predicates as boolean oracle queries, an attacker can extract full credential hashes character-by-character without elevated privileges. No public exploit code has been identified at time of analysis; a patch commit is available upstream.
Cross-tenant SQL injection in OpenPanel's analytics filter builder allows authenticated attackers with project-scoped read credentials to exfiltrate other organizations' analytics data and profile PII. Unvalidated `profile.*` filter column identifiers are interpolated directly into ClickHouse WHERE clauses, enabling blind boolean oracle attacks that bypass project isolation boundaries. No public exploit code has been identified at time of analysis, but the low authentication bar and confirmed cross-tenant scope change make this a genuine priority for any multi-tenant OpenPanel deployment.
Argument injection in GitPython 3.1.59's high-level diff API allows low-privileged remote attackers to read arbitrary filesystem paths by passing the unsanitized `--no-index` flag to the underlying git diff command. By chaining `--no-index` with the `-I`/`--ignore-matching-lines` regex filter, an attacker can construct a content-dependent Boolean oracle - issuing repeated queries that distinguish between regex match and mismatch responses to recover single-line secrets from local files. No active exploitation has been confirmed (not in CISA KEV), but the technique is deterministic and requires only authenticated API access. Patch-upgraded version 3.1.60 is available.
Unauthenticated account takeover in WWBN AVideo (through commit e01e41ecc) stems from get_api_preauthorize in plugin/API/API.php, a second, undocumented login path that performs the same credential check as get_api_signIn but omits the 10-attempts-per-5-minutes throttle enforced by checkRateLimit(). This lets remote attackers brute-force any account - including admin - without rate limiting, and the endpoint doubles as a credential oracle whose users_id field (1 vs 0) discloses password validity even though the message always reads 'Invalid credentials'. No public exploit identified at time of analysis, and no vendor-released patch is available.
Sensitive field disclosure in ash_lua (versions 0.1.0 through 0.2.0) allows any actor who can submit a Lua script to read Ash resource attributes that are deliberately excluded from the manifest's exposed-field allow-list - including sensitive?: true columns such as hashed passwords. The operation aggregate path in AshLua.Runtime resolved field names directly via String.to_existing_atom and Ash.Query.Aggregate.new! without invoking the same AshLua.Fields.for_action/4 allow-list check enforced by the normal field-read path, creating an alternate route to private data. Vendor patch 0.2.1 is confirmed available; no CISA KEV listing or independent exploit beyond the PoC embedded in the security advisory has been identified.
Unauthenticated arbitrary file read in the surya 0.22.1 screenshot server allows any network-reachable attacker to exfiltrate image and PDF files from the host filesystem by supplying attacker-controlled paths to three unprotected HTTP routes. The /info, /page, and /process endpoints pass raw file_path parameters directly to Pillow's Image.open and pypdfium2.PdfDocument, returning rendered file contents as base64-encoded HTTP responses. The /info route additionally acts as a file-existence oracle, enabling systematic enumeration of host paths before targeted exfiltration; no public exploit has been identified at time of analysis.
Unauthenticated SQL injection in WWBN AVideo's channels API endpoint allows remote attackers to extract password hashes and account recovery tokens without any credentials. The `sort` column parameter in `get.json.php?APIName=channels` is injected directly into a SQL ORDER BY clause unsanitized, enabling an ordering oracle attack to infer sensitive column values character-by-character and triggering verbose SQL errors that disclose the full query and database schema. No public exploit has been identified at time of analysis, though VulnCheck has independently reported this vulnerability with a GitHub Security Advisory published by the vendor.
Administrator account takeover in the Support Genix WordPress helpdesk plugin (all versions up to and including 1.4.52) is achievable by any subscriber-level user who can obtain a single guest ticket token, exploiting a catastrophically weak encryption key derivation that yields only ~19.5 bits of effective entropy. The `guest_ticket_login()` function at the publicly reachable `/sgnix/?p=<token>` endpoint lacks capability checks, nonce validation, and session controls, allowing an attacker to exhaustively recover the site-wide AES-256-CBC key offline across ~729,000 candidates and forge an admin-authentication token. No public exploit has been identified at time of analysis, but the attack is technically straightforward given the tiny keyspace, deterministic IV construction, and unauthenticated endpoint exposure.
Unauthenticated stream credential disclosure in AVideo (WWBN, commit e01e41ecc and earlier) lets remote attackers retrieve any user's restream stream_key and stream_url for external platforms like YouTube, Facebook, and Twitch. The getLiveKey.json.php endpoint accepts a 'token' parameter that bypasses both the Live::canRestream() access gate and the restream ownership check, and the token is merely AES-256-CBC encryptString() of an integer id with no user binding, expiry, or authentication tag. Because a public encryption oracle (view/url2Embed.json.php) lets anyone encrypt arbitrary values, valid tokens can be forged with no authentication; no public exploit is identified at time of analysis but the technique is fully described.
Blind SQL injection in WsgiDAV's MySQLBrowserProvider sample module (versions <= 4.3.4) allows unauthenticated network attackers to read arbitrary data from the backing MySQL database via URL path manipulation. The record key segment of the URL is concatenated directly into a WHERE clause without escaping, enabling a boolean status-code oracle that supports full character-by-character data extraction. A secondary typo in the numeric-type check (`INTT` instead of `INT`) ensures all primary key types take the vulnerable quoted branch, and a working PoC with complete extraction script has been publicly confirmed. No public exploit identified as confirmed actively exploited (CISA KEV), but the PoC lowers the exploitation bar significantly.
Unauthenticated content exfiltration in Trilium up to 0.103.0 is possible through the public share-search endpoint, which applies authorization only to the ancestor note supplied in the request rather than to each result it returns. Any visitor with HTTP access to the instance can query `/share/api/notes` to enumerate titles, tree paths, and share identifiers of notes protected by `shareCredentials` passwords or hidden via `shareHiddenFromTree`, and can use the endpoint as a boolean substring oracle to iteratively reconstruct the full plaintext of password-gated notes. No public exploit has been identified at time of analysis, and the issue is patched in version 0.104.0.
CPU-exhaustion denial of service in netty-incubator-codec-ohttp's BinaryHttpParser permanently pins Netty event-loop threads at 100% CPU via an infinite loop in field-section decoding, reachable by any unauthenticated remote attacker. Because OHTTP gateways publish their HPKE public key by design, an attacker can encrypt a crafted ~17-byte Binary HTTP payload as a cryptographically valid OHTTP request, which passes decryption and reaches the vulnerable parser without any authentication barrier. A handful of such requests exhausts the entire fixed-size Netty event-loop thread pool, rendering the gateway or client fully offline until the process is restarted; no public exploit identified at time of analysis, though an empirically-reproduced proof-of-concept is documented in the advisory.
Remote privilege escalation in Ceph RADOS Gateway (RGW) allows any holder of a valid STS session token - regardless of privilege level - to forge administrative credentials by exploiting unauthenticated AES-128-CBC encryption. By applying a deterministic CBC bit-flip to the acct_type, perm_type, and is_admin fields of their own token, an attacker can trigger a global authorization override that bypasses all RGW capability checks, yielding full administrative control over all objects and buckets in the cluster. No public exploit has been identified at time of analysis; however, the attack is self-contained, requires no encryption oracle, and is reachable over the standard RGW S3 endpoint, making it highly accessible to any user with STS access. Fixed versions 19.2.6 and 20.2.4 are confirmed released.
Unauthenticated remote exploitation of Oracle Helidon 3.2.20's Imperative Web Server component enables attackers to perform unauthorized creation, deletion, or modification of critical data via HTTP with no prerequisites. The vulnerability carries a scope change (S:C in CVSS), meaning successful exploitation can cascade to impact additional products or systems beyond Helidon itself. Tagged as an authentication bypass, this is classified by Oracle as easily exploitable with no public exploit identified at time of analysis.
Unauthorized data access in Oracle Helidon 4.5.0 exposes all data reachable through the Imperative Web Server component to unauthenticated remote attackers over HTTP. Tagged as an authentication bypass, the flaw allows complete confidentiality compromise - an attacker can read critical or all accessible application data without supplying credentials. No public exploit has been identified at time of analysis, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the attack is trivially executable from any network position.
Remote denial-of-service and partial data exposure in Oracle Helidon 4.5.0 allows unauthenticated network attackers via HTTP/2 to cause a complete hang or crash of the Helidon Imperative Web Server, alongside unauthorized read access to a subset of accessible data. The vulnerability is classified as easily exploitable with no authentication, user interaction, or special configuration required. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and network-accessible vector make this a realistic denial-of-service threat against any exposed Helidon 4.5.0 deployment.
Remote denial-of-service in Oracle Helidon 4.5.1's Imperative Web Server component allows unauthenticated network attackers to hang or repeatedly crash the service via HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms trivial, zero-prerequisite exploitation against any reachable instance. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity makes this a credible threat to internet-facing deployments.
Denial-of-service in Oracle Helidon 4.5.1's Imperative Web Server component allows unauthenticated remote attackers to crash or indefinitely hang the service via crafted HTTP/2 traffic. Disclosed as part of Oracle's Critical Security Patch Update (CPU) for August 2026, the vulnerability is rated CVSS 7.5 with low attack complexity and no privileges required, making automated exploitation straightforward against any exposed instance. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Denial of service in Oracle Helidon 3.2.19's Imperative Web Server allows unauthenticated network attackers to hang or crash the server entirely via HTTP/2 traffic. The CVSS 3.1 score of 7.5 reflects the low attack complexity and complete availability impact, with no authentication or user interaction required. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Unauthenticated remote exploitation of Oracle Helidon 4.5.3's Imperative Web Server component allows attackers with HTTP network access to perform unauthorized read, write, and partial denial-of-service operations against data accessible to the service. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms this is easily exploitable with no prerequisites, though impacts are bounded to partial CIA effects within the unchanged scope of the Helidon instance. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Unauthenticated remote exploitation of Oracle Helidon 4.5.3's Imperative Web Server component allows network attackers over HTTP to achieve partial confidentiality disclosure, data manipulation, and denial of service - with a confirmed scope change indicating the impact can extend to components beyond Helidon's own security boundary. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C) places this among the most easily reachable vulnerability classes: no credentials, no user interaction, and no elevated complexity required. Disclosed in Oracle's August 2026 Critical Security Patch Update, no public exploit code or CISA KEV listing has been identified at time of analysis.
Scope-changing compromise of Oracle Helidon 4.5.3 (Imperative Web Server component) lets a remote, unauthenticated attacker send HTTP requests that grant high-integrity write access to Helidon-accessible data, partial read disclosure, and a partial denial of service - with impact that can extend beyond Helidon into adjacent products. Rated CVSS 3.1 9.9 due to the scope change combined with easy, no-privilege network exploitation. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated network exploitation of Oracle Helidon 4.5.3's Imperative Web Server component allows remote attackers to partially compromise confidentiality, integrity, and availability of the affected system, with a confirmed scope change meaning attacks can extend impact to additional co-located products or services. The vulnerability is rated 8.3 (High) under CVSS 3.1, elevated by the scope change despite individually low CIA impact ratings. No public exploit code has been identified at time of analysis, and Oracle disclosed this through its August 2026 Critical Patch Update.
Unauthenticated remote exploitation of Oracle Helidon 4.5.3's Imperative Web Server component allows attackers to bypass authentication controls via HTTP, resulting in unauthorized read access to a subset of application data and the ability to insert, update, or delete accessible records. The CVSS scope change (S:C) indicates successful exploitation can affect additional systems beyond the Helidon instance itself - a compounding factor in microservices topologies where Helidon acts as a gateway or intermediary. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the unauthenticated, low-complexity attack path makes this credible against any internet-exposed deployment.
Denial-of-service in Oracle Helidon 3.2.20 (Imperative Web Server component) allows unauthenticated remote attackers to repeatedly crash or indefinitely hang the server via crafted HTTP requests. The vulnerability is rated CVSS 7.5 with no authentication, no user interaction, and low attack complexity, making it trivially exploitable at scale against any exposed instance. No public exploit code or CISA KEV listing has been identified at time of analysis, though the ease of exploitation and complete availability impact warrant prompt patching.
Unauthenticated remote exploitation of Oracle Helidon 1.4.19's Imperative Web Server component via HTTP allows attackers to perform unauthorized creation, deletion, and modification of critical application data, with partial read access to Helidon-accessible data. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms zero barriers to exploitation - no credentials, no user interaction, and low attack complexity over standard HTTP. Reported via Oracle's Critical Patch Update for August 2026 and tagged as an Authentication Bypass, with no public exploit code or CISA KEV listing identified at time of analysis.
Authentication bypass in Oracle Helidon 1.4.19 (Imperative Web Server component of Oracle Fusion Middleware) lets a remote, unauthenticated attacker reach and manipulate protected data over HTTP, yielding full read and write access to all data the Helidon instance can reach. Oracle rates it CVSS 9.1 with High confidentiality and integrity impact and no availability impact, and describes it as easily exploitable. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated data compromise in Oracle Helidon 1.4.19 (Imperative Web Server component) lets a remote attacker send crafted HTTP requests to read, create, modify, or delete all Helidon-accessible data. Oracle rates it CVSS 3.1 9.1 (high confidentiality and integrity impact, no availability impact) and classifies it as an authentication-bypass-class flaw. No public exploit identified at time of analysis, but the low attack complexity and no-authentication requirement make it a high-priority patch item once Oracle's fix is applied.
Remote takeover in Oracle Helidon 1.4.20 (Imperative Web Server component of Oracle Fusion Middleware) allows an unauthenticated attacker with network access over HTTP to fully compromise the affected instance. The flaw carries a critical CVSS 3.1 base score of 9.8 with high impact to confidentiality, integrity and availability, and is described by Oracle as easily exploitable. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, so exploitation is not yet confirmed in the wild.
Unauthenticated remote compromise in Oracle Helidon 4.5.0's Imperative Web Server component lets network attackers reach critical data and disrupt service over plain HTTP with no credentials and no user interaction. Oracle rates it CVSS 3.1 9.4, reflecting high confidentiality and integrity impact plus partial denial of service, and it was disclosed in the Oracle Critical Patch Update of August 2026. No public exploit identified at time of analysis, but the trivial exploitability and unauthenticated network reach make it a top-tier patch priority.
Unauthenticated remote exploitation of Oracle Helidon 4.5.0's Imperative Web Server component allows network-adjacent attackers to partially compromise confidentiality, integrity, and availability via standard HTTP. The CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector confirms zero authentication or user interaction is required, and attack complexity is low - meaning successful exploitation demands minimal attacker skill or infrastructure. Disclosed through Oracle's Critical Patch Update for August 2026, no public exploit code has been identified at time of analysis, though the low-barrier network vector warrants prompt remediation for any internet-exposed Helidon deployment.
Unauthenticated compromise of Oracle Helidon 4.5.0 lets a remote attacker over HTTP read, create, modify, or delete all data accessible to the Helidon application via a flaw in the Imperative Web Server component. Oracle rates it CVSS 9.1 (high confidentiality and integrity impact, no availability impact), and the vendor tag 'Authentication Bypass' indicates protected routes/resources can be reached without credentials. No public exploit identified at time of analysis; addressed in the Oracle Critical Patch Update of August 2026.
Unauthenticated remote compromise of Oracle Helidon 3.2.18 (Imperative Web Server component) allows a network attacker to read, create, modify, or delete all data accessible to the framework over HTTP. Tagged by Oracle as an authentication bypass, it carries a CVSS 3.1 base score of 9.1 with high confidentiality and integrity impact and no availability impact. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but Oracle rates it as easily exploitable, warranting prompt patching.
Remote denial-of-service in Oracle Helidon 4.5.0 Imperative Web Server allows unauthenticated network attackers to cause a persistent hang or repeated crash of the service via HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial remote exploitation with no authentication or user interaction required, making this reliably triggerable against any exposed instance. No public exploit code or CISA KEV listing has been identified at time of analysis, but low attack complexity means operational risk for teams running Helidon 4.5.0 in production microservice environments is meaningful.
Remote takeover of Oracle Helidon 4.5.0 is possible when an unauthenticated attacker reaches the Imperative Web Server component over HTTP, per Oracle's August 2026 Critical Patch Update. The flaw yields full compromise of confidentiality, integrity, and availability (CVSS 9.8) without credentials or user interaction. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network-facing profile makes it a high-priority patch.
Unauthorized data exposure in Oracle Helidon 4.5.0's Imperative Web Server component allows unauthenticated, network-adjacent attackers to read critical application data via HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial exploitability with no authentication or user interaction required. Classified under the Authentication Bypass tag by Oracle, this vulnerability is covered in the Oracle Critical Patch Update for August 2026, with no public exploit code or CISA KEV listing identified at time of analysis.
Unauthorized data disclosure in Oracle Helidon 3.2.18's Imperative Web Server component allows unauthenticated remote attackers to access critical or all Helidon-accessible data via HTTP. The vulnerability is tagged as an authentication bypass, consistent with the CVSS vector showing no privileges or user interaction required (PR:N/UI:N) and a high confidentiality impact. Disclosed as part of Oracle's Critical Patch Update for August 2026, no public exploit or CISA KEV listing has been identified at time of analysis.
Complete takeover of Oracle Helidon 4.5.0 is achievable by remote, unauthenticated attackers over HTTP through the Imperative Web Server component, per Oracle's August 2026 Critical Patch Update. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N, full C/I/A impact) reflects easy exploitation with no privileges or user interaction. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Authentication bypass in Oracle Helidon 4.5.1 (Imperative Web Server component) exposes applications to unauthenticated remote attackers who can create, modify, or delete critical data accessible to the service via standard HTTP requests. Oracle classifies this as 'easily exploitable' with a CVSS 3.1 score of 7.5, reflecting a network-accessible, zero-complexity attack requiring no credentials or user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle addressed the issue in the August 2026 Critical Patch Update.
Unauthenticated remote denial-of-service in Oracle Helidon 3.2.19 allows a network attacker to hang or crash the Imperative Web Server component via crafted HTTP requests, causing complete loss of service availability. The vulnerability requires no privileges, no user interaction, and is reachable over standard HTTP, making it trivially exploitable against any exposed Helidon 3.2.19 instance. No public exploit code has been identified at time of analysis, and the flaw is not listed in the CISA KEV catalog.
Remote unauthenticated exploitation of Oracle Helidon 4.5.0's Imperative Web Server component via HTTP allows attackers to perform unauthorized read access to a subset of data, unauthorized data modification, and partial denial of service - all without credentials or user interaction. Oracle classifies this as 'easily exploitable' in its August 2026 Critical Patch Update advisory. No public exploit identified at time of analysis, but the low attack complexity and network accessibility make this a straightforward target for opportunistic attackers.
Unauthenticated remote exploitation of Oracle Helidon 4.5.0's Imperative Web Server component via HTTP allows attackers to read a subset of accessible data, perform unauthorized write/modify operations, and cause a partial denial of service. The CVSS vector confirms network accessibility with no authentication, no user interaction, and low attack complexity, making this easily exploitable against exposed deployments. No public exploit code or CISA KEV listing has been identified at time of analysis, but the trivial exploitation conditions warrant prompt patching.
Remote denial-of-service in Oracle Helidon 4.5.0's Imperative Web Server component allows unauthenticated network attackers to crash or indefinitely hang the server by sending crafted HTTP/2 traffic. The vulnerability carries a CVSS 7.5 rating with low attack complexity and no credential or interaction requirement, making it trivially scriptable from any network-accessible position. No active exploitation has been confirmed and no public proof-of-concept is known at time of analysis.
Unauthenticated remote access to sensitive data affects Oracle Helidon 4.5.0's Imperative Web Server component via HTTP/2, allowing an attacker with network access to read critical or all data accessible to the Helidon application. The vulnerability is tagged as an authentication bypass, consistent with the CVSS vector showing no privileges or user interaction required. No public exploit identified at time of analysis, and the flaw is disclosed through Oracle's Critical Patch Update for August 2026.
Unauthenticated remote exploitation of the Imperative Web Server component in Oracle Helidon 4.5.0 allows network-accessible attackers to perform unauthorized read and write operations against application-accessible data, with confirmed scope change indicating downstream impact on adjacent systems beyond the directly targeted Helidon instance. The vulnerability is tagged as an authentication bypass, meaning the HTTP-exposed service fails to enforce access controls on one or more endpoints. No public exploit code has been identified at time of analysis, and the issue is not listed in the CISA KEV catalog, though Oracle's Critical Patch Update advisory for August 2026 confirms the vulnerability's existence and assigns a CVSS 3.1 score of 7.2.
Authentication bypass in Oracle Helidon 3.2.18's Imperative Web Server allows remote unauthenticated attackers to read a subset of application data and make unauthorized modifications via HTTP, with a scope change indicating potential cascade impact to downstream services. The CVSS 3.1 score of 7.2 (High) is elevated by the scope change (S:C), reflecting Helidon's common role as a gateway or orchestrator in microservices architectures. No public exploit or CISA KEV listing has been identified at time of analysis, but the fully unauthenticated, low-complexity, network-accessible attack profile makes this a credible and time-sensitive patching priority for any internet-exposed deployment.
Unauthenticated information disclosure in Oracle Helidon 4.5.0's Imperative Web Server component exposes complete application data to remote network attackers via HTTP. Tagged as an authentication bypass, the flaw allows any unauthenticated actor with network access to read critical or all Helidon-accessible data without any privileges or user interaction. No patch version has been independently confirmed beyond the Oracle CPU August 2026 advisory, and no active exploitation has been identified at time of analysis.
Unauthenticated confidentiality breach in Oracle Helidon 3.2.18's Imperative Web Server component exposes all accessible data to remote attackers over HTTP. Tagged as an authentication bypass, this flaw requires no credentials, no user interaction, and no special network positioning - any attacker with HTTP access to a vulnerable instance can read critical application data. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-authentication requirement make this straightforward to exploit opportunistically.
Denial-of-service in Oracle Helidon 3.2.19's Imperative Web Server component allows remote unauthenticated attackers to cause a complete hang or repeatable crash via HTTP, fully disrupting service availability. The vulnerability requires no authentication, no user interaction, and no special configuration, making it trivially exploitable against any network-accessible Helidon 3.2.19 instance. No public exploit code has been identified and it does not appear in CISA KEV at time of analysis, though the low attack complexity elevates operational risk for any exposed deployment.
Unauthenticated remote attackers can create, delete, or modify critical data in Oracle Helidon 4.5.1 by bypassing authentication controls in the Imperative Web Server component over HTTP. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires only network reachability with no credentials, no user interaction, and no elevated access - placing this firmly in the easily exploitable category per Oracle's own classification. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity warrants prompt patching for any internet-exposed Helidon deployments.
Unauthenticated remote data exposure in Oracle Helidon 3.2.18's Imperative Web Server component allows network attackers to bypass authentication and gain complete access to data served by the application via HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no credentials, user interaction, or special access are required, and Oracle's own advisory characterizes the vulnerability as 'easily exploitable.' No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis, but the authentication bypass nature paired with a High confidentiality impact warrants prompt remediation.
Authentication bypass in Oracle Helidon 4.5.1's Imperative Web Server component allows unauthenticated remote attackers to read a subset of accessible data and perform unauthorized insert, update, or delete operations via HTTP. The vulnerability carries a scope-change designation (S:C in CVSS), meaning successful exploitation may cascade beyond Helidon itself to impact additional products or services in the surrounding microservices environment. No public exploit code or active exploitation has been confirmed at time of analysis, but the zero-prerequisite attack profile - no authentication, low complexity, no user interaction - makes this straightforward to exploit once the bypass mechanism is understood.
Unauthenticated network exploitation of Oracle Helidon 3.2.19's Imperative Web Server component allows remote attackers to bypass authentication over HTTP, gaining unauthorized read access to a subset of data and the ability to insert, update, or delete accessible data. The CVSS S:C scope change is particularly significant: in microservices environments where Helidon acts as a service layer, successful exploitation may cascade to impact downstream or co-located systems beyond the initially compromised component. No public exploit code or CISA KEV listing is confirmed at time of analysis, but the zero-prerequisites attack profile (AV:N/AC:L/PR:N/UI:N) and scope change make this a prioritized patching target for any organization running the affected version.
Unauthenticated data compromise in Oracle Helidon 4.5.0 (Imperative Web Server component of Oracle Fusion Middleware) lets a remote attacker reach and manipulate all data accessible to the framework over HTTP. Tagged as an authentication bypass, it carries a CVSS 9.1 with high confidentiality and integrity impact but no availability impact. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Authentication bypass in Oracle Helidon 3.2.18 (Imperative Web Server component of Oracle Fusion Middleware) lets an unauthenticated remote attacker send crafted HTTP requests to read, create, modify, or delete any data the application can access. Rated CVSS 9.1 with high confidentiality and integrity impact but no availability impact, it is trivially exploitable over the network with no user interaction. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated remote compromise of Oracle Helidon 4.5.0 (Imperative Web Server component, part of Oracle Fusion Middleware) lets a network attacker read, create, delete or modify all Helidon-accessible data and cause a partial denial of service, all over HTTP without credentials. Oracle rates this CVSS 9.4 and tags it as an authentication bypass, meaning attackers reach protected functionality without logging in. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated remote compromise of Oracle Helidon 3.2.18 (Imperative Web Server component) lets network attackers read, alter, or destroy all data the framework can access and degrade its availability. The flaw is remotely reachable over HTTP with no authentication or user interaction and carries a CVSS 3.1 base score of 9.4. It was disclosed in Oracle's August 2026 Critical Patch Update; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Full remote takeover in Oracle Helidon 3.2.18 (Fusion Middleware, Imperative Web Server component) allows an unauthenticated attacker with only HTTP network access to fully compromise the affected instance. Oracle rates the flaw CVSS 3.1 9.8 with high confidentiality, integrity, and availability impact and describes it as "easily exploitable," fixed in the August 2026 Critical Patch Update. There is no public exploit identified at time of analysis and the CVE is not on CISA KEV, but the unauthenticated network-facing profile makes it a high-priority patch.
Full instance takeover of Oracle Helidon 3.2.18 (Imperative Web Server component) is achievable by a low-privileged remote attacker over HTTP, though exploitation demands high attack complexity. The CVSS 3.1 score of 7.5 reflects complete confidentiality, integrity, and availability compromise - consistent with the vendor description of 'takeover' - affecting Oracle Fusion Middleware deployments running this specific release. No public exploit code or CISA KEV listing exists at time of analysis; Oracle addressed this in the August 2026 Critical Security Patch Update (CSPU).
Unauthenticated remote attackers can bypass access controls in the Imperative Web Server component of Oracle Helidon 3.2.18, gaining complete read access to all data accessible by the application and limited ability to modify or insert records via HTTP. Oracle classifies this as 'easily exploitable' with a CVSS 3.1 score of 8.2 (High), reflecting a fully network-accessible, zero-complexity attack requiring no credentials or user interaction. No public exploit code has been identified at time of analysis, and the vulnerability is addressed in Oracle's Critical Security Patch Update for August 2026.
Unauthorized data disclosure in Oracle Helidon 3.2.18's Imperative Web Server component exposes all Helidon-accessible data to unauthenticated remote attackers via HTTP. Tagged as an Authentication Bypass, the flaw enables any network-positioned attacker to read critical or complete Helidon-managed data without credentials or user interaction, as confirmed by the AV:N/AC:L/PR:N/UI:N CVSS 3.1 vector. No public exploit has been identified at time of analysis, but the absence of any exploitation prerequisites significantly elevates real-world urgency for any internet-facing or internally networked Helidon 3.2.18 deployment.
Unauthorized data access and partial data manipulation in Oracle Helidon 3.2.18's Imperative Web Server component allows a low-privileged attacker with HTTP network access to gain complete read access to all Helidon-accessible data and limited write capability. The vulnerability carries a scope change, meaning successful exploitation can cascade to impact additional products beyond Helidon itself within the Oracle Fusion Middleware ecosystem. No public exploit code has been identified at time of analysis, but the low attack complexity and absence of required user interaction make this a realistic target for authenticated internal or service-account-level adversaries.
Remote unauthenticated denial-of-service in Oracle Helidon 1.4.20 allows network-accessible attackers to crash or indefinitely hang the Imperative Web Server via HTTP, with no authentication or user interaction required. The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms trivially low exploitation complexity against exposed instances. No public exploit code or CISA KEV listing exists at time of analysis, but the combination of network accessibility and zero prerequisites makes this a realistic operational risk for any deployment of the affected version.
Remote takeover in Oracle Helidon 4.5.0 lets an unauthenticated attacker fully compromise the framework's Imperative Web Server component over HTTP. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact and no authentication or user interaction required, per Oracle's August 2026 Critical Patch Update. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the trivial exploitability rating warrants urgent patching.
Full compromise of Oracle Hyperion Financial Management version 11.2.25.0.000 is achievable by low-privileged network attackers via HTTP, targeting the Security component to gain complete control over confidentiality, integrity, and availability. The CVSS 3.1 score of 8.8 reflects the combination of network accessibility, low attack complexity, and no user interaction required beyond a valid low-privilege account. No public exploit code or CISA KEV listing has been identified at time of analysis, though the severity of the stated outcome - full system takeover - warrants immediate patch application.
Critical data exposure and integrity compromise in Oracle Communications Unified Inventory Management (UIM) allows unauthenticated network attackers to read or tamper with all UIM-accessible data via a vulnerable third-party component over HTTP. Affected versions span 7.5.0 through 8.0.1, covering a wide active deployment range. The vulnerability carries an Authentication Bypass tag and is rated CVSS 7.4 with High Complexity, meaning exploitation is non-trivial but requires no credentials - no public exploit or CISA KEV listing has been identified at time of analysis.
Unauthorized data disclosure in Oracle Communications Unified Inventory Management (versions 7.5.0-7.5.1, 7.6.0-7.8.0, and 8.0.1) exposes critical inventory data to unauthenticated remote attackers over HTTP. The flaw resides in the Security Component and is tagged as an Authentication Bypass, meaning the platform's access controls can be circumvented without any credentials or user interaction, granting complete read access to all data the application can reach. No public exploit has been identified at time of analysis, and the vulnerability is not currently listed in CISA KEV, but the trivially low exploitation complexity makes rapid patching essential.
Oracle VM VirtualBox 7.2.14 Core component exposes a scope-changing integrity vulnerability that allows a local unauthenticated attacker - with logon access to the infrastructure hosting the hypervisor - to critically compromise VirtualBox data when a legitimate third party interacts with the product. The attack vector is local and requires human interaction, but the CVSS scope change (S:C) indicates that a successful exploit can break VM containment and significantly impact the host system or co-resident components beyond VirtualBox itself. No public exploit is identified at time of analysis, and the vulnerability is addressed via Oracle's August 2026 Critical Security Patch Update.
Local privilege escalation and denial-of-service in Oracle VM VirtualBox 7.2.14 allows a high-privileged attacker with local infrastructure access to crash the hypervisor, partially read or modify VM-accessible data, and - critically - extend impact beyond the vulnerable instance to additional products via a confirmed scope change. The CVSS 3.1 vector (AV:L/PR:H/S:C/A:H) indicates this is not a remote threat but a post-compromise or insider-level concern targeting the virtualization layer. No public exploit code or active exploitation has been identified at time of analysis, and Oracle disclosed this through its Critical Patch Update for August 2026.
Local privilege escalation with scope change in Oracle VM VirtualBox 7.2.14 allows a high-privileged local attacker to crash the hypervisor repeatedly, modify limited guest data, and read a subset of accessible data - with impacts that extend beyond the VirtualBox process to additional co-hosted products. No public exploit code has been identified at time of analysis, and this vulnerability is not currently listed in the CISA KEV catalog. The scope change (S:C in CVSS) is the critical differentiator, indicating that a compromised VirtualBox instance can affect the host OS or sibling VMs, raising the actual blast radius above what the per-component impact ratings suggest.
Full takeover of Oracle VM VirtualBox 7.2.14 is achievable by a local, unprivileged attacker who can induce a victim user to interact with a malicious guest or crafted input, with the scope change indicator in the CVSS vector (S:C) strongly suggesting a guest-to-host boundary breach impacting the underlying infrastructure. The complete C:H/I:H/A:H impact triad confirms that successful exploitation results in total loss of confidentiality, integrity, and availability of both the VirtualBox process and potentially the host system. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Remote unauthenticated exploitation of Oracle VM VirtualBox 7.2.14 via its RDP component allows attackers to bypass authentication and gain full read access to all VirtualBox-accessible session data as well as limited write capability, without requiring any credentials or user interaction. The vulnerability resides in the Core component's Virtual Remote Desktop Extension (VRDE), exposed over the network via RDP. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the zero-authentication network vector and low attack complexity make this a high-priority patching candidate for any deployment with VRDE enabled.
Full takeover of Oracle VM VirtualBox 7.2.14 is achievable by a locally-authenticated, high-privileged attacker, with confirmed scope change indicating the compromise extends beyond the hypervisor to additional products - consistent with a VM escape or host privilege escalation pattern. The CVSS vector (AV:L/PR:H/S:C/C:H/I:H/A:H) signals that despite the elevated privilege bar, successful exploitation yields complete confidentiality, integrity, and availability impact across system boundaries. No public exploit code or CISA KEV listing has been identified at time of analysis, though the vulnerability is disclosed via Oracle's August 2026 Critical Patch Update advisory.
Full takeover of Oracle VM VirtualBox 7.2.14 is achievable by a low-privileged local attacker through a high-complexity exploit targeting the Core component, with successful attacks crossing the VM boundary to significantly impact the host and potentially co-hosted workloads. The scope change indicated in the CVSS vector (S:C) is consistent with a VM escape class of vulnerability, making this critical in shared or multi-tenant infrastructure despite the local access prerequisite. No public exploit code or active exploitation has been identified at the time of analysis; exploitation probability remains unquantified due to the absence of EPSS data.
Full system takeover is achievable in Oracle Business Intelligence Enterprise Edition 26.01.0.0.0 via specially crafted HTTP requests targeting the Platform Security component from a high-privileged, network-adjacent attacker. The CVSS 3.1 score of 8.0 reflects a scope-changed exploit with complete Confidentiality, Integrity, and Availability impact, meaning successful compromise can cascade to systems integrated with or hosted alongside the BIEE instance. No public exploit identified at time of analysis, and exploitation requires high attack complexity and high-privilege credentials, but the full-takeover outcome warrants prioritized patching through the August 2026 Oracle CPU.
Full takeover of Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a high-privileged local attacker exploiting a flaw in the Security component, with confirmed scope change enabling impact on additional adjacent products. The CVSS vector (AV:L/AC:H/PR:H) reflects a difficult-to-exploit, infrastructure-local attack requiring significant access prerequisites, yet successful exploitation yields complete confidentiality, integrity, and availability compromise. No public exploit code or CISA KEV listing has been identified at time of analysis; risk is best understood as an insider or post-compromise escalation threat rather than an opportunistic remote attack.
Full hypervisor takeover in Oracle VM VirtualBox 7.2.14 is achievable by a locally authenticated, highly privileged attacker exploiting a flaw in the Core component, with successful attacks producing a scope change that may compromise systems beyond the primary VirtualBox instance. The CVSS vector confirms local-only access with high privilege and complexity prerequisites, but the S:C scope change elevates real-world impact substantially - a compromised hypervisor exposes all hosted guest VMs and their data. Disclosed in Oracle's August 2026 Critical Security Update, no public exploit code has been identified and the vulnerability does not appear in the CISA KEV catalog at time of analysis.
Unauthenticated remote denial-of-service in Oracle VM VirtualBox 7.2.14 allows a network attacker to hang or crash the hypervisor via the RDP interface without any credentials or user interaction. The vulnerability resides in the Core component and is rated easily exploitable by Oracle, yielding complete availability loss of the affected VirtualBox instance. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the low attack complexity and zero authentication requirement make this straightforward to trigger against exposed deployments.
Full system takeover of Oracle PeopleSoft Enterprise FIN Common Objects 9.2 is achievable by an unauthenticated remote attacker over HTTP, with successful exploitation yielding complete compromise of confidentiality, integrity, and availability. The vulnerability resides in the Security component and is categorized as difficult to exploit, reflected in the CVSS AC:H rating, suggesting a precision exploitation condition such as a race condition or specific state requirement. No public exploit code or CISA KEV listing has been identified at time of analysis, but the total-takeover impact and unauthenticated network vector make this a high-priority finding for any organization running affected PeopleSoft FIN deployments.
Local privilege escalation in Oracle Identity Manager's Installer component allows a low-privileged authenticated attacker to fully compromise the OIM instance on versions 12.2.1.4.0 and 14.1.2.1.0. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms that any low-privileged OS user with local logon access to the OIM infrastructure can achieve complete confidentiality, integrity, and availability impact - effectively a full system takeover - with low complexity and no user interaction required. No public exploit identified at time of analysis, and no CISA KEV listing has been confirmed.
Unauthorized data access and tampering in Oracle Helidon 4.5.0's Imperative Web Server component allows low-privileged authenticated attackers to read or modify critical application data over HTTPS. The vulnerability is tagged as an authentication bypass, suggesting that a legitimately authenticated low-privilege user can circumvent authorization controls to access or alter data beyond their permitted scope. No public exploit code or CISA KEV listing has been identified at time of analysis, but the 8.1 CVSS score and high confidentiality and integrity impacts make this a meaningful risk in any deployment where untrusted low-privileged users have HTTPS access.
Unauthenticated remote data exposure in Oracle Business Intelligence Enterprise Edition (OBIEE) versions 8.2.0.0.0 and 26.01.0.0.0 allows network-adjacent attackers to read critical or all accessible analytics data via HTTP without credentials. The authentication bypass (per vendor tagging) in the Analytics Server component yields complete confidentiality loss - CVSS C:H - with no integrity or availability impact. No public exploit or CISA KEV listing has been identified at time of analysis, though Oracle's own security team reported and patched this issue in the August 2026 CPU, suggesting internal discovery.
Remote unauthenticated takeover of Oracle Hospitality OPERA 5 Property Services (Opera Servlet component) is possible in versions 5.6.28.0 through 5.6.28.1 via HTTP, with an attacker requiring no privileges and only low attack complexity. The UI:R CVSS metric indicates exploitation depends on human interaction from a non-attacker party, consistent with client-side injection or CSRF-style attack patterns targeting hotel staff sessions. Full compromise of confidentiality, integrity, and availability is confirmed as the impact; no public exploit has been identified at time of analysis and the vulnerability is not currently listed in CISA KEV.
Full system takeover of Oracle HRMS (Netherlands) versions 12.2.3 through 12.2.15 is achievable by a high-privileged remote attacker targeting the Netherlands Payroll component over HTTP. The CVSS vector confirms network accessibility with low attack complexity, no user interaction, and complete compromise of confidentiality, integrity, and availability upon successful exploitation. No public exploit has been identified at time of analysis, and the vulnerability is not currently listed in the CISA KEV catalog.
Remote tampering and denial-of-service in Oracle Database Server's Portable Clusterware component lets an unauthenticated attacker reach the service over HTTP and manipulate or destroy critical cluster data, or force a complete, repeatable crash. Affected releases span 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3, carrying a CVSS 3.1 base score of 9.1 driven purely by high Integrity and Availability impact (confidentiality is untouched). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability (network, low complexity, no privileges, no user interaction) makes it a high-priority patch item.
Local privilege escalation in Oracle HRMS (US), part of Oracle E-Business Suite versions 12.2.3 through 12.2.15, allows a low-privileged attacker with operating system logon to the infrastructure host to achieve full takeover of the HRMS application. The vulnerability resides in the US Payroll Tax Issues component and results in complete compromise of confidentiality, integrity, and availability. No public exploit code or active exploitation has been identified at time of analysis, though Oracle flagged this in its August 2026 Critical Patch Update.
Full system takeover of Oracle Business Intelligence Enterprise Edition 26.01.0.0.0 is achievable by a high-privileged attacker over HTTP, targeting the Analytics Web Answers component with no user interaction required. The C:H/I:H/A:H impact triad confirms complete compromise of confidentiality, integrity, and availability once exploitation succeeds. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the low attack complexity (AC:L) means that any attacker who clears the authentication barrier faces minimal technical obstacles to achieving full takeover.
Local privilege escalation in Oracle Business Intelligence Enterprise Edition 26.01.0.0.0 allows a low-privileged attacker with local logon access to the host infrastructure to fully compromise the application, achieving confidentiality, integrity, and availability takeover. The attack complexity is rated high, indicating non-trivial exploitation conditions must be met. No public exploit or active exploitation has been identified at time of analysis, but full system takeover is the confirmed impact per Oracle's advisory.
Local privilege escalation in Oracle Business Intelligence Enterprise Edition 26.01.0.0.0 allows a low-privileged attacker with OS-level logon to the hosting infrastructure to achieve full takeover of the BIEE instance. The Platform Security component contains an easily exploitable flaw that, once triggered, yields complete confidentiality, integrity, and availability compromise - equivalent to host-level control over the analytics platform. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low complexity and absence of user-interaction requirements make this straightforward to exploit once local access is established.
Partial authentication bypass in Oracle Business Intelligence Enterprise Edition's BI Platform Security component allows a low-privileged remote attacker to compromise both confidentiality and integrity of critical OBIEE data, with a scope change indicating spillover impact on additional Oracle products within the same environment. Affected versions span three distinct release lines - 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0 - covering a wide enterprise install base. No public exploit code or CISA KEV listing is confirmed at time of analysis, but the combination of high-impact scope change and low privilege requirement elevates urgency even given the high attack complexity.
Password hash extraction from any Dolibarr 24.0.0 user account, including administrators, is possible for authenticated low-privileged users via a case-sensitivity mismatch in the sqlfilters API parameter denylist. The PHP guard in dolForgeSQLCriteriaCallback() performs case-sensitive string matching against forbidden field names, while the underlying database resolves column names case-insensitively, allowing bypasses using uppercase variants such as PASSWORD instead of password. By submitting prefix-matching predicates as boolean oracle queries, an attacker can extract full credential hashes character-by-character without elevated privileges. No public exploit code has been identified at time of analysis; a patch commit is available upstream.
Cross-tenant SQL injection in OpenPanel's analytics filter builder allows authenticated attackers with project-scoped read credentials to exfiltrate other organizations' analytics data and profile PII. Unvalidated `profile.*` filter column identifiers are interpolated directly into ClickHouse WHERE clauses, enabling blind boolean oracle attacks that bypass project isolation boundaries. No public exploit code has been identified at time of analysis, but the low authentication bar and confirmed cross-tenant scope change make this a genuine priority for any multi-tenant OpenPanel deployment.
Argument injection in GitPython 3.1.59's high-level diff API allows low-privileged remote attackers to read arbitrary filesystem paths by passing the unsanitized `--no-index` flag to the underlying git diff command. By chaining `--no-index` with the `-I`/`--ignore-matching-lines` regex filter, an attacker can construct a content-dependent Boolean oracle - issuing repeated queries that distinguish between regex match and mismatch responses to recover single-line secrets from local files. No active exploitation has been confirmed (not in CISA KEV), but the technique is deterministic and requires only authenticated API access. Patch-upgraded version 3.1.60 is available.
Unauthenticated account takeover in WWBN AVideo (through commit e01e41ecc) stems from get_api_preauthorize in plugin/API/API.php, a second, undocumented login path that performs the same credential check as get_api_signIn but omits the 10-attempts-per-5-minutes throttle enforced by checkRateLimit(). This lets remote attackers brute-force any account - including admin - without rate limiting, and the endpoint doubles as a credential oracle whose users_id field (1 vs 0) discloses password validity even though the message always reads 'Invalid credentials'. No public exploit identified at time of analysis, and no vendor-released patch is available.
Sensitive field disclosure in ash_lua (versions 0.1.0 through 0.2.0) allows any actor who can submit a Lua script to read Ash resource attributes that are deliberately excluded from the manifest's exposed-field allow-list - including sensitive?: true columns such as hashed passwords. The operation aggregate path in AshLua.Runtime resolved field names directly via String.to_existing_atom and Ash.Query.Aggregate.new! without invoking the same AshLua.Fields.for_action/4 allow-list check enforced by the normal field-read path, creating an alternate route to private data. Vendor patch 0.2.1 is confirmed available; no CISA KEV listing or independent exploit beyond the PoC embedded in the security advisory has been identified.
Unauthenticated arbitrary file read in the surya 0.22.1 screenshot server allows any network-reachable attacker to exfiltrate image and PDF files from the host filesystem by supplying attacker-controlled paths to three unprotected HTTP routes. The /info, /page, and /process endpoints pass raw file_path parameters directly to Pillow's Image.open and pypdfium2.PdfDocument, returning rendered file contents as base64-encoded HTTP responses. The /info route additionally acts as a file-existence oracle, enabling systematic enumeration of host paths before targeted exfiltration; no public exploit has been identified at time of analysis.
Unauthenticated SQL injection in WWBN AVideo's channels API endpoint allows remote attackers to extract password hashes and account recovery tokens without any credentials. The `sort` column parameter in `get.json.php?APIName=channels` is injected directly into a SQL ORDER BY clause unsanitized, enabling an ordering oracle attack to infer sensitive column values character-by-character and triggering verbose SQL errors that disclose the full query and database schema. No public exploit has been identified at time of analysis, though VulnCheck has independently reported this vulnerability with a GitHub Security Advisory published by the vendor.
Administrator account takeover in the Support Genix WordPress helpdesk plugin (all versions up to and including 1.4.52) is achievable by any subscriber-level user who can obtain a single guest ticket token, exploiting a catastrophically weak encryption key derivation that yields only ~19.5 bits of effective entropy. The `guest_ticket_login()` function at the publicly reachable `/sgnix/?p=<token>` endpoint lacks capability checks, nonce validation, and session controls, allowing an attacker to exhaustively recover the site-wide AES-256-CBC key offline across ~729,000 candidates and forge an admin-authentication token. No public exploit has been identified at time of analysis, but the attack is technically straightforward given the tiny keyspace, deterministic IV construction, and unauthenticated endpoint exposure.
Unauthenticated stream credential disclosure in AVideo (WWBN, commit e01e41ecc and earlier) lets remote attackers retrieve any user's restream stream_key and stream_url for external platforms like YouTube, Facebook, and Twitch. The getLiveKey.json.php endpoint accepts a 'token' parameter that bypasses both the Live::canRestream() access gate and the restream ownership check, and the token is merely AES-256-CBC encryptString() of an integer id with no user binding, expiry, or authentication tag. Because a public encryption oracle (view/url2Embed.json.php) lets anyone encrypt arbitrary values, valid tokens can be forged with no authentication; no public exploit is identified at time of analysis but the technique is fully described.
Blind SQL injection in WsgiDAV's MySQLBrowserProvider sample module (versions <= 4.3.4) allows unauthenticated network attackers to read arbitrary data from the backing MySQL database via URL path manipulation. The record key segment of the URL is concatenated directly into a WHERE clause without escaping, enabling a boolean status-code oracle that supports full character-by-character data extraction. A secondary typo in the numeric-type check (`INTT` instead of `INT`) ensures all primary key types take the vulnerable quoted branch, and a working PoC with complete extraction script has been publicly confirmed. No public exploit identified as confirmed actively exploited (CISA KEV), but the PoC lowers the exploitation bar significantly.
Unauthenticated content exfiltration in Trilium up to 0.103.0 is possible through the public share-search endpoint, which applies authorization only to the ancestor note supplied in the request rather than to each result it returns. Any visitor with HTTP access to the instance can query `/share/api/notes` to enumerate titles, tree paths, and share identifiers of notes protected by `shareCredentials` passwords or hidden via `shareHiddenFromTree`, and can use the endpoint as a boolean substring oracle to iteratively reconstruct the full plaintext of password-gated notes. No public exploit has been identified at time of analysis, and the issue is patched in version 0.104.0.
CPU-exhaustion denial of service in netty-incubator-codec-ohttp's BinaryHttpParser permanently pins Netty event-loop threads at 100% CPU via an infinite loop in field-section decoding, reachable by any unauthenticated remote attacker. Because OHTTP gateways publish their HPKE public key by design, an attacker can encrypt a crafted ~17-byte Binary HTTP payload as a cryptographically valid OHTTP request, which passes decryption and reaches the vulnerable parser without any authentication barrier. A handful of such requests exhausts the entire fixed-size Netty event-loop thread pool, rendering the gateway or client fully offline until the process is restarted; no public exploit identified at time of analysis, though an empirically-reproduced proof-of-concept is documented in the advisory.
Remote privilege escalation in Ceph RADOS Gateway (RGW) allows any holder of a valid STS session token - regardless of privilege level - to forge administrative credentials by exploiting unauthenticated AES-128-CBC encryption. By applying a deterministic CBC bit-flip to the acct_type, perm_type, and is_admin fields of their own token, an attacker can trigger a global authorization override that bypasses all RGW capability checks, yielding full administrative control over all objects and buckets in the cluster. No public exploit has been identified at time of analysis; however, the attack is self-contained, requires no encryption oracle, and is reachable over the standard RGW S3 endpoint, making it highly accessible to any user with STS access. Fixed versions 19.2.6 and 20.2.4 are confirmed released.
Unauthenticated remote exploitation of Oracle Helidon 3.2.20's Imperative Web Server component enables attackers to perform unauthorized creation, deletion, or modification of critical data via HTTP with no prerequisites. The vulnerability carries a scope change (S:C in CVSS), meaning successful exploitation can cascade to impact additional products or systems beyond Helidon itself. Tagged as an authentication bypass, this is classified by Oracle as easily exploitable with no public exploit identified at time of analysis.
Unauthorized data access in Oracle Helidon 4.5.0 exposes all data reachable through the Imperative Web Server component to unauthenticated remote attackers over HTTP. Tagged as an authentication bypass, the flaw allows complete confidentiality compromise - an attacker can read critical or all accessible application data without supplying credentials. No public exploit has been identified at time of analysis, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the attack is trivially executable from any network position.
Remote denial-of-service and partial data exposure in Oracle Helidon 4.5.0 allows unauthenticated network attackers via HTTP/2 to cause a complete hang or crash of the Helidon Imperative Web Server, alongside unauthorized read access to a subset of accessible data. The vulnerability is classified as easily exploitable with no authentication, user interaction, or special configuration required. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and network-accessible vector make this a realistic denial-of-service threat against any exposed Helidon 4.5.0 deployment.
Remote denial-of-service in Oracle Helidon 4.5.1's Imperative Web Server component allows unauthenticated network attackers to hang or repeatedly crash the service via HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms trivial, zero-prerequisite exploitation against any reachable instance. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity makes this a credible threat to internet-facing deployments.
Denial-of-service in Oracle Helidon 4.5.1's Imperative Web Server component allows unauthenticated remote attackers to crash or indefinitely hang the service via crafted HTTP/2 traffic. Disclosed as part of Oracle's Critical Security Patch Update (CPU) for August 2026, the vulnerability is rated CVSS 7.5 with low attack complexity and no privileges required, making automated exploitation straightforward against any exposed instance. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Denial of service in Oracle Helidon 3.2.19's Imperative Web Server allows unauthenticated network attackers to hang or crash the server entirely via HTTP/2 traffic. The CVSS 3.1 score of 7.5 reflects the low attack complexity and complete availability impact, with no authentication or user interaction required. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Unauthenticated remote exploitation of Oracle Helidon 4.5.3's Imperative Web Server component allows attackers with HTTP network access to perform unauthorized read, write, and partial denial-of-service operations against data accessible to the service. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms this is easily exploitable with no prerequisites, though impacts are bounded to partial CIA effects within the unchanged scope of the Helidon instance. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Unauthenticated remote exploitation of Oracle Helidon 4.5.3's Imperative Web Server component allows network attackers over HTTP to achieve partial confidentiality disclosure, data manipulation, and denial of service - with a confirmed scope change indicating the impact can extend to components beyond Helidon's own security boundary. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C) places this among the most easily reachable vulnerability classes: no credentials, no user interaction, and no elevated complexity required. Disclosed in Oracle's August 2026 Critical Security Patch Update, no public exploit code or CISA KEV listing has been identified at time of analysis.
Scope-changing compromise of Oracle Helidon 4.5.3 (Imperative Web Server component) lets a remote, unauthenticated attacker send HTTP requests that grant high-integrity write access to Helidon-accessible data, partial read disclosure, and a partial denial of service - with impact that can extend beyond Helidon into adjacent products. Rated CVSS 3.1 9.9 due to the scope change combined with easy, no-privilege network exploitation. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated network exploitation of Oracle Helidon 4.5.3's Imperative Web Server component allows remote attackers to partially compromise confidentiality, integrity, and availability of the affected system, with a confirmed scope change meaning attacks can extend impact to additional co-located products or services. The vulnerability is rated 8.3 (High) under CVSS 3.1, elevated by the scope change despite individually low CIA impact ratings. No public exploit code has been identified at time of analysis, and Oracle disclosed this through its August 2026 Critical Patch Update.
Unauthenticated remote exploitation of Oracle Helidon 4.5.3's Imperative Web Server component allows attackers to bypass authentication controls via HTTP, resulting in unauthorized read access to a subset of application data and the ability to insert, update, or delete accessible records. The CVSS scope change (S:C) indicates successful exploitation can affect additional systems beyond the Helidon instance itself - a compounding factor in microservices topologies where Helidon acts as a gateway or intermediary. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the unauthenticated, low-complexity attack path makes this credible against any internet-exposed deployment.
Denial-of-service in Oracle Helidon 3.2.20 (Imperative Web Server component) allows unauthenticated remote attackers to repeatedly crash or indefinitely hang the server via crafted HTTP requests. The vulnerability is rated CVSS 7.5 with no authentication, no user interaction, and low attack complexity, making it trivially exploitable at scale against any exposed instance. No public exploit code or CISA KEV listing has been identified at time of analysis, though the ease of exploitation and complete availability impact warrant prompt patching.
Unauthenticated remote exploitation of Oracle Helidon 1.4.19's Imperative Web Server component via HTTP allows attackers to perform unauthorized creation, deletion, and modification of critical application data, with partial read access to Helidon-accessible data. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms zero barriers to exploitation - no credentials, no user interaction, and low attack complexity over standard HTTP. Reported via Oracle's Critical Patch Update for August 2026 and tagged as an Authentication Bypass, with no public exploit code or CISA KEV listing identified at time of analysis.
Authentication bypass in Oracle Helidon 1.4.19 (Imperative Web Server component of Oracle Fusion Middleware) lets a remote, unauthenticated attacker reach and manipulate protected data over HTTP, yielding full read and write access to all data the Helidon instance can reach. Oracle rates it CVSS 9.1 with High confidentiality and integrity impact and no availability impact, and describes it as easily exploitable. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated data compromise in Oracle Helidon 1.4.19 (Imperative Web Server component) lets a remote attacker send crafted HTTP requests to read, create, modify, or delete all Helidon-accessible data. Oracle rates it CVSS 3.1 9.1 (high confidentiality and integrity impact, no availability impact) and classifies it as an authentication-bypass-class flaw. No public exploit identified at time of analysis, but the low attack complexity and no-authentication requirement make it a high-priority patch item once Oracle's fix is applied.
Remote takeover in Oracle Helidon 1.4.20 (Imperative Web Server component of Oracle Fusion Middleware) allows an unauthenticated attacker with network access over HTTP to fully compromise the affected instance. The flaw carries a critical CVSS 3.1 base score of 9.8 with high impact to confidentiality, integrity and availability, and is described by Oracle as easily exploitable. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, so exploitation is not yet confirmed in the wild.
Unauthenticated remote compromise in Oracle Helidon 4.5.0's Imperative Web Server component lets network attackers reach critical data and disrupt service over plain HTTP with no credentials and no user interaction. Oracle rates it CVSS 3.1 9.4, reflecting high confidentiality and integrity impact plus partial denial of service, and it was disclosed in the Oracle Critical Patch Update of August 2026. No public exploit identified at time of analysis, but the trivial exploitability and unauthenticated network reach make it a top-tier patch priority.
Unauthenticated remote exploitation of Oracle Helidon 4.5.0's Imperative Web Server component allows network-adjacent attackers to partially compromise confidentiality, integrity, and availability via standard HTTP. The CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector confirms zero authentication or user interaction is required, and attack complexity is low - meaning successful exploitation demands minimal attacker skill or infrastructure. Disclosed through Oracle's Critical Patch Update for August 2026, no public exploit code has been identified at time of analysis, though the low-barrier network vector warrants prompt remediation for any internet-exposed Helidon deployment.
Unauthenticated compromise of Oracle Helidon 4.5.0 lets a remote attacker over HTTP read, create, modify, or delete all data accessible to the Helidon application via a flaw in the Imperative Web Server component. Oracle rates it CVSS 9.1 (high confidentiality and integrity impact, no availability impact), and the vendor tag 'Authentication Bypass' indicates protected routes/resources can be reached without credentials. No public exploit identified at time of analysis; addressed in the Oracle Critical Patch Update of August 2026.
Unauthenticated remote compromise of Oracle Helidon 3.2.18 (Imperative Web Server component) allows a network attacker to read, create, modify, or delete all data accessible to the framework over HTTP. Tagged by Oracle as an authentication bypass, it carries a CVSS 3.1 base score of 9.1 with high confidentiality and integrity impact and no availability impact. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but Oracle rates it as easily exploitable, warranting prompt patching.
Remote denial-of-service in Oracle Helidon 4.5.0 Imperative Web Server allows unauthenticated network attackers to cause a persistent hang or repeated crash of the service via HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial remote exploitation with no authentication or user interaction required, making this reliably triggerable against any exposed instance. No public exploit code or CISA KEV listing has been identified at time of analysis, but low attack complexity means operational risk for teams running Helidon 4.5.0 in production microservice environments is meaningful.
Remote takeover of Oracle Helidon 4.5.0 is possible when an unauthenticated attacker reaches the Imperative Web Server component over HTTP, per Oracle's August 2026 Critical Patch Update. The flaw yields full compromise of confidentiality, integrity, and availability (CVSS 9.8) without credentials or user interaction. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network-facing profile makes it a high-priority patch.
Unauthorized data exposure in Oracle Helidon 4.5.0's Imperative Web Server component allows unauthenticated, network-adjacent attackers to read critical application data via HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial exploitability with no authentication or user interaction required. Classified under the Authentication Bypass tag by Oracle, this vulnerability is covered in the Oracle Critical Patch Update for August 2026, with no public exploit code or CISA KEV listing identified at time of analysis.
Unauthorized data disclosure in Oracle Helidon 3.2.18's Imperative Web Server component allows unauthenticated remote attackers to access critical or all Helidon-accessible data via HTTP. The vulnerability is tagged as an authentication bypass, consistent with the CVSS vector showing no privileges or user interaction required (PR:N/UI:N) and a high confidentiality impact. Disclosed as part of Oracle's Critical Patch Update for August 2026, no public exploit or CISA KEV listing has been identified at time of analysis.
Complete takeover of Oracle Helidon 4.5.0 is achievable by remote, unauthenticated attackers over HTTP through the Imperative Web Server component, per Oracle's August 2026 Critical Patch Update. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N, full C/I/A impact) reflects easy exploitation with no privileges or user interaction. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Authentication bypass in Oracle Helidon 4.5.1 (Imperative Web Server component) exposes applications to unauthenticated remote attackers who can create, modify, or delete critical data accessible to the service via standard HTTP requests. Oracle classifies this as 'easily exploitable' with a CVSS 3.1 score of 7.5, reflecting a network-accessible, zero-complexity attack requiring no credentials or user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle addressed the issue in the August 2026 Critical Patch Update.
Unauthenticated remote denial-of-service in Oracle Helidon 3.2.19 allows a network attacker to hang or crash the Imperative Web Server component via crafted HTTP requests, causing complete loss of service availability. The vulnerability requires no privileges, no user interaction, and is reachable over standard HTTP, making it trivially exploitable against any exposed Helidon 3.2.19 instance. No public exploit code has been identified at time of analysis, and the flaw is not listed in the CISA KEV catalog.
Remote unauthenticated exploitation of Oracle Helidon 4.5.0's Imperative Web Server component via HTTP allows attackers to perform unauthorized read access to a subset of data, unauthorized data modification, and partial denial of service - all without credentials or user interaction. Oracle classifies this as 'easily exploitable' in its August 2026 Critical Patch Update advisory. No public exploit identified at time of analysis, but the low attack complexity and network accessibility make this a straightforward target for opportunistic attackers.
Unauthenticated remote exploitation of Oracle Helidon 4.5.0's Imperative Web Server component via HTTP allows attackers to read a subset of accessible data, perform unauthorized write/modify operations, and cause a partial denial of service. The CVSS vector confirms network accessibility with no authentication, no user interaction, and low attack complexity, making this easily exploitable against exposed deployments. No public exploit code or CISA KEV listing has been identified at time of analysis, but the trivial exploitation conditions warrant prompt patching.
Remote denial-of-service in Oracle Helidon 4.5.0's Imperative Web Server component allows unauthenticated network attackers to crash or indefinitely hang the server by sending crafted HTTP/2 traffic. The vulnerability carries a CVSS 7.5 rating with low attack complexity and no credential or interaction requirement, making it trivially scriptable from any network-accessible position. No active exploitation has been confirmed and no public proof-of-concept is known at time of analysis.
Unauthenticated remote access to sensitive data affects Oracle Helidon 4.5.0's Imperative Web Server component via HTTP/2, allowing an attacker with network access to read critical or all data accessible to the Helidon application. The vulnerability is tagged as an authentication bypass, consistent with the CVSS vector showing no privileges or user interaction required. No public exploit identified at time of analysis, and the flaw is disclosed through Oracle's Critical Patch Update for August 2026.
Unauthenticated remote exploitation of the Imperative Web Server component in Oracle Helidon 4.5.0 allows network-accessible attackers to perform unauthorized read and write operations against application-accessible data, with confirmed scope change indicating downstream impact on adjacent systems beyond the directly targeted Helidon instance. The vulnerability is tagged as an authentication bypass, meaning the HTTP-exposed service fails to enforce access controls on one or more endpoints. No public exploit code has been identified at time of analysis, and the issue is not listed in the CISA KEV catalog, though Oracle's Critical Patch Update advisory for August 2026 confirms the vulnerability's existence and assigns a CVSS 3.1 score of 7.2.
Authentication bypass in Oracle Helidon 3.2.18's Imperative Web Server allows remote unauthenticated attackers to read a subset of application data and make unauthorized modifications via HTTP, with a scope change indicating potential cascade impact to downstream services. The CVSS 3.1 score of 7.2 (High) is elevated by the scope change (S:C), reflecting Helidon's common role as a gateway or orchestrator in microservices architectures. No public exploit or CISA KEV listing has been identified at time of analysis, but the fully unauthenticated, low-complexity, network-accessible attack profile makes this a credible and time-sensitive patching priority for any internet-exposed deployment.
Unauthenticated information disclosure in Oracle Helidon 4.5.0's Imperative Web Server component exposes complete application data to remote network attackers via HTTP. Tagged as an authentication bypass, the flaw allows any unauthenticated actor with network access to read critical or all Helidon-accessible data without any privileges or user interaction. No patch version has been independently confirmed beyond the Oracle CPU August 2026 advisory, and no active exploitation has been identified at time of analysis.
Unauthenticated confidentiality breach in Oracle Helidon 3.2.18's Imperative Web Server component exposes all accessible data to remote attackers over HTTP. Tagged as an authentication bypass, this flaw requires no credentials, no user interaction, and no special network positioning - any attacker with HTTP access to a vulnerable instance can read critical application data. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-authentication requirement make this straightforward to exploit opportunistically.
Denial-of-service in Oracle Helidon 3.2.19's Imperative Web Server component allows remote unauthenticated attackers to cause a complete hang or repeatable crash via HTTP, fully disrupting service availability. The vulnerability requires no authentication, no user interaction, and no special configuration, making it trivially exploitable against any network-accessible Helidon 3.2.19 instance. No public exploit code has been identified and it does not appear in CISA KEV at time of analysis, though the low attack complexity elevates operational risk for any exposed deployment.
Unauthenticated remote attackers can create, delete, or modify critical data in Oracle Helidon 4.5.1 by bypassing authentication controls in the Imperative Web Server component over HTTP. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires only network reachability with no credentials, no user interaction, and no elevated access - placing this firmly in the easily exploitable category per Oracle's own classification. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity warrants prompt patching for any internet-exposed Helidon deployments.
Unauthenticated remote data exposure in Oracle Helidon 3.2.18's Imperative Web Server component allows network attackers to bypass authentication and gain complete access to data served by the application via HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no credentials, user interaction, or special access are required, and Oracle's own advisory characterizes the vulnerability as 'easily exploitable.' No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis, but the authentication bypass nature paired with a High confidentiality impact warrants prompt remediation.
Authentication bypass in Oracle Helidon 4.5.1's Imperative Web Server component allows unauthenticated remote attackers to read a subset of accessible data and perform unauthorized insert, update, or delete operations via HTTP. The vulnerability carries a scope-change designation (S:C in CVSS), meaning successful exploitation may cascade beyond Helidon itself to impact additional products or services in the surrounding microservices environment. No public exploit code or active exploitation has been confirmed at time of analysis, but the zero-prerequisite attack profile - no authentication, low complexity, no user interaction - makes this straightforward to exploit once the bypass mechanism is understood.
Unauthenticated network exploitation of Oracle Helidon 3.2.19's Imperative Web Server component allows remote attackers to bypass authentication over HTTP, gaining unauthorized read access to a subset of data and the ability to insert, update, or delete accessible data. The CVSS S:C scope change is particularly significant: in microservices environments where Helidon acts as a service layer, successful exploitation may cascade to impact downstream or co-located systems beyond the initially compromised component. No public exploit code or CISA KEV listing is confirmed at time of analysis, but the zero-prerequisites attack profile (AV:N/AC:L/PR:N/UI:N) and scope change make this a prioritized patching target for any organization running the affected version.
Unauthenticated data compromise in Oracle Helidon 4.5.0 (Imperative Web Server component of Oracle Fusion Middleware) lets a remote attacker reach and manipulate all data accessible to the framework over HTTP. Tagged as an authentication bypass, it carries a CVSS 9.1 with high confidentiality and integrity impact but no availability impact. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Authentication bypass in Oracle Helidon 3.2.18 (Imperative Web Server component of Oracle Fusion Middleware) lets an unauthenticated remote attacker send crafted HTTP requests to read, create, modify, or delete any data the application can access. Rated CVSS 9.1 with high confidentiality and integrity impact but no availability impact, it is trivially exploitable over the network with no user interaction. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated remote compromise of Oracle Helidon 4.5.0 (Imperative Web Server component, part of Oracle Fusion Middleware) lets a network attacker read, create, delete or modify all Helidon-accessible data and cause a partial denial of service, all over HTTP without credentials. Oracle rates this CVSS 9.4 and tags it as an authentication bypass, meaning attackers reach protected functionality without logging in. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated remote compromise of Oracle Helidon 3.2.18 (Imperative Web Server component) lets network attackers read, alter, or destroy all data the framework can access and degrade its availability. The flaw is remotely reachable over HTTP with no authentication or user interaction and carries a CVSS 3.1 base score of 9.4. It was disclosed in Oracle's August 2026 Critical Patch Update; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Full remote takeover in Oracle Helidon 3.2.18 (Fusion Middleware, Imperative Web Server component) allows an unauthenticated attacker with only HTTP network access to fully compromise the affected instance. Oracle rates the flaw CVSS 3.1 9.8 with high confidentiality, integrity, and availability impact and describes it as "easily exploitable," fixed in the August 2026 Critical Patch Update. There is no public exploit identified at time of analysis and the CVE is not on CISA KEV, but the unauthenticated network-facing profile makes it a high-priority patch.
Full instance takeover of Oracle Helidon 3.2.18 (Imperative Web Server component) is achievable by a low-privileged remote attacker over HTTP, though exploitation demands high attack complexity. The CVSS 3.1 score of 7.5 reflects complete confidentiality, integrity, and availability compromise - consistent with the vendor description of 'takeover' - affecting Oracle Fusion Middleware deployments running this specific release. No public exploit code or CISA KEV listing exists at time of analysis; Oracle addressed this in the August 2026 Critical Security Patch Update (CSPU).
Unauthenticated remote attackers can bypass access controls in the Imperative Web Server component of Oracle Helidon 3.2.18, gaining complete read access to all data accessible by the application and limited ability to modify or insert records via HTTP. Oracle classifies this as 'easily exploitable' with a CVSS 3.1 score of 8.2 (High), reflecting a fully network-accessible, zero-complexity attack requiring no credentials or user interaction. No public exploit code has been identified at time of analysis, and the vulnerability is addressed in Oracle's Critical Security Patch Update for August 2026.
Unauthorized data disclosure in Oracle Helidon 3.2.18's Imperative Web Server component exposes all Helidon-accessible data to unauthenticated remote attackers via HTTP. Tagged as an Authentication Bypass, the flaw enables any network-positioned attacker to read critical or complete Helidon-managed data without credentials or user interaction, as confirmed by the AV:N/AC:L/PR:N/UI:N CVSS 3.1 vector. No public exploit has been identified at time of analysis, but the absence of any exploitation prerequisites significantly elevates real-world urgency for any internet-facing or internally networked Helidon 3.2.18 deployment.
Unauthorized data access and partial data manipulation in Oracle Helidon 3.2.18's Imperative Web Server component allows a low-privileged attacker with HTTP network access to gain complete read access to all Helidon-accessible data and limited write capability. The vulnerability carries a scope change, meaning successful exploitation can cascade to impact additional products beyond Helidon itself within the Oracle Fusion Middleware ecosystem. No public exploit code has been identified at time of analysis, but the low attack complexity and absence of required user interaction make this a realistic target for authenticated internal or service-account-level adversaries.
Remote unauthenticated denial-of-service in Oracle Helidon 1.4.20 allows network-accessible attackers to crash or indefinitely hang the Imperative Web Server via HTTP, with no authentication or user interaction required. The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms trivially low exploitation complexity against exposed instances. No public exploit code or CISA KEV listing exists at time of analysis, but the combination of network accessibility and zero prerequisites makes this a realistic operational risk for any deployment of the affected version.
Remote takeover in Oracle Helidon 4.5.0 lets an unauthenticated attacker fully compromise the framework's Imperative Web Server component over HTTP. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact and no authentication or user interaction required, per Oracle's August 2026 Critical Patch Update. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the trivial exploitability rating warrants urgent patching.
Full compromise of Oracle Hyperion Financial Management version 11.2.25.0.000 is achievable by low-privileged network attackers via HTTP, targeting the Security component to gain complete control over confidentiality, integrity, and availability. The CVSS 3.1 score of 8.8 reflects the combination of network accessibility, low attack complexity, and no user interaction required beyond a valid low-privilege account. No public exploit code or CISA KEV listing has been identified at time of analysis, though the severity of the stated outcome - full system takeover - warrants immediate patch application.
Critical data exposure and integrity compromise in Oracle Communications Unified Inventory Management (UIM) allows unauthenticated network attackers to read or tamper with all UIM-accessible data via a vulnerable third-party component over HTTP. Affected versions span 7.5.0 through 8.0.1, covering a wide active deployment range. The vulnerability carries an Authentication Bypass tag and is rated CVSS 7.4 with High Complexity, meaning exploitation is non-trivial but requires no credentials - no public exploit or CISA KEV listing has been identified at time of analysis.
Unauthorized data disclosure in Oracle Communications Unified Inventory Management (versions 7.5.0-7.5.1, 7.6.0-7.8.0, and 8.0.1) exposes critical inventory data to unauthenticated remote attackers over HTTP. The flaw resides in the Security Component and is tagged as an Authentication Bypass, meaning the platform's access controls can be circumvented without any credentials or user interaction, granting complete read access to all data the application can reach. No public exploit has been identified at time of analysis, and the vulnerability is not currently listed in CISA KEV, but the trivially low exploitation complexity makes rapid patching essential.
Oracle VM VirtualBox 7.2.14 Core component exposes a scope-changing integrity vulnerability that allows a local unauthenticated attacker - with logon access to the infrastructure hosting the hypervisor - to critically compromise VirtualBox data when a legitimate third party interacts with the product. The attack vector is local and requires human interaction, but the CVSS scope change (S:C) indicates that a successful exploit can break VM containment and significantly impact the host system or co-resident components beyond VirtualBox itself. No public exploit is identified at time of analysis, and the vulnerability is addressed via Oracle's August 2026 Critical Security Patch Update.
Local privilege escalation and denial-of-service in Oracle VM VirtualBox 7.2.14 allows a high-privileged attacker with local infrastructure access to crash the hypervisor, partially read or modify VM-accessible data, and - critically - extend impact beyond the vulnerable instance to additional products via a confirmed scope change. The CVSS 3.1 vector (AV:L/PR:H/S:C/A:H) indicates this is not a remote threat but a post-compromise or insider-level concern targeting the virtualization layer. No public exploit code or active exploitation has been identified at time of analysis, and Oracle disclosed this through its Critical Patch Update for August 2026.
Local privilege escalation with scope change in Oracle VM VirtualBox 7.2.14 allows a high-privileged local attacker to crash the hypervisor repeatedly, modify limited guest data, and read a subset of accessible data - with impacts that extend beyond the VirtualBox process to additional co-hosted products. No public exploit code has been identified at time of analysis, and this vulnerability is not currently listed in the CISA KEV catalog. The scope change (S:C in CVSS) is the critical differentiator, indicating that a compromised VirtualBox instance can affect the host OS or sibling VMs, raising the actual blast radius above what the per-component impact ratings suggest.
Full takeover of Oracle VM VirtualBox 7.2.14 is achievable by a local, unprivileged attacker who can induce a victim user to interact with a malicious guest or crafted input, with the scope change indicator in the CVSS vector (S:C) strongly suggesting a guest-to-host boundary breach impacting the underlying infrastructure. The complete C:H/I:H/A:H impact triad confirms that successful exploitation results in total loss of confidentiality, integrity, and availability of both the VirtualBox process and potentially the host system. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Remote unauthenticated exploitation of Oracle VM VirtualBox 7.2.14 via its RDP component allows attackers to bypass authentication and gain full read access to all VirtualBox-accessible session data as well as limited write capability, without requiring any credentials or user interaction. The vulnerability resides in the Core component's Virtual Remote Desktop Extension (VRDE), exposed over the network via RDP. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the zero-authentication network vector and low attack complexity make this a high-priority patching candidate for any deployment with VRDE enabled.
Full takeover of Oracle VM VirtualBox 7.2.14 is achievable by a locally-authenticated, high-privileged attacker, with confirmed scope change indicating the compromise extends beyond the hypervisor to additional products - consistent with a VM escape or host privilege escalation pattern. The CVSS vector (AV:L/PR:H/S:C/C:H/I:H/A:H) signals that despite the elevated privilege bar, successful exploitation yields complete confidentiality, integrity, and availability impact across system boundaries. No public exploit code or CISA KEV listing has been identified at time of analysis, though the vulnerability is disclosed via Oracle's August 2026 Critical Patch Update advisory.
Full takeover of Oracle VM VirtualBox 7.2.14 is achievable by a low-privileged local attacker through a high-complexity exploit targeting the Core component, with successful attacks crossing the VM boundary to significantly impact the host and potentially co-hosted workloads. The scope change indicated in the CVSS vector (S:C) is consistent with a VM escape class of vulnerability, making this critical in shared or multi-tenant infrastructure despite the local access prerequisite. No public exploit code or active exploitation has been identified at the time of analysis; exploitation probability remains unquantified due to the absence of EPSS data.
Full system takeover is achievable in Oracle Business Intelligence Enterprise Edition 26.01.0.0.0 via specially crafted HTTP requests targeting the Platform Security component from a high-privileged, network-adjacent attacker. The CVSS 3.1 score of 8.0 reflects a scope-changed exploit with complete Confidentiality, Integrity, and Availability impact, meaning successful compromise can cascade to systems integrated with or hosted alongside the BIEE instance. No public exploit identified at time of analysis, and exploitation requires high attack complexity and high-privilege credentials, but the full-takeover outcome warrants prioritized patching through the August 2026 Oracle CPU.
Full takeover of Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a high-privileged local attacker exploiting a flaw in the Security component, with confirmed scope change enabling impact on additional adjacent products. The CVSS vector (AV:L/AC:H/PR:H) reflects a difficult-to-exploit, infrastructure-local attack requiring significant access prerequisites, yet successful exploitation yields complete confidentiality, integrity, and availability compromise. No public exploit code or CISA KEV listing has been identified at time of analysis; risk is best understood as an insider or post-compromise escalation threat rather than an opportunistic remote attack.
Full hypervisor takeover in Oracle VM VirtualBox 7.2.14 is achievable by a locally authenticated, highly privileged attacker exploiting a flaw in the Core component, with successful attacks producing a scope change that may compromise systems beyond the primary VirtualBox instance. The CVSS vector confirms local-only access with high privilege and complexity prerequisites, but the S:C scope change elevates real-world impact substantially - a compromised hypervisor exposes all hosted guest VMs and their data. Disclosed in Oracle's August 2026 Critical Security Update, no public exploit code has been identified and the vulnerability does not appear in the CISA KEV catalog at time of analysis.
Unauthenticated remote denial-of-service in Oracle VM VirtualBox 7.2.14 allows a network attacker to hang or crash the hypervisor via the RDP interface without any credentials or user interaction. The vulnerability resides in the Core component and is rated easily exploitable by Oracle, yielding complete availability loss of the affected VirtualBox instance. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the low attack complexity and zero authentication requirement make this straightforward to trigger against exposed deployments.
Full system takeover of Oracle PeopleSoft Enterprise FIN Common Objects 9.2 is achievable by an unauthenticated remote attacker over HTTP, with successful exploitation yielding complete compromise of confidentiality, integrity, and availability. The vulnerability resides in the Security component and is categorized as difficult to exploit, reflected in the CVSS AC:H rating, suggesting a precision exploitation condition such as a race condition or specific state requirement. No public exploit code or CISA KEV listing has been identified at time of analysis, but the total-takeover impact and unauthenticated network vector make this a high-priority finding for any organization running affected PeopleSoft FIN deployments.
Local privilege escalation in Oracle Identity Manager's Installer component allows a low-privileged authenticated attacker to fully compromise the OIM instance on versions 12.2.1.4.0 and 14.1.2.1.0. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms that any low-privileged OS user with local logon access to the OIM infrastructure can achieve complete confidentiality, integrity, and availability impact - effectively a full system takeover - with low complexity and no user interaction required. No public exploit identified at time of analysis, and no CISA KEV listing has been confirmed.
Unauthorized data access and tampering in Oracle Helidon 4.5.0's Imperative Web Server component allows low-privileged authenticated attackers to read or modify critical application data over HTTPS. The vulnerability is tagged as an authentication bypass, suggesting that a legitimately authenticated low-privilege user can circumvent authorization controls to access or alter data beyond their permitted scope. No public exploit code or CISA KEV listing has been identified at time of analysis, but the 8.1 CVSS score and high confidentiality and integrity impacts make this a meaningful risk in any deployment where untrusted low-privileged users have HTTPS access.
Unauthenticated remote data exposure in Oracle Business Intelligence Enterprise Edition (OBIEE) versions 8.2.0.0.0 and 26.01.0.0.0 allows network-adjacent attackers to read critical or all accessible analytics data via HTTP without credentials. The authentication bypass (per vendor tagging) in the Analytics Server component yields complete confidentiality loss - CVSS C:H - with no integrity or availability impact. No public exploit or CISA KEV listing has been identified at time of analysis, though Oracle's own security team reported and patched this issue in the August 2026 CPU, suggesting internal discovery.
Remote unauthenticated takeover of Oracle Hospitality OPERA 5 Property Services (Opera Servlet component) is possible in versions 5.6.28.0 through 5.6.28.1 via HTTP, with an attacker requiring no privileges and only low attack complexity. The UI:R CVSS metric indicates exploitation depends on human interaction from a non-attacker party, consistent with client-side injection or CSRF-style attack patterns targeting hotel staff sessions. Full compromise of confidentiality, integrity, and availability is confirmed as the impact; no public exploit has been identified at time of analysis and the vulnerability is not currently listed in CISA KEV.
Full system takeover of Oracle HRMS (Netherlands) versions 12.2.3 through 12.2.15 is achievable by a high-privileged remote attacker targeting the Netherlands Payroll component over HTTP. The CVSS vector confirms network accessibility with low attack complexity, no user interaction, and complete compromise of confidentiality, integrity, and availability upon successful exploitation. No public exploit has been identified at time of analysis, and the vulnerability is not currently listed in the CISA KEV catalog.
Remote tampering and denial-of-service in Oracle Database Server's Portable Clusterware component lets an unauthenticated attacker reach the service over HTTP and manipulate or destroy critical cluster data, or force a complete, repeatable crash. Affected releases span 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3, carrying a CVSS 3.1 base score of 9.1 driven purely by high Integrity and Availability impact (confidentiality is untouched). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability (network, low complexity, no privileges, no user interaction) makes it a high-priority patch item.
Local privilege escalation in Oracle HRMS (US), part of Oracle E-Business Suite versions 12.2.3 through 12.2.15, allows a low-privileged attacker with operating system logon to the infrastructure host to achieve full takeover of the HRMS application. The vulnerability resides in the US Payroll Tax Issues component and results in complete compromise of confidentiality, integrity, and availability. No public exploit code or active exploitation has been identified at time of analysis, though Oracle flagged this in its August 2026 Critical Patch Update.
Full system takeover of Oracle Business Intelligence Enterprise Edition 26.01.0.0.0 is achievable by a high-privileged attacker over HTTP, targeting the Analytics Web Answers component with no user interaction required. The C:H/I:H/A:H impact triad confirms complete compromise of confidentiality, integrity, and availability once exploitation succeeds. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the low attack complexity (AC:L) means that any attacker who clears the authentication barrier faces minimal technical obstacles to achieving full takeover.
Local privilege escalation in Oracle Business Intelligence Enterprise Edition 26.01.0.0.0 allows a low-privileged attacker with local logon access to the host infrastructure to fully compromise the application, achieving confidentiality, integrity, and availability takeover. The attack complexity is rated high, indicating non-trivial exploitation conditions must be met. No public exploit or active exploitation has been identified at time of analysis, but full system takeover is the confirmed impact per Oracle's advisory.
Local privilege escalation in Oracle Business Intelligence Enterprise Edition 26.01.0.0.0 allows a low-privileged attacker with OS-level logon to the hosting infrastructure to achieve full takeover of the BIEE instance. The Platform Security component contains an easily exploitable flaw that, once triggered, yields complete confidentiality, integrity, and availability compromise - equivalent to host-level control over the analytics platform. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low complexity and absence of user-interaction requirements make this straightforward to exploit once local access is established.
Partial authentication bypass in Oracle Business Intelligence Enterprise Edition's BI Platform Security component allows a low-privileged remote attacker to compromise both confidentiality and integrity of critical OBIEE data, with a scope change indicating spillover impact on additional Oracle products within the same environment. Affected versions span three distinct release lines - 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0 - covering a wide enterprise install base. No public exploit code or CISA KEV listing is confirmed at time of analysis, but the combination of high-impact scope change and low privilege requirement elevates urgency even given the high attack complexity.