Oracle
Monthly
Unauthenticated remote compromise of Oracle PeopleSoft Enterprise PT PeopleTools 8.61 and 8.62 via the WebLogic component allows attackers with HTTP access to read and modify critical data across PeopleTools and additional products in scope. Oracle rates the issue 8.7 CVSS 3.1 with high attack complexity but no privileges or user interaction, and the scope-change flag means impact extends beyond PeopleTools itself. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Privileged takeover of Oracle WebCenter Content (Content Server component) affects supported versions 12.2.1.4.0 and 14.1.2.0.0, enabling a high-privileged attacker with HTTP network access to fully compromise the instance and pivot to additional Fusion Middleware products via a scope change. The CVSS 3.1 base score is 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), reflecting low attack complexity and full CIA impact. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Unauthorized data modification in Oracle Identity Manager (Fusion Middleware) versions 12.2.1.4.0 and 14.1.2.1.0 allows a remote unauthenticated attacker to create, delete, or modify critical identity data via the REST WebServices component over HTTP. Oracle rates the issue as easily exploitable with a CVSS 3.1 base score of 7.5 (integrity-only impact), and no public exploit has been identified at time of analysis.
Account takeover in Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 (Fusion Middleware Core component) allows a low-privileged remote attacker to fully compromise the product via T3 or IIOP protocols, with scope change extending impact to other Fusion Middleware components. The CVSS 9.9 score reflects high confidentiality, integrity, and availability impact combined with low attack complexity. No public exploit identified at time of analysis, but Identity Manager's role as a central identity authority makes this a critical patching priority.
Account takeover in Oracle Identity Manager (Fusion Middleware) versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged remote attacker to fully compromise the Identity Manager instance via its REST WebServices component over HTTP. Oracle rates the flaw CVSS 8.8 with high impact to confidentiality, integrity, and availability, and no public exploit identified at time of analysis. Because Identity Manager governs enterprise identity lifecycle and provisioning, successful exploitation has cascading impact across downstream applications it manages.
Account takeover in Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged remote attacker with HTTP access to fully compromise the Identity Manager component of Oracle Fusion Middleware. With a CVSS 3.1 base score of 8.8 and high impact across confidentiality, integrity, and availability, successful exploitation results in takeover of the identity governance platform itself. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Remote takeover of Oracle WebLogic Server 14.1.2.0.0 and 15.1.1.0.0 (Fusion Middleware, Core component) is achievable by a low-privileged attacker over HTTP, with a CVSS 3.1 score of 9.9 driven by a scope change that lets the impact spread beyond WebLogic itself. Oracle has issued the fix in the June 2026 Critical Patch Update (cspujun2026), and there is no public exploit identified at time of analysis. Authenticated but low-effort exploitation combined with full confidentiality, integrity and availability impact makes this a top-priority patching item for any Oracle middleware estate.
Authenticated tampering and data exposure in Oracle Data Integrator 12.2.1.4.0 and 14.1.2.0.0 (Market Place component) allows a low-privileged attacker with HTTP network access to read, modify, or delete all data accessible to the product and induce a partial denial of service. Oracle assigns a CVSS 3.1 base score of 8.3 (AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:L), and no public exploit identified at time of analysis. The flaw is described by Oracle as easily exploitable, raising the priority for any externally reachable ODI deployment.
Full takeover of Oracle WebLogic Server 14.1.2.0.0 and 15.1.1.0.0 is achievable by remote unauthenticated attackers via the Console component over HTTPS, provided a victim performs an action such as clicking a malicious link. The flaw carries a CVSS 3.1 base score of 8.8 with high impact across confidentiality, integrity, and availability, but exploitation hinges on user interaction. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Cross-scope data compromise in Oracle WebLogic Server 14.1.2.0.0 and 15.1.1.0.0 allows a low-privileged remote attacker over HTTPS to read, create, modify, or delete critical data through the administration Console, provided a separate user is induced to perform an action. The CVSS 3.1 base score of 8.7 reflects high confidentiality and integrity impact with scope change reaching beyond WebLogic itself, and no public exploit identified at time of analysis.
SQL injection in the WP Review Slider Pro WordPress plugin (versions ≤12.6.8) allows authenticated attackers with Subscriber-level access to inject arbitrary SQL via the 'stypes' and 'slocations' JSON parameters of the wppro_get_overall_chart_data AJAX action. Because the vulnerable handler echoes the executed SQL back in its JSON response, attackers gain a built-in oracle that turns blind injection into a near-trivial database extraction primitive. No public exploit identified at time of analysis, but the very low privilege barrier on a default WordPress install makes any exposed site a realistic target.
Authentication bypass in Discuz! X5.0 releases 20260320 through 20260501 allows unauthenticated remote attackers to access database backup and restore functionality exposed by dbbak.php. The flaw stems from a shared cryptographic key (CWE-323) between UCenter integration and the backup API, which lets an attacker abuse an encryption oracle in logging_ctl::logging_more() to mint legitimately signed authorization tokens, and chain a race condition to impersonate arbitrary users. Publicly available exploit code exists and an upstream fix has been published on Gitee.
Remote takeover of Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 is possible through the Updates Environment Management component via unauthenticated HTTP requests. The CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N) indicates trivial network-based exploitation against any internet- or intranet-exposed instance, with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, but Oracle's 'easily exploitable' language and the unauthenticated nature make this a high-priority patching target.
SQL injection in LimeSurvey's RemoteControl API (invite_participants and remind_participants methods) allows an authenticated attacker with tokens/update permission on a survey to execute arbitrary stacked SQL queries against the application database. Because PDO emulated prepared statements are enabled and MySQL multi-statements are not disabled, attackers can read administrator bcrypt hashes via time-based blind techniques or directly overwrite credentials for instant account takeover. No public exploit identified at time of analysis; the upstream fix is published as LimeSurvey PR #5031, which replaces unsafe string concatenation with parameterized addInCondition().
Server-side request forgery in FUXA SCADA/HMI server (npm package fuxa-server <= 1.1.14-1243) allows unauthenticated remote attackers to connect to the Socket.IO endpoint and coerce the server to issue arbitrary HTTP(S), OPC UA, or ODBC requests with response bodies echoed back to the caller. No public exploit identified at time of analysis, but the GitHub Security Advisory GHSA-w86f-rf9w-h3x6 provides full handler-level reproduction details and the fix is shipped in release v1.3.2.
Sandbox policy bypass in Twig templating engine versions 3.25.0 and earlier allows sandboxed template authors to invoke arbitrary `__toString()` methods on any `Stringable` object reachable in the render context, even when those methods are not allowlisted by `SecurityPolicy::checkMethodAllowed()`. The flaw stems from `SandboxNodeVisitor` only wrapping a hardcoded subset of AST nodes in `CheckToStringNode`, leaving many string-coercion points (conditional expressions, comparison/`matches` operators, tests, ranges, includes, spread arguments) unguarded - and the comparison-operator vector enables byte-by-byte oracle recovery of sensitive object string forms. No public exploit identified at time of analysis; fix shipped in Twig 3.26.0 (also referenced by Symfony's advisory page).
Remote takeover of Oracle REST Data Services (ORDS) versions 24.2.0 through 26.1.0 allows unauthenticated attackers to compromise the service over HTTPS and pivot into adjacent products due to a scope-changing flaw. With a maximum CVSS 10.0 score and trivial exploitability (AV:N/AC:L/PR:N/UI:N), this Backend-as-a-Service component vulnerability poses critical risk, though no public exploit identified at time of analysis and no EPSS or CISA KEV signal has been provided in the available data.
Privilege escalation to full takeover in Oracle REST Data Services (ORDS) versions 24.2.0 through 26.1.0 allows a low-privileged remote attacker over HTTPS to fully compromise the service and pivot into adjacent products via a CVSS scope change. CVSS 3.1 base score is 9.9 with attack complexity rated low, and no public exploit identified at time of analysis. The scope-change designation is the key differentiator - successful exploitation extends beyond ORDS itself into systems it fronts, most notably the backing Oracle Database.
Full product takeover of Oracle Flow Manufacturing (versions 12.2.9 through 12.2.15) is achievable by a low-privileged remote attacker via SQL-based network access, per Oracle's advisory. The flaw scores CVSS 8.8 with high impact across confidentiality, integrity, and availability, and no public exploit has been identified at time of analysis. As a component of Oracle E-Business Suite, exploitation provides an attacker with control over a business-critical manufacturing execution system.
Remote denial of service in Oracle Database Server 23.4.0 through 23.26.2 allows unauthenticated network attackers to crash or hang the Net Service component via crafted TLS traffic. The flaw scores CVSS 7.5 with availability-only impact and was disclosed by Oracle in the May 2026 Critical Patch Update; no public exploit identified at time of analysis.
Remote denial-of-service in Oracle Database Server's Net Service component (versions 23.4.0 through 23.26.2) allows unauthenticated attackers with TLS network access to hang or repeatedly crash the listener, producing a complete DoS of database connectivity. The flaw is rated CVSS 7.5 (availability-only) and was disclosed by Oracle in the May 2026 Critical Patch Update; no public exploit identified at time of analysis and the issue is not currently listed in CISA KEV.
Net Service takeover in Oracle Database Server 23.4.0 through 23.26.2 allows unauthenticated remote attackers reaching the TLS-protected Net Service listener to fully compromise confidentiality, integrity, and availability, with scope change indicating impact on adjacent components. CVSS 9.0 reflects high impact tempered by high attack complexity (AC:H), and no public exploit identified at time of analysis. Reported and tracked in Oracle's May 2026 Critical Patch Update advisory.
Remote denial-of-service in Oracle REST Data Services (ORDS) versions 24.2.0 through 26.1.0 allows unauthenticated network attackers to cause a complete hang or repeatable crash of the service via the Mongoapi component over HTTPS. The vulnerability is rated CVSS 7.5 with availability-only impact and no public exploit identified at time of analysis, but the unauthenticated, low-complexity attack profile makes it operationally significant for any internet-exposed ORDS instance.
Unauthorized data access and modification in Oracle Payroll (a module of Oracle E-Business Suite) versions 12.2.3 through 12.2.15 allows a low-privileged authenticated attacker with HTTP network access to read, create, delete, or modify any data accessible to the Oracle Payroll application. The flaw carries a CVSS 8.1 due to high confidentiality and integrity impact with low attack complexity, but no public exploit identified at time of analysis and it is not listed in CISA KEV. The advisory was published as part of Oracle's Critical Patch Update cycle (CPU May 2026).
Account takeover in Oracle Payroll (Self Service Manager component) of Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a low-privileged authenticated attacker to fully compromise the Payroll module over HTTP. The CVSS 3.1 base score of 8.8 reflects high impacts to confidentiality, integrity, and availability, and Oracle has issued a fix in the May 2026 Critical Patch Update. No public exploit identified at time of analysis.
Account takeover in Oracle Payroll (component: Internal Operations) within Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a low-privileged remote attacker with HTTPS network access to fully compromise the Payroll application. The CVSS 8.8 vector indicates low complexity and no user interaction, meaning any authenticated EBS user can pivot to full confidentiality, integrity, and availability impact on Payroll. No public exploit identified at time of analysis, but the issue was disclosed in Oracle's Critical Patch Update advisory and warrants prompt patching given the sensitivity of payroll data.
Account takeover in Oracle Universal Work Queue (component: Work Provider Site Level Administration) within Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows low-privileged remote attackers over HTTP to fully compromise the product with confidentiality, integrity, and availability impact. The CVSS 9.9 score reflects a scope-changing flaw whose blast radius extends to other Oracle E-Business Suite products beyond Universal Work Queue itself. No public exploit identified at time of analysis, but the low attack complexity and minimal privilege requirement make this a high-priority Oracle Critical Patch Update item.
Unauthorized data access in Oracle Public Sector Financials (International), a module of Oracle E-Business Suite versions 12.2.6 through 12.2.15, allows low-privileged remote attackers to read sensitive data across module boundaries due to a flaw in the Authorization component. The scope-changed CVSS 7.7 vector indicates exploitation can affect resources beyond the vulnerable component itself, expanding the blast radius to other EBS data. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Account takeover in Oracle iAssets (part of Oracle E-Business Suite versions 12.2.3 through 12.2.15) allows a low-privileged attacker with HTTP network access to fully compromise the iAssets component and pivot into adjacent products via a scope change. The 9.9 CVSS score reflects high impact on confidentiality, integrity, and availability combined with low attack complexity; no public exploit identified at time of analysis, but Oracle's inclusion in the May 2026 Critical Patch Update warrants immediate attention.
Unauthorized data access in Oracle E-Business Suite's Financials Common Modules (versions 12.2.3 through 12.2.15) allows low-privileged remote attackers to read sensitive data via HTTP, with a scope change that extends impact beyond the vulnerable component to other Oracle products. The flaw carries a CVSS 3.1 base score of 7.7 reflecting high confidentiality impact, but no public exploit has been identified at time of analysis and the issue is not currently listed in CISA KEV.
Cross-product data exposure in Oracle Financials Common Modules (E-Business Suite versions 12.2.3 through 12.2.15) allows a low-privileged authenticated attacker to access or modify sensitive financial data over HTTP. The scope-changed nature of the flaw means exploitation impacts additional Oracle products beyond Financials Common Modules itself. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Remote unauthenticated compromise of Oracle Internet Procurement Connector (a component of Oracle E-Business Suite versions 12.2.3 through 12.2.15) allows attackers to read, modify, create, or delete all data accessible to the component over HTTP. The CVSS 9.1 score reflects high confidentiality and integrity impact with low attack complexity and no privileges or user interaction required. No public exploit identified at time of analysis, but the trivial exploitability profile combined with EBS's history of being targeted (e.g., CVE-2025 Cl0p campaigns) makes this a priority patch for any internet-exposed deployment.
Unauthorized data modification and disclosure in Oracle E-Business Suite (Oracle Payments component, File Transmission) versions 12.2.3 through 12.2.15 allows unauthenticated remote attackers over HTTPS to read, alter, create, or delete all Oracle Payments-accessible data. The flaw carries a CVSS 3.1 base score of 7.4 with high confidentiality and integrity impact but no availability impact, and is rated high attack complexity. No public exploit identified at time of analysis, and it is not currently listed in CISA KEV.
Remote takeover of Oracle Payments in Oracle E-Business Suite versions 12.2.3 through 12.2.15 is possible via the File Transmission component, allowing unauthenticated network-based attackers to fully compromise confidentiality, integrity, and availability (CVSS 9.8). The flaw is described by Oracle as easily exploitable over HTTP with no user interaction, and no public exploit identified at time of analysis. Tagged as Information Disclosure and listed in Oracle's May 2026 Critical Patch Update advisory.
Takeover of Oracle REST Data Services (ORDS) versions 24.2.0 through 26.1.0 is achievable by a low-privileged remote attacker over HTTPS, with scope-changed impact extending to additional Oracle products beyond ORDS itself. Oracle rates this 9.9 CVSS due to the combination of low attack complexity, minimal privilege requirement, and full confidentiality/integrity/availability compromise; no public exploit identified at time of analysis, but the easy exploitability noted in Oracle's advisory makes this a high-priority patch target.
Unauthorized data access and modification in Oracle REST Data Services (ORDS) versions 24.2.0 through 26.1.0 allows low-privileged remote attackers to read, create, modify, or delete any data accessible via the service. The flaw is network-reachable over HTTPS with low attack complexity (CVSS 8.1) and was disclosed by Oracle in the May 2026 Critical Patch Update. No public exploit has been identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.
Cross-product compromise in Oracle REST Data Services (ORDS) versions 24.2.0 through 26.1.0 allows a low-privileged remote attacker who can lure an authenticated user into interacting with a crafted request to gain high-impact read and write access to ORDS-accessible data and cause partial denial of service. Because the CVSS scope is Changed (S:C), successful exploitation may also impact downstream Oracle components beyond ORDS itself. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the 7.9 base score combined with scope change warrants prompt patching.
Remote takeover of Oracle Hospitality OPERA 5 Property Services (versions 5.6.19.24, 5.6.22, 5.6.25.19, 5.6.27.6, and 5.6.28) is achievable by unauthenticated network attackers over HTTP, per Oracle's May 2026 CPU. With CVSS 9.8 and full CIA impact, this is a critical hospitality-sector exposure, though no public exploit is identified at time of analysis and KEV status is not present. EPSS data was not supplied, so probability-of-exploitation cannot be quantified.
Sensitive credential disclosure in OpenMetadata 1.12.1 allows any authenticated non-admin SSO user to retrieve cleartext database passwords and a long-lived ingestion-bot JWT by triggering a TEST_CONNECTION workflow via POST /api/v1/automations/workflows. The HTTP 201 response unexpectedly echoes the stored Oracle/database secret and the bot's bearer token, which can then be replayed against service APIs with bot-level privileges. A detailed proof-of-concept is published in the GitHub Security Advisory (GHSA-9vmh-whc4-7phg), so publicly available exploit code exists; no public exploit identified at time of analysis in CISA KEV.
Boolean-oracle information disclosure in Strapi Content API allows remote unauthenticated attackers to extract admin password-reset tokens and achieve full administrative account takeover. Strapi versions 4.0.0 through 5.36.1 fail to sanitize relational query parameters on public content-type endpoints. By crafting `where` filters that traverse into joined `admin_users` table columns (e.g., `where[updatedBy][resetPasswordToken][$startsWith]=a`), attackers perform character-by-character oracle attacks against private admin fields, then use the extracted reset token to hijack administrator accounts. WildWest CyberSecurity reports this critical vulnerability with CVSS 9.3, affecting all Strapi deployments with public content-types containing admin-relation fields (`updatedBy`, `createdBy`, `publishedBy`). Vendor-released patch available in version 5.37.0. No active exploitation or public POC identified at time of analysis.
Arbitrary file read in the esm.sh CDN build server (Go implementation, versions ≤ 137) lets a remote attacker exfiltrate sensitive host files by publishing a malicious npm package. The esbuild plugin re-maps module paths using the package.json 'browser' field without re-validating the sandbox, so '../' sequences escape the package directory and file contents are returned inside the bundled JS and source-map sourcesContent. A working PoC exists (published npm package chess-sec-utils1) reading /etc/hostname, /etc/os-release and /etc/environment, but there is no public exploit identified as actively used and EPSS risk is low (0.04%).
Brute-force protection bypass in Vaultwarden (the Rust Bitwarden-compatible server) before 1.35.4 lets unauthenticated remote attackers guess passwords without rate-limiting when email 2FA is enabled on the instance. The /api/two-factor/send-email-login endpoint (send_email_login in email.rs) is not covered by login rate-limiting yet still validates the username/password pair, turning it into a credential-validity oracle. The flaw affects all accounts on an instance that has email 2FA enabled — even users who never configured email 2FA themselves. Publicly available exploit code exists (SSVC 'poc'); EPSS is very low at 0.04% and it is not in CISA KEV, so no confirmed active exploitation.
SQL injection in Daptin's fuzzy-search API (versions <= 0.11.4) allows any authenticated user to read the entire backend database via boolean-blind extraction. The GET /api/<entity> endpoint with operator=fuzzy passes the user-supplied column parameter into raw SQL through goqu.L without schema validation, bypassing the GetColumnByName whitelist used on other query paths. Publicly available exploit code exists (SSVC lists Exploitation: poc) and the vulnerability is CWE-89; a full working PoC extracted user emails and bcrypt hashes on SQLite, though EPSS remains low at 0.05%.
SQL injection in Rucio's DID search API allows any authenticated user to execute arbitrary SQL on Oracle database backends, enabling complete database compromise. The vulnerability affects Rucio versions 1.27.0 through 40.1.0 when deployed with Oracle databases using the default json_meta plugin. Attackers can extract authentication tokens, password hashes (SHA-256 single-iteration, GPU-crackable), storage credentials, and all managed data. Data modification and potential remote code execution via Oracle PL/SQL features are possible. Vendor-confirmed vulnerability with patches released across four version branches. PostgreSQL and MySQL deployments are not affected due to proper SQLAlchemy parameterization on those database dialects.
Authorization bypass in YAFNET forum software (versions ≤4.0.4) allows any low-privileged authenticated user to execute arbitrary SQL commands against the backend database. The flaw stems from a misplaced ASP.NET Core filter (`PageSecurityCheckAttribute`) that validates admin privileges *after* page handlers execute, enabling attackers to inject SQL via the `/Admin/RunSql` endpoint before the 302 redirect occurs. Publicly available exploit code exists (GitHub advisory GHSA-xhw7-j96h-c3g5) demonstrating time-based blind SQL injection to extract `@@VERSION` and manipulate identity tables. CVSS 8.8 (AV:N/AC:L/PR:L) reflects network-accessible exploitation requiring only a standard forum account-trivially obtained via self-registration on most deployments. Vendor-released patch available in version 4.0.5.
SQL injection in Oracle MCP Server Helper Tool 1.0.1-1.0.156 allows low-privileged authenticated attackers to execute malicious SQL queries with high confidentiality and integrity impact across security boundaries. The vulnerability requires network access via HTTP and user interaction, affecting the helper tool component. With CVSS 8.7 and easily exploitable characteristics (AC:L), this represents significant risk for organizations running affected versions, though no public exploit or active exploitation (CISA KEV) has been identified at time of analysis. The changed scope (S:C) indicates potential impact beyond the vulnerable component itself.
Server-Side Request Forgery (SSRF) in n8n-mcp SDK allows authenticated remote attackers to access cloud metadata endpoints and internal network resources via IPv4-mapped IPv6 address bypass. Versions 2.47.4 through 2.47.13 fail to validate IPv6 addresses in the synchronous URL validator (SSRFProtection.validateUrlSync()), enabling attackers who control the n8nApiUrl parameter to bypass RFC1918, localhost, and cloud metadata protections using addresses like [::ffff:169.254.169.254]. The vulnerability is non-blind SSRF returning response bodies to the attacker, and forwards the n8nApiKey in the x-n8n-api-key header to attacker-controlled targets. Confirmed actively exploited (CISA KEV). Vendor-released patch: version 2.47.14. EPSS exploitation probability not provided but risk is elevated given KEV status and availability of exploit code in the GitHub advisory.
Sharing-token forgery in SmarterTools SmarterMail builds before 9610 lets remote unauthenticated attackers decrypt and access arbitrary emails, attachments, and file-storage contents. The file/email sharing endpoints protect tokens with DES-CBC keys and IVs derived from System.Random seeded with only ~19,000 possible values, and the attachment download endpoint leaks enough information to act as an oracle for recovering the seed. No public exploit is identified at time of analysis, and EPSS is low (0.03%), consistent with the high-complexity, non-automatable oracle attack it requires.
Local privilege-driven compromise in Oracle VM VirtualBox 7.2.6 (Core component) allows a high-privileged local attacker who is already logged onto the host running VirtualBox to take over the VirtualBox instance, with a scope change that can significantly impact additional products beyond the hypervisor itself. The flaw is classed as improper access control (CWE-284) and tagged as an authentication bypass, yielding total confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, it is not listed in CISA KEV, and EPSS is negligible (0.01%), consistent with the high attack complexity and privilege requirements.
Privilege-based host compromise in Oracle VM VirtualBox 7.2.6 (Core component) allows a high-privileged local attacker with logon access to the host to take over VirtualBox, with a scope change that can significantly impact additional products beyond the hypervisor itself. Disclosed in Oracle's April 2026 Critical Patch Update with a CVSS 3.1 base score of 7.5 and full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and CISA SSVC records exploitation status as none with the flaw rated not automatable.
Denial-of-service in Oracle VM VirtualBox 7.2.6 (Core component) lets an unauthenticated remote attacker reachable over the VirtualBox Remote Desktop Protocol (VRDP/RDP) service trigger a hang or repeatable crash, producing a complete availability loss of the virtualization host process. There is no public exploit identified at time of analysis, and EPSS is very low (0.04%, 12th percentile), so while the flaw is network-reachable and unauthenticated, real-world exploitation pressure currently appears minimal. Note that the supplied 'Authentication Bypass' tag conflicts with the availability-only CVSS vector - the confirmed impact is DoS, not auth bypass.
Full compromise of Oracle Application Development Framework (ADF Faces component) is possible by an authenticated low-privileged user with local logon access to the host where ADF executes, affecting Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0. The improper access control weakness (CWE-284) yields complete confidentiality, integrity, and availability loss ("takeover") with a CVSS 3.1 base score of 7.8. No public exploit identified at time of analysis; the EPSS probability is negligible at 0.01% (2nd percentile) and CISA SSVC records exploitation as none.
Full compromise of Oracle VM VirtualBox 7.2.6 (Core component) is possible for a high-privileged local attacker who can log on to the host where VirtualBox runs, per Oracle's April 2026 Critical Patch Update. Because the flaw carries a scope change (S:C), a successful attack breaks out of VirtualBox and can significantly impact additional products on the host, yielding total loss of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and EPSS is negligible (0.01%), consistent with the high exploitation difficulty (AC:H) and the local, high-privilege prerequisite.
Unauthenticated information disclosure in Oracle Financial Services Transaction Filtering 8.1.2.8.0 (User Interface component) allows a remote attacker with only network/HTTP access to read all data accessible to the application. Oracle rates it CVSS 7.5 (confidentiality-only), and community tagging labels it an authentication bypass; there is no public exploit identified at time of analysis, with EPSS at a low 0.03% (9th percentile) and SSVC exploitation status 'none'.
Guest-to-host compromise in Oracle VM VirtualBox 7.2.6 (Core component) allows a high-privileged local attacker to take over the VirtualBox instance, with a scope change that can significantly impact products beyond VirtualBox itself - consistent with a hypervisor escape affecting the host. Disclosed in the Oracle April 2026 Critical Patch Update with a CVSS 3.1 base score of 7.5. There is no public exploit identified at time of analysis, and EPSS exploitation probability is negligible (0.01%).
Unauthorized data access in Oracle Database Server's Java VM component allows a remote, unauthenticated attacker to compromise the Java VM over Oracle Net (default port 1521) and read all data accessible to it, affecting versions 19.3-19.30 and 21.3-21.21. The flaw is rated CVSS 7.5 with confidentiality-only impact and is easily exploitable per Oracle, though EPSS is very low (0.03%, 9th percentile) and no public exploit identified at time of analysis. It is addressed in the Oracle Critical Patch Update of April 2026.
Unauthorized data disclosure in Oracle Financial Services Customer Screening 8.1.2.8.0 (User Interface component) allows a remote, unauthenticated attacker with only HTTP network access to read all data accessible to the application. The flaw is an authorization/access-control weakness (CWE-285) that yields high confidentiality impact without any integrity or availability effect. There is no public exploit identified at time of analysis, and the EPSS probability is very low (0.03%, 9th percentile), indicating no observed exploitation activity.
Unauthorized data access in Oracle Financial Services Analytical Applications Infrastructure (OFSAA) versions 8.0.7.9, 8.0.8.7, and 8.1.2.5 lets a remote, unauthenticated attacker read critical data over HTTP with no user interaction. The flaw stems from improper access control (CWE-284) in the Platform component and is tagged as an authentication bypass, though impact is limited to confidentiality (no data modification or denial of service). No public exploit has been identified at time of analysis and EPSS exploitation probability is very low (0.03%).
Broad data compromise in Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.62 allows a low-privileged, network-adjacent attacker to reach any data the platform can access. The flaw sits in the Security component and is characterized by improper access control (CWE-284, tagged as Authentication Bypass), letting an authenticated-but-unprivileged user read, create, delete, or modify critical data across the deployment. There is no public exploit identified at time of analysis, EPSS risk is very low (0.03%), and it is not on CISA KEV.
Unauthenticated information disclosure in Oracle WebLogic Server (Fusion Middleware, Web Services component) versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 allows a remote attacker with only HTTP network access to read critical data, potentially gaining access to all data accessible to the server. The flaw is rated CVSS 7.5 with confidentiality-only impact and is classified under CWE-200 (Information Exposure). Publicly available exploit code exists per the CISA SSVC assessment, but the vulnerability is not on the CISA KEV list and EPSS exploitation probability is very low (0.03%).
Unauthorized information disclosure in Oracle HCM Common Architecture (Knowledge Integration component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) lets a remote, unauthenticated attacker read critical HCM data over HTTP without any user interaction. Oracle rates this 7.5 (confidentiality-only impact) and addressed it in the April 2026 Critical Patch Update. There is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.03%), but SSVC flags the attack as automatable.
Full server takeover in Oracle WebLogic Server 12.2.1.4.0 and 14.1.1.0.0 (Core component) allows a high-privileged, authenticated attacker with HTTP network access to fully compromise the affected instance, resulting in total loss of confidentiality, integrity, and availability. CVSS 3.1 base score is 7.2 (PR:H), and while the intelligence tags reference 'Authentication Bypass,' the CVSS vector requires high privileges, indicating a conflict worth vendor verification. There is no public exploit identified at time of analysis, EPSS is very low (0.04%, 12th percentile), and CISA SSVC reports no known exploitation.
Cross-boundary compromise of Oracle HTTP Server (a component of Oracle Fusion Middleware) affects supported versions 12.2.1.4.0 and 14.1.2.0.0, where an unauthenticated remote attacker sending crafted HTTP traffic can gain read and write access to critical server-accessible data and, via a scope change, impact additional co-located products. The CVSS 3.1 base score is 8.7 with high confidentiality and integrity impact but no availability impact, and the flaw is classified as improper access control (CWE-284) with an Authentication Bypass tag. Currently there is no public exploit identified at time of analysis, EPSS risk is low (0.03%, 9th percentile), and CISA's SSVC rates exploitation as none despite a 'total' technical impact rating.
Denial-of-service in Oracle Identity Manager Connector (Core component) version 12.2.1.4.0 lets a remote, unauthenticated attacker send network traffic over TCP to hang or repeatedly crash the service, producing a complete availability outage (CVSS 3.1 7.5). Oracle disclosed this in the April 2026 Critical Patch Update; there is no public exploit identified at time of analysis, and EPSS is very low (0.04%). Confidentiality and integrity are unaffected - the impact is purely availability (CWE-400, resource exhaustion).
Unauthenticated authentication-bypass and access-control weakness in Oracle Identity Manager Connector 12.2.1.4.0 (Core component of Oracle Fusion Middleware) allows a network attacker to read, create, delete, or modify any data the connector can reach over HTTPS. Rated CVSS 3.1 9.1 with high confidentiality and integrity impact but no availability impact, it is easily exploitable without credentials or user interaction, though EPSS is very low (0.03%) and there is no public exploit identified at time of analysis. SSVC marks technical impact as total and the flaw as automatable, so it warrants prompt patching in the April 2026 Oracle CPU despite the currently low observed exploitation.
Authentication bypass in Oracle Identity Manager Connector 12.2.1.4.0 (Oracle Fusion Middleware, Core component) lets a remote, unauthenticated attacker reach and manipulate all connector-accessible data over HTTPS. Because the flaw is a missing-authentication weakness (CWE-306), an attacker can read, create, delete, or modify critical identity data with no credentials and low complexity. There is no public exploit identified at time of analysis, and EPSS is very low (0.03%), but the CVSS 9.1 and CISA SSVC 'total' technical impact rating mark it as high severity.
Unauthenticated data compromise in Oracle Identity Manager Connector 12.2.1.4.0 (Oracle Fusion Middleware, Core component) allows a remote attacker to reach the connector over HTTPS with no credentials and read, create, delete, or modify all connector-accessible data. Mapped to CWE-306 (Missing Authentication) and tagged as an authentication bypass, it carries a CVSS 3.1 base score of 9.1 (C:H/I:H). There is no public exploit identified at time of analysis, and EPSS is very low (0.03%, 9th percentile), but CISA SSVC rates it automatable with total technical impact.
Denial of service in the Networking component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows an unauthenticated, network-based attacker to cause a hang or repeatable crash (complete availability loss) of the affected runtime. The flaw is described by Oracle as easily exploitable via multiple protocols against any application that feeds attacker-controlled data to the vulnerable networking APIs (e.g., an exposed web service). There is no public exploit identified at time of analysis; EPSS is very low (0.04%, 12th percentile) and CISA SSVC lists exploitation status as none, so this is a patch-in-cycle availability issue rather than an active threat.
Full takeover of Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) is possible through the Event Management component, where a high-privileged attacker with HTTP network access can compromise the platform and, due to a scope change, significantly impact additional connected products. The flaw is classed as CWE-306 (Missing Authentication for Critical Function) and tagged as an authentication bypass, carrying a CVSS 3.1 base score of 9.1 with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is very low (0.04%, 12th percentile), indicating no observed exploitation activity to date.
Full takeover of Oracle Advanced Inbound Telephony (a module within Oracle E-Business Suite, versions 12.2.3 through 12.2.15) is possible by a remote, unauthenticated attacker over HTTP against the Setup and Administration component, per Oracle's April 2026 Critical Patch Update. Classified as a missing-authentication authentication bypass (CWE-306) with a 9.8 CVSS, successful exploitation yields complete confidentiality, integrity, and availability compromise of the product. There is no public exploit identified at time of analysis, and EPSS probability is low (0.04%), but CISA's SSVC assessment rates the technical impact as total and the flaw as automatable.
Unauthorized data disclosure in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition arises from a flaw in the JAXP (Java API for XML Processing) component, allowing an unauthenticated remote attacker to read critical or all accessible data across affected JDK 8, 11, 17, 21, 25, and 26 builds. The confidentiality-only issue (CVSS 7.5, C:H/I:N/A:N) is easily exploitable over multiple network protocols, including via web services that pass attacker-supplied data into JAXP APIs, and also affects sandboxed Java Web Start/applet deployments running untrusted code. There is no public exploit identified at time of analysis and EPSS is very low (0.03%, 9th percentile), consistent with the SSVC exploitation status of 'none'.
Privilege-based compromise of the Oracle Applications DBA product (ADPatch component) within Oracle E-Business Suite 12.2.3 through 12.2.15 allows an already high-privileged attacker with HTTP network access to fully take over the Applications DBA and, via a scope change, significantly impact additional products. Exploitation is rated difficult and requires human interaction from a victim other than the attacker. There is no public exploit identified at time of analysis, EPSS is negligible (0.03%, 10th percentile), and it is not in CISA KEV, indicating low real-world exploitation pressure despite the high CVSS score.
Unauthorized data disclosure in Oracle Financial Services Analytical Applications Infrastructure (OFSAA) 8.0.7.9, 8.0.8.7, and 8.1.2.5 allows a remote, unauthenticated attacker to reach protected data over HTTP against the Platform component. Successful exploitation yields read access to critical or all OFSAA-accessible data with no integrity or availability impact. There is no public exploit identified at time of analysis, and EPSS is very low (0.03%, 9th percentile), consistent with CISA SSVC scoring exploitation as 'none.'
Unauthorized data manipulation in Oracle Life Sciences Empirica Signal 9.2.1 through 9.2.3 (Common Core component) allows a low-privileged, network-authenticated attacker to create, delete, or modify critical data and read a subset of accessible data over HTTP. The scope-changed flaw (rooted in improper access control, CWE-284) can significantly impact additional products beyond Empirica Signal itself, and Oracle rates it CVSS 3.1 8.5. There is no public exploit identified at time of analysis, and EPSS is very low at 0.03% (8th percentile).
LDAP injection in maddy mail server versions before 0.9.3 allows remote unauthenticated attackers to extract sensitive directory attributes and spoof user identities. The auth.ldap module fails to escape user-supplied usernames before interpolating them into LDAP search filters and DN strings, despite having the ldap.EscapeFilter() function available. Attackers can exploit this via SMTP AUTH PLAIN or IMAP LOGIN interfaces to perform boolean-based blind injection attacks that extract password hashes, email addresses, group memberships, and other LDAP attributes character-by-character. While CVSS rates this 8.2 (High) for network-accessible unauthenticated exploitation with high confidentiality impact, no active exploitation (KEV) or weaponized POC has been identified at time of analysis. EPSS data not available for this recent CVE.
Padding oracle attack in Apache Tomcat EncryptInterceptor leaks encrypted session data confidentiality across versions 7.0.100-7.0.109, 8.5.38-8.5.100, 9.0.13-9.0.115, 10.0.0-M1-10.1.52, and 11.0.0-M1-11.0.18 when default configuration is deployed. Unauthenticated remote attackers exploit oracle responses to decrypt sensitive information without authentication (CVSS:3.1 AV:N/AC:L/PR:N). CWE-209 (information exposure through error messages) enables cryptographic side-channel extraction. No public exploit identified at time of analysis; low observed exploitation activity (EPSS 0.02%).
Server-Side Request Forgery in n8n-mcp (npm package) versions ≤2.47.3 allows authenticated attackers with valid AUTH_TOKEN to force the server to issue HTTP requests to arbitrary URLs via manipulated multi-tenant HTTP headers (x-n8n-url, x-n8n-key). Response bodies are reflected through JSON-RPC, enabling unauthorized access to cloud instance metadata endpoints (AWS IMDS, GCP, Azure, Oracle, Alibaba), internal network services, and any host reachable by the server process. Multi-tenant HTTP deployments with shared or multiple AUTH_TOKENs are at highest risk. No public exploit identified at time of analysis.
Remote code execution in OpenIdentityPlatform OpenAM 16.0.5 and earlier allows unauthenticated attackers to execute arbitrary OS commands via unsafe Java deserialization of the jato.clientSession HTTP parameter. This bypass exploits an unpatched deserialization sink in JATO's ClientSession.deserializeAttributes() that was overlooked when CVE-2021-35464 was mitigated. Attackers can target any JATO ViewBean endpoint with <jato:form> tags (commonly found in password reset pages) using a PriorityQue
Server-Side Request Forgery in pyLoad-ng allows authenticated users with ADD permissions to read local files via file:// protocol, access internal network services, and exfiltrate cloud metadata. The parse_urls API endpoint fetches arbitrary URLs without protocol validation, enabling attackers to read /etc/passwd, configuration files, SQLite databases, and AWS/GCP metadata endpoints at 169.254.169.254. Error-based responses create a file existence oracle. Multi-protocol support (file://, gopher://, dict://) escalates impact beyond standard HTTP SSRF. CVSS 7.7 reflects network attack vector, low complexity, and scope change with high confidentiality impact. No public exploit code identified at time of analysis, though detailed proof-of-concept included in advisory demonstrates exploitation via curl commands against Docker deployments.
phpseclib versions 1.0.26 and below, 2.0.0 through 2.0.51, and 3.0.0 through 3.0.49 are vulnerable to a padding oracle timing attack when using AES in CBC mode, allowing attackers to decrypt sensitive data through cryptanalysis of response timing differences. This information disclosure vulnerability affects any PHP application using the vulnerable phpseclib library for AES-CBC encryption. Although no CVSS score, EPSS data, or confirmed active exploitation (KEV status) are currently available, the presence of a verified fix and security advisory indicates this is a legitimate cryptographic weakness requiring attention.
A critical authentication bypass vulnerability in Oracle Identity Manager and Oracle Web Services Manager allows remote attackers to completely compromise affected systems without any credentials. The vulnerability resides in the REST WebServices and Web Services Security components, affecting versions 12.2.1.4.0 and 14.1.2.1.0 of both products. With a CVSS score of 9.8 and no authentication required, this represents a severe risk to identity management infrastructure, though no current KEV listing or public POC has been documented in available sources.
Unauthenticated attackers can stream any private or paid video in PHP, Oracle, and Apple applications through a path traversal vulnerability in the HLS streaming endpoint. The flaw exploits a split-oracle condition where authorization validation and file access use different parsing logic on the videoDirectory parameter, allowing attackers to bypass authentication checks while accessing unauthorized content. No patch is currently available for this high-severity vulnerability.
This is a critical unauthenticated remote code execution vulnerability in Oracle Edge Cloud Infrastructure Designer and Visualisation Toolkit version 0.3.0. An attacker with network access via HTTP can completely take over the affected system without any authentication, privileges, or user interaction required. The CVSS score of 9.8 reflects maximum impact across confidentiality, integrity, and availability. There is no evidence of active exploitation (not in CISA KEV), and no proof-of-concept code has been publicly identified in the available intelligence.
Private key recovery in Stanford JavaScript Crypto Library (SJCL) ECDH implementation affects all versions prior to 1.0.9, allowing remote unauthenticated attackers to extract a victim's ECDH private key by submitting crafted off-curve public keys and observing the resulting shared-secret outputs. The flaw stems from missing point-on-curve validation in sjcl.ecc.basicKey.publicKey(), combined with dhJavaEc() returning the raw x-coordinate without hashing - providing a direct plaintext oracle. Publicly available exploit code exists (PoC gist by Kr0emer); EPSS is low at 0.02% despite the high confidentiality impact, suggesting limited current opportunistic targeting.
Vm Virtualbox versions up to 7.1.14 contains a vulnerability that allows attackers to takeover of Oracle VM VirtualBox (CVSS 8.2).
Vm Virtualbox versions up to 7.1.14 contains a vulnerability that allows attackers to unauthorized creation, deletion or modification access to critical data or all O (CVSS 8.1).
Vm Virtualbox versions up to 7.1.14 contains a vulnerability that allows attackers to takeover of Oracle VM VirtualBox (CVSS 8.2).
Vm Virtualbox versions up to 7.1.14 contains a vulnerability that allows attackers to takeover of Oracle VM VirtualBox (CVSS 8.2).
Vm Virtualbox versions up to 7.1.14 contains a vulnerability that allows attackers to unauthorized ability to cause a hang or frequently repeatable crash (complete DO (CVSS 7.1).
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. [CVSS 7.5 HIGH]
Unauthenticated remote compromise of Oracle PeopleSoft Enterprise PT PeopleTools 8.61 and 8.62 via the WebLogic component allows attackers with HTTP access to read and modify critical data across PeopleTools and additional products in scope. Oracle rates the issue 8.7 CVSS 3.1 with high attack complexity but no privileges or user interaction, and the scope-change flag means impact extends beyond PeopleTools itself. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Privileged takeover of Oracle WebCenter Content (Content Server component) affects supported versions 12.2.1.4.0 and 14.1.2.0.0, enabling a high-privileged attacker with HTTP network access to fully compromise the instance and pivot to additional Fusion Middleware products via a scope change. The CVSS 3.1 base score is 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), reflecting low attack complexity and full CIA impact. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Unauthorized data modification in Oracle Identity Manager (Fusion Middleware) versions 12.2.1.4.0 and 14.1.2.1.0 allows a remote unauthenticated attacker to create, delete, or modify critical identity data via the REST WebServices component over HTTP. Oracle rates the issue as easily exploitable with a CVSS 3.1 base score of 7.5 (integrity-only impact), and no public exploit has been identified at time of analysis.
Account takeover in Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 (Fusion Middleware Core component) allows a low-privileged remote attacker to fully compromise the product via T3 or IIOP protocols, with scope change extending impact to other Fusion Middleware components. The CVSS 9.9 score reflects high confidentiality, integrity, and availability impact combined with low attack complexity. No public exploit identified at time of analysis, but Identity Manager's role as a central identity authority makes this a critical patching priority.
Account takeover in Oracle Identity Manager (Fusion Middleware) versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged remote attacker to fully compromise the Identity Manager instance via its REST WebServices component over HTTP. Oracle rates the flaw CVSS 8.8 with high impact to confidentiality, integrity, and availability, and no public exploit identified at time of analysis. Because Identity Manager governs enterprise identity lifecycle and provisioning, successful exploitation has cascading impact across downstream applications it manages.
Account takeover in Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged remote attacker with HTTP access to fully compromise the Identity Manager component of Oracle Fusion Middleware. With a CVSS 3.1 base score of 8.8 and high impact across confidentiality, integrity, and availability, successful exploitation results in takeover of the identity governance platform itself. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Remote takeover of Oracle WebLogic Server 14.1.2.0.0 and 15.1.1.0.0 (Fusion Middleware, Core component) is achievable by a low-privileged attacker over HTTP, with a CVSS 3.1 score of 9.9 driven by a scope change that lets the impact spread beyond WebLogic itself. Oracle has issued the fix in the June 2026 Critical Patch Update (cspujun2026), and there is no public exploit identified at time of analysis. Authenticated but low-effort exploitation combined with full confidentiality, integrity and availability impact makes this a top-priority patching item for any Oracle middleware estate.
Authenticated tampering and data exposure in Oracle Data Integrator 12.2.1.4.0 and 14.1.2.0.0 (Market Place component) allows a low-privileged attacker with HTTP network access to read, modify, or delete all data accessible to the product and induce a partial denial of service. Oracle assigns a CVSS 3.1 base score of 8.3 (AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:L), and no public exploit identified at time of analysis. The flaw is described by Oracle as easily exploitable, raising the priority for any externally reachable ODI deployment.
Full takeover of Oracle WebLogic Server 14.1.2.0.0 and 15.1.1.0.0 is achievable by remote unauthenticated attackers via the Console component over HTTPS, provided a victim performs an action such as clicking a malicious link. The flaw carries a CVSS 3.1 base score of 8.8 with high impact across confidentiality, integrity, and availability, but exploitation hinges on user interaction. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Cross-scope data compromise in Oracle WebLogic Server 14.1.2.0.0 and 15.1.1.0.0 allows a low-privileged remote attacker over HTTPS to read, create, modify, or delete critical data through the administration Console, provided a separate user is induced to perform an action. The CVSS 3.1 base score of 8.7 reflects high confidentiality and integrity impact with scope change reaching beyond WebLogic itself, and no public exploit identified at time of analysis.
SQL injection in the WP Review Slider Pro WordPress plugin (versions ≤12.6.8) allows authenticated attackers with Subscriber-level access to inject arbitrary SQL via the 'stypes' and 'slocations' JSON parameters of the wppro_get_overall_chart_data AJAX action. Because the vulnerable handler echoes the executed SQL back in its JSON response, attackers gain a built-in oracle that turns blind injection into a near-trivial database extraction primitive. No public exploit identified at time of analysis, but the very low privilege barrier on a default WordPress install makes any exposed site a realistic target.
Authentication bypass in Discuz! X5.0 releases 20260320 through 20260501 allows unauthenticated remote attackers to access database backup and restore functionality exposed by dbbak.php. The flaw stems from a shared cryptographic key (CWE-323) between UCenter integration and the backup API, which lets an attacker abuse an encryption oracle in logging_ctl::logging_more() to mint legitimately signed authorization tokens, and chain a race condition to impersonate arbitrary users. Publicly available exploit code exists and an upstream fix has been published on Gitee.
Remote takeover of Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 is possible through the Updates Environment Management component via unauthenticated HTTP requests. The CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N) indicates trivial network-based exploitation against any internet- or intranet-exposed instance, with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, but Oracle's 'easily exploitable' language and the unauthenticated nature make this a high-priority patching target.
SQL injection in LimeSurvey's RemoteControl API (invite_participants and remind_participants methods) allows an authenticated attacker with tokens/update permission on a survey to execute arbitrary stacked SQL queries against the application database. Because PDO emulated prepared statements are enabled and MySQL multi-statements are not disabled, attackers can read administrator bcrypt hashes via time-based blind techniques or directly overwrite credentials for instant account takeover. No public exploit identified at time of analysis; the upstream fix is published as LimeSurvey PR #5031, which replaces unsafe string concatenation with parameterized addInCondition().
Server-side request forgery in FUXA SCADA/HMI server (npm package fuxa-server <= 1.1.14-1243) allows unauthenticated remote attackers to connect to the Socket.IO endpoint and coerce the server to issue arbitrary HTTP(S), OPC UA, or ODBC requests with response bodies echoed back to the caller. No public exploit identified at time of analysis, but the GitHub Security Advisory GHSA-w86f-rf9w-h3x6 provides full handler-level reproduction details and the fix is shipped in release v1.3.2.
Sandbox policy bypass in Twig templating engine versions 3.25.0 and earlier allows sandboxed template authors to invoke arbitrary `__toString()` methods on any `Stringable` object reachable in the render context, even when those methods are not allowlisted by `SecurityPolicy::checkMethodAllowed()`. The flaw stems from `SandboxNodeVisitor` only wrapping a hardcoded subset of AST nodes in `CheckToStringNode`, leaving many string-coercion points (conditional expressions, comparison/`matches` operators, tests, ranges, includes, spread arguments) unguarded - and the comparison-operator vector enables byte-by-byte oracle recovery of sensitive object string forms. No public exploit identified at time of analysis; fix shipped in Twig 3.26.0 (also referenced by Symfony's advisory page).
Remote takeover of Oracle REST Data Services (ORDS) versions 24.2.0 through 26.1.0 allows unauthenticated attackers to compromise the service over HTTPS and pivot into adjacent products due to a scope-changing flaw. With a maximum CVSS 10.0 score and trivial exploitability (AV:N/AC:L/PR:N/UI:N), this Backend-as-a-Service component vulnerability poses critical risk, though no public exploit identified at time of analysis and no EPSS or CISA KEV signal has been provided in the available data.
Privilege escalation to full takeover in Oracle REST Data Services (ORDS) versions 24.2.0 through 26.1.0 allows a low-privileged remote attacker over HTTPS to fully compromise the service and pivot into adjacent products via a CVSS scope change. CVSS 3.1 base score is 9.9 with attack complexity rated low, and no public exploit identified at time of analysis. The scope-change designation is the key differentiator - successful exploitation extends beyond ORDS itself into systems it fronts, most notably the backing Oracle Database.
Full product takeover of Oracle Flow Manufacturing (versions 12.2.9 through 12.2.15) is achievable by a low-privileged remote attacker via SQL-based network access, per Oracle's advisory. The flaw scores CVSS 8.8 with high impact across confidentiality, integrity, and availability, and no public exploit has been identified at time of analysis. As a component of Oracle E-Business Suite, exploitation provides an attacker with control over a business-critical manufacturing execution system.
Remote denial of service in Oracle Database Server 23.4.0 through 23.26.2 allows unauthenticated network attackers to crash or hang the Net Service component via crafted TLS traffic. The flaw scores CVSS 7.5 with availability-only impact and was disclosed by Oracle in the May 2026 Critical Patch Update; no public exploit identified at time of analysis.
Remote denial-of-service in Oracle Database Server's Net Service component (versions 23.4.0 through 23.26.2) allows unauthenticated attackers with TLS network access to hang or repeatedly crash the listener, producing a complete DoS of database connectivity. The flaw is rated CVSS 7.5 (availability-only) and was disclosed by Oracle in the May 2026 Critical Patch Update; no public exploit identified at time of analysis and the issue is not currently listed in CISA KEV.
Net Service takeover in Oracle Database Server 23.4.0 through 23.26.2 allows unauthenticated remote attackers reaching the TLS-protected Net Service listener to fully compromise confidentiality, integrity, and availability, with scope change indicating impact on adjacent components. CVSS 9.0 reflects high impact tempered by high attack complexity (AC:H), and no public exploit identified at time of analysis. Reported and tracked in Oracle's May 2026 Critical Patch Update advisory.
Remote denial-of-service in Oracle REST Data Services (ORDS) versions 24.2.0 through 26.1.0 allows unauthenticated network attackers to cause a complete hang or repeatable crash of the service via the Mongoapi component over HTTPS. The vulnerability is rated CVSS 7.5 with availability-only impact and no public exploit identified at time of analysis, but the unauthenticated, low-complexity attack profile makes it operationally significant for any internet-exposed ORDS instance.
Unauthorized data access and modification in Oracle Payroll (a module of Oracle E-Business Suite) versions 12.2.3 through 12.2.15 allows a low-privileged authenticated attacker with HTTP network access to read, create, delete, or modify any data accessible to the Oracle Payroll application. The flaw carries a CVSS 8.1 due to high confidentiality and integrity impact with low attack complexity, but no public exploit identified at time of analysis and it is not listed in CISA KEV. The advisory was published as part of Oracle's Critical Patch Update cycle (CPU May 2026).
Account takeover in Oracle Payroll (Self Service Manager component) of Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a low-privileged authenticated attacker to fully compromise the Payroll module over HTTP. The CVSS 3.1 base score of 8.8 reflects high impacts to confidentiality, integrity, and availability, and Oracle has issued a fix in the May 2026 Critical Patch Update. No public exploit identified at time of analysis.
Account takeover in Oracle Payroll (component: Internal Operations) within Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a low-privileged remote attacker with HTTPS network access to fully compromise the Payroll application. The CVSS 8.8 vector indicates low complexity and no user interaction, meaning any authenticated EBS user can pivot to full confidentiality, integrity, and availability impact on Payroll. No public exploit identified at time of analysis, but the issue was disclosed in Oracle's Critical Patch Update advisory and warrants prompt patching given the sensitivity of payroll data.
Account takeover in Oracle Universal Work Queue (component: Work Provider Site Level Administration) within Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows low-privileged remote attackers over HTTP to fully compromise the product with confidentiality, integrity, and availability impact. The CVSS 9.9 score reflects a scope-changing flaw whose blast radius extends to other Oracle E-Business Suite products beyond Universal Work Queue itself. No public exploit identified at time of analysis, but the low attack complexity and minimal privilege requirement make this a high-priority Oracle Critical Patch Update item.
Unauthorized data access in Oracle Public Sector Financials (International), a module of Oracle E-Business Suite versions 12.2.6 through 12.2.15, allows low-privileged remote attackers to read sensitive data across module boundaries due to a flaw in the Authorization component. The scope-changed CVSS 7.7 vector indicates exploitation can affect resources beyond the vulnerable component itself, expanding the blast radius to other EBS data. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Account takeover in Oracle iAssets (part of Oracle E-Business Suite versions 12.2.3 through 12.2.15) allows a low-privileged attacker with HTTP network access to fully compromise the iAssets component and pivot into adjacent products via a scope change. The 9.9 CVSS score reflects high impact on confidentiality, integrity, and availability combined with low attack complexity; no public exploit identified at time of analysis, but Oracle's inclusion in the May 2026 Critical Patch Update warrants immediate attention.
Unauthorized data access in Oracle E-Business Suite's Financials Common Modules (versions 12.2.3 through 12.2.15) allows low-privileged remote attackers to read sensitive data via HTTP, with a scope change that extends impact beyond the vulnerable component to other Oracle products. The flaw carries a CVSS 3.1 base score of 7.7 reflecting high confidentiality impact, but no public exploit has been identified at time of analysis and the issue is not currently listed in CISA KEV.
Cross-product data exposure in Oracle Financials Common Modules (E-Business Suite versions 12.2.3 through 12.2.15) allows a low-privileged authenticated attacker to access or modify sensitive financial data over HTTP. The scope-changed nature of the flaw means exploitation impacts additional Oracle products beyond Financials Common Modules itself. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Remote unauthenticated compromise of Oracle Internet Procurement Connector (a component of Oracle E-Business Suite versions 12.2.3 through 12.2.15) allows attackers to read, modify, create, or delete all data accessible to the component over HTTP. The CVSS 9.1 score reflects high confidentiality and integrity impact with low attack complexity and no privileges or user interaction required. No public exploit identified at time of analysis, but the trivial exploitability profile combined with EBS's history of being targeted (e.g., CVE-2025 Cl0p campaigns) makes this a priority patch for any internet-exposed deployment.
Unauthorized data modification and disclosure in Oracle E-Business Suite (Oracle Payments component, File Transmission) versions 12.2.3 through 12.2.15 allows unauthenticated remote attackers over HTTPS to read, alter, create, or delete all Oracle Payments-accessible data. The flaw carries a CVSS 3.1 base score of 7.4 with high confidentiality and integrity impact but no availability impact, and is rated high attack complexity. No public exploit identified at time of analysis, and it is not currently listed in CISA KEV.
Remote takeover of Oracle Payments in Oracle E-Business Suite versions 12.2.3 through 12.2.15 is possible via the File Transmission component, allowing unauthenticated network-based attackers to fully compromise confidentiality, integrity, and availability (CVSS 9.8). The flaw is described by Oracle as easily exploitable over HTTP with no user interaction, and no public exploit identified at time of analysis. Tagged as Information Disclosure and listed in Oracle's May 2026 Critical Patch Update advisory.
Takeover of Oracle REST Data Services (ORDS) versions 24.2.0 through 26.1.0 is achievable by a low-privileged remote attacker over HTTPS, with scope-changed impact extending to additional Oracle products beyond ORDS itself. Oracle rates this 9.9 CVSS due to the combination of low attack complexity, minimal privilege requirement, and full confidentiality/integrity/availability compromise; no public exploit identified at time of analysis, but the easy exploitability noted in Oracle's advisory makes this a high-priority patch target.
Unauthorized data access and modification in Oracle REST Data Services (ORDS) versions 24.2.0 through 26.1.0 allows low-privileged remote attackers to read, create, modify, or delete any data accessible via the service. The flaw is network-reachable over HTTPS with low attack complexity (CVSS 8.1) and was disclosed by Oracle in the May 2026 Critical Patch Update. No public exploit has been identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.
Cross-product compromise in Oracle REST Data Services (ORDS) versions 24.2.0 through 26.1.0 allows a low-privileged remote attacker who can lure an authenticated user into interacting with a crafted request to gain high-impact read and write access to ORDS-accessible data and cause partial denial of service. Because the CVSS scope is Changed (S:C), successful exploitation may also impact downstream Oracle components beyond ORDS itself. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the 7.9 base score combined with scope change warrants prompt patching.
Remote takeover of Oracle Hospitality OPERA 5 Property Services (versions 5.6.19.24, 5.6.22, 5.6.25.19, 5.6.27.6, and 5.6.28) is achievable by unauthenticated network attackers over HTTP, per Oracle's May 2026 CPU. With CVSS 9.8 and full CIA impact, this is a critical hospitality-sector exposure, though no public exploit is identified at time of analysis and KEV status is not present. EPSS data was not supplied, so probability-of-exploitation cannot be quantified.
Sensitive credential disclosure in OpenMetadata 1.12.1 allows any authenticated non-admin SSO user to retrieve cleartext database passwords and a long-lived ingestion-bot JWT by triggering a TEST_CONNECTION workflow via POST /api/v1/automations/workflows. The HTTP 201 response unexpectedly echoes the stored Oracle/database secret and the bot's bearer token, which can then be replayed against service APIs with bot-level privileges. A detailed proof-of-concept is published in the GitHub Security Advisory (GHSA-9vmh-whc4-7phg), so publicly available exploit code exists; no public exploit identified at time of analysis in CISA KEV.
Boolean-oracle information disclosure in Strapi Content API allows remote unauthenticated attackers to extract admin password-reset tokens and achieve full administrative account takeover. Strapi versions 4.0.0 through 5.36.1 fail to sanitize relational query parameters on public content-type endpoints. By crafting `where` filters that traverse into joined `admin_users` table columns (e.g., `where[updatedBy][resetPasswordToken][$startsWith]=a`), attackers perform character-by-character oracle attacks against private admin fields, then use the extracted reset token to hijack administrator accounts. WildWest CyberSecurity reports this critical vulnerability with CVSS 9.3, affecting all Strapi deployments with public content-types containing admin-relation fields (`updatedBy`, `createdBy`, `publishedBy`). Vendor-released patch available in version 5.37.0. No active exploitation or public POC identified at time of analysis.
Arbitrary file read in the esm.sh CDN build server (Go implementation, versions ≤ 137) lets a remote attacker exfiltrate sensitive host files by publishing a malicious npm package. The esbuild plugin re-maps module paths using the package.json 'browser' field without re-validating the sandbox, so '../' sequences escape the package directory and file contents are returned inside the bundled JS and source-map sourcesContent. A working PoC exists (published npm package chess-sec-utils1) reading /etc/hostname, /etc/os-release and /etc/environment, but there is no public exploit identified as actively used and EPSS risk is low (0.04%).
Brute-force protection bypass in Vaultwarden (the Rust Bitwarden-compatible server) before 1.35.4 lets unauthenticated remote attackers guess passwords without rate-limiting when email 2FA is enabled on the instance. The /api/two-factor/send-email-login endpoint (send_email_login in email.rs) is not covered by login rate-limiting yet still validates the username/password pair, turning it into a credential-validity oracle. The flaw affects all accounts on an instance that has email 2FA enabled — even users who never configured email 2FA themselves. Publicly available exploit code exists (SSVC 'poc'); EPSS is very low at 0.04% and it is not in CISA KEV, so no confirmed active exploitation.
SQL injection in Daptin's fuzzy-search API (versions <= 0.11.4) allows any authenticated user to read the entire backend database via boolean-blind extraction. The GET /api/<entity> endpoint with operator=fuzzy passes the user-supplied column parameter into raw SQL through goqu.L without schema validation, bypassing the GetColumnByName whitelist used on other query paths. Publicly available exploit code exists (SSVC lists Exploitation: poc) and the vulnerability is CWE-89; a full working PoC extracted user emails and bcrypt hashes on SQLite, though EPSS remains low at 0.05%.
SQL injection in Rucio's DID search API allows any authenticated user to execute arbitrary SQL on Oracle database backends, enabling complete database compromise. The vulnerability affects Rucio versions 1.27.0 through 40.1.0 when deployed with Oracle databases using the default json_meta plugin. Attackers can extract authentication tokens, password hashes (SHA-256 single-iteration, GPU-crackable), storage credentials, and all managed data. Data modification and potential remote code execution via Oracle PL/SQL features are possible. Vendor-confirmed vulnerability with patches released across four version branches. PostgreSQL and MySQL deployments are not affected due to proper SQLAlchemy parameterization on those database dialects.
Authorization bypass in YAFNET forum software (versions ≤4.0.4) allows any low-privileged authenticated user to execute arbitrary SQL commands against the backend database. The flaw stems from a misplaced ASP.NET Core filter (`PageSecurityCheckAttribute`) that validates admin privileges *after* page handlers execute, enabling attackers to inject SQL via the `/Admin/RunSql` endpoint before the 302 redirect occurs. Publicly available exploit code exists (GitHub advisory GHSA-xhw7-j96h-c3g5) demonstrating time-based blind SQL injection to extract `@@VERSION` and manipulate identity tables. CVSS 8.8 (AV:N/AC:L/PR:L) reflects network-accessible exploitation requiring only a standard forum account-trivially obtained via self-registration on most deployments. Vendor-released patch available in version 4.0.5.
SQL injection in Oracle MCP Server Helper Tool 1.0.1-1.0.156 allows low-privileged authenticated attackers to execute malicious SQL queries with high confidentiality and integrity impact across security boundaries. The vulnerability requires network access via HTTP and user interaction, affecting the helper tool component. With CVSS 8.7 and easily exploitable characteristics (AC:L), this represents significant risk for organizations running affected versions, though no public exploit or active exploitation (CISA KEV) has been identified at time of analysis. The changed scope (S:C) indicates potential impact beyond the vulnerable component itself.
Server-Side Request Forgery (SSRF) in n8n-mcp SDK allows authenticated remote attackers to access cloud metadata endpoints and internal network resources via IPv4-mapped IPv6 address bypass. Versions 2.47.4 through 2.47.13 fail to validate IPv6 addresses in the synchronous URL validator (SSRFProtection.validateUrlSync()), enabling attackers who control the n8nApiUrl parameter to bypass RFC1918, localhost, and cloud metadata protections using addresses like [::ffff:169.254.169.254]. The vulnerability is non-blind SSRF returning response bodies to the attacker, and forwards the n8nApiKey in the x-n8n-api-key header to attacker-controlled targets. Confirmed actively exploited (CISA KEV). Vendor-released patch: version 2.47.14. EPSS exploitation probability not provided but risk is elevated given KEV status and availability of exploit code in the GitHub advisory.
Sharing-token forgery in SmarterTools SmarterMail builds before 9610 lets remote unauthenticated attackers decrypt and access arbitrary emails, attachments, and file-storage contents. The file/email sharing endpoints protect tokens with DES-CBC keys and IVs derived from System.Random seeded with only ~19,000 possible values, and the attachment download endpoint leaks enough information to act as an oracle for recovering the seed. No public exploit is identified at time of analysis, and EPSS is low (0.03%), consistent with the high-complexity, non-automatable oracle attack it requires.
Local privilege-driven compromise in Oracle VM VirtualBox 7.2.6 (Core component) allows a high-privileged local attacker who is already logged onto the host running VirtualBox to take over the VirtualBox instance, with a scope change that can significantly impact additional products beyond the hypervisor itself. The flaw is classed as improper access control (CWE-284) and tagged as an authentication bypass, yielding total confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, it is not listed in CISA KEV, and EPSS is negligible (0.01%), consistent with the high attack complexity and privilege requirements.
Privilege-based host compromise in Oracle VM VirtualBox 7.2.6 (Core component) allows a high-privileged local attacker with logon access to the host to take over VirtualBox, with a scope change that can significantly impact additional products beyond the hypervisor itself. Disclosed in Oracle's April 2026 Critical Patch Update with a CVSS 3.1 base score of 7.5 and full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and CISA SSVC records exploitation status as none with the flaw rated not automatable.
Denial-of-service in Oracle VM VirtualBox 7.2.6 (Core component) lets an unauthenticated remote attacker reachable over the VirtualBox Remote Desktop Protocol (VRDP/RDP) service trigger a hang or repeatable crash, producing a complete availability loss of the virtualization host process. There is no public exploit identified at time of analysis, and EPSS is very low (0.04%, 12th percentile), so while the flaw is network-reachable and unauthenticated, real-world exploitation pressure currently appears minimal. Note that the supplied 'Authentication Bypass' tag conflicts with the availability-only CVSS vector - the confirmed impact is DoS, not auth bypass.
Full compromise of Oracle Application Development Framework (ADF Faces component) is possible by an authenticated low-privileged user with local logon access to the host where ADF executes, affecting Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0. The improper access control weakness (CWE-284) yields complete confidentiality, integrity, and availability loss ("takeover") with a CVSS 3.1 base score of 7.8. No public exploit identified at time of analysis; the EPSS probability is negligible at 0.01% (2nd percentile) and CISA SSVC records exploitation as none.
Full compromise of Oracle VM VirtualBox 7.2.6 (Core component) is possible for a high-privileged local attacker who can log on to the host where VirtualBox runs, per Oracle's April 2026 Critical Patch Update. Because the flaw carries a scope change (S:C), a successful attack breaks out of VirtualBox and can significantly impact additional products on the host, yielding total loss of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and EPSS is negligible (0.01%), consistent with the high exploitation difficulty (AC:H) and the local, high-privilege prerequisite.
Unauthenticated information disclosure in Oracle Financial Services Transaction Filtering 8.1.2.8.0 (User Interface component) allows a remote attacker with only network/HTTP access to read all data accessible to the application. Oracle rates it CVSS 7.5 (confidentiality-only), and community tagging labels it an authentication bypass; there is no public exploit identified at time of analysis, with EPSS at a low 0.03% (9th percentile) and SSVC exploitation status 'none'.
Guest-to-host compromise in Oracle VM VirtualBox 7.2.6 (Core component) allows a high-privileged local attacker to take over the VirtualBox instance, with a scope change that can significantly impact products beyond VirtualBox itself - consistent with a hypervisor escape affecting the host. Disclosed in the Oracle April 2026 Critical Patch Update with a CVSS 3.1 base score of 7.5. There is no public exploit identified at time of analysis, and EPSS exploitation probability is negligible (0.01%).
Unauthorized data access in Oracle Database Server's Java VM component allows a remote, unauthenticated attacker to compromise the Java VM over Oracle Net (default port 1521) and read all data accessible to it, affecting versions 19.3-19.30 and 21.3-21.21. The flaw is rated CVSS 7.5 with confidentiality-only impact and is easily exploitable per Oracle, though EPSS is very low (0.03%, 9th percentile) and no public exploit identified at time of analysis. It is addressed in the Oracle Critical Patch Update of April 2026.
Unauthorized data disclosure in Oracle Financial Services Customer Screening 8.1.2.8.0 (User Interface component) allows a remote, unauthenticated attacker with only HTTP network access to read all data accessible to the application. The flaw is an authorization/access-control weakness (CWE-285) that yields high confidentiality impact without any integrity or availability effect. There is no public exploit identified at time of analysis, and the EPSS probability is very low (0.03%, 9th percentile), indicating no observed exploitation activity.
Unauthorized data access in Oracle Financial Services Analytical Applications Infrastructure (OFSAA) versions 8.0.7.9, 8.0.8.7, and 8.1.2.5 lets a remote, unauthenticated attacker read critical data over HTTP with no user interaction. The flaw stems from improper access control (CWE-284) in the Platform component and is tagged as an authentication bypass, though impact is limited to confidentiality (no data modification or denial of service). No public exploit has been identified at time of analysis and EPSS exploitation probability is very low (0.03%).
Broad data compromise in Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.62 allows a low-privileged, network-adjacent attacker to reach any data the platform can access. The flaw sits in the Security component and is characterized by improper access control (CWE-284, tagged as Authentication Bypass), letting an authenticated-but-unprivileged user read, create, delete, or modify critical data across the deployment. There is no public exploit identified at time of analysis, EPSS risk is very low (0.03%), and it is not on CISA KEV.
Unauthenticated information disclosure in Oracle WebLogic Server (Fusion Middleware, Web Services component) versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 allows a remote attacker with only HTTP network access to read critical data, potentially gaining access to all data accessible to the server. The flaw is rated CVSS 7.5 with confidentiality-only impact and is classified under CWE-200 (Information Exposure). Publicly available exploit code exists per the CISA SSVC assessment, but the vulnerability is not on the CISA KEV list and EPSS exploitation probability is very low (0.03%).
Unauthorized information disclosure in Oracle HCM Common Architecture (Knowledge Integration component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) lets a remote, unauthenticated attacker read critical HCM data over HTTP without any user interaction. Oracle rates this 7.5 (confidentiality-only impact) and addressed it in the April 2026 Critical Patch Update. There is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.03%), but SSVC flags the attack as automatable.
Full server takeover in Oracle WebLogic Server 12.2.1.4.0 and 14.1.1.0.0 (Core component) allows a high-privileged, authenticated attacker with HTTP network access to fully compromise the affected instance, resulting in total loss of confidentiality, integrity, and availability. CVSS 3.1 base score is 7.2 (PR:H), and while the intelligence tags reference 'Authentication Bypass,' the CVSS vector requires high privileges, indicating a conflict worth vendor verification. There is no public exploit identified at time of analysis, EPSS is very low (0.04%, 12th percentile), and CISA SSVC reports no known exploitation.
Cross-boundary compromise of Oracle HTTP Server (a component of Oracle Fusion Middleware) affects supported versions 12.2.1.4.0 and 14.1.2.0.0, where an unauthenticated remote attacker sending crafted HTTP traffic can gain read and write access to critical server-accessible data and, via a scope change, impact additional co-located products. The CVSS 3.1 base score is 8.7 with high confidentiality and integrity impact but no availability impact, and the flaw is classified as improper access control (CWE-284) with an Authentication Bypass tag. Currently there is no public exploit identified at time of analysis, EPSS risk is low (0.03%, 9th percentile), and CISA's SSVC rates exploitation as none despite a 'total' technical impact rating.
Denial-of-service in Oracle Identity Manager Connector (Core component) version 12.2.1.4.0 lets a remote, unauthenticated attacker send network traffic over TCP to hang or repeatedly crash the service, producing a complete availability outage (CVSS 3.1 7.5). Oracle disclosed this in the April 2026 Critical Patch Update; there is no public exploit identified at time of analysis, and EPSS is very low (0.04%). Confidentiality and integrity are unaffected - the impact is purely availability (CWE-400, resource exhaustion).
Unauthenticated authentication-bypass and access-control weakness in Oracle Identity Manager Connector 12.2.1.4.0 (Core component of Oracle Fusion Middleware) allows a network attacker to read, create, delete, or modify any data the connector can reach over HTTPS. Rated CVSS 3.1 9.1 with high confidentiality and integrity impact but no availability impact, it is easily exploitable without credentials or user interaction, though EPSS is very low (0.03%) and there is no public exploit identified at time of analysis. SSVC marks technical impact as total and the flaw as automatable, so it warrants prompt patching in the April 2026 Oracle CPU despite the currently low observed exploitation.
Authentication bypass in Oracle Identity Manager Connector 12.2.1.4.0 (Oracle Fusion Middleware, Core component) lets a remote, unauthenticated attacker reach and manipulate all connector-accessible data over HTTPS. Because the flaw is a missing-authentication weakness (CWE-306), an attacker can read, create, delete, or modify critical identity data with no credentials and low complexity. There is no public exploit identified at time of analysis, and EPSS is very low (0.03%), but the CVSS 9.1 and CISA SSVC 'total' technical impact rating mark it as high severity.
Unauthenticated data compromise in Oracle Identity Manager Connector 12.2.1.4.0 (Oracle Fusion Middleware, Core component) allows a remote attacker to reach the connector over HTTPS with no credentials and read, create, delete, or modify all connector-accessible data. Mapped to CWE-306 (Missing Authentication) and tagged as an authentication bypass, it carries a CVSS 3.1 base score of 9.1 (C:H/I:H). There is no public exploit identified at time of analysis, and EPSS is very low (0.03%, 9th percentile), but CISA SSVC rates it automatable with total technical impact.
Denial of service in the Networking component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows an unauthenticated, network-based attacker to cause a hang or repeatable crash (complete availability loss) of the affected runtime. The flaw is described by Oracle as easily exploitable via multiple protocols against any application that feeds attacker-controlled data to the vulnerable networking APIs (e.g., an exposed web service). There is no public exploit identified at time of analysis; EPSS is very low (0.04%, 12th percentile) and CISA SSVC lists exploitation status as none, so this is a patch-in-cycle availability issue rather than an active threat.
Full takeover of Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) is possible through the Event Management component, where a high-privileged attacker with HTTP network access can compromise the platform and, due to a scope change, significantly impact additional connected products. The flaw is classed as CWE-306 (Missing Authentication for Critical Function) and tagged as an authentication bypass, carrying a CVSS 3.1 base score of 9.1 with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is very low (0.04%, 12th percentile), indicating no observed exploitation activity to date.
Full takeover of Oracle Advanced Inbound Telephony (a module within Oracle E-Business Suite, versions 12.2.3 through 12.2.15) is possible by a remote, unauthenticated attacker over HTTP against the Setup and Administration component, per Oracle's April 2026 Critical Patch Update. Classified as a missing-authentication authentication bypass (CWE-306) with a 9.8 CVSS, successful exploitation yields complete confidentiality, integrity, and availability compromise of the product. There is no public exploit identified at time of analysis, and EPSS probability is low (0.04%), but CISA's SSVC assessment rates the technical impact as total and the flaw as automatable.
Unauthorized data disclosure in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition arises from a flaw in the JAXP (Java API for XML Processing) component, allowing an unauthenticated remote attacker to read critical or all accessible data across affected JDK 8, 11, 17, 21, 25, and 26 builds. The confidentiality-only issue (CVSS 7.5, C:H/I:N/A:N) is easily exploitable over multiple network protocols, including via web services that pass attacker-supplied data into JAXP APIs, and also affects sandboxed Java Web Start/applet deployments running untrusted code. There is no public exploit identified at time of analysis and EPSS is very low (0.03%, 9th percentile), consistent with the SSVC exploitation status of 'none'.
Privilege-based compromise of the Oracle Applications DBA product (ADPatch component) within Oracle E-Business Suite 12.2.3 through 12.2.15 allows an already high-privileged attacker with HTTP network access to fully take over the Applications DBA and, via a scope change, significantly impact additional products. Exploitation is rated difficult and requires human interaction from a victim other than the attacker. There is no public exploit identified at time of analysis, EPSS is negligible (0.03%, 10th percentile), and it is not in CISA KEV, indicating low real-world exploitation pressure despite the high CVSS score.
Unauthorized data disclosure in Oracle Financial Services Analytical Applications Infrastructure (OFSAA) 8.0.7.9, 8.0.8.7, and 8.1.2.5 allows a remote, unauthenticated attacker to reach protected data over HTTP against the Platform component. Successful exploitation yields read access to critical or all OFSAA-accessible data with no integrity or availability impact. There is no public exploit identified at time of analysis, and EPSS is very low (0.03%, 9th percentile), consistent with CISA SSVC scoring exploitation as 'none.'
Unauthorized data manipulation in Oracle Life Sciences Empirica Signal 9.2.1 through 9.2.3 (Common Core component) allows a low-privileged, network-authenticated attacker to create, delete, or modify critical data and read a subset of accessible data over HTTP. The scope-changed flaw (rooted in improper access control, CWE-284) can significantly impact additional products beyond Empirica Signal itself, and Oracle rates it CVSS 3.1 8.5. There is no public exploit identified at time of analysis, and EPSS is very low at 0.03% (8th percentile).
LDAP injection in maddy mail server versions before 0.9.3 allows remote unauthenticated attackers to extract sensitive directory attributes and spoof user identities. The auth.ldap module fails to escape user-supplied usernames before interpolating them into LDAP search filters and DN strings, despite having the ldap.EscapeFilter() function available. Attackers can exploit this via SMTP AUTH PLAIN or IMAP LOGIN interfaces to perform boolean-based blind injection attacks that extract password hashes, email addresses, group memberships, and other LDAP attributes character-by-character. While CVSS rates this 8.2 (High) for network-accessible unauthenticated exploitation with high confidentiality impact, no active exploitation (KEV) or weaponized POC has been identified at time of analysis. EPSS data not available for this recent CVE.
Padding oracle attack in Apache Tomcat EncryptInterceptor leaks encrypted session data confidentiality across versions 7.0.100-7.0.109, 8.5.38-8.5.100, 9.0.13-9.0.115, 10.0.0-M1-10.1.52, and 11.0.0-M1-11.0.18 when default configuration is deployed. Unauthenticated remote attackers exploit oracle responses to decrypt sensitive information without authentication (CVSS:3.1 AV:N/AC:L/PR:N). CWE-209 (information exposure through error messages) enables cryptographic side-channel extraction. No public exploit identified at time of analysis; low observed exploitation activity (EPSS 0.02%).
Server-Side Request Forgery in n8n-mcp (npm package) versions ≤2.47.3 allows authenticated attackers with valid AUTH_TOKEN to force the server to issue HTTP requests to arbitrary URLs via manipulated multi-tenant HTTP headers (x-n8n-url, x-n8n-key). Response bodies are reflected through JSON-RPC, enabling unauthorized access to cloud instance metadata endpoints (AWS IMDS, GCP, Azure, Oracle, Alibaba), internal network services, and any host reachable by the server process. Multi-tenant HTTP deployments with shared or multiple AUTH_TOKENs are at highest risk. No public exploit identified at time of analysis.
Remote code execution in OpenIdentityPlatform OpenAM 16.0.5 and earlier allows unauthenticated attackers to execute arbitrary OS commands via unsafe Java deserialization of the jato.clientSession HTTP parameter. This bypass exploits an unpatched deserialization sink in JATO's ClientSession.deserializeAttributes() that was overlooked when CVE-2021-35464 was mitigated. Attackers can target any JATO ViewBean endpoint with <jato:form> tags (commonly found in password reset pages) using a PriorityQue
Server-Side Request Forgery in pyLoad-ng allows authenticated users with ADD permissions to read local files via file:// protocol, access internal network services, and exfiltrate cloud metadata. The parse_urls API endpoint fetches arbitrary URLs without protocol validation, enabling attackers to read /etc/passwd, configuration files, SQLite databases, and AWS/GCP metadata endpoints at 169.254.169.254. Error-based responses create a file existence oracle. Multi-protocol support (file://, gopher://, dict://) escalates impact beyond standard HTTP SSRF. CVSS 7.7 reflects network attack vector, low complexity, and scope change with high confidentiality impact. No public exploit code identified at time of analysis, though detailed proof-of-concept included in advisory demonstrates exploitation via curl commands against Docker deployments.
phpseclib versions 1.0.26 and below, 2.0.0 through 2.0.51, and 3.0.0 through 3.0.49 are vulnerable to a padding oracle timing attack when using AES in CBC mode, allowing attackers to decrypt sensitive data through cryptanalysis of response timing differences. This information disclosure vulnerability affects any PHP application using the vulnerable phpseclib library for AES-CBC encryption. Although no CVSS score, EPSS data, or confirmed active exploitation (KEV status) are currently available, the presence of a verified fix and security advisory indicates this is a legitimate cryptographic weakness requiring attention.
A critical authentication bypass vulnerability in Oracle Identity Manager and Oracle Web Services Manager allows remote attackers to completely compromise affected systems without any credentials. The vulnerability resides in the REST WebServices and Web Services Security components, affecting versions 12.2.1.4.0 and 14.1.2.1.0 of both products. With a CVSS score of 9.8 and no authentication required, this represents a severe risk to identity management infrastructure, though no current KEV listing or public POC has been documented in available sources.
Unauthenticated attackers can stream any private or paid video in PHP, Oracle, and Apple applications through a path traversal vulnerability in the HLS streaming endpoint. The flaw exploits a split-oracle condition where authorization validation and file access use different parsing logic on the videoDirectory parameter, allowing attackers to bypass authentication checks while accessing unauthorized content. No patch is currently available for this high-severity vulnerability.
This is a critical unauthenticated remote code execution vulnerability in Oracle Edge Cloud Infrastructure Designer and Visualisation Toolkit version 0.3.0. An attacker with network access via HTTP can completely take over the affected system without any authentication, privileges, or user interaction required. The CVSS score of 9.8 reflects maximum impact across confidentiality, integrity, and availability. There is no evidence of active exploitation (not in CISA KEV), and no proof-of-concept code has been publicly identified in the available intelligence.
Private key recovery in Stanford JavaScript Crypto Library (SJCL) ECDH implementation affects all versions prior to 1.0.9, allowing remote unauthenticated attackers to extract a victim's ECDH private key by submitting crafted off-curve public keys and observing the resulting shared-secret outputs. The flaw stems from missing point-on-curve validation in sjcl.ecc.basicKey.publicKey(), combined with dhJavaEc() returning the raw x-coordinate without hashing - providing a direct plaintext oracle. Publicly available exploit code exists (PoC gist by Kr0emer); EPSS is low at 0.02% despite the high confidentiality impact, suggesting limited current opportunistic targeting.
Vm Virtualbox versions up to 7.1.14 contains a vulnerability that allows attackers to takeover of Oracle VM VirtualBox (CVSS 8.2).
Vm Virtualbox versions up to 7.1.14 contains a vulnerability that allows attackers to unauthorized creation, deletion or modification access to critical data or all O (CVSS 8.1).
Vm Virtualbox versions up to 7.1.14 contains a vulnerability that allows attackers to takeover of Oracle VM VirtualBox (CVSS 8.2).
Vm Virtualbox versions up to 7.1.14 contains a vulnerability that allows attackers to takeover of Oracle VM VirtualBox (CVSS 8.2).
Vm Virtualbox versions up to 7.1.14 contains a vulnerability that allows attackers to unauthorized ability to cause a hang or frequently repeatable crash (complete DO (CVSS 7.1).
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. [CVSS 7.5 HIGH]