Oracle
Monthly
Denial-of-service in Oracle Java SE 8u491 (and 8u491-perf) and 11.0.31 lets an unauthenticated remote attacker hang or repeatedly crash the JVM by feeding crafted input to the Scripting component's APIs, for example via a web service that passes data to those APIs. There is no confidentiality or integrity impact - only availability - but the attack is network-reachable, low-complexity, and requires no authentication or user interaction, yielding a CVSS 7.5. No public exploit identified at time of analysis and the flaw is not on CISA KEV.
Complete takeover of Oracle Data Integrator (versions 12.2.1.4.0 and 14.1.2.0.0) is achievable by a remote, unauthenticated attacker sending crafted HTTP requests to the REST Service component. Because the CVSS scope is changed (S:C), successful exploitation can pivot beyond ODI to significantly impact other integrated Fusion Middleware products, and the maximum 10.0 base score reflects full loss of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, but the trivial exploitability and network reach make this a top-priority patch from Oracle's July 2026 Critical Patch Update.
Local privilege escalation to full takeover in Oracle VM VirtualBox 7.2.12 on Windows hosts allows a low-privileged attacker who can log on to the host to compromise the VirtualBox Core component with high confidentiality, integrity, and availability impact. Oracle rates this CVSS 3.1 7.8; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The single vendor reference is Oracle's July 2026 Critical Patch Update advisory.
Integrity and availability compromise in Oracle VM VirtualBox 7.2.8 (Core component) allows a high-privileged local user, with the aid of a separate tricked user, to modify or destroy critical data and force a complete denial of service, with impact crossing into additional products due to a scope change. Rated CVSS 3.1 7.4 and disclosed in Oracle's July 2026 Critical Patch Update, it carries no confidentiality impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege escalation to full product takeover in Oracle VM VirtualBox 7.2.12 (Core component) allows a low-privileged attacker with a logon session on the host where VirtualBox runs to fully compromise the VirtualBox instance, with high impact to confidentiality, integrity, and availability (CVSS 3.1 7.8). No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV. It was disclosed by Oracle in the July 2026 Critical Patch Update.
Complete denial of service in the RDBMS component of Oracle Database Server 23.4.0 through 23.26.2 lets an unauthenticated remote attacker reach the database over Oracle Net and trigger a hang or repeatable crash, and additionally gain unauthorized update, insert, or delete access to some database-accessible data. Rated CVSS 3.1 8.2 (High) with network attack vector and low complexity, it requires no privileges or user interaction, making it easily exploitable per Oracle's advisory. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated remote compromise of Oracle Net Services affects Oracle Database Server versions 19.3-19.31, 21.3-21.22, and 23.4.0-23.26.2, letting a network attacker reaching the database listener over Oracle Net (typically TCP 1521) read all data accessible to the component and hang or repeatedly crash it for a complete denial of service. Rated CVSS 3.1 9.1 with high confidentiality and availability impact and no integrity impact, it requires no authentication or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and network-facing nature make it a high remediation priority.
Full compromise of Oracle Access Manager 14.1.2.1.0 (Oracle Fusion Middleware) is possible through its Authentication Engine, allowing a low-privileged attacker with HTTP network access to take over the identity and access management platform. Oracle rates this CVSS 3.1 8.8 with high impact to confidentiality, integrity, and availability, and describes it as easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote takeover of Oracle Siebel CRM (Siebel CRM Development, Siebel Approval Manager component) is possible by an unauthenticated attacker sending crafted HTTP requests, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact, affecting supported versions 17.0 through 26.3. There is no public exploit identified at time of analysis and the issue is not on the CISA KEV list, but the unauthenticated network-facing profile makes it a high-priority patch item.
Privilege escalation and full component takeover affects Oracle Contracts Integration within Oracle E-Business Suite (Internal Operations component), versions 12.2.3 through 12.2.15, where a low-privileged, network-authenticated attacker can compromise the component and, due to a scope change (S:C), significantly impact additional connected products. Rated CVSS 3.1 8.5 (High) with full confidentiality, integrity, and availability loss, though the attack is flagged as difficult to exploit (AC:H). No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Product takeover in Oracle Bills of Material (Bill Issues component) of Oracle E-Business Suite 12.2.3 through 12.2.15 lets a low-privileged attacker with HTTP network access fully compromise the module, per Oracle's July 2026 Critical Patch Update. The CVSS 3.1 base score is 8.8 with high impact across confidentiality, integrity, and availability, meaning an authenticated user can read, alter, and destroy Bills of Material data. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though Oracle EBS is a recurring high-value target for post-authentication attacks.
Data compromise in Oracle E-Business Suite's Document Management and Collaboration module (Attachments component) lets a low-privileged, network-adjacent attacker read, create, modify, or delete all data accessible to the module across supported releases 12.2.3 through 12.2.15. Oracle rates it CVSS 8.1 with high confidentiality and integrity impact but no availability effect, and flags it as 'easily exploitable' - meaning any authenticated EBS user can weaponize it over HTTP. There is no public exploit identified at time of analysis and it is not on CISA KEV, but Oracle EBS Attachments flaws have historically been high-value targets.
Unauthorized access to critical data in Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 is possible via the bundled OpenSearch Dashboards component, where a remote unauthenticated attacker can compromise confidentiality by luring a victim into interacting with attacker-supplied content (UI:R). The scope-change and confidentiality-only vector (S:C/C:H/I:N/A:N), combined with the vendor's 'Authentication Bypass' tag, is characteristic of a client-side flaw such as cross-site scripting in the Dashboards UI that lets an attacker read data across products the victim can reach. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; it is addressed in Oracle's July 2026 Critical Patch Update.
Data compromise in Oracle Product Hub (Oracle E-Business Suite Item Catalog component), versions 12.2.3 through 12.2.15, lets a low-privileged attacker with HTTP network access read, create, delete, or modify all Product Hub-accessible data. The CVSS 3.1 base score is 8.1, reflecting high confidentiality and integrity impact with no availability effect. No public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle E-Business Suite flaws are attractive targets and this issue is fixed in the July 2026 Critical Patch Update.
Denial-of-service in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component, versions 22.3 through 26.5) allows an unauthenticated remote attacker to send crafted HTTPS traffic that hangs or repeatedly crashes the application, producing a complete availability loss. The flaw carries a CVSS 3.1 base score of 7.5 with pure availability impact and no confidentiality or integrity effect. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Data compromise in Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 (Process Scheduler component) lets a low-privileged, network-reachable attacker read and modify critical data after luring a legitimate user into an interaction, with a scope change that can spill impact onto additional connected products. Oracle rates it CVSS 3.1 8.7 (C:H/I:H, no availability impact). No public exploit is identified at time of analysis and it is not in CISA KEV, but ease of exploitation and the cross-boundary scope change make it a notable item in the July 2026 Oracle Critical Patch Update.
Cross-site-scripting-style compromise of Oracle PeopleSoft Enterprise PeopleTools 8.62 (PIA Core Technology) lets a remote, unauthenticated attacker who lures an authenticated user into interacting with a crafted HTTP request achieve limited read/write access to PeopleSoft data and cause partial denial of service. The scope-change flag (S:C) means the impact can extend beyond PeopleTools into additional integrated products. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; CVSS 3.1 base score is 7.1.
Compromise of Oracle Product Workbench (a Security component of Oracle E-Business Suite) allows a low-privileged, network-based attacker over HTTP to read, create, delete, or modify all data accessible to the application, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 8.1 with high confidentiality and integrity impact but no availability impact, and affects EBS versions 12.2.3 through 12.2.15. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though Oracle rates it 'easily exploitable.'
Privilege-boundary compromise in Oracle Communications Pricing Design Center 15.0.0.0.0 through 15.2.0.0.0 (On-premise Deployment) lets a low-privileged attacker who already has a logon to the host infrastructure read all data accessible to the product and modify a subset of it, with a scope change that can significantly affect additional products. Oracle rates it CVSS 3.1 7.3 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) and describes it as easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full takeover of Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) is possible through the Self Update Framework component, where an authenticated high-privileged attacker reaching the console over HTTPS can compromise the confidentiality, integrity and availability of the entire management platform. Oracle rates it CVSS 3.1 7.2 and describes it as easily exploitable once the required privileges are held. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise of the Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) is possible through its Self Update Framework component, allowing an already high-privileged, authenticated attacker with network/HTTPS access to escalate to complete takeover of the platform with high confidentiality, integrity, and availability impact. Oracle rates this CVSS 3.1 7.2 and describes it as easily exploitable; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because Enterprise Manager centrally administers large Oracle estates, a takeover here is a high-value pivot despite the elevated privilege prerequisite.
Full compromise of Oracle Enterprise Manager Base Platform is possible through the Self Update Framework component in versions 13.5 and 24.1, where a low-privileged attacker with network access over HTTPS can escalate to complete takeover of the platform. The CVSS 3.1 base score is 8.8 with high confidentiality, integrity, and availability impact, and Oracle rates it 'easily exploitable.' There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided.
Data tampering and information disclosure in Oracle Enterprise Manager Base Platform (Discovery Framework component, versions 13.5 and 24.1) allows a remote, unauthenticated attacker to reach the console over HTTPS and, if the difficult-to-exploit conditions are met, create, delete, or modify critical data and read a subset of application data, plus cause a partial denial of service. Oracle rates this CVSS 3.1 7.0 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full takeover of Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) is possible when an unauthenticated remote attacker abuses a flaw in the Metadata Plugin component over HTTPS and induces an authorized user to interact with attacker-controlled content. Because the compromise yields high confidentiality, integrity, and availability impact against a central management console for Oracle estates, one successful attack can hand an adversary control of the platform. There is no public exploit identified at time of analysis and no CISA KEV listing, but the low attack complexity and unauthenticated network vector make it a priority patch in this quarter's Oracle Critical Patch Update.
Data manipulation in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1, Metadata Plugin component) allows a low-privileged attacker with HTTPS network access to create, delete, or modify critical data and read a subset of data across the platform. Rated CVSS 3.1 7.1 by Oracle, the flaw is described as easily exploitable and tagged as an authentication-bypass class issue. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full product takeover in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) allows a low-privileged, authenticated attacker with network access over HTTPS to fully compromise the platform via the Metadata Plugin component, yielding high confidentiality, integrity, and availability impact. Rated CVSS 3.1 8.8, the flaw is described by Oracle as 'easily exploitable' and requires only an existing low-privilege account and no user interaction. At time of analysis there is no public exploit identified and the CVE is not listed in CISA KEV; no EPSS score was provided in the input.
Complete product takeover in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) allows an unauthenticated remote attacker to fully compromise the management platform via the Agent Next Gen component over HTTPS. The CVSS 3.1 base score of 9.8 reflects total loss of confidentiality, integrity, and availability with no privileges or user interaction required. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but the trivial exploitability and full-takeover impact make this a high-priority patch item from Oracle's July 2026 Critical Patch Update.
Privileged data compromise in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1), via the Agent Next Gen component, lets a low-privileged, network-authenticated attacker read and modify all EM-accessible data over HTTPS. The scope-changing flaw (S:C) means impact extends beyond EM into other managed products, and the Oracle-supplied 'Authentication Bypass' tag suggests trust/privilege boundaries can be crossed. No public exploit identified at time of analysis; high attack complexity (AC:H) tempers real-world exploitability.
Product takeover in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1, Enterprise Config Management component) allows an authenticated low-privileged attacker with network access over HTTPS to fully compromise the platform. Rated CVSS 3.1 8.8 with high confidentiality, integrity, and availability impact, the flaw requires only low privileges and no user interaction, making it readily exploitable once an attacker holds any valid EM account. No public exploit identified at time of analysis, and it is not currently listed in CISA KEV.
Unauthorized data access and partial denial of service in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) allows a remote, unauthenticated attacker to reach the Enterprise Config Management component over HTTP and read, insert, update, or delete a subset of EM-accessible data. Oracle rates it CVSS 3.1 7.3 and describes it as 'easily exploitable' with no authentication or user interaction, so it is a high-priority patch for internet- or intranet-reachable EM consoles. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege-abusing compromise of the Oracle Enterprise Manager Base Platform UI Framework lets a low-privileged, network-adjacent attacker read all EM-accessible data and partially tamper with or degrade the platform over HTTPS. The scope-changing flaw (CVSS 9.1) means a successful attack can spill beyond EM into other managed products, and Oracle's own tags flag authentication-bypass and denial-of-service behavior. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and network vector make it a high patch priority.
Full takeover of Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) is possible via the Connector Framework component, allowing an attacker who already holds high privileges to fully compromise confidentiality, integrity, and availability over the network via HTTPS. Oracle rates this CVSS 7.2 and, despite the 'Information Disclosure' tag, the described impact is complete product takeover (C:H/I:H/A:H). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Information disclosure with scope change in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1, Application Service Level Management component) lets a low-privileged, network-authenticated attacker read all data accessible to the platform over HTTPS. Oracle rates it CVSS 3.1 7.7 with a scope change, so a successful attack can significantly impact products beyond Enterprise Manager itself. No public exploit is identified at time of analysis and it is not in CISA KEV, but low attack complexity plus total confidentiality loss make it a meaningful priority in Oracle-managed estates.
Full takeover of Oracle Retail Integration Bus 16.0.3 (RIB Kernel component) is achievable by an unauthenticated remote attacker over HTTP, per Oracle's July 2026 Critical Patch Update. The CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact reflects complete compromise of the RIB instance with no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivially low attack complexity makes it a high-priority patch target.
Full compromise of Oracle Retail Integration Bus 14.1.3.2 (RIB Kernel component) allows a remote, unauthenticated attacker to take over the product over HTTP, per Oracle's July 2026 Critical Patch Update. The flaw is rated CVSS 9.8 with high confidentiality, integrity, and availability impact and is described by Oracle as 'easily exploitable.' No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated network compromise of Oracle Utilities Network Management System (Mobile component) allows remote attackers to gain partial read access and partial write (insert/update/delete) access to NMS-accessible data over HTTP, with a scope change that can significantly impact adjacent products. Oracle tags this as an Authentication Bypass and rates it CVSS 7.2; no public exploit was identified at time of analysis, and it is not listed in CISA KEV. Affected releases span the 2.5.x, 2.6.x, and 25.12.x branches, fixed in the Oracle Critical Patch Update of July 2026.
Full compromise of Oracle Human Resources (part of Oracle E-Business Suite) is possible via the Data Removal Tool component, where a high-privileged attacker with HTTP network access can take over the module across supported releases 12.2.3 through 12.2.15. The flaw carries a CVSS 3.1 base score of 7.2 with high confidentiality, integrity, and availability impact, and Oracle classifies it as easily exploitable. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Data compromise in Oracle Retail EFTLink (versions 21.0.0 through 25.0.0) allows a remote unauthenticated attacker with HTTPS network access to read, create, delete, or modify all data accessible to the EFTLink service, despite a high attack-complexity barrier. Disclosed in Oracle's July 2026 Critical Patch Update with a CVSS 3.1 base score of 7.4 (C:H/I:H, no availability impact); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise of Oracle Cost Management (the Cost Maintenance component of Oracle E-Business Suite) is achievable over HTTP by a low-privileged, authenticated attacker, per Oracle's July 2026 Critical Patch Update. Successful exploitation yields complete takeover with high confidentiality, integrity, and availability impact, though Oracle rates it difficult to exploit (AC:H). There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Remote takeover of Oracle Application Testing Suite 13.3.0.1 allows an unauthenticated attacker with TCP network access to fully compromise the product without any user interaction. The flaw carries a CVSS 3.1 base score of 9.8 with complete confidentiality, integrity, and availability impact, and is addressed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-privilege attack profile makes it a high-priority patch.
Full compromise (takeover) of the Oracle Public Sector Financials (International) module in Oracle E-Business Suite is possible via its Authorization component, affecting supported versions 12.2.3 through 12.2.15. A high-privileged attacker with network access over HTTP can, under difficult-to-exploit conditions, breach the module and, because of a scope change, significantly impact additional connected products. There is no public exploit identified at time of analysis and the issue is not on CISA KEV.
Complete compromise of Oracle Application Testing Suite version 13.3.0.1 is possible by remote, unauthenticated attackers over the Oracle Net protocol, per Oracle's July 2026 Critical Patch Update. Oracle rates this 'easily exploitable' with a CVSS 3.1 base score of 9.8, and a successful attack results in full takeover of the product with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector makes it a high-priority patching target.
Complete takeover of Oracle Application Testing Suite 13.3.0.1 is possible by unauthenticated attackers over the network via TCP, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact, and Oracle characterizes it as 'easily exploitable.' No public exploit identified at time of analysis, and it is not listed in CISA KEV; no EPSS score was supplied.
Unauthenticated data disclosure in Oracle Application Testing Suite 13.3.0.1 lets a remote attacker with only TCP network access read critical application data, potentially gaining complete access to all data reachable by the product. The flaw is tagged as an authentication bypass and was disclosed in Oracle's July 2026 Critical Patch Update; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Impact is confined to confidentiality - integrity and availability are unaffected per the CVSS vector.
Cross-resource SQL injection in the FacturaScripts REST API (all versions through 2026.1) lets a low-privileged, scoped ApiKey read or modify arbitrary database tables via the `filter` query parameter, enabling full admin account takeover. A single GET request with a parenthesized filter key leaks the admin's bcrypt password hash and `logkey` session token, which are then replayed as the `fsLogkey` cookie to reach admin-only endpoints like `/AdminPlugins`. A live end-to-end PoC was verified on 2026-04-30, so publicly available exploit code exists, though there is no public exploit identified as being used in active attacks (not in CISA KEV).
CSRF token disclosure in the Perl Mojolicious web framework (versions 4.59 up to but not including 9.48) allows a network attacker to recover a victim's session CSRF token via a BREACH compression side channel and then bypass csrf_protect validation. Because _csrf_token cached and returned one stable per-session value that _csrf_field embedded in every response, an attacker who could inject reflected input into a gzip-compressed page could iteratively guess the token by observing compressed response lengths. There is no public exploit identified at time of analysis, EPSS is low (0.15%), and it is not in CISA KEV, but SSVC rates technical impact as total and automatable as yes.
Boolean-based blind SQL injection in YesWiki's public Bazar entry-listing API allows unauthenticated attackers to read arbitrary database contents by abusing numeric query/queries filters. Because numeric field values are escaped with mysqli_real_escape_string but inserted into the SQL statement without quotes or numeric validation, injected boolean expressions (e.g. '100 OR (SELECT COUNT(*) FROM yeswiki_users)>0') are evaluated by the database, turning the public endpoints into a data-exfiltration oracle. A detailed, self-contained proof-of-concept is published in the advisory; a vendor patch (commit f3b0dd0) is available, though the issue is not listed in CISA KEV.
Server-side request forgery in the Ruby css_parser gem (< 3.0.0) lets a remote unauthenticated attacker force the parsing server to issue arbitrary HTTP/HTTPS GET requests, and via an attacker-controlled 3xx redirect to a file:// URI, escalate to arbitrary local file disclosure. The flaw sits in CssParser::Parser#read_remote_file, reachable through load_uri! and any add_block! call that supplies base_uri: - Premailer being the canonical consumer - so a single attacker-planted @import url(...) in parsed CSS reaches the sink. Publicly available exploit code exists (author-supplied PoC); there is no public exploit identified as being used in active campaigns, and it is not listed in CISA KEV.
Heap out-of-bounds read and write in the Linux kernel's KVM AMD SEV-SNP host code lets a malicious confidential guest corrupt and disclose host kernel heap memory. The flaw is in the GHCB Page State Change (PSC) path: setup_vmgexit_scratch() sizes a kvzalloc buffer from the guest-controlled exit_info_2, but snp_begin_psc() only bounds the entry index against VMGEXIT_PSC_MAX_COUNT (253) rather than the actual allocation, so a guest can drive iteration past the buffer into adjacent kmalloc-cg-32 slab objects. Rated CVSS 8.8 with a guest-to-host scope change; EPSS is low at 0.27% and there is no CISA KEV listing, though a working in-tree reproducer is credited in the changelog.
Unauthorized blob read, write, and delete operations in CrateDB's HTTP API allow any authenticated user to bypass privilege grants on blob tables. The HttpBlobHandler endpoint fails to enforce access control, enabling authenticated users to read, delete, or plant arbitrary blobs via crafted HTTP requests, regardless of their SQL-level permissions. Public proof-of-concept exploit code exists; a vendor patch is available, but active exploitation has not been confirmed through CISA KEV.
Sandbox policy bypass in Twig PHP template engine allows sandboxed template authors to trigger `__toString()` calls on objects explicitly blocked by `SecurityPolicy::$allowedMethods`, through two distinct coercion paths: `Traversable` inputs to the `join` and `replace` filters, and PHP's implicit spaceship-operator coercion inside the `in`/`not in` operator implementation. Beyond unauthorized method invocation, the `in` operator can be chained into a character-by-character equality oracle, enabling reconstruction of the full string value of sensitive objects - such as tokens or credentials passed into the render context - without any direct method invocation being permitted. This is a residual bypass of CVE-2026-47732; no public exploit code has been identified at time of analysis, and the issue is patched in Twig v3.27.0.
Denial of service in Citrix NetScaler ADC and NetScaler Gateway stems from multiple memory overflow conditions that produce unpredictable or erroneous behavior when the appliance is configured for specific DNS or load-balancing roles. Remote unauthenticated attackers can send crafted traffic to a vulnerable appliance to crash or destabilize it, with the CVSS 4.0 score of 8.8 driven primarily by high availability impact. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Unauthenticated NoSQL operator injection in Budibase server <= 3.39.0 allows anonymous attackers to read or modify all documents in any MongoDB, CouchDB, Elasticsearch, DynamoDB-PartiQL, or REST-with-JSON-body datasource when a builder has published a query with a PUBLIC role. By injecting JSON metacharacters through query parameters, an attacker can override the intended filter, bypass authentication, and exfiltrate sensitive data or mass-update records in a single HTTP request. Exploit code is publicly available, though no active exploitation is confirmed, and the vulnerability has been patched in version 3.39.12.
Information disclosure in Capgo before 12.128.2 lets remote unauthenticated attackers abuse the security-definer RPC function get_identity_apikey_only to validate arbitrary API keys and map them to owning user_ids. The endpoint functions as an oracle, and results can be chained into other exposed RPCs such as get_orgs_v6 to enumerate organization membership and harvest management email PII. No public exploit identified at time of analysis, though VulnCheck has publicly documented the technique and a vendor patch is available.
Cross-user flow execution in Langflow (< 1.9.1) lets any authenticated API-key holder run another user's flow by passing the victim's flow UUID as the `model` value to the `/api/v1/responses` endpoint, exposing data the victim's flow processes and consuming their resources. The flaw is an Insecure Direct Object Reference (CWE-639) in the `get_flow_by_id_or_endpoint_name` helper, which skipped ownership checks on the UUID lookup path. Publicly available exploit code exists (a working curl PoC), and the input lists it as confirmed actively exploited (CISA KEV), though the SSVC exploitation status of 'poc' and a low 0.24% EPSS complicate that claim (see risk_assessment).
Remote code execution in libaom (reference AV1 codec) is possible when services use the SVC encoder with attacker-supplied frames, allowing crafted pixel data to overlap encoder layer context structures and hijack the cyclic refresh map pointer. The flaw chains a heap out-of-bounds write (CWE-787) with a crash-oracle ASLR bypass to redirect control flow in fork-based video processing services. No public exploit identified at time of analysis, but the issue is tracked under Red Hat and Chromium security trackers and an upstream fix commit has landed in aomedia.
Server-side request forgery in Open WebUI versions 0.9.5 and earlier allows authenticated OAuth users to read arbitrary internal HTTP responses by abusing the `_process_picture_url` function in `backend/open_webui/utils/oauth.py`, which validates only the initial URL and then permits aiohttp's default 10-redirect follow chain to reach internal addresses. The decoded response body is stored in the attacker's `profile_image_url` and retrievable via `GET /api/v1/auths/`, yielding cloud metadata credentials and access to localhost-bound services. Publicly available exploit code exists (detailed sentinel-verified PoC supplied by the reporter); no public exploit identified at time of analysis in the form of weaponized tooling, and the CVE is not on the CISA KEV list.
Server-Side Request Forgery in Crawl4AI's Docker API server (versions <= 0.8.7) allows unauthenticated remote attackers to bypass the IPv4/IPv6 CIDR blocklist in validate_webhook_url/validate_url_destination by using IPv6 transition forms (NAT64, 6to4, IPv4-mapped, IPv4-compatible) or the unspecified address. Since the Docker API ships with jwt_enabled:false by default, attackers can pivot the server into fetching cloud metadata endpoints like 169.254.169.254, potentially exposing IAM credentials. No public exploit identified at time of analysis, but the upstream advisory (GHSA-4qqr-vv2q-cmr5) details the exact bypass payloads.
Unauthenticated remote compromise of Oracle Solaris 11.4 Remote Administration Daemon (RAD) allows network attackers to read, modify, create, or delete critical data with scope change impacting adjacent products. The CVSS 3.1 base score of 10.0 with AV:N/AC:L/PR:N/UI:N reflects trivial network exploitability over HTTPS without authentication, and no public exploit identified at time of analysis. The scope-change designation indicates that successful exploitation breaches the security authority of RAD and propagates impact to other Solaris-managed components.
Full takeover of Oracle Public Sector Payroll (E-Business Suite 12.2.3-12.2.15) is possible by a high-privileged, network-adjacent attacker exploiting a flaw in the Internal Operations component, with confidentiality, integrity, and availability all fully impacted. Oracle's June 2026 Critical Patch Update describes the issue as easily exploitable over HTTP once privileges are held, and no public exploit identified at time of analysis. CVSS 3.1 base score is 7.2.
Privileged local compromise of Oracle VM VirtualBox 7.2.8 allows an attacker already authenticated to the host with high privileges to take over the VirtualBox installation and cross the hypervisor boundary into additional products (scope-changed). Oracle's CPU advisory rates this CVSS 3.1 7.5 with high attack complexity; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Account takeover in Oracle Outsourced Mfg for Discrete Industries (component: Internal Operations) within Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a low-privileged remote attacker to fully compromise the module over HTTP. With CVSS 3.1 base score 8.8 and high impact on confidentiality, integrity, and availability, this is a high-priority patching item, though no public exploit identified at time of analysis and it is not currently listed in CISA KEV.
Full takeover of Oracle Outsourced Mfg for Discrete Industries (component: Internal Operations) is achievable by a low-privileged authenticated attacker over HTTP, per Oracle's June 2026 Critical Patch Update advisory. The CVSS 3.1 base score of 8.8 reflects high impact across confidentiality, integrity, and availability with low attack complexity, though no public exploit identified at time of analysis. Affected versions span 12.2.3 through 12.2.15 of Oracle E-Business Suite.
Full compromise of Oracle HR Intelligence (a module of Oracle E-Business Suite) is possible for an authenticated low-privileged attacker who can reach the Internal Operations component over HTTP, per Oracle's June 2026 Critical Patch Update. The flaw affects EBS versions 12.2.3 through 12.2.15 and yields high impact across confidentiality, integrity, and availability, though Oracle rates exploitation as difficult (AC:H). No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Full compromise of Oracle HR Intelligence (component: Internal Operations) in Oracle E-Business Suite versions 12.2.3 through 12.2.15 is possible by an authenticated high-privileged attacker over HTTP. Successful exploitation results in takeover of the HR Intelligence application with confidentiality, integrity, and availability impact (CVSS 3.1 base 7.2). There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Privileged takeover of Oracle Financials for EMEA (component: Internal Operations) in Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows an authenticated high-privileged attacker with HTTP network access to fully compromise confidentiality, integrity, and availability of the module. The CVSS 3.1 base score is 7.2 with vector AV:N/AC:L/PR:H/UI:N, and there is no public exploit identified at time of analysis.
Authorization flaw in Oracle Public Sector Financials (International) versions 12.2.3 through 12.2.15 enables low-privileged authenticated attackers with HTTP network access to fully take over the affected component. Oracle's Critical Patch Update describes the issue as easily exploitable with high impact to confidentiality, integrity, and availability (CVSS 8.8). No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Takeover of Oracle Universal Work Queue is possible in Oracle E-Business Suite versions 12.2.3 through 12.2.15 via the Work Provider Site Level Administration component, where a low-privileged attacker with HTTP network access can fully compromise confidentiality, integrity, and availability of the module. Oracle classifies the issue as difficult to exploit (AC:H), and no public exploit identified at time of analysis. The flaw was disclosed in the Oracle Critical Patch Update of June 2026.
Account takeover in Oracle Universal Work Queue (Oracle E-Business Suite 12.2.3 through 12.2.15) allows a low-privileged attacker with HTTP network access to fully compromise the Work Provider Site Level Administration component. Oracle rates this as easily exploitable with full confidentiality, integrity, and availability impact (CVSS 3.1 base 8.8), though no public exploit identified at time of analysis and it is not currently listed in CISA KEV.
Privilege escalation and full takeover of Oracle Universal Work Queue (component: Work Provider Site Level Administration) in Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a low-privileged remote attacker over HTTP to compromise the application with scope change extending impact to additional products. The CVSS 3.1 base score is 9.9 with full confidentiality, integrity, and availability impact, and no public exploit identified at time of analysis.
Account takeover in Oracle Universal Work Queue (Oracle E-Business Suite 12.2.3 through 12.2.15) allows a low-privileged remote attacker to fully compromise the component via HTTP, with a scope change that can significantly impact other connected products. The CVSS 3.1 base score of 9.9 reflects high confidentiality, integrity, and availability impact, and no public exploit is identified at time of analysis. Authenticated EBS users - including low-tier business users - should be treated as potential threat actors against this surface.
Authenticated takeover of Oracle Project Portfolio Analysis (E-Business Suite versions 12.2.3 through 12.2.15) is possible over HTTP, allowing a low-privileged attacker to fully compromise the application's confidentiality, integrity, and availability. Oracle rates this as easily exploitable with a CVSS 3.1 base score of 8.8, though no public exploit identified at time of analysis. The flaw resides in the Internal Operations component and was disclosed in Oracle's June 2026 Critical Patch Update.
Account takeover in Oracle Project Portfolio Analysis (E-Business Suite component Internal Operations) versions 12.2.3 through 12.2.15 allows a low-privileged authenticated attacker to fully compromise the module over HTTP. Oracle's June 2026 Critical Patch Update rates the issue 8.8 with high confidentiality, integrity, and availability impacts, and the CVSS vector flags it as easily exploitable; no public exploit identified at time of analysis and the issue is not on CISA KEV.
Full product takeover of Oracle Project Portfolio Analysis (E-Business Suite component Internal Operations) is possible by an authenticated high-privileged attacker over HTTP, affecting supported versions 12.2.3 through 12.2.15. The flaw yields complete confidentiality, integrity, and availability impact on the application. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Takeover of Oracle Subledger Accounting (component: Internal Operations) in Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows an authenticated low-privileged attacker with HTTP network access to fully compromise confidentiality, integrity, and availability of the module. Although the CVSS 3.1 base score is 7.5 with high impact across all three pillars, the AC:H rating signals non-trivial exploitation requirements, and there is no public exploit identified at time of analysis.
Takeover of Oracle Subledger Accounting (component: Internal Operations) in Oracle E-Business Suite versions 12.2.3 through 12.2.15 is possible by a low-privileged remote attacker leveraging HTTP. The flaw yields full confidentiality, integrity, and availability impact (CVSS 7.5) but is rated high attack complexity, so reliable exploitation is non-trivial. No public exploit identified at time of analysis, and the issue is not listed on CISA KEV.
Takeover of Oracle iSupplier Portal (E-Business Suite versions 12.2.3 through 12.2.15) is achievable by a low-privileged remote attacker over HTTP, per Oracle's June 2026 Critical Patch Update. The flaw is rated CVSS 7.5 with high confidentiality, integrity, and availability impact, but carries high attack complexity, suggesting non-trivial preconditions. There is no public exploit identified at time of analysis and the CVE is not on CISA KEV.
Takeover of Oracle Property Manager (component: Internal Operations) in Oracle E-Business Suite versions 12.2.3 through 12.2.15 is achievable by a high-privileged attacker with HTTP network access, with no public exploit identified at time of analysis. Oracle rates the issue easily exploitable with full confidentiality, integrity, and availability impact, but the PR:H requirement narrows the practical attacker pool to those already holding elevated EBS application privileges. The flaw is disclosed in the Oracle Critical Patch Update of June 2026 and tagged as Information Disclosure / Oracle Property Manager.
Takeover of Oracle Human Resources in Oracle E-Business Suite versions 12.2.3 through 12.2.15 is possible when a remote unauthenticated attacker tricks a separate user into interacting with a crafted HTTP request targeting the Person component. Despite high attack complexity, successful exploitation yields full confidentiality, integrity, and availability impact on the HR module. No public exploit identified at time of analysis.
Full takeover of Oracle HRMS (UK) - the UK Payroll component of Oracle E-Business Suite versions 12.2.3 through 12.2.15 - is possible by an already-authenticated, highly privileged attacker over HTTP, leading to complete loss of confidentiality, integrity, and availability of the HRMS application. Oracle classifies the issue as easily exploitable but the PR:H requirement narrows the realistic attacker pool to insiders and compromised admin accounts. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Account takeover in the Oracle Quality module of Oracle E-Business Suite 12.2.3 through 12.2.15 allows a low-privileged attacker with HTTP network access to fully compromise the Quality component, impacting confidentiality, integrity, and availability (CVSS 3.1 8.8). The flaw resides in the Internal Operations component and is rated easily exploitable by Oracle's own advisory, though no public exploit identified at time of analysis and the issue is not yet listed in CISA KEV.
Account takeover of the Oracle Quality module in Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a low-privileged authenticated attacker to fully compromise the component over HTTP. Per the vendor's June 2026 Critical Patch Update advisory the issue is rated CVSS 8.8 with high impact on confidentiality, integrity, and availability, and no public exploit identified at time of analysis. Risk is elevated for internet- or intranet-exposed EBS deployments because exploitation is rated 'easily exploitable' and only requires a valid low-privilege session.
Account takeover in Oracle Advanced Outbound Telephony (E-Business Suite component, versions 12.2.3 through 12.2.15) allows a low-privileged remote attacker with HTTP access to fully compromise the product's confidentiality, integrity, and availability. Oracle has published a fix in the June 2026 Critical Patch Update, and the CVSS 3.1 base score of 8.8 reflects an easily exploitable network-borne flaw, though no public exploit identified at time of analysis and EPSS data was not provided.
Remote unauthenticated compromise of Oracle Advanced Outbound Telephony (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows attackers to read, create, modify, or delete all data accessible to the application via HTTP. Oracle rates the issue 9.1 (CVSS 3.1) due to network attack vector with no authentication and high confidentiality and integrity impact, though availability is unaffected. No public exploit identified at time of analysis, but the trivial exploitability and EBS exposure profile make it a priority patch.
Account takeover in Oracle Advanced Outbound Telephony (E-Business Suite versions 12.2.3 through 12.2.15) allows a low-privileged remote attacker to fully compromise the component over HTTP. The Internal Operations component is exposed to authenticated users with network reach, and successful exploitation yields high impact across confidentiality, integrity, and availability. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Takeover of Oracle iSupport in Oracle E-Business Suite versions 12.2.3 through 12.2.15 is achievable by an authenticated high-privileged attacker over HTTP, with scope-changed impact extending to additional EBS components. The CVSS 3.1 base score of 9.1 reflects full confidentiality, integrity, and availability loss beyond the vulnerable component itself. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Privileged remote takeover of Oracle iSupport (Oracle E-Business Suite, Internal Operations component) affects versions 12.2.3 through 12.2.15, where an authenticated high-privilege attacker with HTTP access can fully compromise the application with scope change into adjacent E-Business Suite components. The CVSS 9.1 score reflects the cross-component blast radius rather than ease of access, since PR:H means the attacker must already hold elevated privileges. No public exploit identified at time of analysis and the issue is not listed on CISA KEV.
Full takeover of Oracle iSupport (component: Internal Operations) in Oracle E-Business Suite versions 12.2.3 through 12.2.15 is achievable by an authenticated high-privileged attacker over HTTP, with a scope change that lets the attack significantly impact additional products beyond iSupport itself. The flaw carries a CVSS 3.1 base score of 9.1 with confidentiality, integrity, and availability all rated High, and no public exploit identified at time of analysis. The vendor (Oracle) is the sole reporting source via the June 2026 Critical Patch Update advisory.
Takeover of Oracle Process Manufacturing Process Planning (versions 12.2.3 through 12.2.15) is achievable by a low-privileged remote attacker over HTTP through the Internal Operations component of Oracle E-Business Suite. The flaw carries a CVSS 3.1 base score of 8.8 with full confidentiality, integrity, and availability impact, and Oracle has classified it as easily exploitable. There is no public exploit identified at time of analysis, but the low complexity and minimal authentication threshold make it a high-priority patching target for any EBS deployment.
Remote takeover of Oracle Cost Management (component: Cost Planning) within Oracle E-Business Suite versions 12.2.3 through 12.2.15 is achievable by a low-privileged attacker over HTTP, yielding full compromise of confidentiality, integrity, and availability (CVSS 8.8). The advisory was published in Oracle's June 2026 Critical Patch Update and no public exploit identified at time of analysis. Because the EBS Cost Management module is commonly reachable from internal corporate networks by any authenticated EBS user, the low privilege requirement (PR:L) makes this a credible insider/post-foothold escalation path rather than an unauthenticated internet risk.
Denial-of-service in Oracle Java SE 8u491 (and 8u491-perf) and 11.0.31 lets an unauthenticated remote attacker hang or repeatedly crash the JVM by feeding crafted input to the Scripting component's APIs, for example via a web service that passes data to those APIs. There is no confidentiality or integrity impact - only availability - but the attack is network-reachable, low-complexity, and requires no authentication or user interaction, yielding a CVSS 7.5. No public exploit identified at time of analysis and the flaw is not on CISA KEV.
Complete takeover of Oracle Data Integrator (versions 12.2.1.4.0 and 14.1.2.0.0) is achievable by a remote, unauthenticated attacker sending crafted HTTP requests to the REST Service component. Because the CVSS scope is changed (S:C), successful exploitation can pivot beyond ODI to significantly impact other integrated Fusion Middleware products, and the maximum 10.0 base score reflects full loss of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, but the trivial exploitability and network reach make this a top-priority patch from Oracle's July 2026 Critical Patch Update.
Local privilege escalation to full takeover in Oracle VM VirtualBox 7.2.12 on Windows hosts allows a low-privileged attacker who can log on to the host to compromise the VirtualBox Core component with high confidentiality, integrity, and availability impact. Oracle rates this CVSS 3.1 7.8; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The single vendor reference is Oracle's July 2026 Critical Patch Update advisory.
Integrity and availability compromise in Oracle VM VirtualBox 7.2.8 (Core component) allows a high-privileged local user, with the aid of a separate tricked user, to modify or destroy critical data and force a complete denial of service, with impact crossing into additional products due to a scope change. Rated CVSS 3.1 7.4 and disclosed in Oracle's July 2026 Critical Patch Update, it carries no confidentiality impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege escalation to full product takeover in Oracle VM VirtualBox 7.2.12 (Core component) allows a low-privileged attacker with a logon session on the host where VirtualBox runs to fully compromise the VirtualBox instance, with high impact to confidentiality, integrity, and availability (CVSS 3.1 7.8). No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV. It was disclosed by Oracle in the July 2026 Critical Patch Update.
Complete denial of service in the RDBMS component of Oracle Database Server 23.4.0 through 23.26.2 lets an unauthenticated remote attacker reach the database over Oracle Net and trigger a hang or repeatable crash, and additionally gain unauthorized update, insert, or delete access to some database-accessible data. Rated CVSS 3.1 8.2 (High) with network attack vector and low complexity, it requires no privileges or user interaction, making it easily exploitable per Oracle's advisory. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated remote compromise of Oracle Net Services affects Oracle Database Server versions 19.3-19.31, 21.3-21.22, and 23.4.0-23.26.2, letting a network attacker reaching the database listener over Oracle Net (typically TCP 1521) read all data accessible to the component and hang or repeatedly crash it for a complete denial of service. Rated CVSS 3.1 9.1 with high confidentiality and availability impact and no integrity impact, it requires no authentication or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and network-facing nature make it a high remediation priority.
Full compromise of Oracle Access Manager 14.1.2.1.0 (Oracle Fusion Middleware) is possible through its Authentication Engine, allowing a low-privileged attacker with HTTP network access to take over the identity and access management platform. Oracle rates this CVSS 3.1 8.8 with high impact to confidentiality, integrity, and availability, and describes it as easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote takeover of Oracle Siebel CRM (Siebel CRM Development, Siebel Approval Manager component) is possible by an unauthenticated attacker sending crafted HTTP requests, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact, affecting supported versions 17.0 through 26.3. There is no public exploit identified at time of analysis and the issue is not on the CISA KEV list, but the unauthenticated network-facing profile makes it a high-priority patch item.
Privilege escalation and full component takeover affects Oracle Contracts Integration within Oracle E-Business Suite (Internal Operations component), versions 12.2.3 through 12.2.15, where a low-privileged, network-authenticated attacker can compromise the component and, due to a scope change (S:C), significantly impact additional connected products. Rated CVSS 3.1 8.5 (High) with full confidentiality, integrity, and availability loss, though the attack is flagged as difficult to exploit (AC:H). No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Product takeover in Oracle Bills of Material (Bill Issues component) of Oracle E-Business Suite 12.2.3 through 12.2.15 lets a low-privileged attacker with HTTP network access fully compromise the module, per Oracle's July 2026 Critical Patch Update. The CVSS 3.1 base score is 8.8 with high impact across confidentiality, integrity, and availability, meaning an authenticated user can read, alter, and destroy Bills of Material data. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though Oracle EBS is a recurring high-value target for post-authentication attacks.
Data compromise in Oracle E-Business Suite's Document Management and Collaboration module (Attachments component) lets a low-privileged, network-adjacent attacker read, create, modify, or delete all data accessible to the module across supported releases 12.2.3 through 12.2.15. Oracle rates it CVSS 8.1 with high confidentiality and integrity impact but no availability effect, and flags it as 'easily exploitable' - meaning any authenticated EBS user can weaponize it over HTTP. There is no public exploit identified at time of analysis and it is not on CISA KEV, but Oracle EBS Attachments flaws have historically been high-value targets.
Unauthorized access to critical data in Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 is possible via the bundled OpenSearch Dashboards component, where a remote unauthenticated attacker can compromise confidentiality by luring a victim into interacting with attacker-supplied content (UI:R). The scope-change and confidentiality-only vector (S:C/C:H/I:N/A:N), combined with the vendor's 'Authentication Bypass' tag, is characteristic of a client-side flaw such as cross-site scripting in the Dashboards UI that lets an attacker read data across products the victim can reach. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; it is addressed in Oracle's July 2026 Critical Patch Update.
Data compromise in Oracle Product Hub (Oracle E-Business Suite Item Catalog component), versions 12.2.3 through 12.2.15, lets a low-privileged attacker with HTTP network access read, create, delete, or modify all Product Hub-accessible data. The CVSS 3.1 base score is 8.1, reflecting high confidentiality and integrity impact with no availability effect. No public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle E-Business Suite flaws are attractive targets and this issue is fixed in the July 2026 Critical Patch Update.
Denial-of-service in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component, versions 22.3 through 26.5) allows an unauthenticated remote attacker to send crafted HTTPS traffic that hangs or repeatedly crashes the application, producing a complete availability loss. The flaw carries a CVSS 3.1 base score of 7.5 with pure availability impact and no confidentiality or integrity effect. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Data compromise in Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 (Process Scheduler component) lets a low-privileged, network-reachable attacker read and modify critical data after luring a legitimate user into an interaction, with a scope change that can spill impact onto additional connected products. Oracle rates it CVSS 3.1 8.7 (C:H/I:H, no availability impact). No public exploit is identified at time of analysis and it is not in CISA KEV, but ease of exploitation and the cross-boundary scope change make it a notable item in the July 2026 Oracle Critical Patch Update.
Cross-site-scripting-style compromise of Oracle PeopleSoft Enterprise PeopleTools 8.62 (PIA Core Technology) lets a remote, unauthenticated attacker who lures an authenticated user into interacting with a crafted HTTP request achieve limited read/write access to PeopleSoft data and cause partial denial of service. The scope-change flag (S:C) means the impact can extend beyond PeopleTools into additional integrated products. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; CVSS 3.1 base score is 7.1.
Compromise of Oracle Product Workbench (a Security component of Oracle E-Business Suite) allows a low-privileged, network-based attacker over HTTP to read, create, delete, or modify all data accessible to the application, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 8.1 with high confidentiality and integrity impact but no availability impact, and affects EBS versions 12.2.3 through 12.2.15. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though Oracle rates it 'easily exploitable.'
Privilege-boundary compromise in Oracle Communications Pricing Design Center 15.0.0.0.0 through 15.2.0.0.0 (On-premise Deployment) lets a low-privileged attacker who already has a logon to the host infrastructure read all data accessible to the product and modify a subset of it, with a scope change that can significantly affect additional products. Oracle rates it CVSS 3.1 7.3 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) and describes it as easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full takeover of Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) is possible through the Self Update Framework component, where an authenticated high-privileged attacker reaching the console over HTTPS can compromise the confidentiality, integrity and availability of the entire management platform. Oracle rates it CVSS 3.1 7.2 and describes it as easily exploitable once the required privileges are held. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise of the Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) is possible through its Self Update Framework component, allowing an already high-privileged, authenticated attacker with network/HTTPS access to escalate to complete takeover of the platform with high confidentiality, integrity, and availability impact. Oracle rates this CVSS 3.1 7.2 and describes it as easily exploitable; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because Enterprise Manager centrally administers large Oracle estates, a takeover here is a high-value pivot despite the elevated privilege prerequisite.
Full compromise of Oracle Enterprise Manager Base Platform is possible through the Self Update Framework component in versions 13.5 and 24.1, where a low-privileged attacker with network access over HTTPS can escalate to complete takeover of the platform. The CVSS 3.1 base score is 8.8 with high confidentiality, integrity, and availability impact, and Oracle rates it 'easily exploitable.' There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided.
Data tampering and information disclosure in Oracle Enterprise Manager Base Platform (Discovery Framework component, versions 13.5 and 24.1) allows a remote, unauthenticated attacker to reach the console over HTTPS and, if the difficult-to-exploit conditions are met, create, delete, or modify critical data and read a subset of application data, plus cause a partial denial of service. Oracle rates this CVSS 3.1 7.0 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full takeover of Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) is possible when an unauthenticated remote attacker abuses a flaw in the Metadata Plugin component over HTTPS and induces an authorized user to interact with attacker-controlled content. Because the compromise yields high confidentiality, integrity, and availability impact against a central management console for Oracle estates, one successful attack can hand an adversary control of the platform. There is no public exploit identified at time of analysis and no CISA KEV listing, but the low attack complexity and unauthenticated network vector make it a priority patch in this quarter's Oracle Critical Patch Update.
Data manipulation in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1, Metadata Plugin component) allows a low-privileged attacker with HTTPS network access to create, delete, or modify critical data and read a subset of data across the platform. Rated CVSS 3.1 7.1 by Oracle, the flaw is described as easily exploitable and tagged as an authentication-bypass class issue. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full product takeover in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) allows a low-privileged, authenticated attacker with network access over HTTPS to fully compromise the platform via the Metadata Plugin component, yielding high confidentiality, integrity, and availability impact. Rated CVSS 3.1 8.8, the flaw is described by Oracle as 'easily exploitable' and requires only an existing low-privilege account and no user interaction. At time of analysis there is no public exploit identified and the CVE is not listed in CISA KEV; no EPSS score was provided in the input.
Complete product takeover in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) allows an unauthenticated remote attacker to fully compromise the management platform via the Agent Next Gen component over HTTPS. The CVSS 3.1 base score of 9.8 reflects total loss of confidentiality, integrity, and availability with no privileges or user interaction required. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but the trivial exploitability and full-takeover impact make this a high-priority patch item from Oracle's July 2026 Critical Patch Update.
Privileged data compromise in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1), via the Agent Next Gen component, lets a low-privileged, network-authenticated attacker read and modify all EM-accessible data over HTTPS. The scope-changing flaw (S:C) means impact extends beyond EM into other managed products, and the Oracle-supplied 'Authentication Bypass' tag suggests trust/privilege boundaries can be crossed. No public exploit identified at time of analysis; high attack complexity (AC:H) tempers real-world exploitability.
Product takeover in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1, Enterprise Config Management component) allows an authenticated low-privileged attacker with network access over HTTPS to fully compromise the platform. Rated CVSS 3.1 8.8 with high confidentiality, integrity, and availability impact, the flaw requires only low privileges and no user interaction, making it readily exploitable once an attacker holds any valid EM account. No public exploit identified at time of analysis, and it is not currently listed in CISA KEV.
Unauthorized data access and partial denial of service in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) allows a remote, unauthenticated attacker to reach the Enterprise Config Management component over HTTP and read, insert, update, or delete a subset of EM-accessible data. Oracle rates it CVSS 3.1 7.3 and describes it as 'easily exploitable' with no authentication or user interaction, so it is a high-priority patch for internet- or intranet-reachable EM consoles. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege-abusing compromise of the Oracle Enterprise Manager Base Platform UI Framework lets a low-privileged, network-adjacent attacker read all EM-accessible data and partially tamper with or degrade the platform over HTTPS. The scope-changing flaw (CVSS 9.1) means a successful attack can spill beyond EM into other managed products, and Oracle's own tags flag authentication-bypass and denial-of-service behavior. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and network vector make it a high patch priority.
Full takeover of Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) is possible via the Connector Framework component, allowing an attacker who already holds high privileges to fully compromise confidentiality, integrity, and availability over the network via HTTPS. Oracle rates this CVSS 7.2 and, despite the 'Information Disclosure' tag, the described impact is complete product takeover (C:H/I:H/A:H). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Information disclosure with scope change in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1, Application Service Level Management component) lets a low-privileged, network-authenticated attacker read all data accessible to the platform over HTTPS. Oracle rates it CVSS 3.1 7.7 with a scope change, so a successful attack can significantly impact products beyond Enterprise Manager itself. No public exploit is identified at time of analysis and it is not in CISA KEV, but low attack complexity plus total confidentiality loss make it a meaningful priority in Oracle-managed estates.
Full takeover of Oracle Retail Integration Bus 16.0.3 (RIB Kernel component) is achievable by an unauthenticated remote attacker over HTTP, per Oracle's July 2026 Critical Patch Update. The CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact reflects complete compromise of the RIB instance with no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivially low attack complexity makes it a high-priority patch target.
Full compromise of Oracle Retail Integration Bus 14.1.3.2 (RIB Kernel component) allows a remote, unauthenticated attacker to take over the product over HTTP, per Oracle's July 2026 Critical Patch Update. The flaw is rated CVSS 9.8 with high confidentiality, integrity, and availability impact and is described by Oracle as 'easily exploitable.' No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated network compromise of Oracle Utilities Network Management System (Mobile component) allows remote attackers to gain partial read access and partial write (insert/update/delete) access to NMS-accessible data over HTTP, with a scope change that can significantly impact adjacent products. Oracle tags this as an Authentication Bypass and rates it CVSS 7.2; no public exploit was identified at time of analysis, and it is not listed in CISA KEV. Affected releases span the 2.5.x, 2.6.x, and 25.12.x branches, fixed in the Oracle Critical Patch Update of July 2026.
Full compromise of Oracle Human Resources (part of Oracle E-Business Suite) is possible via the Data Removal Tool component, where a high-privileged attacker with HTTP network access can take over the module across supported releases 12.2.3 through 12.2.15. The flaw carries a CVSS 3.1 base score of 7.2 with high confidentiality, integrity, and availability impact, and Oracle classifies it as easily exploitable. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Data compromise in Oracle Retail EFTLink (versions 21.0.0 through 25.0.0) allows a remote unauthenticated attacker with HTTPS network access to read, create, delete, or modify all data accessible to the EFTLink service, despite a high attack-complexity barrier. Disclosed in Oracle's July 2026 Critical Patch Update with a CVSS 3.1 base score of 7.4 (C:H/I:H, no availability impact); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise of Oracle Cost Management (the Cost Maintenance component of Oracle E-Business Suite) is achievable over HTTP by a low-privileged, authenticated attacker, per Oracle's July 2026 Critical Patch Update. Successful exploitation yields complete takeover with high confidentiality, integrity, and availability impact, though Oracle rates it difficult to exploit (AC:H). There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Remote takeover of Oracle Application Testing Suite 13.3.0.1 allows an unauthenticated attacker with TCP network access to fully compromise the product without any user interaction. The flaw carries a CVSS 3.1 base score of 9.8 with complete confidentiality, integrity, and availability impact, and is addressed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-privilege attack profile makes it a high-priority patch.
Full compromise (takeover) of the Oracle Public Sector Financials (International) module in Oracle E-Business Suite is possible via its Authorization component, affecting supported versions 12.2.3 through 12.2.15. A high-privileged attacker with network access over HTTP can, under difficult-to-exploit conditions, breach the module and, because of a scope change, significantly impact additional connected products. There is no public exploit identified at time of analysis and the issue is not on CISA KEV.
Complete compromise of Oracle Application Testing Suite version 13.3.0.1 is possible by remote, unauthenticated attackers over the Oracle Net protocol, per Oracle's July 2026 Critical Patch Update. Oracle rates this 'easily exploitable' with a CVSS 3.1 base score of 9.8, and a successful attack results in full takeover of the product with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector makes it a high-priority patching target.
Complete takeover of Oracle Application Testing Suite 13.3.0.1 is possible by unauthenticated attackers over the network via TCP, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact, and Oracle characterizes it as 'easily exploitable.' No public exploit identified at time of analysis, and it is not listed in CISA KEV; no EPSS score was supplied.
Unauthenticated data disclosure in Oracle Application Testing Suite 13.3.0.1 lets a remote attacker with only TCP network access read critical application data, potentially gaining complete access to all data reachable by the product. The flaw is tagged as an authentication bypass and was disclosed in Oracle's July 2026 Critical Patch Update; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Impact is confined to confidentiality - integrity and availability are unaffected per the CVSS vector.
Cross-resource SQL injection in the FacturaScripts REST API (all versions through 2026.1) lets a low-privileged, scoped ApiKey read or modify arbitrary database tables via the `filter` query parameter, enabling full admin account takeover. A single GET request with a parenthesized filter key leaks the admin's bcrypt password hash and `logkey` session token, which are then replayed as the `fsLogkey` cookie to reach admin-only endpoints like `/AdminPlugins`. A live end-to-end PoC was verified on 2026-04-30, so publicly available exploit code exists, though there is no public exploit identified as being used in active attacks (not in CISA KEV).
CSRF token disclosure in the Perl Mojolicious web framework (versions 4.59 up to but not including 9.48) allows a network attacker to recover a victim's session CSRF token via a BREACH compression side channel and then bypass csrf_protect validation. Because _csrf_token cached and returned one stable per-session value that _csrf_field embedded in every response, an attacker who could inject reflected input into a gzip-compressed page could iteratively guess the token by observing compressed response lengths. There is no public exploit identified at time of analysis, EPSS is low (0.15%), and it is not in CISA KEV, but SSVC rates technical impact as total and automatable as yes.
Boolean-based blind SQL injection in YesWiki's public Bazar entry-listing API allows unauthenticated attackers to read arbitrary database contents by abusing numeric query/queries filters. Because numeric field values are escaped with mysqli_real_escape_string but inserted into the SQL statement without quotes or numeric validation, injected boolean expressions (e.g. '100 OR (SELECT COUNT(*) FROM yeswiki_users)>0') are evaluated by the database, turning the public endpoints into a data-exfiltration oracle. A detailed, self-contained proof-of-concept is published in the advisory; a vendor patch (commit f3b0dd0) is available, though the issue is not listed in CISA KEV.
Server-side request forgery in the Ruby css_parser gem (< 3.0.0) lets a remote unauthenticated attacker force the parsing server to issue arbitrary HTTP/HTTPS GET requests, and via an attacker-controlled 3xx redirect to a file:// URI, escalate to arbitrary local file disclosure. The flaw sits in CssParser::Parser#read_remote_file, reachable through load_uri! and any add_block! call that supplies base_uri: - Premailer being the canonical consumer - so a single attacker-planted @import url(...) in parsed CSS reaches the sink. Publicly available exploit code exists (author-supplied PoC); there is no public exploit identified as being used in active campaigns, and it is not listed in CISA KEV.
Heap out-of-bounds read and write in the Linux kernel's KVM AMD SEV-SNP host code lets a malicious confidential guest corrupt and disclose host kernel heap memory. The flaw is in the GHCB Page State Change (PSC) path: setup_vmgexit_scratch() sizes a kvzalloc buffer from the guest-controlled exit_info_2, but snp_begin_psc() only bounds the entry index against VMGEXIT_PSC_MAX_COUNT (253) rather than the actual allocation, so a guest can drive iteration past the buffer into adjacent kmalloc-cg-32 slab objects. Rated CVSS 8.8 with a guest-to-host scope change; EPSS is low at 0.27% and there is no CISA KEV listing, though a working in-tree reproducer is credited in the changelog.
Unauthorized blob read, write, and delete operations in CrateDB's HTTP API allow any authenticated user to bypass privilege grants on blob tables. The HttpBlobHandler endpoint fails to enforce access control, enabling authenticated users to read, delete, or plant arbitrary blobs via crafted HTTP requests, regardless of their SQL-level permissions. Public proof-of-concept exploit code exists; a vendor patch is available, but active exploitation has not been confirmed through CISA KEV.
Sandbox policy bypass in Twig PHP template engine allows sandboxed template authors to trigger `__toString()` calls on objects explicitly blocked by `SecurityPolicy::$allowedMethods`, through two distinct coercion paths: `Traversable` inputs to the `join` and `replace` filters, and PHP's implicit spaceship-operator coercion inside the `in`/`not in` operator implementation. Beyond unauthorized method invocation, the `in` operator can be chained into a character-by-character equality oracle, enabling reconstruction of the full string value of sensitive objects - such as tokens or credentials passed into the render context - without any direct method invocation being permitted. This is a residual bypass of CVE-2026-47732; no public exploit code has been identified at time of analysis, and the issue is patched in Twig v3.27.0.
Denial of service in Citrix NetScaler ADC and NetScaler Gateway stems from multiple memory overflow conditions that produce unpredictable or erroneous behavior when the appliance is configured for specific DNS or load-balancing roles. Remote unauthenticated attackers can send crafted traffic to a vulnerable appliance to crash or destabilize it, with the CVSS 4.0 score of 8.8 driven primarily by high availability impact. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Unauthenticated NoSQL operator injection in Budibase server <= 3.39.0 allows anonymous attackers to read or modify all documents in any MongoDB, CouchDB, Elasticsearch, DynamoDB-PartiQL, or REST-with-JSON-body datasource when a builder has published a query with a PUBLIC role. By injecting JSON metacharacters through query parameters, an attacker can override the intended filter, bypass authentication, and exfiltrate sensitive data or mass-update records in a single HTTP request. Exploit code is publicly available, though no active exploitation is confirmed, and the vulnerability has been patched in version 3.39.12.
Information disclosure in Capgo before 12.128.2 lets remote unauthenticated attackers abuse the security-definer RPC function get_identity_apikey_only to validate arbitrary API keys and map them to owning user_ids. The endpoint functions as an oracle, and results can be chained into other exposed RPCs such as get_orgs_v6 to enumerate organization membership and harvest management email PII. No public exploit identified at time of analysis, though VulnCheck has publicly documented the technique and a vendor patch is available.
Cross-user flow execution in Langflow (< 1.9.1) lets any authenticated API-key holder run another user's flow by passing the victim's flow UUID as the `model` value to the `/api/v1/responses` endpoint, exposing data the victim's flow processes and consuming their resources. The flaw is an Insecure Direct Object Reference (CWE-639) in the `get_flow_by_id_or_endpoint_name` helper, which skipped ownership checks on the UUID lookup path. Publicly available exploit code exists (a working curl PoC), and the input lists it as confirmed actively exploited (CISA KEV), though the SSVC exploitation status of 'poc' and a low 0.24% EPSS complicate that claim (see risk_assessment).
Remote code execution in libaom (reference AV1 codec) is possible when services use the SVC encoder with attacker-supplied frames, allowing crafted pixel data to overlap encoder layer context structures and hijack the cyclic refresh map pointer. The flaw chains a heap out-of-bounds write (CWE-787) with a crash-oracle ASLR bypass to redirect control flow in fork-based video processing services. No public exploit identified at time of analysis, but the issue is tracked under Red Hat and Chromium security trackers and an upstream fix commit has landed in aomedia.
Server-side request forgery in Open WebUI versions 0.9.5 and earlier allows authenticated OAuth users to read arbitrary internal HTTP responses by abusing the `_process_picture_url` function in `backend/open_webui/utils/oauth.py`, which validates only the initial URL and then permits aiohttp's default 10-redirect follow chain to reach internal addresses. The decoded response body is stored in the attacker's `profile_image_url` and retrievable via `GET /api/v1/auths/`, yielding cloud metadata credentials and access to localhost-bound services. Publicly available exploit code exists (detailed sentinel-verified PoC supplied by the reporter); no public exploit identified at time of analysis in the form of weaponized tooling, and the CVE is not on the CISA KEV list.
Server-Side Request Forgery in Crawl4AI's Docker API server (versions <= 0.8.7) allows unauthenticated remote attackers to bypass the IPv4/IPv6 CIDR blocklist in validate_webhook_url/validate_url_destination by using IPv6 transition forms (NAT64, 6to4, IPv4-mapped, IPv4-compatible) or the unspecified address. Since the Docker API ships with jwt_enabled:false by default, attackers can pivot the server into fetching cloud metadata endpoints like 169.254.169.254, potentially exposing IAM credentials. No public exploit identified at time of analysis, but the upstream advisory (GHSA-4qqr-vv2q-cmr5) details the exact bypass payloads.
Unauthenticated remote compromise of Oracle Solaris 11.4 Remote Administration Daemon (RAD) allows network attackers to read, modify, create, or delete critical data with scope change impacting adjacent products. The CVSS 3.1 base score of 10.0 with AV:N/AC:L/PR:N/UI:N reflects trivial network exploitability over HTTPS without authentication, and no public exploit identified at time of analysis. The scope-change designation indicates that successful exploitation breaches the security authority of RAD and propagates impact to other Solaris-managed components.
Full takeover of Oracle Public Sector Payroll (E-Business Suite 12.2.3-12.2.15) is possible by a high-privileged, network-adjacent attacker exploiting a flaw in the Internal Operations component, with confidentiality, integrity, and availability all fully impacted. Oracle's June 2026 Critical Patch Update describes the issue as easily exploitable over HTTP once privileges are held, and no public exploit identified at time of analysis. CVSS 3.1 base score is 7.2.
Privileged local compromise of Oracle VM VirtualBox 7.2.8 allows an attacker already authenticated to the host with high privileges to take over the VirtualBox installation and cross the hypervisor boundary into additional products (scope-changed). Oracle's CPU advisory rates this CVSS 3.1 7.5 with high attack complexity; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Account takeover in Oracle Outsourced Mfg for Discrete Industries (component: Internal Operations) within Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a low-privileged remote attacker to fully compromise the module over HTTP. With CVSS 3.1 base score 8.8 and high impact on confidentiality, integrity, and availability, this is a high-priority patching item, though no public exploit identified at time of analysis and it is not currently listed in CISA KEV.
Full takeover of Oracle Outsourced Mfg for Discrete Industries (component: Internal Operations) is achievable by a low-privileged authenticated attacker over HTTP, per Oracle's June 2026 Critical Patch Update advisory. The CVSS 3.1 base score of 8.8 reflects high impact across confidentiality, integrity, and availability with low attack complexity, though no public exploit identified at time of analysis. Affected versions span 12.2.3 through 12.2.15 of Oracle E-Business Suite.
Full compromise of Oracle HR Intelligence (a module of Oracle E-Business Suite) is possible for an authenticated low-privileged attacker who can reach the Internal Operations component over HTTP, per Oracle's June 2026 Critical Patch Update. The flaw affects EBS versions 12.2.3 through 12.2.15 and yields high impact across confidentiality, integrity, and availability, though Oracle rates exploitation as difficult (AC:H). No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Full compromise of Oracle HR Intelligence (component: Internal Operations) in Oracle E-Business Suite versions 12.2.3 through 12.2.15 is possible by an authenticated high-privileged attacker over HTTP. Successful exploitation results in takeover of the HR Intelligence application with confidentiality, integrity, and availability impact (CVSS 3.1 base 7.2). There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Privileged takeover of Oracle Financials for EMEA (component: Internal Operations) in Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows an authenticated high-privileged attacker with HTTP network access to fully compromise confidentiality, integrity, and availability of the module. The CVSS 3.1 base score is 7.2 with vector AV:N/AC:L/PR:H/UI:N, and there is no public exploit identified at time of analysis.
Authorization flaw in Oracle Public Sector Financials (International) versions 12.2.3 through 12.2.15 enables low-privileged authenticated attackers with HTTP network access to fully take over the affected component. Oracle's Critical Patch Update describes the issue as easily exploitable with high impact to confidentiality, integrity, and availability (CVSS 8.8). No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Takeover of Oracle Universal Work Queue is possible in Oracle E-Business Suite versions 12.2.3 through 12.2.15 via the Work Provider Site Level Administration component, where a low-privileged attacker with HTTP network access can fully compromise confidentiality, integrity, and availability of the module. Oracle classifies the issue as difficult to exploit (AC:H), and no public exploit identified at time of analysis. The flaw was disclosed in the Oracle Critical Patch Update of June 2026.
Account takeover in Oracle Universal Work Queue (Oracle E-Business Suite 12.2.3 through 12.2.15) allows a low-privileged attacker with HTTP network access to fully compromise the Work Provider Site Level Administration component. Oracle rates this as easily exploitable with full confidentiality, integrity, and availability impact (CVSS 3.1 base 8.8), though no public exploit identified at time of analysis and it is not currently listed in CISA KEV.
Privilege escalation and full takeover of Oracle Universal Work Queue (component: Work Provider Site Level Administration) in Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a low-privileged remote attacker over HTTP to compromise the application with scope change extending impact to additional products. The CVSS 3.1 base score is 9.9 with full confidentiality, integrity, and availability impact, and no public exploit identified at time of analysis.
Account takeover in Oracle Universal Work Queue (Oracle E-Business Suite 12.2.3 through 12.2.15) allows a low-privileged remote attacker to fully compromise the component via HTTP, with a scope change that can significantly impact other connected products. The CVSS 3.1 base score of 9.9 reflects high confidentiality, integrity, and availability impact, and no public exploit is identified at time of analysis. Authenticated EBS users - including low-tier business users - should be treated as potential threat actors against this surface.
Authenticated takeover of Oracle Project Portfolio Analysis (E-Business Suite versions 12.2.3 through 12.2.15) is possible over HTTP, allowing a low-privileged attacker to fully compromise the application's confidentiality, integrity, and availability. Oracle rates this as easily exploitable with a CVSS 3.1 base score of 8.8, though no public exploit identified at time of analysis. The flaw resides in the Internal Operations component and was disclosed in Oracle's June 2026 Critical Patch Update.
Account takeover in Oracle Project Portfolio Analysis (E-Business Suite component Internal Operations) versions 12.2.3 through 12.2.15 allows a low-privileged authenticated attacker to fully compromise the module over HTTP. Oracle's June 2026 Critical Patch Update rates the issue 8.8 with high confidentiality, integrity, and availability impacts, and the CVSS vector flags it as easily exploitable; no public exploit identified at time of analysis and the issue is not on CISA KEV.
Full product takeover of Oracle Project Portfolio Analysis (E-Business Suite component Internal Operations) is possible by an authenticated high-privileged attacker over HTTP, affecting supported versions 12.2.3 through 12.2.15. The flaw yields complete confidentiality, integrity, and availability impact on the application. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Takeover of Oracle Subledger Accounting (component: Internal Operations) in Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows an authenticated low-privileged attacker with HTTP network access to fully compromise confidentiality, integrity, and availability of the module. Although the CVSS 3.1 base score is 7.5 with high impact across all three pillars, the AC:H rating signals non-trivial exploitation requirements, and there is no public exploit identified at time of analysis.
Takeover of Oracle Subledger Accounting (component: Internal Operations) in Oracle E-Business Suite versions 12.2.3 through 12.2.15 is possible by a low-privileged remote attacker leveraging HTTP. The flaw yields full confidentiality, integrity, and availability impact (CVSS 7.5) but is rated high attack complexity, so reliable exploitation is non-trivial. No public exploit identified at time of analysis, and the issue is not listed on CISA KEV.
Takeover of Oracle iSupplier Portal (E-Business Suite versions 12.2.3 through 12.2.15) is achievable by a low-privileged remote attacker over HTTP, per Oracle's June 2026 Critical Patch Update. The flaw is rated CVSS 7.5 with high confidentiality, integrity, and availability impact, but carries high attack complexity, suggesting non-trivial preconditions. There is no public exploit identified at time of analysis and the CVE is not on CISA KEV.
Takeover of Oracle Property Manager (component: Internal Operations) in Oracle E-Business Suite versions 12.2.3 through 12.2.15 is achievable by a high-privileged attacker with HTTP network access, with no public exploit identified at time of analysis. Oracle rates the issue easily exploitable with full confidentiality, integrity, and availability impact, but the PR:H requirement narrows the practical attacker pool to those already holding elevated EBS application privileges. The flaw is disclosed in the Oracle Critical Patch Update of June 2026 and tagged as Information Disclosure / Oracle Property Manager.
Takeover of Oracle Human Resources in Oracle E-Business Suite versions 12.2.3 through 12.2.15 is possible when a remote unauthenticated attacker tricks a separate user into interacting with a crafted HTTP request targeting the Person component. Despite high attack complexity, successful exploitation yields full confidentiality, integrity, and availability impact on the HR module. No public exploit identified at time of analysis.
Full takeover of Oracle HRMS (UK) - the UK Payroll component of Oracle E-Business Suite versions 12.2.3 through 12.2.15 - is possible by an already-authenticated, highly privileged attacker over HTTP, leading to complete loss of confidentiality, integrity, and availability of the HRMS application. Oracle classifies the issue as easily exploitable but the PR:H requirement narrows the realistic attacker pool to insiders and compromised admin accounts. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Account takeover in the Oracle Quality module of Oracle E-Business Suite 12.2.3 through 12.2.15 allows a low-privileged attacker with HTTP network access to fully compromise the Quality component, impacting confidentiality, integrity, and availability (CVSS 3.1 8.8). The flaw resides in the Internal Operations component and is rated easily exploitable by Oracle's own advisory, though no public exploit identified at time of analysis and the issue is not yet listed in CISA KEV.
Account takeover of the Oracle Quality module in Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a low-privileged authenticated attacker to fully compromise the component over HTTP. Per the vendor's June 2026 Critical Patch Update advisory the issue is rated CVSS 8.8 with high impact on confidentiality, integrity, and availability, and no public exploit identified at time of analysis. Risk is elevated for internet- or intranet-exposed EBS deployments because exploitation is rated 'easily exploitable' and only requires a valid low-privilege session.
Account takeover in Oracle Advanced Outbound Telephony (E-Business Suite component, versions 12.2.3 through 12.2.15) allows a low-privileged remote attacker with HTTP access to fully compromise the product's confidentiality, integrity, and availability. Oracle has published a fix in the June 2026 Critical Patch Update, and the CVSS 3.1 base score of 8.8 reflects an easily exploitable network-borne flaw, though no public exploit identified at time of analysis and EPSS data was not provided.
Remote unauthenticated compromise of Oracle Advanced Outbound Telephony (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows attackers to read, create, modify, or delete all data accessible to the application via HTTP. Oracle rates the issue 9.1 (CVSS 3.1) due to network attack vector with no authentication and high confidentiality and integrity impact, though availability is unaffected. No public exploit identified at time of analysis, but the trivial exploitability and EBS exposure profile make it a priority patch.
Account takeover in Oracle Advanced Outbound Telephony (E-Business Suite versions 12.2.3 through 12.2.15) allows a low-privileged remote attacker to fully compromise the component over HTTP. The Internal Operations component is exposed to authenticated users with network reach, and successful exploitation yields high impact across confidentiality, integrity, and availability. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Takeover of Oracle iSupport in Oracle E-Business Suite versions 12.2.3 through 12.2.15 is achievable by an authenticated high-privileged attacker over HTTP, with scope-changed impact extending to additional EBS components. The CVSS 3.1 base score of 9.1 reflects full confidentiality, integrity, and availability loss beyond the vulnerable component itself. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Privileged remote takeover of Oracle iSupport (Oracle E-Business Suite, Internal Operations component) affects versions 12.2.3 through 12.2.15, where an authenticated high-privilege attacker with HTTP access can fully compromise the application with scope change into adjacent E-Business Suite components. The CVSS 9.1 score reflects the cross-component blast radius rather than ease of access, since PR:H means the attacker must already hold elevated privileges. No public exploit identified at time of analysis and the issue is not listed on CISA KEV.
Full takeover of Oracle iSupport (component: Internal Operations) in Oracle E-Business Suite versions 12.2.3 through 12.2.15 is achievable by an authenticated high-privileged attacker over HTTP, with a scope change that lets the attack significantly impact additional products beyond iSupport itself. The flaw carries a CVSS 3.1 base score of 9.1 with confidentiality, integrity, and availability all rated High, and no public exploit identified at time of analysis. The vendor (Oracle) is the sole reporting source via the June 2026 Critical Patch Update advisory.
Takeover of Oracle Process Manufacturing Process Planning (versions 12.2.3 through 12.2.15) is achievable by a low-privileged remote attacker over HTTP through the Internal Operations component of Oracle E-Business Suite. The flaw carries a CVSS 3.1 base score of 8.8 with full confidentiality, integrity, and availability impact, and Oracle has classified it as easily exploitable. There is no public exploit identified at time of analysis, but the low complexity and minimal authentication threshold make it a high-priority patching target for any EBS deployment.
Remote takeover of Oracle Cost Management (component: Cost Planning) within Oracle E-Business Suite versions 12.2.3 through 12.2.15 is achievable by a low-privileged attacker over HTTP, yielding full compromise of confidentiality, integrity, and availability (CVSS 8.8). The advisory was published in Oracle's June 2026 Critical Patch Update and no public exploit identified at time of analysis. Because the EBS Cost Management module is commonly reachable from internal corporate networks by any authenticated EBS user, the low privilege requirement (PR:L) makes this a credible insider/post-foothold escalation path rather than an unauthenticated internet risk.