Oracle
Monthly
Unauthenticated blind server-side request forgery in sgoudelis Ground Station before 0.6.0 lets any network attacker coerce the ground-station process into issuing outbound HTTP requests to arbitrary destinations, including cloud instance metadata at 169.254.169.254 and internal RFC1918/loopback services. Because the Socket.IO server on port 7000 enforces no authentication and uses a wildcard CORS policy, an attacker persists a malicious orbital-source URL and triggers a sync, then reads returned HTTP status codes and error strings as an oracle for probing the internal network. There is no public exploit identified at time of analysis, but the flaw is durable: the malicious source survives restarts and re-fires automatically every 24 hours.
Password recovery in Eclipse Milo (the open-source OPC UA SDK for Java) versions 0.6.0 through 1.1.4 allows an on-path attacker to break username-token confidentiality via a Bleichenbacher-style padding oracle. The server returns distinguishable error responses for invalid RSA PKCS#1 v1.5 padding versus other authentication failures during username-token processing, so an attacker who captures a victim's Basic128Rsa15-encrypted username token can send repeated unauthenticated ActivateSession requests to recover the cleartext password and then authenticate as the victim. No public exploit identified at time of analysis and it is not listed in CISA KEV; the weakness and its upstream fix are confirmed by the Eclipse Foundation.
PKCS#7 EnvelopedData decryption in the Python cryptography library (versions 44.0.0-49.x) leaks a Bleichenbacher oracle through four distinguishable error messages and timing side-channels during RSA PKCS#1 v1.5 key unwrapping, exposing the exact recovered plaintext length in one case. An attacker who can submit crafted EnvelopedData to an auto-decrypting service - such as an S/MIME gateway or mail filter that reflects outcomes at high volume - can adaptively recover the content-encryption key and decrypt intercepted messages. No public exploit has been identified at time of analysis, and exploitation requires very specific deployment conditions; the fix in version 50.0.0 applies RFC 3218 indistinguishability by substituting a random key on any failure.
Blind SQL injection in Shlink's tag statistics REST endpoint allows any API key holder to extract sensitive data from the underlying database across all tenants. The unvalidated `direction` value of the `orderBy` query parameter flows unsanitized into a Doctrine QueryBuilder ORDER BY clause, enabling time-based, boolean-oracle, and error-based extraction of long URLs, visitor records, IP addresses, geolocation data, user agents, and hashed API key secrets. A public proof-of-concept exploit is available on GitHub, no public exploit identified at time of analysis as confirmed actively exploited, but the low barrier to exploitation - any valid API key suffices - makes this a genuine remediation priority for Shlink operators.
SQL injection in the Sequelize Node.js ORM (versions prior to 6.37.4) allows remote attackers to inject arbitrary SQL through application values that reach the string-escaping routine, but only when the ORM is configured with the Oracle dialect. The escape() function in sql-string.js returns any string beginning with TO_TIMESTAMP or TO_DATE verbatim without doubling single quotes, letting a crafted value break out of the intended literal. Publicly available exploit code exists in the GitHub Security Advisory (GHSA-v8fg-2rw7-q452); there is no CISA KEV listing and no EPSS score was provided.
Broken access control in SiYuan versions before 3.7.3 lets publish-mode readers - including anonymous users when publish Basic Auth is disabled - retrieve the rendered content of publish-forbidden documents by calling the /api/ref/getBacklinkDoc and /api/ref/getBackmentionDoc endpoints directly with a target document ID. Although the corresponding backlink list endpoints correctly filter publish-forbidden documents, these two content endpoints are gated only by CheckAuth and omit the publish-access filter, exposing DOM content and a reference-existence oracle. Reported by VulnCheck; no public exploit identified at time of analysis and not listed in CISA KEV.
Bouncy Castle for Java's OpenPGP session-key decryption path re-exposes the Mister-Zuccherato adaptive-chosen-ciphertext oracle by failing to suppress the legacy CFB 'quick check' on the PKESK/session-key route, enabling an attacker with decryption oracle access to recover plaintext from SEIPD v1 encrypted messages. Affected are bc-java before 1.85, bc-lts-java before 2.73.12, and BC-FJA (bcpg-fips) across the 1.0.X, 2.0.X, and 2.1.X series - three distinct product lines used broadly in enterprise and open-source Java applications. No public exploit or CISA KEV listing has been identified at time of analysis; however, the attack technique is well-established in cryptographic literature dating to the Mister-Zuccherato paper.
Cross-tenant information disclosure in the self-hosted task manager Vikunja (0.24.0 through 2.3.0) lets a holder of any project share link read kanban bucket records - bucket titles and the full created_by user object (username, name, id) - belonging to other tenants' project views, because the task-collection endpoint loads the view from the attacker-controlled URL path without re-authorizing it. The same missing pre-authorization check yields a project/view-ID existence oracle (404 vs non-404) usable by link shares and ordinary authenticated users. No public exploit identified at time of analysis; fixed in 2.4.0.
Path traversal in NLTK's FramenetCorpusReader (versions ≤3.9.4) allows a caller-supplied frame name containing ../ sequences to escape the corpus root and read arbitrary XML files accessible to the process, silently bypassing the nltk.pathsec sandbox even when ENFORCE=True is explicitly enabled. Any web service or pipeline that routes user-controlled input into FramenetCorpusReader.frame() is directly exposed, with full parsed content of frame-shaped XML files returned to the caller and a file-existence oracle for all other XML paths. A working proof-of-concept is publicly available in the GitHub security advisory; the vulnerability is not listed in CISA KEV at time of analysis.
Unauthenticated information disclosure in ComfyUI (comfy-org/comfyui) before 0.28.0 lets remote attackers read arbitrary image-decodable files and enumerate the host filesystem via the get_model_preview endpoint, which joins an unrestricted {filename:.*} route capture to the model directory with no containment check (CWE-22). Attackers can use literal ../, percent-encoded %2e%2e%2f, absolute paths, or an unbounded path_index to escape the model folder; disclosure is bounded to files Pillow can decode plus a file-existence/path-enumeration oracle. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the issue is fixed in version 0.28.0.
Error-based SQL injection in Koollab LMS 5.3.2 lets an authenticated attacker abuse the face-to-face runs update endpoint as a SQL oracle to exfiltrate the entire application database, including valid JWT tokens that enable full account takeover. Rated CVSS 8.1 with high confidentiality and integrity impact; there is no public exploit identified at time of analysis and EPSS is low at 0.25% (17th percentile). SSVC scores technical impact as total but exploitation as none, indicating no observed use so far.
Blind SQL injection in Koollab LMS enables unauthenticated attackers to exfiltrate sensitive database contents, including credentials and JWT tokens, through its SSO OAuth endpoint without user interaction. This critical flaw (CVSS 9.1) can lead to full account takeover, but no public exploit or active exploitation has been confirmed at this time.
Arbitrary file read in PostCSS (npm postcss <= 8.5.11) lets an attacker who controls CSS input embed a `/*# sourceMappingURL=PATH */` comment that the PreviousMap parser dereferences directly against the local filesystem with no scheme, allowlist, or traversal check. Because the read fires under default options (no `from`, `map`, or plugins), any pipeline that processes untrusted CSS is reachable; when the resulting `JSON.parse` SyntaxError is surfaced to the caller it leaks roughly the first 10 bytes of the targeted file, and the same code path yields a file-existence oracle and a DoS primitive. Publicly available exploit code exists (POC), but there is no public evidence of active exploitation, and EPSS is low at 0.50% (40th percentile).
Takeover of Oracle Platform Security for Java (OPSS) is possible where a low-privileged attacker with HTTP network access can fully compromise the confidentiality, integrity, and availability of the service. The flaw resides in the Centralized Thirdparty Jars component and affects Oracle Fusion Middleware releases 12.2.1.4.0 and 14.1.2.0.0. It carries a CVSS 3.1 base score of 8.8 and was disclosed in the Oracle Critical Patch Update of July 2026; no public exploit identified at time of analysis.
Full compromise of Oracle Platform Security for Java (OPSS) in Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0 is possible by a low-privileged attacker over HTTP, targeting the Centralized Thirdparty Jars component. Oracle rates the flaw 8.8 and describes it as 'easily exploitable,' with successful attacks yielding complete takeover (high confidentiality, integrity, and availability impact). No public exploit is identified at time of analysis and the CVE is not listed in CISA KEV.
Full compromise of Oracle Platform Security for Java (OPSS) in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with network access over HTTP to take over the component, per Oracle's July 2026 Critical Patch Update. The flaw yields high confidentiality, integrity, and availability impact and is rated easily exploitable (CVSS 8.8), though no public exploit identified at time of analysis. Because OPSS underpins authentication, authorization, and credential management for the wider Fusion Middleware stack, a takeover has cascading security consequences.
Full compromise of Oracle Platform Security for Java (OPSS), a security framework within Oracle Fusion Middleware, is possible when a low-privileged attacker reaches the affected instance over HTTP via the Centralized Thirdparty Jars component. Oracle rates the flaw CVSS 3.1 8.8 and describes it as "easily exploitable," resulting in a complete takeover of OPSS with high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis and it is not in CISA KEV, but the low attack complexity and only a low-privilege authenticated prerequisite make it a strong candidate for prompt patching in Oracle environments.
Full compromise ("takeover") of Oracle Platform Security for Java (OPSS), a core security framework shipped inside Oracle Fusion Middleware, is possible by an unauthenticated remote attacker over HTTP against versions 12.2.1.4.0 and 14.1.2.0.0. Oracle rates this 9.8 with full confidentiality, integrity, and availability loss and describes it as "easily exploitable," so it should be treated as a top-priority patch in the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitation profile (no authentication, no user interaction) makes it an attractive target once details or patches are reverse-engineered.
Full takeover of Oracle Platform Security for Java (OPSS), a security framework within Oracle Fusion Middleware, is possible for a low-privileged attacker positioned on the same physical communication segment as the host. Disclosed in Oracle's July 2026 Critical Patch Update, the flaw carries a CVSS 3.1 score of 8.0 and a scope change, meaning successful exploitation can significantly impact additional products beyond OPSS itself. Exploitation is rated difficult (AC:H) and there is no public exploit identified at time of analysis, so risk is elevated by potential blast radius rather than by ease of attack.
Full takeover of Oracle Platform Security for Java (OPSS), a security framework bundled with Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0, is possible via its Centralized Thirdparty Jars component. A low-privileged attacker with HTTP network access can compromise confidentiality, integrity, and availability, though the attack is rated difficult to execute (high attack complexity). No public exploit identified at time of analysis and the flaw is not in CISA KEV, but it was disclosed by Oracle in the July 2026 Critical Patch Update.
Full compromise of Oracle Platform Security for Java (OPSS) in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 is achievable by a low-privileged attacker over HTTP through the Centralized Thirdparty Jars component. Because the flaw carries a scope change, successful exploitation can result in complete takeover of OPSS and significantly impact additional connected products, earning a near-maximum CVSS 3.1 base score of 9.9. No public exploit has been identified at time of analysis, but the low attack complexity and minimal privilege requirement make this a high-priority patch.
Full takeover of Oracle Platform Security for Java (OPSS) is possible in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0, where a low-privileged attacker with network access can compromise the component via crafted SOAP requests. Oracle rates this CVSS 8.8 with high confidentiality, integrity, and availability impact, meaning successful exploitation yields complete control of the OPSS component rather than mere data exposure. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote takeover of Oracle Platform Security for Java (OPSS), a security framework bundled with Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0, allows an unauthenticated attacker with HTTP network access to fully compromise the component. Rated CVSS 3.1 9.8 with high confidentiality, integrity, and availability impact, Oracle describes it as 'easily exploitable' via the Centralized Thirdparty Jars component. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and lack of authentication make it a high-priority patch.
Complete takeover of Oracle Platform Security for Java (OPSS) in Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0 is possible by an unauthenticated remote attacker over HTTP, per Oracle's July 2026 Critical Patch Update. The flaw resides in the 'Centralized Thirdparty Jars' component and carries a maximum CVSS 3.1 base score of 10.0 with a scope change, meaning successful exploitation can significantly impact products beyond OPSS itself. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the perfect CVSS score and 'easily exploitable' vendor language make this a top-priority patch.
Remote code execution in Fujitsu openFT managed file transfer software (Linux and Oracle Solaris variants) before version 12.1D00 lets remote attackers run arbitrary code without authentication (pre-auth RCE) over the network. The flaw is a CWE-94 code injection carrying a CVSS 4.0 base score of 9.3, and the CVSS vector confirms it needs no privileges and no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the pre-auth, network-reachable nature makes it a high-priority patch target.
Local privilege escalation in Fujitsu openFT (managed file transfer) on GNU/Linux and Oracle Solaris allows an already-authenticated local user to gain root privileges on versions before 12.1D00. The flaw stems from improper privilege management (CWE-269) and carries a CVSS 4.0 base score of 8.5 (High). No public exploit identified at time of analysis; the intelligence was obtained internally by the Fsas Technologies PSIRT rather than from public disclosure.
Information disclosure in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 lets remote unauthenticated attackers abuse the RadAsyncUpload control's client-state handling as a cryptographic oracle. Because the server distinguishes decryption failures from invalid-JSON parse failures, an attacker can iteratively probe the encrypted rauPostData token and recover protected metadata values. No public exploit identified at time of analysis, and it is not listed in CISA KEV; EPSS was not provided.
Local privilege escalation to full takeover in the Install component of Oracle Java SE (8u491, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1), Oracle GraalVM for JDK (17.0.19, 21.0.11), and Oracle GraalVM Enterprise Edition (21.3.18) lets a low-privileged local user compromise the runtime and take it over with full confidentiality, integrity, and availability loss. Oracle rates it 7.8 (High) and describes it as easily exploitable by an attacker holding only a logon to the host. No public exploit has been identified at time of analysis and it is not on CISA KEV.
Unauthorized data disclosure in Oracle HRMS (UK) UK Payroll component of Oracle E-Business Suite 12.2.3 through 12.2.15 allows a low-privileged, authenticated remote attacker over HTTP to read all HRMS (UK)-accessible data, with a scope change that can significantly impact additional products beyond the vulnerable module. Rated CVSS 3.1 7.7 (High) for confidentiality-only impact, it was reported by Oracle and patched in the July 2026 Critical Patch Update; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data access in Oracle HRMS (US) within Oracle E-Business Suite (US Payroll Year End component) lets a low-privileged, network-based attacker read all HRMS-accessible data and modify some of it. Affected supported releases are 12.2.3 through 12.2.15, addressed in the Oracle July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and no CISA KEV listing, so this is not confirmed as actively exploited despite the sensitive payroll data at stake.
Full compromise of Oracle HRMS (US) is possible in Oracle E-Business Suite versions 12.2.3 through 12.2.15 via the Internal Operations component, where a low-privileged attacker with local logon access to the hosting infrastructure can escalate to complete takeover of the HRMS module. The flaw yields high confidentiality, integrity, and availability impact (CVSS 3.1 7.8) and is fixed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Unauthorized data access in Oracle E-Business Suite HRMS (Norway) allows a low-privileged remote attacker to read all HRMS-accessible data over HTTP, with a scope change that may significantly impact other integrated products. The flaw affects EBS releases 12.2.3 through 12.2.15 and is addressed in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the confidentiality-only, network-exploitable nature nonetheless makes it a meaningful data-exposure risk in HR environments.
Sensitive data disclosure in Oracle HRMS (UK) UK Payroll, part of Oracle E-Business Suite 12.2.3 through 12.2.15, lets a low-privileged attacker with HTTP network access read all HRMS-accessible data and modify some of it. The flaw is exploitable by an authenticated user (CVSS 3.1 PR:L) and carries a base score of 7.1 with high confidentiality and low integrity impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though Oracle E-Business Suite payroll modules are high-value targets holding PII and financial data.
Unauthorized data compromise in Oracle HRMS (UK) UK Payroll component of Oracle E-Business Suite (versions 12.2.3 through 12.2.15) allows a low-privileged, network-authenticated attacker to read, create, delete, and modify all HRMS-accessible data over HTTP. The scope-change (S:C) rating means a successful attack can pivot beyond HRMS to significantly impact other Oracle EBS products, yielding a CVSS 3.1 base score of 9.6. No public exploit identified at time of analysis; the fix is delivered in Oracle's July 2026 Critical Patch Update.
Full compromise of the Oracle HRMS (US) module within Oracle E-Business Suite is achievable by a high-privileged attacker over HTTP against the Internal Operations component, affecting supported releases 12.2.3 through 12.2.15. A successful attack yields complete takeover of the HRMS (US) subsystem with high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; it was reported through Oracle's internal security alert channel and fixed in the July 2026 Critical Patch Update.
Takeover of Oracle Workflow in Oracle E-Business Suite (versions 12.2.3 through 12.2.15) is possible when an unauthenticated attacker reaches the Workflow Notification Mailer over SMTP. The high-difficulty flaw (CVSS 3.1 base 8.1, AC:H) yields full compromise of the Workflow component with confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided.
Full takeover of the Oracle Applications Framework (Web Utilities component) is possible in Oracle E-Business Suite 12.2.8 through 12.2.15, where a high-privileged attacker with HTTP network access can compromise confidentiality, integrity, and availability. Oracle rates it CVSS 9.1 largely because the scope-changed impact extends beyond the framework to additional bundled EBS products. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but it was fixed in Oracle's July 2026 Critical Patch Update.
Privilege-abusing account takeover in Oracle Applications Framework (Web Utilities component) of Oracle E-Business Suite 12.2.11 through 12.2.15 lets a low-privileged, network-authenticated attacker fully compromise the framework over HTTP, gaining full confidentiality, integrity, and availability impact (CVSS 8.8). No public exploit identified at time of analysis and the CVE is not on CISA KEV; it was disclosed through the Oracle July 2026 Critical Patch Update.
Data compromise in the French HR component of Oracle HRMS within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) lets a low-privileged attacker with HTTP network access read, create, delete, or modify critical HRMS (France) data. Rated CVSS 3.1 8.1 (High) with High confidentiality and integrity impact and no availability impact, Oracle characterizes it as easily exploitable with no user interaction required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though Oracle's disclosure notes low attack complexity.
Unauthenticated data disclosure in Oracle HRMS (US) US Payroll module of Oracle E-Business Suite 12.2.7 through 12.2.15 allows a remote attacker to read all HRMS-accessible data over HTTP without credentials. Disclosed in Oracle's July 2026 Critical Patch Update and tagged as an authentication bypass, the flaw carries a CVSS 3.1 score of 7.5 with confidentiality-only impact and is easily exploitable. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Data tampering and partial denial-of-service in Oracle Production Scheduling (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a low-privileged, network-authenticated attacker over HTTP create, delete, or modify critical data - with additional limited read access and a partial DoS. Oracle rates it CVSS 3.1 7.6, driven primarily by high integrity impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so this is a patch-during-normal-cycle priority rather than an emergency.
Full takeover of Oracle Demantra Demand Management (versions 12.2.3 through 12.2.15) is possible when a low-privileged, network-authenticated attacker submits crafted SQL against the Product Security component, yielding complete loss of confidentiality, integrity, and availability. Oracle rates this 8.8 (CVSS 3.1) and addresses it in the July 2026 Critical Patch Update; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The 'via SQL' wording combined with the tags points to a SQL-injection-class weakness in an authenticated interface.
Privileged data compromise in Oracle Advanced Planning Command Center (Oracle E-Business Suite Internal Operations component, versions 12.2.3 through 12.2.15) lets an already high-privileged attacker with network HTTP access read all APCC-accessible data and perform limited unauthorized modifications. Because the flaw carries a scope change, successful attacks may significantly impact additional products beyond APCC itself. Disclosed in Oracle's July 2026 Critical Patch Update with a CVSS 3.1 base score of 7.6; no public exploit identified at time of analysis.
Data compromise in Oracle Process Manufacturing Regulatory Management (a component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) allows a low-privileged, network-authenticated attacker over HTTP to read, create, delete, or modify all data accessible to the component. Oracle rates it CVSS 3.1 8.1 with high confidentiality and integrity impact but no availability impact. There is no public exploit identified at time of analysis and it is not in CISA KEV; an 'Authentication Bypass' tag is noted in intelligence sources but is not corroborated by the CVSS vector, which requires low privileges (PR:L).
Unauthorized critical-data access in Oracle E-Business Suite's Process Manufacturing Regulatory Management module (component: Internal Operations) allows a low-privileged, network-authenticated attacker to compromise the module over HTTP, with a scope change that may significantly impact additional Oracle products. Oracle rates it CVSS 3.1 8.5, reflecting high confidentiality impact plus limited integrity impact across a changed scope. There is no public exploit identified and it is not in CISA KEV, but Oracle self-reported it and shipped a fix in the July 2026 Critical Patch Update.
Data compromise in Oracle Time and Labor (Oracle E-Business Suite, versions 12.2.3 through 12.2.15) allows a low-privileged attacker with HTTP network access to read, create, delete, or modify all data accessible to the application. Oracle rates it CVSS 3.1 8.1 (C:H/I:H) and describes it as easily exploitable, though availability is unaffected. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided.
Full compromise of Oracle Flow Manufacturing (Internal Operations component of Oracle E-Business Suite) is achievable by a low-privileged attacker over the network via HTTP, per Oracle's July 2026 Critical Patch Update. Any authenticated EBS user can leverage the flaw to take over the module, exposing and altering confidential manufacturing data (high confidentiality, integrity, and availability impact, CVSS 8.8). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle EBS is a recurring target for opportunistic and targeted attackers.
Data compromise in Oracle Flow Manufacturing (Oracle E-Business Suite 12.2.13-12.2.15, Internal Operations component) allows a low-privileged remote attacker over HTTP to read, create, delete, or modify all data accessible to the application. Rated CVSS 3.1 8.1 (high) with full confidentiality and integrity impact but no availability impact. No public exploit is identified at time of analysis and it is not listed in CISA KEV; disclosure is via Oracle's July 2026 Critical Patch Update.
Full compromise of Oracle Yard Management (part of Oracle E-Business Suite, Internal Operations component) is possible for a low-privileged, network-authenticated attacker over HTTP, per Oracle's July 2026 Critical Patch Update. Affecting supported versions 12.2.6 through 12.2.15, the flaw carries a CVSS 3.1 base score of 8.8 and, on successful exploitation, results in complete takeover of the Yard Management application with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise (takeover) of Oracle Process Manufacturing Process Execution 12.2.15, a module of Oracle E-Business Suite (component: Internal Operations), is achievable by a low-privileged, authenticated attacker over HTTP. Successful exploitation yields high confidentiality, integrity, and availability impact against the module, though Oracle rates the attack complexity as high ('difficult to exploit'). No public exploit identified at time of analysis, and it is not listed in CISA KEV; the fix ships in Oracle's July 2026 Critical Patch Update.
Unauthorized data compromise in Oracle Time and Labor (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker over HTTP to read, create, delete, or modify all data accessible to the module. Rated CVSS 3.1 8.1 (High) with high confidentiality and integrity impact but no availability impact, it was reported by Oracle in the July 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Takeover of Oracle Purchasing (a module of Oracle E-Business Suite, Internal Operations component) is possible for a low-privileged, network-authenticated attacker in supported releases 12.2.11 through 12.2.15. Successful attacks yield full confidentiality, integrity, and availability compromise of the Purchasing application per Oracle's July 2026 Critical Patch Update. Exploitation is rated high-complexity (AC:H), and no public exploit identified at time of analysis; the issue was reported internally by Oracle's security alert team rather than a public researcher.
Account takeover in Oracle Public Sector Financials (a module of Oracle E-Business Suite, Internal Operations component) allows a low-privileged, network-adjacent attacker to fully compromise the product over HTTP. Any authenticated user with minimal EBS privileges can escalate to complete control of the Public Sector Financials application (CVSS 8.8, high confidentiality/integrity/availability impact). There is no public exploit identified at time of analysis, but Oracle E-Business Suite is a recurring, high-value target for post-authentication attacks, and the July 2026 Critical Patch Update remediates it.
Account takeover in Oracle Public Sector Payroll (a component of Oracle E-Business Suite 12.2.3 through 12.2.15) lets a low-privileged, network-adjacent attacker fully compromise the module over HTTP. The CVSS 3.1 base score of 8.8 reflects complete confidentiality, integrity, and availability impact, and the flaw resides in the Internal Operations component. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the fix ships in Oracle's Critical Patch Update for July 2026.
Data compromise in Oracle Installed Base (Oracle E-Business Suite, Create Item Instance component) versions 12.2.3 through 12.2.15 allows a low-privileged attacker with HTTP network access to read, create, delete, or modify all Installed Base-accessible data and cause a partial denial of service. Rated CVSS 3.1 8.3 (High) with high confidentiality and integrity impact, it was disclosed in Oracle's July 2026 Critical Patch Update. No public exploit was identified at time of analysis and it is not listed in CISA KEV, so exploitation is theoretical, but the low bar (any authenticated EBS account, no user interaction) makes it a strong patching priority.
Data compromise in Oracle Installed Base (Create Item Instance component) of Oracle E-Business Suite versions 12.2.4 through 12.2.15 allows a low-privileged attacker with HTTP network access to read, create, modify, or delete all data accessible to the Installed Base module. The flaw carries a CVSS 3.1 base score of 8.1 with high confidentiality and integrity impact but no availability impact, and was disclosed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score provided in the source data.
Authenticated data compromise in the Enterprise Command Center component of Oracle Human Resources (Oracle E-Business Suite 12.2.14–12.2.15) lets a low-privileged user with logon access to the hosting infrastructure read, create, delete, or modify all data the HR application can reach. Oracle rates it CVSS 3.1 7.1 with High confidentiality and integrity impact and no availability impact, and it is addressed in the Oracle Critical Patch Update of July 2026. No public exploit is identified at time of analysis and it is not listed in CISA KEV.
Data compromise in the Oracle Human Resources module of Oracle E-Business Suite 12.2.14 through 12.2.15 (Enterprise Command Center component) lets a low-privileged attacker with HTTP network access read, create, delete, or modify all HR-accessible data. Oracle rates this 8.1 and describes it as easily exploitable, requiring only network access and a low-privilege account; there is no public exploit identified at time of analysis and it is not in CISA KEV. The high confidentiality and integrity impact with no availability impact makes this a strong patch priority for organizations running affected EBS releases.
Full compromise of the Oracle Human Resources module (Data Removal Tool component) in Oracle E-Business Suite versions 12.2.3 through 12.2.15 is achievable by a high-privileged attacker with HTTP network access, resulting in complete takeover of the Human Resources application with confidentiality, integrity, and availability impact. Disclosed in Oracle's July 2026 Critical Patch Update (CVSS 3.1 base 7.2), the flaw requires existing elevated privileges (PR:H) but no user interaction and has low attack complexity. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise of Oracle Payroll (Internal Operations component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) is achievable by a low-privileged, network-authenticated attacker over HTTP, per Oracle's July 2026 Critical Patch Update. Oracle rates the flaw 8.8 and characterizes it as 'easily exploitable' with a result of complete product takeover across confidentiality, integrity, and availability. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the low complexity and low-privilege prerequisite make it a strong patching priority for EBS operators.
Unauthorized data compromise in the Oracle HRMS (UK) module of Oracle E-Business Suite (Internal Operations component) allows a low-privileged, network-authenticated attacker to read, create, delete, or modify critical HR data, with a scope change that lets attacks significantly impact other products beyond HRMS. Rated CVSS 3.1 8.2 (High) with high confidentiality and integrity impact but no availability impact, and flagged by Oracle as difficult to exploit (AC:H). At the time of analysis there is no public exploit identified and no CISA KEV listing, so exploitation appears theoretical rather than active.
Unauthorized data compromise in Oracle Work in Process (a manufacturing module of Oracle E-Business Suite) 12.2.14 through 12.2.15 lets a low-privileged attacker with HTTP network access read, create, delete, or modify all data accessible to the Work in Process application. Oracle rates it 8.1 (CVSS 3.1) with high confidentiality and integrity impact but no availability impact, and describes it as easily exploitable. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Takeover of Oracle Trade Management (component: Claim LOV) within Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a low-privileged attacker with HTTP network access to fully compromise confidentiality, integrity, and availability of the module. The flaw is easily exploitable (AC:L) and requires only a low level of authenticated access (PR:L), carrying a CVSS 3.1 base score of 8.8. No public exploit identified at time of analysis, and it is not currently listed in CISA KEV.
Data compromise in Oracle Order Management (Product Diagnostic Tools component) of Oracle E-Business Suite versions 12.2.4 through 12.2.15 allows a low-privileged, network-adjacent attacker over HTTP to read, create, delete, or modify all Order Management-accessible data. Rated CVSS 3.1 8.1 (High) with confidentiality and integrity impact but no availability effect, this flaw is described by Oracle as easily exploitable and is fixed in the July 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Data tampering and partial denial-of-service in Oracle Contracts Integration (a module of Oracle E-Business Suite, Internal Operations component) affects supported EBS releases 12.2.3 through 12.2.15. An unauthenticated remote attacker who can lure a legitimate user into interacting with a crafted HTTP request can create, delete, or modify all Contracts-Integration-accessible data and partially disrupt the service. No public exploit identified at time of analysis, and it is not listed in CISA KEV; Oracle rates it CVSS 3.1 7.1.
Data compromise in Oracle Contracts Integration (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a low-privileged, network-authenticated attacker read and tamper with all data the module can access over HTTP. Because it is rated easily exploitable with high confidentiality and integrity impact (CVSS 8.1), any authenticated EBS user could pivot to unauthorized creation, deletion, or modification of critical contract data. There is no public exploit identified at time of analysis and no CISA KEV listing, so exploitation is a real but not yet demonstrated concern.
Full application takeover in Oracle Lease and Finance Management (versions 12.2.11 through 12.2.15), a module of Oracle E-Business Suite's Internal Operations component, lets a low-privileged attacker with HTTP network access compromise the confidentiality, integrity, and availability of the product. Oracle rates the flaw CVSS 3.1 7.5 but marks it 'difficult to exploit' (AC:H) and disclosed it in the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis, and it is not listed on the CISA KEV catalog.
Full compromise of Oracle Lease and Finance Management (versions 12.2.14 through 12.2.15), a module of Oracle E-Business Suite's Internal Operations component, is possible for a network-based attacker who already holds high application privileges. Oracle rates this CVSS 3.1 7.2 with high confidentiality, integrity, and availability impact, describing successful attacks as resulting in complete takeover of the module. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the modest EPSS-relevant profile is consistent with the high-privilege precondition limiting mass exploitation.
Unauthorized read and write access to critical data in Oracle Product Workbench (Internal Operations component of Oracle E-Business Suite 12.2.3 through 12.2.15) allows a low-privileged attacker with HTTP network access to create, delete, or modify all data accessible to the application. The flaw is rated CVSS 8.1 with high confidentiality and integrity impact but no availability impact, was reported by Oracle's own security team in the July 2026 Critical Patch Update, and is tagged as an authentication-bypass-class issue. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Data tampering and information disclosure in Oracle Price Protection (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a low-privileged attacker with HTTP network access create, delete, or modify critical Price Protection data and read a subset of accessible data. The flaw carries a CVSS 3.1 base score of 7.1 (C:L/I:H/A:N) and was disclosed in Oracle's July 2026 Critical Patch Update. No public exploit has been identified at time of analysis, the issue is not listed in CISA KEV, and no EPSS score was provided.
Unauthorized data compromise in Oracle Product Workbench (Oracle E-Business Suite, Internal Operations component), versions 12.2.3 through 12.2.15, lets a low-privileged remote attacker with HTTP access read, create, modify, or delete all data accessible to the application. The CVSS 3.1 base score of 8.1 reflects full confidentiality and integrity loss with no availability impact. The flaw is tagged as an authentication-bypass-class issue and was disclosed by Oracle in the July 2026 Critical Patch Update; no public exploit identified at time of analysis.
Data compromise in Oracle Price Protection (Internal Operations component) of Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker over HTTP to read, create, modify, or delete all data accessible to the Price Protection module. Rated CVSS 3.1 8.1 (High) with full confidentiality and integrity impact but no availability impact, the flaw was disclosed in Oracle's July 2026 Critical Patch Update and is tagged as an authentication bypass; no public exploit identified at time of analysis.
Data compromise in Oracle Bills of Material (Internal Operations component) of Oracle E-Business Suite versions 12.2.13 through 12.2.15 allows a low-privileged, network-authenticated attacker to read, create, delete, or modify all data accessible to the Bills of Material module via HTTP. Rated CVSS 3.1 8.1 (High) with full confidentiality and integrity impact but no availability impact, the flaw is easily exploitable and requires only low privileges. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the vendor tag references an 'Authentication Bypass' class though the CVSS vector requires PR:L.
Privilege-abusing data compromise in Oracle Advanced Benefits 12.2.15 (a module of Oracle E-Business Suite, Internal Operations component) lets a high-privileged, network-authenticated attacker read all data accessible to the application and make limited unauthorized modifications. Because the flaw carries a scope change (CVSS S:C), successful attacks may extend impact to other Oracle products beyond Advanced Benefits itself. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; the fix is delivered in the Oracle July 2026 Critical Patch Update.
Unauthorized data manipulation in Oracle Advanced Benefits 12.2.15 (Oracle E-Business Suite, Internal Operations component) lets a low-privileged attacker with HTTP network access create, delete, or modify critical data. Because the CVSS vector carries a scope change (S:C), successful attacks can significantly impact additional products beyond Advanced Benefits itself. The flaw is rated CVSS 3.1 7.7 with integrity-only impact (I:H, C:N, A:N); no public exploit is identified at time of analysis, and it was disclosed via Oracle's July 2026 Critical Patch Update.
Full compromise of the Oracle E-Business Suite TeleSales module (Internal Operations component) is possible over the network via HTTP by a low-privileged authenticated user. Affecting EBS releases 12.2.3 through 12.2.15, successful exploitation results in complete takeover of TeleSales with high confidentiality, integrity, and availability impact (CVSS 3.1 8.8). This flaw was disclosed in the Oracle July 2026 Critical Patch Update; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise of Oracle Payables (Oracle E-Business Suite, Internal Operations component) allows a low-privileged, network-authenticated attacker to take over the module via HTTP, with high impact to confidentiality, integrity, and availability (CVSS 3.1 8.8). Any user holding a valid low-privilege EBS session can escalate to full control of the Payables application. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and 'easily exploitable' vendor language make it a strong patching priority.
Full compromise of Oracle EDI Gateway (a module of Oracle E-Business Suite) is possible where a high-privileged, authenticated attacker with HTTP network access can achieve complete takeover of the component, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 7.2 with high confidentiality, integrity, and availability impact, affecting EBS versions 12.2.3 through 12.2.15. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Full compromise of Oracle Product Hub (Internal Operations component) in Oracle E-Business Suite 12.2.3 through 12.2.15 allows an authenticated, low-privileged attacker with HTTP network access to take over the product and, because of a scope change, significantly impact additional connected products. The flaw was disclosed in Oracle's July 2026 Critical Patch Update with a CVSS 3.1 score of 8.5, though the vector rates it as difficult to exploit (AC:H). No public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege-based takeover of Oracle Product Hub (Oracle E-Business Suite, Internal Operations component) allows a low-privileged, network-authenticated attacker to fully compromise the product via HTTP. Affected releases span EBS 12.2.3 through 12.2.15, and the CVSS 3.1 vector (8.8) reflects high confidentiality, integrity, and availability impact with low attack complexity. No public exploit identified at time of analysis; disclosed through Oracle's July 2026 Critical Patch Update.
Unauthorized data compromise in Oracle Product Hub (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged attacker with HTTP network access to read, create, delete, or modify all data accessible to the Product Hub application. The flaw carries a CVSS 3.1 base score of 8.1 with high confidentiality and integrity impact but no availability impact, and Oracle tags it as an Authentication Bypass. There is no public exploit identified at time of analysis and no CISA KEV listing, but it is addressed in Oracle's July 2026 Critical Patch Update.
Unauthorized data disclosure in the Oracle In-Memory Cost Management for Discrete Industries component (Internal Operations) of Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows an unauthenticated, network-based attacker over HTTP to read critical or all data accessible to the product. The flaw is rated CVSS 3.1 7.5 with a pure confidentiality impact (C:H/I:N/A:N) and was disclosed in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis, though the 'Authentication Bypass' tag and low attack complexity make it an attractive target for internet-exposed EBS instances.
Data compromise in Oracle Process Manufacturing Financials (Internal Operations component) of Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a low-privileged, network-adjacent attacker to read, create, modify, or delete all data accessible to the module over HTTP. Rated CVSS 3.1 8.1 (High) with confidentiality and integrity impact but no availability effect. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though Oracle EBS is a recurring target for post-authentication attacks.
Information disclosure and limited data tampering in Oracle E-Business Suite's Process Manufacturing Logistics module (Internal Operations component) lets a low-privileged, network-based attacker reach critical application data over HTTP. Affecting supported EBS releases 12.2.3 through 12.2.15, a successful attack yields full read access to all Process Manufacturing Logistics data plus partial write (insert/update/delete) capability. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; EPSS was not provided.
Broad data compromise in Oracle Customers Online (part of Oracle E-Business Suite, component: Internal Operations) allows a low-privileged, network-authenticated attacker over HTTP to read, create, delete, or modify all data accessible to the application. Rated CVSS 3.1 8.1 (High), it carries full confidentiality and integrity impact with no availability impact, and Oracle tags it as an authentication-bypass-class weakness. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and modest privilege requirement make it a high-priority fix.
Takeover of Oracle Process Manufacturing (OPM) Product Development is possible in Oracle E-Business Suite 12.2.15 via its Quality Management Specs component, where a low-privileged attacker with HTTP network access can fully compromise the module. Oracle rates this 8.8 (High) with full confidentiality, integrity, and availability impact, and flags it as easily exploitable, meaning a valid but low-privilege application account is the only barrier. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Data compromise in Oracle Process Manufacturing Systems (Oracle E-Business Suite 12.2.3 through 12.2.15) lets a low-privileged attacker with network HTTP access read, create, modify, or delete all data accessible to the Process Manufacturing module. Oracle rates it 8.1 (High) with confidentiality and integrity impact but no availability impact, and describes it as 'easily exploitable.' No public exploit identified at time of analysis; the fix ships in the Oracle Critical Patch Update of July 2026.
Full compromise of the Oracle Process Manufacturing Systems module in Oracle E-Business Suite 12.2.11 through 12.2.15 is achievable by a high-privileged, authenticated attacker sending crafted HTTP requests to the Internal Operations component. Successful exploitation yields complete takeover of the Process Manufacturing Systems application with high confidentiality, integrity, and availability impact (CVSS 7.2). No public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data access and partial denial of service in Oracle E-Business Suite's Document Management and Collaboration module (Attachments component) allows a remote unauthenticated attacker to read, insert, update, or delete a subset of application data over HTTP. Affecting supported EBS releases 12.2.3 through 12.2.15, the flaw is rated CVSS 7.3 and is described by Oracle as easily exploitable, requiring no authentication or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low-complexity, unauthenticated network vector makes it a meaningful patching priority in a product family that has been a repeated target of mass-exploitation campaigns.
Unauthorized data manipulation in Oracle HCM Configuration Workbench (part of Oracle E-Business Suite, Spreadsheet Loading component) lets a remote unauthenticated attacker reach the application over HTTP and perform unauthorized update, insert, delete and limited read operations, plus trigger a partial denial of service. All EBS releases from 12.2.3 through 12.2.15 are affected. Rated CVSS 3.1 7.3; no public exploit identified at time of analysis and it is not listed in CISA KEV, but the pre-authentication network reach makes it a meaningful patch priority for exposed EBS deployments.
Unauthenticated blind server-side request forgery in sgoudelis Ground Station before 0.6.0 lets any network attacker coerce the ground-station process into issuing outbound HTTP requests to arbitrary destinations, including cloud instance metadata at 169.254.169.254 and internal RFC1918/loopback services. Because the Socket.IO server on port 7000 enforces no authentication and uses a wildcard CORS policy, an attacker persists a malicious orbital-source URL and triggers a sync, then reads returned HTTP status codes and error strings as an oracle for probing the internal network. There is no public exploit identified at time of analysis, but the flaw is durable: the malicious source survives restarts and re-fires automatically every 24 hours.
Password recovery in Eclipse Milo (the open-source OPC UA SDK for Java) versions 0.6.0 through 1.1.4 allows an on-path attacker to break username-token confidentiality via a Bleichenbacher-style padding oracle. The server returns distinguishable error responses for invalid RSA PKCS#1 v1.5 padding versus other authentication failures during username-token processing, so an attacker who captures a victim's Basic128Rsa15-encrypted username token can send repeated unauthenticated ActivateSession requests to recover the cleartext password and then authenticate as the victim. No public exploit identified at time of analysis and it is not listed in CISA KEV; the weakness and its upstream fix are confirmed by the Eclipse Foundation.
PKCS#7 EnvelopedData decryption in the Python cryptography library (versions 44.0.0-49.x) leaks a Bleichenbacher oracle through four distinguishable error messages and timing side-channels during RSA PKCS#1 v1.5 key unwrapping, exposing the exact recovered plaintext length in one case. An attacker who can submit crafted EnvelopedData to an auto-decrypting service - such as an S/MIME gateway or mail filter that reflects outcomes at high volume - can adaptively recover the content-encryption key and decrypt intercepted messages. No public exploit has been identified at time of analysis, and exploitation requires very specific deployment conditions; the fix in version 50.0.0 applies RFC 3218 indistinguishability by substituting a random key on any failure.
Blind SQL injection in Shlink's tag statistics REST endpoint allows any API key holder to extract sensitive data from the underlying database across all tenants. The unvalidated `direction` value of the `orderBy` query parameter flows unsanitized into a Doctrine QueryBuilder ORDER BY clause, enabling time-based, boolean-oracle, and error-based extraction of long URLs, visitor records, IP addresses, geolocation data, user agents, and hashed API key secrets. A public proof-of-concept exploit is available on GitHub, no public exploit identified at time of analysis as confirmed actively exploited, but the low barrier to exploitation - any valid API key suffices - makes this a genuine remediation priority for Shlink operators.
SQL injection in the Sequelize Node.js ORM (versions prior to 6.37.4) allows remote attackers to inject arbitrary SQL through application values that reach the string-escaping routine, but only when the ORM is configured with the Oracle dialect. The escape() function in sql-string.js returns any string beginning with TO_TIMESTAMP or TO_DATE verbatim without doubling single quotes, letting a crafted value break out of the intended literal. Publicly available exploit code exists in the GitHub Security Advisory (GHSA-v8fg-2rw7-q452); there is no CISA KEV listing and no EPSS score was provided.
Broken access control in SiYuan versions before 3.7.3 lets publish-mode readers - including anonymous users when publish Basic Auth is disabled - retrieve the rendered content of publish-forbidden documents by calling the /api/ref/getBacklinkDoc and /api/ref/getBackmentionDoc endpoints directly with a target document ID. Although the corresponding backlink list endpoints correctly filter publish-forbidden documents, these two content endpoints are gated only by CheckAuth and omit the publish-access filter, exposing DOM content and a reference-existence oracle. Reported by VulnCheck; no public exploit identified at time of analysis and not listed in CISA KEV.
Bouncy Castle for Java's OpenPGP session-key decryption path re-exposes the Mister-Zuccherato adaptive-chosen-ciphertext oracle by failing to suppress the legacy CFB 'quick check' on the PKESK/session-key route, enabling an attacker with decryption oracle access to recover plaintext from SEIPD v1 encrypted messages. Affected are bc-java before 1.85, bc-lts-java before 2.73.12, and BC-FJA (bcpg-fips) across the 1.0.X, 2.0.X, and 2.1.X series - three distinct product lines used broadly in enterprise and open-source Java applications. No public exploit or CISA KEV listing has been identified at time of analysis; however, the attack technique is well-established in cryptographic literature dating to the Mister-Zuccherato paper.
Cross-tenant information disclosure in the self-hosted task manager Vikunja (0.24.0 through 2.3.0) lets a holder of any project share link read kanban bucket records - bucket titles and the full created_by user object (username, name, id) - belonging to other tenants' project views, because the task-collection endpoint loads the view from the attacker-controlled URL path without re-authorizing it. The same missing pre-authorization check yields a project/view-ID existence oracle (404 vs non-404) usable by link shares and ordinary authenticated users. No public exploit identified at time of analysis; fixed in 2.4.0.
Path traversal in NLTK's FramenetCorpusReader (versions ≤3.9.4) allows a caller-supplied frame name containing ../ sequences to escape the corpus root and read arbitrary XML files accessible to the process, silently bypassing the nltk.pathsec sandbox even when ENFORCE=True is explicitly enabled. Any web service or pipeline that routes user-controlled input into FramenetCorpusReader.frame() is directly exposed, with full parsed content of frame-shaped XML files returned to the caller and a file-existence oracle for all other XML paths. A working proof-of-concept is publicly available in the GitHub security advisory; the vulnerability is not listed in CISA KEV at time of analysis.
Unauthenticated information disclosure in ComfyUI (comfy-org/comfyui) before 0.28.0 lets remote attackers read arbitrary image-decodable files and enumerate the host filesystem via the get_model_preview endpoint, which joins an unrestricted {filename:.*} route capture to the model directory with no containment check (CWE-22). Attackers can use literal ../, percent-encoded %2e%2e%2f, absolute paths, or an unbounded path_index to escape the model folder; disclosure is bounded to files Pillow can decode plus a file-existence/path-enumeration oracle. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the issue is fixed in version 0.28.0.
Error-based SQL injection in Koollab LMS 5.3.2 lets an authenticated attacker abuse the face-to-face runs update endpoint as a SQL oracle to exfiltrate the entire application database, including valid JWT tokens that enable full account takeover. Rated CVSS 8.1 with high confidentiality and integrity impact; there is no public exploit identified at time of analysis and EPSS is low at 0.25% (17th percentile). SSVC scores technical impact as total but exploitation as none, indicating no observed use so far.
Blind SQL injection in Koollab LMS enables unauthenticated attackers to exfiltrate sensitive database contents, including credentials and JWT tokens, through its SSO OAuth endpoint without user interaction. This critical flaw (CVSS 9.1) can lead to full account takeover, but no public exploit or active exploitation has been confirmed at this time.
Arbitrary file read in PostCSS (npm postcss <= 8.5.11) lets an attacker who controls CSS input embed a `/*# sourceMappingURL=PATH */` comment that the PreviousMap parser dereferences directly against the local filesystem with no scheme, allowlist, or traversal check. Because the read fires under default options (no `from`, `map`, or plugins), any pipeline that processes untrusted CSS is reachable; when the resulting `JSON.parse` SyntaxError is surfaced to the caller it leaks roughly the first 10 bytes of the targeted file, and the same code path yields a file-existence oracle and a DoS primitive. Publicly available exploit code exists (POC), but there is no public evidence of active exploitation, and EPSS is low at 0.50% (40th percentile).
Takeover of Oracle Platform Security for Java (OPSS) is possible where a low-privileged attacker with HTTP network access can fully compromise the confidentiality, integrity, and availability of the service. The flaw resides in the Centralized Thirdparty Jars component and affects Oracle Fusion Middleware releases 12.2.1.4.0 and 14.1.2.0.0. It carries a CVSS 3.1 base score of 8.8 and was disclosed in the Oracle Critical Patch Update of July 2026; no public exploit identified at time of analysis.
Full compromise of Oracle Platform Security for Java (OPSS) in Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0 is possible by a low-privileged attacker over HTTP, targeting the Centralized Thirdparty Jars component. Oracle rates the flaw 8.8 and describes it as 'easily exploitable,' with successful attacks yielding complete takeover (high confidentiality, integrity, and availability impact). No public exploit is identified at time of analysis and the CVE is not listed in CISA KEV.
Full compromise of Oracle Platform Security for Java (OPSS) in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with network access over HTTP to take over the component, per Oracle's July 2026 Critical Patch Update. The flaw yields high confidentiality, integrity, and availability impact and is rated easily exploitable (CVSS 8.8), though no public exploit identified at time of analysis. Because OPSS underpins authentication, authorization, and credential management for the wider Fusion Middleware stack, a takeover has cascading security consequences.
Full compromise of Oracle Platform Security for Java (OPSS), a security framework within Oracle Fusion Middleware, is possible when a low-privileged attacker reaches the affected instance over HTTP via the Centralized Thirdparty Jars component. Oracle rates the flaw CVSS 3.1 8.8 and describes it as "easily exploitable," resulting in a complete takeover of OPSS with high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis and it is not in CISA KEV, but the low attack complexity and only a low-privilege authenticated prerequisite make it a strong candidate for prompt patching in Oracle environments.
Full compromise ("takeover") of Oracle Platform Security for Java (OPSS), a core security framework shipped inside Oracle Fusion Middleware, is possible by an unauthenticated remote attacker over HTTP against versions 12.2.1.4.0 and 14.1.2.0.0. Oracle rates this 9.8 with full confidentiality, integrity, and availability loss and describes it as "easily exploitable," so it should be treated as a top-priority patch in the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitation profile (no authentication, no user interaction) makes it an attractive target once details or patches are reverse-engineered.
Full takeover of Oracle Platform Security for Java (OPSS), a security framework within Oracle Fusion Middleware, is possible for a low-privileged attacker positioned on the same physical communication segment as the host. Disclosed in Oracle's July 2026 Critical Patch Update, the flaw carries a CVSS 3.1 score of 8.0 and a scope change, meaning successful exploitation can significantly impact additional products beyond OPSS itself. Exploitation is rated difficult (AC:H) and there is no public exploit identified at time of analysis, so risk is elevated by potential blast radius rather than by ease of attack.
Full takeover of Oracle Platform Security for Java (OPSS), a security framework bundled with Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0, is possible via its Centralized Thirdparty Jars component. A low-privileged attacker with HTTP network access can compromise confidentiality, integrity, and availability, though the attack is rated difficult to execute (high attack complexity). No public exploit identified at time of analysis and the flaw is not in CISA KEV, but it was disclosed by Oracle in the July 2026 Critical Patch Update.
Full compromise of Oracle Platform Security for Java (OPSS) in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 is achievable by a low-privileged attacker over HTTP through the Centralized Thirdparty Jars component. Because the flaw carries a scope change, successful exploitation can result in complete takeover of OPSS and significantly impact additional connected products, earning a near-maximum CVSS 3.1 base score of 9.9. No public exploit has been identified at time of analysis, but the low attack complexity and minimal privilege requirement make this a high-priority patch.
Full takeover of Oracle Platform Security for Java (OPSS) is possible in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0, where a low-privileged attacker with network access can compromise the component via crafted SOAP requests. Oracle rates this CVSS 8.8 with high confidentiality, integrity, and availability impact, meaning successful exploitation yields complete control of the OPSS component rather than mere data exposure. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote takeover of Oracle Platform Security for Java (OPSS), a security framework bundled with Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0, allows an unauthenticated attacker with HTTP network access to fully compromise the component. Rated CVSS 3.1 9.8 with high confidentiality, integrity, and availability impact, Oracle describes it as 'easily exploitable' via the Centralized Thirdparty Jars component. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and lack of authentication make it a high-priority patch.
Complete takeover of Oracle Platform Security for Java (OPSS) in Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0 is possible by an unauthenticated remote attacker over HTTP, per Oracle's July 2026 Critical Patch Update. The flaw resides in the 'Centralized Thirdparty Jars' component and carries a maximum CVSS 3.1 base score of 10.0 with a scope change, meaning successful exploitation can significantly impact products beyond OPSS itself. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the perfect CVSS score and 'easily exploitable' vendor language make this a top-priority patch.
Remote code execution in Fujitsu openFT managed file transfer software (Linux and Oracle Solaris variants) before version 12.1D00 lets remote attackers run arbitrary code without authentication (pre-auth RCE) over the network. The flaw is a CWE-94 code injection carrying a CVSS 4.0 base score of 9.3, and the CVSS vector confirms it needs no privileges and no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the pre-auth, network-reachable nature makes it a high-priority patch target.
Local privilege escalation in Fujitsu openFT (managed file transfer) on GNU/Linux and Oracle Solaris allows an already-authenticated local user to gain root privileges on versions before 12.1D00. The flaw stems from improper privilege management (CWE-269) and carries a CVSS 4.0 base score of 8.5 (High). No public exploit identified at time of analysis; the intelligence was obtained internally by the Fsas Technologies PSIRT rather than from public disclosure.
Information disclosure in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 lets remote unauthenticated attackers abuse the RadAsyncUpload control's client-state handling as a cryptographic oracle. Because the server distinguishes decryption failures from invalid-JSON parse failures, an attacker can iteratively probe the encrypted rauPostData token and recover protected metadata values. No public exploit identified at time of analysis, and it is not listed in CISA KEV; EPSS was not provided.
Local privilege escalation to full takeover in the Install component of Oracle Java SE (8u491, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1), Oracle GraalVM for JDK (17.0.19, 21.0.11), and Oracle GraalVM Enterprise Edition (21.3.18) lets a low-privileged local user compromise the runtime and take it over with full confidentiality, integrity, and availability loss. Oracle rates it 7.8 (High) and describes it as easily exploitable by an attacker holding only a logon to the host. No public exploit has been identified at time of analysis and it is not on CISA KEV.
Unauthorized data disclosure in Oracle HRMS (UK) UK Payroll component of Oracle E-Business Suite 12.2.3 through 12.2.15 allows a low-privileged, authenticated remote attacker over HTTP to read all HRMS (UK)-accessible data, with a scope change that can significantly impact additional products beyond the vulnerable module. Rated CVSS 3.1 7.7 (High) for confidentiality-only impact, it was reported by Oracle and patched in the July 2026 Critical Patch Update; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data access in Oracle HRMS (US) within Oracle E-Business Suite (US Payroll Year End component) lets a low-privileged, network-based attacker read all HRMS-accessible data and modify some of it. Affected supported releases are 12.2.3 through 12.2.15, addressed in the Oracle July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and no CISA KEV listing, so this is not confirmed as actively exploited despite the sensitive payroll data at stake.
Full compromise of Oracle HRMS (US) is possible in Oracle E-Business Suite versions 12.2.3 through 12.2.15 via the Internal Operations component, where a low-privileged attacker with local logon access to the hosting infrastructure can escalate to complete takeover of the HRMS module. The flaw yields high confidentiality, integrity, and availability impact (CVSS 3.1 7.8) and is fixed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Unauthorized data access in Oracle E-Business Suite HRMS (Norway) allows a low-privileged remote attacker to read all HRMS-accessible data over HTTP, with a scope change that may significantly impact other integrated products. The flaw affects EBS releases 12.2.3 through 12.2.15 and is addressed in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the confidentiality-only, network-exploitable nature nonetheless makes it a meaningful data-exposure risk in HR environments.
Sensitive data disclosure in Oracle HRMS (UK) UK Payroll, part of Oracle E-Business Suite 12.2.3 through 12.2.15, lets a low-privileged attacker with HTTP network access read all HRMS-accessible data and modify some of it. The flaw is exploitable by an authenticated user (CVSS 3.1 PR:L) and carries a base score of 7.1 with high confidentiality and low integrity impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though Oracle E-Business Suite payroll modules are high-value targets holding PII and financial data.
Unauthorized data compromise in Oracle HRMS (UK) UK Payroll component of Oracle E-Business Suite (versions 12.2.3 through 12.2.15) allows a low-privileged, network-authenticated attacker to read, create, delete, and modify all HRMS-accessible data over HTTP. The scope-change (S:C) rating means a successful attack can pivot beyond HRMS to significantly impact other Oracle EBS products, yielding a CVSS 3.1 base score of 9.6. No public exploit identified at time of analysis; the fix is delivered in Oracle's July 2026 Critical Patch Update.
Full compromise of the Oracle HRMS (US) module within Oracle E-Business Suite is achievable by a high-privileged attacker over HTTP against the Internal Operations component, affecting supported releases 12.2.3 through 12.2.15. A successful attack yields complete takeover of the HRMS (US) subsystem with high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; it was reported through Oracle's internal security alert channel and fixed in the July 2026 Critical Patch Update.
Takeover of Oracle Workflow in Oracle E-Business Suite (versions 12.2.3 through 12.2.15) is possible when an unauthenticated attacker reaches the Workflow Notification Mailer over SMTP. The high-difficulty flaw (CVSS 3.1 base 8.1, AC:H) yields full compromise of the Workflow component with confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided.
Full takeover of the Oracle Applications Framework (Web Utilities component) is possible in Oracle E-Business Suite 12.2.8 through 12.2.15, where a high-privileged attacker with HTTP network access can compromise confidentiality, integrity, and availability. Oracle rates it CVSS 9.1 largely because the scope-changed impact extends beyond the framework to additional bundled EBS products. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but it was fixed in Oracle's July 2026 Critical Patch Update.
Privilege-abusing account takeover in Oracle Applications Framework (Web Utilities component) of Oracle E-Business Suite 12.2.11 through 12.2.15 lets a low-privileged, network-authenticated attacker fully compromise the framework over HTTP, gaining full confidentiality, integrity, and availability impact (CVSS 8.8). No public exploit identified at time of analysis and the CVE is not on CISA KEV; it was disclosed through the Oracle July 2026 Critical Patch Update.
Data compromise in the French HR component of Oracle HRMS within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) lets a low-privileged attacker with HTTP network access read, create, delete, or modify critical HRMS (France) data. Rated CVSS 3.1 8.1 (High) with High confidentiality and integrity impact and no availability impact, Oracle characterizes it as easily exploitable with no user interaction required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though Oracle's disclosure notes low attack complexity.
Unauthenticated data disclosure in Oracle HRMS (US) US Payroll module of Oracle E-Business Suite 12.2.7 through 12.2.15 allows a remote attacker to read all HRMS-accessible data over HTTP without credentials. Disclosed in Oracle's July 2026 Critical Patch Update and tagged as an authentication bypass, the flaw carries a CVSS 3.1 score of 7.5 with confidentiality-only impact and is easily exploitable. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Data tampering and partial denial-of-service in Oracle Production Scheduling (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a low-privileged, network-authenticated attacker over HTTP create, delete, or modify critical data - with additional limited read access and a partial DoS. Oracle rates it CVSS 3.1 7.6, driven primarily by high integrity impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so this is a patch-during-normal-cycle priority rather than an emergency.
Full takeover of Oracle Demantra Demand Management (versions 12.2.3 through 12.2.15) is possible when a low-privileged, network-authenticated attacker submits crafted SQL against the Product Security component, yielding complete loss of confidentiality, integrity, and availability. Oracle rates this 8.8 (CVSS 3.1) and addresses it in the July 2026 Critical Patch Update; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The 'via SQL' wording combined with the tags points to a SQL-injection-class weakness in an authenticated interface.
Privileged data compromise in Oracle Advanced Planning Command Center (Oracle E-Business Suite Internal Operations component, versions 12.2.3 through 12.2.15) lets an already high-privileged attacker with network HTTP access read all APCC-accessible data and perform limited unauthorized modifications. Because the flaw carries a scope change, successful attacks may significantly impact additional products beyond APCC itself. Disclosed in Oracle's July 2026 Critical Patch Update with a CVSS 3.1 base score of 7.6; no public exploit identified at time of analysis.
Data compromise in Oracle Process Manufacturing Regulatory Management (a component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) allows a low-privileged, network-authenticated attacker over HTTP to read, create, delete, or modify all data accessible to the component. Oracle rates it CVSS 3.1 8.1 with high confidentiality and integrity impact but no availability impact. There is no public exploit identified at time of analysis and it is not in CISA KEV; an 'Authentication Bypass' tag is noted in intelligence sources but is not corroborated by the CVSS vector, which requires low privileges (PR:L).
Unauthorized critical-data access in Oracle E-Business Suite's Process Manufacturing Regulatory Management module (component: Internal Operations) allows a low-privileged, network-authenticated attacker to compromise the module over HTTP, with a scope change that may significantly impact additional Oracle products. Oracle rates it CVSS 3.1 8.5, reflecting high confidentiality impact plus limited integrity impact across a changed scope. There is no public exploit identified and it is not in CISA KEV, but Oracle self-reported it and shipped a fix in the July 2026 Critical Patch Update.
Data compromise in Oracle Time and Labor (Oracle E-Business Suite, versions 12.2.3 through 12.2.15) allows a low-privileged attacker with HTTP network access to read, create, delete, or modify all data accessible to the application. Oracle rates it CVSS 3.1 8.1 (C:H/I:H) and describes it as easily exploitable, though availability is unaffected. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided.
Full compromise of Oracle Flow Manufacturing (Internal Operations component of Oracle E-Business Suite) is achievable by a low-privileged attacker over the network via HTTP, per Oracle's July 2026 Critical Patch Update. Any authenticated EBS user can leverage the flaw to take over the module, exposing and altering confidential manufacturing data (high confidentiality, integrity, and availability impact, CVSS 8.8). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle EBS is a recurring target for opportunistic and targeted attackers.
Data compromise in Oracle Flow Manufacturing (Oracle E-Business Suite 12.2.13-12.2.15, Internal Operations component) allows a low-privileged remote attacker over HTTP to read, create, delete, or modify all data accessible to the application. Rated CVSS 3.1 8.1 (high) with full confidentiality and integrity impact but no availability impact. No public exploit is identified at time of analysis and it is not listed in CISA KEV; disclosure is via Oracle's July 2026 Critical Patch Update.
Full compromise of Oracle Yard Management (part of Oracle E-Business Suite, Internal Operations component) is possible for a low-privileged, network-authenticated attacker over HTTP, per Oracle's July 2026 Critical Patch Update. Affecting supported versions 12.2.6 through 12.2.15, the flaw carries a CVSS 3.1 base score of 8.8 and, on successful exploitation, results in complete takeover of the Yard Management application with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise (takeover) of Oracle Process Manufacturing Process Execution 12.2.15, a module of Oracle E-Business Suite (component: Internal Operations), is achievable by a low-privileged, authenticated attacker over HTTP. Successful exploitation yields high confidentiality, integrity, and availability impact against the module, though Oracle rates the attack complexity as high ('difficult to exploit'). No public exploit identified at time of analysis, and it is not listed in CISA KEV; the fix ships in Oracle's July 2026 Critical Patch Update.
Unauthorized data compromise in Oracle Time and Labor (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker over HTTP to read, create, delete, or modify all data accessible to the module. Rated CVSS 3.1 8.1 (High) with high confidentiality and integrity impact but no availability impact, it was reported by Oracle in the July 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Takeover of Oracle Purchasing (a module of Oracle E-Business Suite, Internal Operations component) is possible for a low-privileged, network-authenticated attacker in supported releases 12.2.11 through 12.2.15. Successful attacks yield full confidentiality, integrity, and availability compromise of the Purchasing application per Oracle's July 2026 Critical Patch Update. Exploitation is rated high-complexity (AC:H), and no public exploit identified at time of analysis; the issue was reported internally by Oracle's security alert team rather than a public researcher.
Account takeover in Oracle Public Sector Financials (a module of Oracle E-Business Suite, Internal Operations component) allows a low-privileged, network-adjacent attacker to fully compromise the product over HTTP. Any authenticated user with minimal EBS privileges can escalate to complete control of the Public Sector Financials application (CVSS 8.8, high confidentiality/integrity/availability impact). There is no public exploit identified at time of analysis, but Oracle E-Business Suite is a recurring, high-value target for post-authentication attacks, and the July 2026 Critical Patch Update remediates it.
Account takeover in Oracle Public Sector Payroll (a component of Oracle E-Business Suite 12.2.3 through 12.2.15) lets a low-privileged, network-adjacent attacker fully compromise the module over HTTP. The CVSS 3.1 base score of 8.8 reflects complete confidentiality, integrity, and availability impact, and the flaw resides in the Internal Operations component. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the fix ships in Oracle's Critical Patch Update for July 2026.
Data compromise in Oracle Installed Base (Oracle E-Business Suite, Create Item Instance component) versions 12.2.3 through 12.2.15 allows a low-privileged attacker with HTTP network access to read, create, delete, or modify all Installed Base-accessible data and cause a partial denial of service. Rated CVSS 3.1 8.3 (High) with high confidentiality and integrity impact, it was disclosed in Oracle's July 2026 Critical Patch Update. No public exploit was identified at time of analysis and it is not listed in CISA KEV, so exploitation is theoretical, but the low bar (any authenticated EBS account, no user interaction) makes it a strong patching priority.
Data compromise in Oracle Installed Base (Create Item Instance component) of Oracle E-Business Suite versions 12.2.4 through 12.2.15 allows a low-privileged attacker with HTTP network access to read, create, modify, or delete all data accessible to the Installed Base module. The flaw carries a CVSS 3.1 base score of 8.1 with high confidentiality and integrity impact but no availability impact, and was disclosed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score provided in the source data.
Authenticated data compromise in the Enterprise Command Center component of Oracle Human Resources (Oracle E-Business Suite 12.2.14–12.2.15) lets a low-privileged user with logon access to the hosting infrastructure read, create, delete, or modify all data the HR application can reach. Oracle rates it CVSS 3.1 7.1 with High confidentiality and integrity impact and no availability impact, and it is addressed in the Oracle Critical Patch Update of July 2026. No public exploit is identified at time of analysis and it is not listed in CISA KEV.
Data compromise in the Oracle Human Resources module of Oracle E-Business Suite 12.2.14 through 12.2.15 (Enterprise Command Center component) lets a low-privileged attacker with HTTP network access read, create, delete, or modify all HR-accessible data. Oracle rates this 8.1 and describes it as easily exploitable, requiring only network access and a low-privilege account; there is no public exploit identified at time of analysis and it is not in CISA KEV. The high confidentiality and integrity impact with no availability impact makes this a strong patch priority for organizations running affected EBS releases.
Full compromise of the Oracle Human Resources module (Data Removal Tool component) in Oracle E-Business Suite versions 12.2.3 through 12.2.15 is achievable by a high-privileged attacker with HTTP network access, resulting in complete takeover of the Human Resources application with confidentiality, integrity, and availability impact. Disclosed in Oracle's July 2026 Critical Patch Update (CVSS 3.1 base 7.2), the flaw requires existing elevated privileges (PR:H) but no user interaction and has low attack complexity. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise of Oracle Payroll (Internal Operations component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) is achievable by a low-privileged, network-authenticated attacker over HTTP, per Oracle's July 2026 Critical Patch Update. Oracle rates the flaw 8.8 and characterizes it as 'easily exploitable' with a result of complete product takeover across confidentiality, integrity, and availability. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the low complexity and low-privilege prerequisite make it a strong patching priority for EBS operators.
Unauthorized data compromise in the Oracle HRMS (UK) module of Oracle E-Business Suite (Internal Operations component) allows a low-privileged, network-authenticated attacker to read, create, delete, or modify critical HR data, with a scope change that lets attacks significantly impact other products beyond HRMS. Rated CVSS 3.1 8.2 (High) with high confidentiality and integrity impact but no availability impact, and flagged by Oracle as difficult to exploit (AC:H). At the time of analysis there is no public exploit identified and no CISA KEV listing, so exploitation appears theoretical rather than active.
Unauthorized data compromise in Oracle Work in Process (a manufacturing module of Oracle E-Business Suite) 12.2.14 through 12.2.15 lets a low-privileged attacker with HTTP network access read, create, delete, or modify all data accessible to the Work in Process application. Oracle rates it 8.1 (CVSS 3.1) with high confidentiality and integrity impact but no availability impact, and describes it as easily exploitable. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Takeover of Oracle Trade Management (component: Claim LOV) within Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a low-privileged attacker with HTTP network access to fully compromise confidentiality, integrity, and availability of the module. The flaw is easily exploitable (AC:L) and requires only a low level of authenticated access (PR:L), carrying a CVSS 3.1 base score of 8.8. No public exploit identified at time of analysis, and it is not currently listed in CISA KEV.
Data compromise in Oracle Order Management (Product Diagnostic Tools component) of Oracle E-Business Suite versions 12.2.4 through 12.2.15 allows a low-privileged, network-adjacent attacker over HTTP to read, create, delete, or modify all Order Management-accessible data. Rated CVSS 3.1 8.1 (High) with confidentiality and integrity impact but no availability effect, this flaw is described by Oracle as easily exploitable and is fixed in the July 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Data tampering and partial denial-of-service in Oracle Contracts Integration (a module of Oracle E-Business Suite, Internal Operations component) affects supported EBS releases 12.2.3 through 12.2.15. An unauthenticated remote attacker who can lure a legitimate user into interacting with a crafted HTTP request can create, delete, or modify all Contracts-Integration-accessible data and partially disrupt the service. No public exploit identified at time of analysis, and it is not listed in CISA KEV; Oracle rates it CVSS 3.1 7.1.
Data compromise in Oracle Contracts Integration (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a low-privileged, network-authenticated attacker read and tamper with all data the module can access over HTTP. Because it is rated easily exploitable with high confidentiality and integrity impact (CVSS 8.1), any authenticated EBS user could pivot to unauthorized creation, deletion, or modification of critical contract data. There is no public exploit identified at time of analysis and no CISA KEV listing, so exploitation is a real but not yet demonstrated concern.
Full application takeover in Oracle Lease and Finance Management (versions 12.2.11 through 12.2.15), a module of Oracle E-Business Suite's Internal Operations component, lets a low-privileged attacker with HTTP network access compromise the confidentiality, integrity, and availability of the product. Oracle rates the flaw CVSS 3.1 7.5 but marks it 'difficult to exploit' (AC:H) and disclosed it in the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis, and it is not listed on the CISA KEV catalog.
Full compromise of Oracle Lease and Finance Management (versions 12.2.14 through 12.2.15), a module of Oracle E-Business Suite's Internal Operations component, is possible for a network-based attacker who already holds high application privileges. Oracle rates this CVSS 3.1 7.2 with high confidentiality, integrity, and availability impact, describing successful attacks as resulting in complete takeover of the module. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the modest EPSS-relevant profile is consistent with the high-privilege precondition limiting mass exploitation.
Unauthorized read and write access to critical data in Oracle Product Workbench (Internal Operations component of Oracle E-Business Suite 12.2.3 through 12.2.15) allows a low-privileged attacker with HTTP network access to create, delete, or modify all data accessible to the application. The flaw is rated CVSS 8.1 with high confidentiality and integrity impact but no availability impact, was reported by Oracle's own security team in the July 2026 Critical Patch Update, and is tagged as an authentication-bypass-class issue. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Data tampering and information disclosure in Oracle Price Protection (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a low-privileged attacker with HTTP network access create, delete, or modify critical Price Protection data and read a subset of accessible data. The flaw carries a CVSS 3.1 base score of 7.1 (C:L/I:H/A:N) and was disclosed in Oracle's July 2026 Critical Patch Update. No public exploit has been identified at time of analysis, the issue is not listed in CISA KEV, and no EPSS score was provided.
Unauthorized data compromise in Oracle Product Workbench (Oracle E-Business Suite, Internal Operations component), versions 12.2.3 through 12.2.15, lets a low-privileged remote attacker with HTTP access read, create, modify, or delete all data accessible to the application. The CVSS 3.1 base score of 8.1 reflects full confidentiality and integrity loss with no availability impact. The flaw is tagged as an authentication-bypass-class issue and was disclosed by Oracle in the July 2026 Critical Patch Update; no public exploit identified at time of analysis.
Data compromise in Oracle Price Protection (Internal Operations component) of Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker over HTTP to read, create, modify, or delete all data accessible to the Price Protection module. Rated CVSS 3.1 8.1 (High) with full confidentiality and integrity impact but no availability impact, the flaw was disclosed in Oracle's July 2026 Critical Patch Update and is tagged as an authentication bypass; no public exploit identified at time of analysis.
Data compromise in Oracle Bills of Material (Internal Operations component) of Oracle E-Business Suite versions 12.2.13 through 12.2.15 allows a low-privileged, network-authenticated attacker to read, create, delete, or modify all data accessible to the Bills of Material module via HTTP. Rated CVSS 3.1 8.1 (High) with full confidentiality and integrity impact but no availability impact, the flaw is easily exploitable and requires only low privileges. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the vendor tag references an 'Authentication Bypass' class though the CVSS vector requires PR:L.
Privilege-abusing data compromise in Oracle Advanced Benefits 12.2.15 (a module of Oracle E-Business Suite, Internal Operations component) lets a high-privileged, network-authenticated attacker read all data accessible to the application and make limited unauthorized modifications. Because the flaw carries a scope change (CVSS S:C), successful attacks may extend impact to other Oracle products beyond Advanced Benefits itself. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; the fix is delivered in the Oracle July 2026 Critical Patch Update.
Unauthorized data manipulation in Oracle Advanced Benefits 12.2.15 (Oracle E-Business Suite, Internal Operations component) lets a low-privileged attacker with HTTP network access create, delete, or modify critical data. Because the CVSS vector carries a scope change (S:C), successful attacks can significantly impact additional products beyond Advanced Benefits itself. The flaw is rated CVSS 3.1 7.7 with integrity-only impact (I:H, C:N, A:N); no public exploit is identified at time of analysis, and it was disclosed via Oracle's July 2026 Critical Patch Update.
Full compromise of the Oracle E-Business Suite TeleSales module (Internal Operations component) is possible over the network via HTTP by a low-privileged authenticated user. Affecting EBS releases 12.2.3 through 12.2.15, successful exploitation results in complete takeover of TeleSales with high confidentiality, integrity, and availability impact (CVSS 3.1 8.8). This flaw was disclosed in the Oracle July 2026 Critical Patch Update; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise of Oracle Payables (Oracle E-Business Suite, Internal Operations component) allows a low-privileged, network-authenticated attacker to take over the module via HTTP, with high impact to confidentiality, integrity, and availability (CVSS 3.1 8.8). Any user holding a valid low-privilege EBS session can escalate to full control of the Payables application. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and 'easily exploitable' vendor language make it a strong patching priority.
Full compromise of Oracle EDI Gateway (a module of Oracle E-Business Suite) is possible where a high-privileged, authenticated attacker with HTTP network access can achieve complete takeover of the component, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 7.2 with high confidentiality, integrity, and availability impact, affecting EBS versions 12.2.3 through 12.2.15. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Full compromise of Oracle Product Hub (Internal Operations component) in Oracle E-Business Suite 12.2.3 through 12.2.15 allows an authenticated, low-privileged attacker with HTTP network access to take over the product and, because of a scope change, significantly impact additional connected products. The flaw was disclosed in Oracle's July 2026 Critical Patch Update with a CVSS 3.1 score of 8.5, though the vector rates it as difficult to exploit (AC:H). No public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege-based takeover of Oracle Product Hub (Oracle E-Business Suite, Internal Operations component) allows a low-privileged, network-authenticated attacker to fully compromise the product via HTTP. Affected releases span EBS 12.2.3 through 12.2.15, and the CVSS 3.1 vector (8.8) reflects high confidentiality, integrity, and availability impact with low attack complexity. No public exploit identified at time of analysis; disclosed through Oracle's July 2026 Critical Patch Update.
Unauthorized data compromise in Oracle Product Hub (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged attacker with HTTP network access to read, create, delete, or modify all data accessible to the Product Hub application. The flaw carries a CVSS 3.1 base score of 8.1 with high confidentiality and integrity impact but no availability impact, and Oracle tags it as an Authentication Bypass. There is no public exploit identified at time of analysis and no CISA KEV listing, but it is addressed in Oracle's July 2026 Critical Patch Update.
Unauthorized data disclosure in the Oracle In-Memory Cost Management for Discrete Industries component (Internal Operations) of Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows an unauthenticated, network-based attacker over HTTP to read critical or all data accessible to the product. The flaw is rated CVSS 3.1 7.5 with a pure confidentiality impact (C:H/I:N/A:N) and was disclosed in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis, though the 'Authentication Bypass' tag and low attack complexity make it an attractive target for internet-exposed EBS instances.
Data compromise in Oracle Process Manufacturing Financials (Internal Operations component) of Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a low-privileged, network-adjacent attacker to read, create, modify, or delete all data accessible to the module over HTTP. Rated CVSS 3.1 8.1 (High) with confidentiality and integrity impact but no availability effect. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though Oracle EBS is a recurring target for post-authentication attacks.
Information disclosure and limited data tampering in Oracle E-Business Suite's Process Manufacturing Logistics module (Internal Operations component) lets a low-privileged, network-based attacker reach critical application data over HTTP. Affecting supported EBS releases 12.2.3 through 12.2.15, a successful attack yields full read access to all Process Manufacturing Logistics data plus partial write (insert/update/delete) capability. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; EPSS was not provided.
Broad data compromise in Oracle Customers Online (part of Oracle E-Business Suite, component: Internal Operations) allows a low-privileged, network-authenticated attacker over HTTP to read, create, delete, or modify all data accessible to the application. Rated CVSS 3.1 8.1 (High), it carries full confidentiality and integrity impact with no availability impact, and Oracle tags it as an authentication-bypass-class weakness. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and modest privilege requirement make it a high-priority fix.
Takeover of Oracle Process Manufacturing (OPM) Product Development is possible in Oracle E-Business Suite 12.2.15 via its Quality Management Specs component, where a low-privileged attacker with HTTP network access can fully compromise the module. Oracle rates this 8.8 (High) with full confidentiality, integrity, and availability impact, and flags it as easily exploitable, meaning a valid but low-privilege application account is the only barrier. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Data compromise in Oracle Process Manufacturing Systems (Oracle E-Business Suite 12.2.3 through 12.2.15) lets a low-privileged attacker with network HTTP access read, create, modify, or delete all data accessible to the Process Manufacturing module. Oracle rates it 8.1 (High) with confidentiality and integrity impact but no availability impact, and describes it as 'easily exploitable.' No public exploit identified at time of analysis; the fix ships in the Oracle Critical Patch Update of July 2026.
Full compromise of the Oracle Process Manufacturing Systems module in Oracle E-Business Suite 12.2.11 through 12.2.15 is achievable by a high-privileged, authenticated attacker sending crafted HTTP requests to the Internal Operations component. Successful exploitation yields complete takeover of the Process Manufacturing Systems application with high confidentiality, integrity, and availability impact (CVSS 7.2). No public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data access and partial denial of service in Oracle E-Business Suite's Document Management and Collaboration module (Attachments component) allows a remote unauthenticated attacker to read, insert, update, or delete a subset of application data over HTTP. Affecting supported EBS releases 12.2.3 through 12.2.15, the flaw is rated CVSS 7.3 and is described by Oracle as easily exploitable, requiring no authentication or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low-complexity, unauthenticated network vector makes it a meaningful patching priority in a product family that has been a repeated target of mass-exploitation campaigns.
Unauthorized data manipulation in Oracle HCM Configuration Workbench (part of Oracle E-Business Suite, Spreadsheet Loading component) lets a remote unauthenticated attacker reach the application over HTTP and perform unauthorized update, insert, delete and limited read operations, plus trigger a partial denial of service. All EBS releases from 12.2.3 through 12.2.15 are affected. Rated CVSS 3.1 7.3; no public exploit identified at time of analysis and it is not listed in CISA KEV, but the pre-authentication network reach makes it a meaningful patch priority for exposed EBS deployments.