Oracle
Monthly
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 7, allows remote attackers to affect integrity via unknown vectors. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable, no authentication required. Actively exploited in the wild (cisa kev) and public exploit code available.
Unspecified vulnerability in the Oracle WebCenter Content component in Oracle Fusion Middleware 10.1.3.5.1 and 11.1.1.6.0 allows remote authenticated users to affect availability via unknown vectors. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 68.9%.
The Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 6 and 7, allows remote attackers to execute arbitrary code via unspecified vectors involving. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 86.3%.
The color management (CMM) functionality in the 2D component in Oracle Java SE 7 Update 15 and earlier, 6 Update 41 and earlier, and 5.0 Update 40 and earlier allows remote attackers to execute. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 93.0%.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, and OpenJDK 7, allows user-assisted remote attackers to bypass the Java security. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using the public getMBeanInstantiator method in the JmxMBeanServer class to obtain a. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
MySQL 5.5.19 and possibly other versions, and MariaDB 5.5.28a and possibly other versions, when configured to assign the FILE privilege to users who should not have administrative privileges, allows. Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 88.8%.
Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0 allows remote attackers to affect confidentiality and integrity via. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 91.2%.
Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0 allows remote attackers to affect confidentiality and integrity via. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3.0 allows remote attackers to affect integrity via unknown vectors related to. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 14.5%.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers to affect confidentiality, integrity, and availability via. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 79.3%.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers to affect confidentiality, integrity, and availability,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, and 6 Update 35 and earlier, allows remote attackers to affect confidentiality,. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 65.9%.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName methods, enabling complete sandbox escape for untrusted applets. Massively exploited by exploit kits in 2012.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris 11 and earlier; illumos before r13724; Joyent. Rated high severity (CVSS 7.2), this vulnerability is low attack complexity. Public exploit code available and EPSS exploitation probability 88.0%.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0 Update 33 and earlier allows remote attackers to. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Unspecified vulnerability in the Oracle WebCenter Forms Recognition component in Oracle Fusion Middleware 10.1.3.5 allows remote attackers to affect confidentiality, integrity, and availability via. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 39.6%.
Unspecified vulnerability in the Oracle AutoVue Office component in Oracle Supply Chain Products Suite 20.1.1 allows remote attackers to affect confidentiality, integrity, and availability, related. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 85.1%.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and JavaFX 2.0.2 and earlier allows remote untrusted Java. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 74.9%.
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise through malicious Java Web Start applications and untrusted applets exploiting the Scripting component. CISA KEV confirms active exploitation in the wild. EPSS score of 92.59% (100th percentile) indicates extremely high probability of mass exploitation. Public exploit code exists, making this a critical priority for any environment running affected Java versions despite the vulnerability's age.
SQL injection in the ORDER BY direction handling of MikroORM (a TypeScript ORM for Node.js) lets authenticated remote attackers append arbitrary SQL fragments to generated queries, enabling blind or boolean-based extraction of data readable by the configured database account. Affected are SQL drivers in versions prior to 6.6.16 and 7.0.0 through 7.1.6 (SQLite, PostgreSQL, MySQL, MariaDB, MSSQL, libSQL, Oracle); MongoDB is not affected. Exploitation is conditional - the application must bind attacker-controlled request data directly to the orderBy direction in em.find(), em.findOne(), em.findAndCount(), QueryBuilder.orderBy(), or QueryBuilderHelper.getQueryOrderFromObject(); the field key is already validated against entity metadata, and there is no public exploit identified at time of analysis. Vendor-released fixes exist in 6.6.16 and 7.1.7.
An authorization bypass in the Ash framework (Elixir) lets authenticated, lower-privileged actors recover values they are not permitted to see by using filtered calculations or aggregates as a yes/no oracle. Ash field policies are designed to protect against filter-based disclosure by rewriting references to forbidden attributes into an expression that evaluates to nil, but prior to 3.33.4 that rewriting only matched Ash.Resource.* structs and not Ash.Query.Calculation or Ash.Query.Aggregate structs, so filters on those ran against real values. Any application that uses Ash.Policy.Authorizer with field policies on calculations or aggregates and exposes filter arguments (commonly via AshGraphql or AshJsonApi) is affected; no public exploit identified at time of analysis, and the disclosure is gradual - one probe at a time - with no integrity or availability impact.
A locally reachable denial-of-service flaw in Oracle VM VirtualBox 7.2.16 (Core component) lets an attacker who already holds a high-privileged logon on the host crash or repeatedly hang the hypervisor, taking down all hosted virtual machines. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H, base 6.0) confirms the impact is availability-only and confined to already-privileged local users, but the scope-change flag indicates the resulting outage can extend to other workloads running on the same infrastructure. No EPSS score, KEV listing, or public exploit evidence was present in the supplied intelligence, so exploitation status is unknown and the flaw should be treated as a privilege-gated local availability risk rather than a remotely exploitable emergency.
Oracle VM VirtualBox 7.2.16 contains a flaw in the Core component that lets a high-privileged attacker who already has a logon on the host trigger a partial denial of service against the VirtualBox process itself. The attack is local (AV:L) and requires elevated privileges (PR:H), but carries a scope change (S:C), meaning the successful exploit can significantly affect additional products layered on the same infrastructure. CVSS 3.1 scores this 3.2 with availability-only impact; there is no public exploit identified at time of analysis and no CISA KEV listing, so real-world urgency is low for most deployments.
Denial of service in Oracle VM VirtualBox 7.2.16 (Core component) lets a locally logged-on attacker with high privileges hang or repeatedly crash the hypervisor, with the CVSS scope-change metric indicating the disruption can extend beyond VirtualBox to other products on the same host. Exploitation requires logon access to the infrastructure running VirtualBox and high privileges (PR:H, AV:L), so it is an insider/administrator-privileged availability attack rather than a remote one. No public exploit code has been identified and the flaw is not listed in CISA KEV; EPSS data was not supplied with this record.
Denial of service in Oracle VM VirtualBox 7.2.16 allows an attacker who already holds high privileges and can log on to the machine running the hypervisor to crash the product through its Core component, producing a hang or repeatable crash. The flaw is rated CVSS 3.1 6.0 (AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H), so it is purely an availability issue with no confidentiality or integrity impact, but the scope change flag means a successful attack can degrade other workloads running alongside VirtualBox — typically guest VMs and co-resident services. It is not remotely exploitable, no public exploit code or CISA KEV entry was identified at time of analysis, and the affected build is confirmed as 7.2.16 by both the vendor advisory and ENISA EUVD.
Oracle VM VirtualBox 7.2.16 (Core component) contains a low-severity information disclosure flaw that requires an attacker to already hold a high-privileged logon on the host where VirtualBox runs. A successful attack yields read access to a limited subset of VirtualBox-accessible data (C:L) and, per Oracle's scope-change rating, may affect components beyond the hypervisor boundary. No public exploit code and no CISA KEV listing were identified at time of analysis, and the CVSS 3.1 base score is only 3.2, so real-world prioritization should be low relative to other virtualization issues.
Oracle VM VirtualBox 7.2.16 can be hung or repeatedly crashed by a high-privileged attacker who already has an interactive logon on the host where the hypervisor runs, provided another person on the system performs an interaction such as opening or starting a crafted VM. The flaw sits in VirtualBox Core and yields availability-only impact: any hosted guest and the VirtualBox process itself can be taken down. It is scored 4.2 and the local-plus-privileged access requirement makes mass exploitation unlikely; no public exploit code or CISA KEV listing was present in the supplied intelligence at time of analysis.
A locally exploitable flaw in the Core component of Oracle VM VirtualBox 7.2.16 lets a low-privileged user who can log on to the host repeatedly crash the hypervisor process and tamper with some VirtualBox-accessible data. The issue requires only local logon with low privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N), no user interaction, and no network exposure, yielding a 6.1 base score driven by Availability (High) and Integrity (Low) impacts with no Confidentiality impact. There is no public exploit code identified and the CVE is not listed in CISA KEV, so current risk is concentrated in multi-user or shared-workstation deployments where untrusted users share a virtualization host.
Oracle VM VirtualBox 7.2.16 contains a Core-component flaw that lets an attacker who already has a logon on the host crash the hypervisor (complete denial of service) and make limited unauthorized modifications to VirtualBox-accessible data, provided they can induce a victim to perform a user action. The issue is local rather than network-reachable, requires no special privileges beyond an interactive session on the machine where VirtualBox runs, and is rated 6.1 on the CVSS 3.1 scale (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H). No public exploit code has been identified and the CVE is not listed in CISA KEV at time of analysis, but the integrity-plus-availability impact and the trivially low attack complexity make prompt patching worthwhile.
A locally exploitable flaw in the Core component of Oracle VM VirtualBox 7.2.16 lets an attacker who already holds a high-privileged logon on the host read a limited subset of VirtualBox-accessible data and trigger a partial denial of service against the hypervisor. The scope-change rating (S:C) indicates the impact can extend beyond VirtualBox itself to other products on or around the host, but exploitation requires local logon with elevated privileges and there is no indication of remote reach. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV, so real-world priority is driven by host-access hygiene rather than internet-facing exposure.
Denial of service in Oracle VM VirtualBox 7.2.16, where a local attacker who already holds a low-privileged logon session on the host can trigger a fault in the Core component that hangs or repeatedly crashes the VirtualBox process. Exploitation is difficult (AC:H) and requires active interaction from a different user on the same machine, and the impact is limited to availability — no confidentiality or integrity loss — giving a CVSS 3.1 base score of 4.4. No public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis, so treat it as a local reliability/DoS nuisance rather than a remote compromise risk.
A crafted remote-desktop (RDP) interaction with Oracle VM VirtualBox 7.2.16 can hang or repeatedly crash the hypervisor's Core component, producing a complete denial of service against the affected VM sessions. Exploitation is rated difficult (AC:H) and requires a low-privileged account with network reachability to the virtual machine's remote display service, so it is not a drive-by or unauthenticated attack. Only availability is impacted — there is no confidentiality or integrity loss. No EPSS score, CISA KEV listing, or public exploit code was present in the supplied intelligence, so the vulnerability should be treated as a medium-priority patching item rather than an active emergency.
Unauthenticated attackers who can reach the Oracle Agile PLM Web Client over HTTP can read and tamper with a limited subset of PLM data, but only if they first persuade another user to interact with a crafted request. Oracle rates this 6.1 (medium) with a scope change, meaning a successful attack may also affect additional products reachable through the same component. No public exploit code, POC, or CISA KEV entry was identified in the supplied intelligence for this CVE.
Adjacent-network attackers can bypass authentication in Oracle Agile PLM 9.3.6 (Application Server component), gaining the ability to read, create, delete, or modify any data the PLM application can reach. The flaw is unauthenticated per its CVSS vector (PR:N) but only reachable from the physical communication segment attached to the host running Agile PLM, and Oracle rates it as difficult to exploit (AC:H) with a 6.8 base score affecting confidentiality and integrity only. No public exploit code or CISA KEV listing was present in the available intelligence, so active exploitation is unconfirmed.
Local attackers who already hold high privileges and a valid logon to the host running Oracle Hyperion Financial Management 11.2.26.0.000 can exploit a flaw in the product's Security component to seize full control of the application, with complete loss of confidentiality, integrity and availability. The issue is rated CVSS 6.7 (AV:L/AC:L/PR:H/UI:N) and no public exploit code, EPSS score or CISA KEV entry was present in the supplied intelligence. Because it requires pre-existing privileged local access, this is primarily a post-compromise escalation and insider-abuse concern rather than an internet-facing remote attack.
Oracle Contract Lifecycle Management for Public Sector — specifically the Wage Determination Online component of Oracle E-Business Suite 12.2.3 through 12.2.15 — can be abused by an unauthenticated, network-based attacker who persuades another user to interact with a crafted HTTP request, yielding unauthorized read plus update/insert/delete access to module data. The CVSS 3.1 base score is 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), and the scope-change metric indicates the compromise may significantly impact additional products beyond the vulnerable module. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so this reads as a patch-cycle priority rather than an emergency.
Oracle iRecruitment, the recruitment module of Oracle E-Business Suite, exposes an access-control weakness in its Internal Operations component across versions 12.2.3 through 12.2.15 that lets an attacker on the same physical network segment read, create, modify, or delete recruitment data without authenticating. The flaw is rated difficult to exploit (CVSS 6.8, AV:A/AC:H/PR:N/UI:N) because it demands layer-2 adjacency to the application host and a race-prone or otherwise unreliable attack path, but it delivers high confidentiality and integrity impact with no availability loss. No public exploit code or CISA KEV entry was present in the supplied intelligence, so exploitation is not confirmed in the wild.
Oracle Helidon 4.0.0 through 4.5.4 contains an authorization weakness in the helidon-microprofile-security component that allows a low-privileged user with ordinary HTTP network access to read a subset of Helidon-accessible data and to insert, update or delete records they should not reach, with no user interaction required. The defect is trivially reachable (CVSS 3.1 base 5.4, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), meaning any valid low-privilege account is enough to over-reach, though availability is unaffected. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied, so the practical urgency rests on whether the affected microprofile-security module is exposed and whether low-privilege accounts are widely issued.
Unauthenticated attackers with network access to HTTP endpoints can cause a partial denial of service in Oracle Helidon versions 4.0.0 through 4.5.4 by abusing the WebSocket component. The flaw carries a CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N, availability-only partial impact) and requires no credentials or user interaction, making it trivially automatable against any reachable WebSocket-enabled service. No public exploit code, EPSS score, or CISA KEV listing was provided in the available intelligence, so active exploitation is not confirmed.
Unauthenticated network access to the Long Running Actions (LRA) component of Oracle Helidon 4.0.0 through 4.5.4 allows a remote attacker to read a subset of data and to insert, update, or delete records handled by the LRA coordinator without supplying credentials. The flaw is rated CVSS 6.5 with a network attack vector, low complexity, and no required privileges or user interaction, but it produces only partial confidentiality and integrity impact with no availability loss. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; EPSS data was not supplied in the input.
Unauthenticated HTTP requests can drive Oracle Helidon 3.0.0 through 3.2.20 into a partial denial-of-service condition through the helidon-media-multipart component, which handles multipart/form-data parsing. The flaw is network-reachable with no privileges or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, base 5.3) and impacts availability only — confidentiality and integrity are unaffected. Oracle rates it easily exploitable in its CPU advisory, but no KEV listing or public exploit code was present in the supplied intelligence feeds, so no public exploit identified at time of analysis.
Unauthenticated attackers with network access to an HTTP endpoint on Oracle Helidon 4.0.0 through 4.5.4 can trigger a partial denial of service in the framework's JSON component, degrading availability of the hosted application. The flaw is rated CVSS 3.1 base 5.3 (AV:N/AC:L/PR:N/UI:N, availability-only impact) and is described by Oracle as easily exploitable, though no public proof-of-concept, EPSS score, or CISA KEV entry was supplied in the input data, so active exploitation is unconfirmed.
Oracle Assets, a module within Oracle E-Business Suite, exposes sensitive asset and financial data to any authenticated user with low privileges who can reach the module over HTTP. Versions 12.2.3 through 12.2.15 are affected; a successful attack yields high confidentiality impact (CVSS 3.1 base 6.5, AV:N/AC:L/PR:L/UI:N) with no integrity or availability effect. Oracle rates the flaw 'easily exploitable', but no EPSS score, KEV listing, or public exploit code was present in the supplied intelligence, so exploitation status is best described as no public exploit identified at time of analysis.
Oracle Product Hub, the product master-data component of Oracle E-Business Suite (versions 12.2.3 through 12.2.15), is exposed to a difficult-to-exploit flaw in its Internal Operations component that lets a low-privileged, network-positioned attacker read and tamper with critical product data via HTTP. The CVSS 3.1 base score is 6.8 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N), reflecting high confidentiality and integrity impact but no availability impact, with the high attack-complexity metric indicating exploitation depends on conditions outside the attacker's direct control. There is no public exploit identified at time of analysis and the flaw has not been listed in CISA KEV; Oracle's own advisory at cspusep2026.html is the authoritative remediation source.
High-privileged users of Oracle E-Business Suite Depot Repair 12.2.3 through 12.2.15 can exploit a flaw in the Depot Repair Diagnostics component over HTTP to read, create, modify, or delete any Depot Repair data they can reach. Oracle rates this CVSS 3.1 6.5 (AV:N/AC:L/PR:H/UI:N, C:H/I:H/A:N), meaning exploitation is network-reachable and low-complexity but requires an already-privileged EBS account; there is no integrity-verified public exploit code and no CISA KEV listing at time of analysis. The practical exposure is privilege escalation or lateral data compromise inside an EBS instance rather than a pre-authentication breach.
Authenticated attackers holding only low-privileged credentials in Oracle E-Business Suite can exploit a WebUI flaw in Oracle Product Workbench 12.2.3 through 12.2.15 to read and tamper with application data, provided they can convince another user to interact with a crafted request. The CVSS 3.1 base score is 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), with a scope change meaning downstream components of the E-Business Suite may also be affected. No public exploit code or active exploitation has been identified in the supplied intelligence, and no EPSS score was provided.
Oracle Communications Cloud Native Core Security Edge Protection Proxy (SEPP) versions 26.1.200 and 25.2.201 permit a low-privileged, network-positioned attacker to reach the SEPP over HTTP and read a subset of its accessible data while also updating, inserting, or deleting some of that data. The flaw is rated 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), meaning exploitation needs an existing low-privilege account but no user interaction and no special attack complexity. There is no CISA KEV listing and no public exploit code identified at time of analysis; the issue is addressed through Oracle's Critical Patch Update advisory cspusep2026.
A partial denial-of-service flaw in the Core component of Oracle Coherence lets a low-privileged, network-positioned attacker degrade availability of the distributed data grid by sending crafted HTTP requests. Versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 of the Oracle Fusion Middleware product are listed as affected by Oracle and mirrored by EUVD (EUVD-2026-79717). The CVSS 3.1 base score is only 4.3 because impact is limited to availability (A:L) with no confidentiality or integrity effect, and no public exploit code or CISA KEV entry was present in the supplied intelligence.
Oracle Coherence 15.1.1.0.0 exposes a narrow local information-disclosure weakness in its Core component that lets an attacker who already holds a low-privileged operating-system logon on the Coherence host read a limited subset of data the process can access. The flaw is rated CVSS 3.1 base 2.5 (AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N), meaning high attack complexity, no integrity or availability impact, and no remote vector. There is no public exploit code and no CISA KEV listing, so this is a low-priority, defense-in-depth item rather than an emergency; Oracle published it through its Critical Patch Update advisory for Fusion Middleware.
Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 contain a flaw in the Core component that lets an attacker who already holds a high-privileged account and can log on to the host where Coherence runs make unauthorized updates, inserts or deletions against Coherence-accessible data. The CVSS 3.1 base score is only 1.9 (AV:L/AC:H/PR:H/UI:N, integrity-only), reflecting that exploitation demands local logon, elevated privileges and a difficult-to-achieve condition; confidentiality and availability are not impacted. No public exploit code or CISA KEV entry was present in the supplied intelligence, so this is assessed as a low-priority, defense-in-depth issue rather than an urgent patch item. The vendor-reported nature of the record and the presence of an 'Authentication Bypass' tag that conflicts with the PR:H, integrity-only vector are notable data-quality caveats.
Partial denial of service in Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 (Access SDK component) can be triggered by a low-privileged, authenticated attacker who reaches the product over HTTP. The flaw is rated CVSS 3.1 base 3.1 with an availability-only, partial impact, and Oracle characterizes it as difficult to exploit (AC:H), so successful disruption requires favorable timing or state rather than a simple repeatable request. No public exploit code, EPSS score, or CISA KEV entry was present in the supplied intelligence, so there is no indication of active exploitation at time of analysis.
Information disclosure in Oracle Coherence 15.1.1.0.0 lets a low-privileged attacker with HTTP network access read critical data or the entire contents of Coherence-accessible caches, and because the CVSS vector reports a scope change, products built on top of that grid can be exposed as well. Oracle scores it 6.3 with high attack complexity, so it is not a trivial drive-by exploit; the feed contains no public exploit code and no CISA KEV entry, and the only remediation reference is Oracle's Critical Security Patch Update advisory. Authentication is required per the PR:L metric, meaning the attacker needs an existing low-privilege foothold rather than being an anonymous internet client.
A denial-of-service flaw in the Oracle Net Services component of Oracle Database Server (versions 23.4.0 through 23.26.3) lets an unauthenticated attacker with network access over TCPS hang or repeatedly crash the Net Services layer, degrading or halting database connectivity. Exploitation is network-reachable and low-complexity but requires interaction from a person other than the attacker, and it yields availability impact only (CVSS 3.1 base 6.5, C:N/I:N/A:H). No public exploit code or CISA KEV listing was identified at time of analysis, and no EPSS score was supplied with the source data.
Oracle Fusion Middleware Control 12.2.1.4.0 and 14.1.2.0.0 contain a flaw in the Framework component that lets a low-privileged attacker with HTTP network access trick a privileged user into an interaction that results in unauthorized read and modification of data, with cross-scope impact on other Oracle products. Oracle rates it CVSS 3.1 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), meaning exploitation is easy but gated by an existing low-privileged account and victim user interaction. There is no public exploit code or CISA KEV entry in the provided data, and EPSS is not supplied; treat this as a patch-cycle item rather than an emergency.
Improper access control in the CAX Client component of the Oracle Agile PLM MCAD Connector 3.6 allows a locally logged-on, low-privileged user to read critical Agile PLM data, or all data the connector can reach. The flaw is confidentiality-only (CVSS 3.1 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so it is a post-logon insider/desktop compromise risk rather than a remote pre-auth issue. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; EPSS data was not supplied in the available intelligence.
Unauthenticated attackers positioned on the adjacent network segment of a host running Oracle Helidon can read and modify critical application data through a flaw in the helidon-integrations-neo4j component. Affected releases are Helidon 3.0.0 through 3.2.20 and 4.0.0 through 4.5.4; Oracle rates this CVSS 3.1 6.8 with an AV:A/AC:H profile, meaning the attacker needs layer-2 proximity and must satisfy non-trivial conditions, but needs no credentials and no user interaction. No public exploit code and no CISA KEV entry were identified at the time of analysis, and no EPSS score was supplied with the intelligence.
A locally exploitable information-disclosure flaw in the CAX Client component of Oracle Agile PLM MCAD Connector 3.6 lets any attacker who already holds a low-privileged logon on the host read data they should not be able to reach, including critical PLM content the connector can access. Confidentiality is the only impacted metric (CVSS 3.1 base 5.5, AV:L/PR:L/UI:N/C:H/I:N/A:N), so integrity and availability of the connector are untouched. There is no CISA KEV listing and no public exploit code identified at time of analysis, and Oracle has published a fix through its Supply Chain Critical Security Patch Update.
Unauthenticated network attackers with access to the TLS interface of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 can trigger a hang or repeatedly crash the Forge component while also reading a limited subset of application-accessible data. Oracle's advisory rates it 6.5 (AV:N/AC:H/PR:N/UI:N/C:L/A:H), so impact is dominated by availability loss rather than data compromise, and the high attack complexity suggests exploitation requires carefully crafted conditions rather than a trivial request. No public exploit code or CISA KEV entry is present in the available intelligence, and the vulnerability is not confirmed as actively exploited at time of analysis.
Unauthenticated attackers with network access to the HTTP interface of the Forge component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 can exploit a difficult-to-trigger flaw to read the full set of data the platform can reach and to partially degrade its availability. The vendor rates this 6.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L), so the damage ceiling is high confidentiality loss rather than code execution. No public exploit code and no CISA KEV entry appear in the supplied intelligence, and no EPSS score was provided, so active exploitation is unconfirmed — the practical driver for patching is the exposure of complete catalogue and index data, not observed attacks.
Unauthorized read access to critical data in Oracle Process Manufacturing Intelligence (part of Oracle E-Business Suite) is achievable by a low-privileged attacker over the network via Oracle Net, because the Internal Operations component fails to properly enforce authorization for 12.2.3 through 12.2.15. The flaw is rated CVSS 3.1 6.5 (AV:N/AC:L/PR:L/UI:N, confidentiality-only) and is trivially reachable by anyone holding a valid low-privileged account and network path to the Oracle Net listener. There is no CISA KEV listing and no public exploit identified at time of analysis, but Oracle shipped an official fix in its Critical Security Patch Update, so unpatched internet- or intranet-exposed EBS instances remain the exposure.
Oracle Field Service, a component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, can be compromised over HTTP by a low-privileged attacker who induces another person to interact with a crafted request. Successful exploitation gives the attacker unauthorized read access plus insert, update, or delete capability over a subset of Field Service data, and because the CVSS scope metric is Changed, the impact may extend into additional connected products. There is no public exploit code identified and no CISA KEV listing at time of analysis, so this rates as a moderate-priority patch item rather than an emergency, with a CVSS 3.1 base score of 5.4 reflecting limited confidentiality and integrity loss and no availability impact.
A low-privileged, authenticated attacker with HTTP network access can read all data accessible through the Oracle Application Object Library (Core) component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, resulting in a full confidentiality compromise of that component with no integrity or availability impact. Oracle rates it CVSS 3.1 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) and describes it as easily exploitable, meaning an existing low-privilege EBS account is enough to reach sensitive data beyond the account's intended scope. No public exploit code or active exploitation is indicated in the available intelligence, and the patch is delivered through Oracle's Critical Security Patch Update for E-Business Suite.
Improper authorization enforcement in the Internal Operations component of Oracle Field Service, part of Oracle E-Business Suite 12.2.3 through 12.2.15, lets a low-privileged user read data that the application should have kept out of reach. The attack is delivered over HTTP with no user interaction and no special complexity, but it does require a valid account on the affected system, so it is an authorization/confidentiality failure rather than a pre-authentication bypass. Impact is limited to confidentiality (CVSS 3.1 base 6.5, C:H/I:N/A:N); no public exploit code or CISA KEV entry was present in the supplied intelligence at time of analysis.
Unauthenticated attackers with HTTP access to Oracle Forms Services can read a limited subset of data the application exposes, per Oracle's Fusion Middleware security advisory affecting versions 12.2.1.19.0 and 14.1.2.0.0. The flaw is rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/C:L/I:N/A:N), meaning low-complexity, no-credential, no-user-interaction exploitation whose only impact is partial confidentiality loss - there is no integrity or availability impact and no scope change. No public exploit code, EPSS score, or CISA KEV listing is present in the supplied intelligence, so this should be treated as a patch-now confidentiality leak rather than an actively exploited emergency.
Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 contain an easily exploitable flaw in the Forms Services, C/S and Charmode components that lets a high-privileged attacker with network access over HTTP tamper with or destroy critical Forms data and repeatedly crash the service (complete denial of service). Oracle rated it 6.5 with integrity and availability impacts only, meaning confidentiality is untouched but data can be created, deleted or modified. No public exploit code or active exploitation has been identified at time of analysis, and no EPSS or CISA KEV signal was supplied with this record.
Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component), versions 22.3 through 26.7, permits low-privileged authenticated users with HTTP network access to reach functionality they should not control, enabling unauthorized read and modification of data and affecting systems beyond the vulnerable component (scope change). The flaw is rated CVSS 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting an easily automated but credential-gated attack with limited confidentiality and integrity impact. No public exploit code or CISA KEV entry is identified at time of analysis, and no CWE classification was assigned by the reporting source.
Oracle HR Intelligence, a component of Oracle E-Business Suite (versions 12.2.3 through 12.2.15), contains a difficult-to-exploit vulnerability in its Internal Operations component that lets a low-privileged, network-positioned attacker with an authenticated HTTP session tamper with or destroy critical HR data and repeatedly crash the service. Integrity and availability are both fully impacted while confidentiality is not, giving a CVSS 3.1 base score of 6.8 (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H). No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV, so the current exposure is driven by unpatched enterprise ERP deployments rather than active exploitation.
Oracle Siebel CRM Deployment (Cloud Gateway component) versions 17.0 through 26.7 contains a hard-to-exploit flaw that lets a low-privileged attacker with HTTP network access read and modify critical CRM data, with Oracle rating both confidentiality and integrity impact as High. The vendor advisory does not disclose the root cause, and no public exploit code, EPSS score, or CISA KEV entry was supplied with this record, so real-world exploitation is unconfirmed. The associated 'Authentication Bypass' tag is not corroborated by the Oracle text, which describes unauthorized data creation, deletion, and modification rather than an explicit credential-check bypass.
Sensitive data disclosure in Oracle Web Applications Desktop Integrator (Web ADI), a component of Oracle E-Business Suite 12.2.3 through 12.2.15, where the 'File download' component fails to properly restrict which files a low-privileged user can retrieve over HTTP. An attacker holding any valid low-privileged EBS account can read files they do not own, resulting in unauthorized access to critical data (CVSS 6.5, high confidentiality impact, no integrity or availability impact). Exploitation is network-based, low complexity and requires no user interaction, making it highly automatable once credentials exist; no public exploit code has been identified and there is no CISA KEV listing at time of analysis.
Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 expose the Event Management component to low-privileged, network-positioned attackers who can abuse SOAP requests to create, delete, or modify event and management data without authorization. The flaw is rated CVSS 3.1 6.5 (AV:N/AC:L/PR:L/UI:N, integrity-only impact) and is addressed in Oracle's September 2026 Critical Security Patch Update. No EPSS score, CISA KEV listing, or public exploit code was provided in the source data, so active exploitation is unconfirmed at time of analysis.
The Bitnami Sealed Secrets controller (versions up to and including 0.38.4) turns its unauthenticated POST /v1/verify and /v1/rotate endpoints into a decryption oracle, letting an attacker with internal cluster network access — or a simple kubectl port-forward to port 8080 — recover the full plaintext of any sealed secret one character at a time. The flaw chains two weaknesses: spec.template.data is excluded from the AEAD authenticated-data label binding, so an attacker can replay a victim's metadata and encryptedData verbatim and substitute arbitrary Go template logic, and template execution errors are reflected directly in HTTP status codes (200 = success, 409 = failure), producing a reliable equality oracle. No public exploit code and no CISA KEV entry were associated with this CVE at the time of analysis, though the vendor has published a GitHub security advisory.
Server-side request forgery in OpenPanel's data importer allows authenticated organization members to probe internal network hosts, services, and cloud metadata endpoints. The flaw exists because `parseRemoteFile` in `packages/importer/src/providers/umami.ts` calls plain `fetch()` on a caller-supplied `config.fileUrl` validated only by Zod's `z.string().url()` format check, entirely bypassing the project's own SSRF guard at `apps/api/src/utils/safe-fetch.ts`; the shared `createFileImportConfig` factory exposes the same unguarded field. An additional access-control bug means even a default 'member' with no project_access rows can exploit this path, because `getProjectAccess` returns boolean `true` instead of a level object, causing the intended access-level check to be skipped. No patched release was available at time of publication, and no public exploit has been identified at time of analysis.
Cyrus IMAP before 3.12.4 exposes a Sieve-based mailbox existence oracle that allows authenticated users to enumerate private mailboxes belonging to other users and read shared mailbox annotation values. By crafting conditional Sieve filter scripts using `fileinto` branches and observing delivery outcomes during LMTP processing, an attacker can infer the existence of otherwise inaccessible mailboxes or annotation content through a side-channel. No public exploit exists and the vulnerability is not listed in CISA KEV; the EPSS risk is commensurately low, reflecting a medium-severity information disclosure limited to authenticated insiders.
Unauthenticated remote attackers can exploit sqladmin's `ModelView` list view to probe hidden model column values via an ordering oracle, bypassing the UI-level `column_sortable_list` restriction. The `sortBy` HTTP query parameter is resolved through `getattr(model, ...)` and fed directly into ORM `ORDER BY` clauses without server-side validation, meaning any column - including those deliberately hidden from `column_list` - and related-model columns via dotted paths can be sorted. By observing row-order changes across ascending and descending requests, an attacker incrementally infers relative values of unexposed fields. No public exploit code and no CISA KEV listing exist at time of analysis; vendor-released patch is available in 0.27.1.
Path traversal in GitHacker ≤1.1.7 allows a malicious git server to coerce the tool into reading arbitrary files from the victim's local filesystem via an unsanitized `ref:` value in a crafted `.git/HEAD`. The exploitable primitive is narrower than full arbitrary file-read: the recovery loop converts every 40-character hex substring in any accessed file into an outbound HTTP GET back to the attacker's server, yielding an existence oracle for arbitrary paths and hex-fragment exfiltration for files containing cryptographic material such as password hashes, HMAC-SHA1 outputs, or SSH key fingerprints. Exploitation requires the victim to actively run GitHacker against an attacker-controlled URL; no public exploit code has been identified at time of analysis, and a vendor-released patch is available as version 1.1.8.
Blind Server-Side Request Forgery in the Divi WordPress theme (all versions through 4.27.6) allows authenticated Contributor-level users to coerce the web server into making arbitrary outbound HTTP requests, including to private and reserved IP ranges unreachable from the public internet. The root cause is the use of WordPress's unrestricted `wp_remote_get()` instead of the network-safe `wp_safe_remote_get()` in the `et_pb_set_video_oembed_thumbnail_resolution()` function. Although response bodies are withheld (blind SSRF), two side-channel oracles - a status oracle based on the returned URL string and a timing oracle based on response latency - allow limited internal network reconnaissance. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; a vendor patch is available as of Divi 4.27.7.
FilterForm in ash_phoenix (versions 0.6.0-rc.1 through 2.3.24) exposes private relationship data to authenticated users by resolving attacker-controlled filter path parameters through private Ash relationship traversal rather than the public-only gate. By supplying crafted path or field form values targeting non-public relationships, an authenticated attacker converts query result row counts into a boolean oracle over data the resource author explicitly marked private. The CVSS 4.0 score is 2.3 (Low); no active exploitation is identified and no public proof-of-concept exists at time of analysis.
Composite primary key decoding in AshAdmin (ash_admin) versions 0.1.0 through 1.3.0 can be abused by authenticated users to turn any record-lookup URL into an equality oracle over arbitrary resource attributes. By crafting a Base64+ETF-encoded payload substituting a sensitive field name (e.g., api_token, reset_token) for an actual primary key, an attacker can brute-force secret attribute values one equality guess at a time. No public exploit has been identified at time of analysis, and exploitation requires authentication and specific preconditions (CVSS 4.0: 2.3, AT:P).
Path traversal in Apache Wicket's package resource URL handling exposes files outside the intended package directory to unauthenticated remote attackers, including files under WEB-INF that servlet containers ordinarily protect from direct access. Affected are all releases from 8.0.0 through 8.18.0, 9.0.0 through 9.23.0, and 10.0.0 through 10.10.0. Under default configuration the readable file set is bounded by the SecurePackageResourceGuard's extension allowlist (excluding .xml, .properties, .class), but all configurations unconditionally expose a path-existence oracle usable for reconnaissance, and applications using looser guard configurations can disclose web.xml and other sensitive configuration files. No public exploit identified at time of analysis.
Non-constant-time authentication comparisons and plaintext logging of XRES* in free5GC's AUSF component (v1.4.4 and earlier) expose two distinct vulnerability classes under CWE-208. The 5G-AKA confirmation path writes the expected XRES* value to INFO-level application logs immediately before comparison, making authentication material directly readable by any principal with AUSF log access - operators, SIEM agents, log-collection sidecars, or compromised containers. Both 5G-AKA and EAP-AKA' confirmation paths use non-constant-time Go primitives (strings.EqualFold, bytes.Equal, ==) instead of crypto/subtle.ConstantTimeCompare, though the researcher's own PoC confirmed the timing signal is too small to distinguish from HTTP/SBI noise under standard network conditions. No public exploit or CISA KEV listing; patched in v1.4.5.
Denial-of-service and minor integrity impact in Oracle Java SE 7u511 allows unauthenticated remote attackers to crash or hang the JVM via the 2D graphics rendering component, exploitable across multiple network protocols with no authentication or user interaction required. The attack surface is broadened by the component's exposure through APIs consumed by web services, sandboxed Java Web Start applications, and sandboxed Java applets loading untrusted code. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis, though the low exploitation complexity means automated scanning is feasible.
Timing oracle in Kimai's TokenAuthenticator (all 2.x versions before 2.54.0) allows unauthenticated network attackers to enumerate valid usernames by measuring a consistent ~25ms response time differential - argon2id password hashing executes only when a matched user record exists, leaking username validity despite identical HTTP 403 response bodies. No authentication, API token, or session cookie is required to exploit this flaw against default Kimai deployments. A fully functional proof-of-concept Python script is publicly available in the GitHub Security Advisory (GHSA-jrc6-fmhw-fpq2), making this a low-barrier reconnaissance primitive for follow-on credential attacks; no confirmed active exploitation (CISA KEV) has been recorded at time of analysis.
Server-Side Request Forgery in Unleash's addon and integration subsystem (versions prior to 7.5.2, 7.6.5, and 8.0.2) allows authenticated operators with CREATE_ADDON or UPDATE_ADDON permissions to cause the Unleash server to issue HTTP requests to arbitrary internal network addresses, including loopback, link-local, and cloud metadata endpoints such as the AWS Instance Metadata Service. The vulnerability exists because operator-supplied URL parameters in Webhook, Slack, Microsoft Teams, Datadog, and New Relic integration configurations were passed directly to the internal fetch function without SSRF filtering, enabling blind network probing via event status responses and credential forwarding when Authorization or API key headers are configured. Vendor-released patches are available and no public exploit code has been identified at time of analysis.
Broken cryptography in Ceph's CephX authentication subsystem enables credential scope escalation and plaintext inference for any network-adjacent attacker holding a compromised Ceph account. CephX employed AES-CBC with a hardcoded initialization vector and no message authentication code, making encrypted authentication traffic both deterministic (identical plaintexts yield identical ciphertexts) and malleable (bit-flip attacks alter decrypted credential payloads undetected). Fixed in Ceph Tentacle 20.2.4 and Squid 19.2.6 by replacing the scheme with AES-256-CTS-HMAC-SHA384-192; no public exploit has been identified at time of analysis.
Arbitrary root file read in Linuxfabrik monitoring plugins allows a local attacker controlling the nagios or icinga account to exfiltrate any root-readable file by exploiting the hidden but permanently live --test argument accepted by all sudoers-whitelisted check plugins. Invoking the deb-updates plugin via sudo with --test=/etc/shadow,,0 causes lftest.py to read the supplied path as root with no path confinement and echo its full contents to stdout; approximately 22 additional whitelisted plugins yield filtered leaks or file-existence oracles through the same mechanism. No active exploitation has been confirmed by CISA KEV, but a fully functional proof-of-concept command is publicly disclosed in the vendor's own GitHub security advisory GHSA-rh9c-rqvg-f7pr, and patches are available in linuxfabrik-lib v6.1.0 and monitoring-plugins v7.0.0.
Partial denial of service in Oracle Helidon 4.5.3 is reachable by unauthenticated network attackers over HTTP, targeting the Imperative Web Server component within Oracle Fusion Middleware. Successful exploitation degrades availability without compromising confidentiality or integrity. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS score of 5.3 (Medium) reflects a bounded, availability-only impact.
Integrity compromise in Oracle Helidon 1.4.20's Imperative Web Server component enables unauthenticated remote attackers to perform limited unauthorized data modifications via HTTP under high-complexity conditions. The vulnerability, tagged as an authentication bypass, allows circumvention of access controls to execute unauthorized update, insert, or delete operations on Helidon-accessible data without requiring credentials or user interaction. No public exploit code has been identified and no active exploitation is confirmed; the CVSS 3.7 Low score combined with high attack complexity (AC:H) significantly constrain real-world risk.
Unauthorized data access in Oracle Helidon 3.2.18's Imperative Web Server component allows low-privileged network attackers to read a subset of accessible data and perform unauthorized insert, update, or delete operations via HTTP. Tagged as an authentication bypass by Oracle, the flaw presents a moderate but concrete integrity and confidentiality risk for organizations running this specific microservice framework version. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the low attack complexity and no user interaction requirement lower the barrier for exploitation by any authenticated user.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 7, allows remote attackers to affect integrity via unknown vectors. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable, no authentication required. Actively exploited in the wild (cisa kev) and public exploit code available.
Unspecified vulnerability in the Oracle WebCenter Content component in Oracle Fusion Middleware 10.1.3.5.1 and 11.1.1.6.0 allows remote authenticated users to affect availability via unknown vectors. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 68.9%.
The Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 6 and 7, allows remote attackers to execute arbitrary code via unspecified vectors involving. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 86.3%.
The color management (CMM) functionality in the 2D component in Oracle Java SE 7 Update 15 and earlier, 6 Update 41 and earlier, and 5.0 Update 40 and earlier allows remote attackers to execute. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 93.0%.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, and OpenJDK 7, allows user-assisted remote attackers to bypass the Java security. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using the public getMBeanInstantiator method in the JmxMBeanServer class to obtain a. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
MySQL 5.5.19 and possibly other versions, and MariaDB 5.5.28a and possibly other versions, when configured to assign the FILE privilege to users who should not have administrative privileges, allows. Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 88.8%.
Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0 allows remote attackers to affect confidentiality and integrity via. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 91.2%.
Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0 allows remote attackers to affect confidentiality and integrity via. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3.0 allows remote attackers to affect integrity via unknown vectors related to. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 14.5%.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers to affect confidentiality, integrity, and availability via. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 79.3%.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers to affect confidentiality, integrity, and availability,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, and 6 Update 35 and earlier, allows remote attackers to affect confidentiality,. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 65.9%.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName methods, enabling complete sandbox escape for untrusted applets. Massively exploited by exploit kits in 2012.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris 11 and earlier; illumos before r13724; Joyent. Rated high severity (CVSS 7.2), this vulnerability is low attack complexity. Public exploit code available and EPSS exploitation probability 88.0%.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0 Update 33 and earlier allows remote attackers to. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Unspecified vulnerability in the Oracle WebCenter Forms Recognition component in Oracle Fusion Middleware 10.1.3.5 allows remote attackers to affect confidentiality, integrity, and availability via. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 39.6%.
Unspecified vulnerability in the Oracle AutoVue Office component in Oracle Supply Chain Products Suite 20.1.1 allows remote attackers to affect confidentiality, integrity, and availability, related. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 85.1%.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and JavaFX 2.0.2 and earlier allows remote untrusted Java. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 74.9%.
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise through malicious Java Web Start applications and untrusted applets exploiting the Scripting component. CISA KEV confirms active exploitation in the wild. EPSS score of 92.59% (100th percentile) indicates extremely high probability of mass exploitation. Public exploit code exists, making this a critical priority for any environment running affected Java versions despite the vulnerability's age.
SQL injection in the ORDER BY direction handling of MikroORM (a TypeScript ORM for Node.js) lets authenticated remote attackers append arbitrary SQL fragments to generated queries, enabling blind or boolean-based extraction of data readable by the configured database account. Affected are SQL drivers in versions prior to 6.6.16 and 7.0.0 through 7.1.6 (SQLite, PostgreSQL, MySQL, MariaDB, MSSQL, libSQL, Oracle); MongoDB is not affected. Exploitation is conditional - the application must bind attacker-controlled request data directly to the orderBy direction in em.find(), em.findOne(), em.findAndCount(), QueryBuilder.orderBy(), or QueryBuilderHelper.getQueryOrderFromObject(); the field key is already validated against entity metadata, and there is no public exploit identified at time of analysis. Vendor-released fixes exist in 6.6.16 and 7.1.7.
An authorization bypass in the Ash framework (Elixir) lets authenticated, lower-privileged actors recover values they are not permitted to see by using filtered calculations or aggregates as a yes/no oracle. Ash field policies are designed to protect against filter-based disclosure by rewriting references to forbidden attributes into an expression that evaluates to nil, but prior to 3.33.4 that rewriting only matched Ash.Resource.* structs and not Ash.Query.Calculation or Ash.Query.Aggregate structs, so filters on those ran against real values. Any application that uses Ash.Policy.Authorizer with field policies on calculations or aggregates and exposes filter arguments (commonly via AshGraphql or AshJsonApi) is affected; no public exploit identified at time of analysis, and the disclosure is gradual - one probe at a time - with no integrity or availability impact.
A locally reachable denial-of-service flaw in Oracle VM VirtualBox 7.2.16 (Core component) lets an attacker who already holds a high-privileged logon on the host crash or repeatedly hang the hypervisor, taking down all hosted virtual machines. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H, base 6.0) confirms the impact is availability-only and confined to already-privileged local users, but the scope-change flag indicates the resulting outage can extend to other workloads running on the same infrastructure. No EPSS score, KEV listing, or public exploit evidence was present in the supplied intelligence, so exploitation status is unknown and the flaw should be treated as a privilege-gated local availability risk rather than a remotely exploitable emergency.
Oracle VM VirtualBox 7.2.16 contains a flaw in the Core component that lets a high-privileged attacker who already has a logon on the host trigger a partial denial of service against the VirtualBox process itself. The attack is local (AV:L) and requires elevated privileges (PR:H), but carries a scope change (S:C), meaning the successful exploit can significantly affect additional products layered on the same infrastructure. CVSS 3.1 scores this 3.2 with availability-only impact; there is no public exploit identified at time of analysis and no CISA KEV listing, so real-world urgency is low for most deployments.
Denial of service in Oracle VM VirtualBox 7.2.16 (Core component) lets a locally logged-on attacker with high privileges hang or repeatedly crash the hypervisor, with the CVSS scope-change metric indicating the disruption can extend beyond VirtualBox to other products on the same host. Exploitation requires logon access to the infrastructure running VirtualBox and high privileges (PR:H, AV:L), so it is an insider/administrator-privileged availability attack rather than a remote one. No public exploit code has been identified and the flaw is not listed in CISA KEV; EPSS data was not supplied with this record.
Denial of service in Oracle VM VirtualBox 7.2.16 allows an attacker who already holds high privileges and can log on to the machine running the hypervisor to crash the product through its Core component, producing a hang or repeatable crash. The flaw is rated CVSS 3.1 6.0 (AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H), so it is purely an availability issue with no confidentiality or integrity impact, but the scope change flag means a successful attack can degrade other workloads running alongside VirtualBox — typically guest VMs and co-resident services. It is not remotely exploitable, no public exploit code or CISA KEV entry was identified at time of analysis, and the affected build is confirmed as 7.2.16 by both the vendor advisory and ENISA EUVD.
Oracle VM VirtualBox 7.2.16 (Core component) contains a low-severity information disclosure flaw that requires an attacker to already hold a high-privileged logon on the host where VirtualBox runs. A successful attack yields read access to a limited subset of VirtualBox-accessible data (C:L) and, per Oracle's scope-change rating, may affect components beyond the hypervisor boundary. No public exploit code and no CISA KEV listing were identified at time of analysis, and the CVSS 3.1 base score is only 3.2, so real-world prioritization should be low relative to other virtualization issues.
Oracle VM VirtualBox 7.2.16 can be hung or repeatedly crashed by a high-privileged attacker who already has an interactive logon on the host where the hypervisor runs, provided another person on the system performs an interaction such as opening or starting a crafted VM. The flaw sits in VirtualBox Core and yields availability-only impact: any hosted guest and the VirtualBox process itself can be taken down. It is scored 4.2 and the local-plus-privileged access requirement makes mass exploitation unlikely; no public exploit code or CISA KEV listing was present in the supplied intelligence at time of analysis.
A locally exploitable flaw in the Core component of Oracle VM VirtualBox 7.2.16 lets a low-privileged user who can log on to the host repeatedly crash the hypervisor process and tamper with some VirtualBox-accessible data. The issue requires only local logon with low privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N), no user interaction, and no network exposure, yielding a 6.1 base score driven by Availability (High) and Integrity (Low) impacts with no Confidentiality impact. There is no public exploit code identified and the CVE is not listed in CISA KEV, so current risk is concentrated in multi-user or shared-workstation deployments where untrusted users share a virtualization host.
Oracle VM VirtualBox 7.2.16 contains a Core-component flaw that lets an attacker who already has a logon on the host crash the hypervisor (complete denial of service) and make limited unauthorized modifications to VirtualBox-accessible data, provided they can induce a victim to perform a user action. The issue is local rather than network-reachable, requires no special privileges beyond an interactive session on the machine where VirtualBox runs, and is rated 6.1 on the CVSS 3.1 scale (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H). No public exploit code has been identified and the CVE is not listed in CISA KEV at time of analysis, but the integrity-plus-availability impact and the trivially low attack complexity make prompt patching worthwhile.
A locally exploitable flaw in the Core component of Oracle VM VirtualBox 7.2.16 lets an attacker who already holds a high-privileged logon on the host read a limited subset of VirtualBox-accessible data and trigger a partial denial of service against the hypervisor. The scope-change rating (S:C) indicates the impact can extend beyond VirtualBox itself to other products on or around the host, but exploitation requires local logon with elevated privileges and there is no indication of remote reach. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV, so real-world priority is driven by host-access hygiene rather than internet-facing exposure.
Denial of service in Oracle VM VirtualBox 7.2.16, where a local attacker who already holds a low-privileged logon session on the host can trigger a fault in the Core component that hangs or repeatedly crashes the VirtualBox process. Exploitation is difficult (AC:H) and requires active interaction from a different user on the same machine, and the impact is limited to availability — no confidentiality or integrity loss — giving a CVSS 3.1 base score of 4.4. No public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis, so treat it as a local reliability/DoS nuisance rather than a remote compromise risk.
A crafted remote-desktop (RDP) interaction with Oracle VM VirtualBox 7.2.16 can hang or repeatedly crash the hypervisor's Core component, producing a complete denial of service against the affected VM sessions. Exploitation is rated difficult (AC:H) and requires a low-privileged account with network reachability to the virtual machine's remote display service, so it is not a drive-by or unauthenticated attack. Only availability is impacted — there is no confidentiality or integrity loss. No EPSS score, CISA KEV listing, or public exploit code was present in the supplied intelligence, so the vulnerability should be treated as a medium-priority patching item rather than an active emergency.
Unauthenticated attackers who can reach the Oracle Agile PLM Web Client over HTTP can read and tamper with a limited subset of PLM data, but only if they first persuade another user to interact with a crafted request. Oracle rates this 6.1 (medium) with a scope change, meaning a successful attack may also affect additional products reachable through the same component. No public exploit code, POC, or CISA KEV entry was identified in the supplied intelligence for this CVE.
Adjacent-network attackers can bypass authentication in Oracle Agile PLM 9.3.6 (Application Server component), gaining the ability to read, create, delete, or modify any data the PLM application can reach. The flaw is unauthenticated per its CVSS vector (PR:N) but only reachable from the physical communication segment attached to the host running Agile PLM, and Oracle rates it as difficult to exploit (AC:H) with a 6.8 base score affecting confidentiality and integrity only. No public exploit code or CISA KEV listing was present in the available intelligence, so active exploitation is unconfirmed.
Local attackers who already hold high privileges and a valid logon to the host running Oracle Hyperion Financial Management 11.2.26.0.000 can exploit a flaw in the product's Security component to seize full control of the application, with complete loss of confidentiality, integrity and availability. The issue is rated CVSS 6.7 (AV:L/AC:L/PR:H/UI:N) and no public exploit code, EPSS score or CISA KEV entry was present in the supplied intelligence. Because it requires pre-existing privileged local access, this is primarily a post-compromise escalation and insider-abuse concern rather than an internet-facing remote attack.
Oracle Contract Lifecycle Management for Public Sector — specifically the Wage Determination Online component of Oracle E-Business Suite 12.2.3 through 12.2.15 — can be abused by an unauthenticated, network-based attacker who persuades another user to interact with a crafted HTTP request, yielding unauthorized read plus update/insert/delete access to module data. The CVSS 3.1 base score is 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), and the scope-change metric indicates the compromise may significantly impact additional products beyond the vulnerable module. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so this reads as a patch-cycle priority rather than an emergency.
Oracle iRecruitment, the recruitment module of Oracle E-Business Suite, exposes an access-control weakness in its Internal Operations component across versions 12.2.3 through 12.2.15 that lets an attacker on the same physical network segment read, create, modify, or delete recruitment data without authenticating. The flaw is rated difficult to exploit (CVSS 6.8, AV:A/AC:H/PR:N/UI:N) because it demands layer-2 adjacency to the application host and a race-prone or otherwise unreliable attack path, but it delivers high confidentiality and integrity impact with no availability loss. No public exploit code or CISA KEV entry was present in the supplied intelligence, so exploitation is not confirmed in the wild.
Oracle Helidon 4.0.0 through 4.5.4 contains an authorization weakness in the helidon-microprofile-security component that allows a low-privileged user with ordinary HTTP network access to read a subset of Helidon-accessible data and to insert, update or delete records they should not reach, with no user interaction required. The defect is trivially reachable (CVSS 3.1 base 5.4, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), meaning any valid low-privilege account is enough to over-reach, though availability is unaffected. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied, so the practical urgency rests on whether the affected microprofile-security module is exposed and whether low-privilege accounts are widely issued.
Unauthenticated attackers with network access to HTTP endpoints can cause a partial denial of service in Oracle Helidon versions 4.0.0 through 4.5.4 by abusing the WebSocket component. The flaw carries a CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N, availability-only partial impact) and requires no credentials or user interaction, making it trivially automatable against any reachable WebSocket-enabled service. No public exploit code, EPSS score, or CISA KEV listing was provided in the available intelligence, so active exploitation is not confirmed.
Unauthenticated network access to the Long Running Actions (LRA) component of Oracle Helidon 4.0.0 through 4.5.4 allows a remote attacker to read a subset of data and to insert, update, or delete records handled by the LRA coordinator without supplying credentials. The flaw is rated CVSS 6.5 with a network attack vector, low complexity, and no required privileges or user interaction, but it produces only partial confidentiality and integrity impact with no availability loss. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; EPSS data was not supplied in the input.
Unauthenticated HTTP requests can drive Oracle Helidon 3.0.0 through 3.2.20 into a partial denial-of-service condition through the helidon-media-multipart component, which handles multipart/form-data parsing. The flaw is network-reachable with no privileges or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, base 5.3) and impacts availability only — confidentiality and integrity are unaffected. Oracle rates it easily exploitable in its CPU advisory, but no KEV listing or public exploit code was present in the supplied intelligence feeds, so no public exploit identified at time of analysis.
Unauthenticated attackers with network access to an HTTP endpoint on Oracle Helidon 4.0.0 through 4.5.4 can trigger a partial denial of service in the framework's JSON component, degrading availability of the hosted application. The flaw is rated CVSS 3.1 base 5.3 (AV:N/AC:L/PR:N/UI:N, availability-only impact) and is described by Oracle as easily exploitable, though no public proof-of-concept, EPSS score, or CISA KEV entry was supplied in the input data, so active exploitation is unconfirmed.
Oracle Assets, a module within Oracle E-Business Suite, exposes sensitive asset and financial data to any authenticated user with low privileges who can reach the module over HTTP. Versions 12.2.3 through 12.2.15 are affected; a successful attack yields high confidentiality impact (CVSS 3.1 base 6.5, AV:N/AC:L/PR:L/UI:N) with no integrity or availability effect. Oracle rates the flaw 'easily exploitable', but no EPSS score, KEV listing, or public exploit code was present in the supplied intelligence, so exploitation status is best described as no public exploit identified at time of analysis.
Oracle Product Hub, the product master-data component of Oracle E-Business Suite (versions 12.2.3 through 12.2.15), is exposed to a difficult-to-exploit flaw in its Internal Operations component that lets a low-privileged, network-positioned attacker read and tamper with critical product data via HTTP. The CVSS 3.1 base score is 6.8 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N), reflecting high confidentiality and integrity impact but no availability impact, with the high attack-complexity metric indicating exploitation depends on conditions outside the attacker's direct control. There is no public exploit identified at time of analysis and the flaw has not been listed in CISA KEV; Oracle's own advisory at cspusep2026.html is the authoritative remediation source.
High-privileged users of Oracle E-Business Suite Depot Repair 12.2.3 through 12.2.15 can exploit a flaw in the Depot Repair Diagnostics component over HTTP to read, create, modify, or delete any Depot Repair data they can reach. Oracle rates this CVSS 3.1 6.5 (AV:N/AC:L/PR:H/UI:N, C:H/I:H/A:N), meaning exploitation is network-reachable and low-complexity but requires an already-privileged EBS account; there is no integrity-verified public exploit code and no CISA KEV listing at time of analysis. The practical exposure is privilege escalation or lateral data compromise inside an EBS instance rather than a pre-authentication breach.
Authenticated attackers holding only low-privileged credentials in Oracle E-Business Suite can exploit a WebUI flaw in Oracle Product Workbench 12.2.3 through 12.2.15 to read and tamper with application data, provided they can convince another user to interact with a crafted request. The CVSS 3.1 base score is 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), with a scope change meaning downstream components of the E-Business Suite may also be affected. No public exploit code or active exploitation has been identified in the supplied intelligence, and no EPSS score was provided.
Oracle Communications Cloud Native Core Security Edge Protection Proxy (SEPP) versions 26.1.200 and 25.2.201 permit a low-privileged, network-positioned attacker to reach the SEPP over HTTP and read a subset of its accessible data while also updating, inserting, or deleting some of that data. The flaw is rated 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), meaning exploitation needs an existing low-privilege account but no user interaction and no special attack complexity. There is no CISA KEV listing and no public exploit code identified at time of analysis; the issue is addressed through Oracle's Critical Patch Update advisory cspusep2026.
A partial denial-of-service flaw in the Core component of Oracle Coherence lets a low-privileged, network-positioned attacker degrade availability of the distributed data grid by sending crafted HTTP requests. Versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 of the Oracle Fusion Middleware product are listed as affected by Oracle and mirrored by EUVD (EUVD-2026-79717). The CVSS 3.1 base score is only 4.3 because impact is limited to availability (A:L) with no confidentiality or integrity effect, and no public exploit code or CISA KEV entry was present in the supplied intelligence.
Oracle Coherence 15.1.1.0.0 exposes a narrow local information-disclosure weakness in its Core component that lets an attacker who already holds a low-privileged operating-system logon on the Coherence host read a limited subset of data the process can access. The flaw is rated CVSS 3.1 base 2.5 (AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N), meaning high attack complexity, no integrity or availability impact, and no remote vector. There is no public exploit code and no CISA KEV listing, so this is a low-priority, defense-in-depth item rather than an emergency; Oracle published it through its Critical Patch Update advisory for Fusion Middleware.
Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 contain a flaw in the Core component that lets an attacker who already holds a high-privileged account and can log on to the host where Coherence runs make unauthorized updates, inserts or deletions against Coherence-accessible data. The CVSS 3.1 base score is only 1.9 (AV:L/AC:H/PR:H/UI:N, integrity-only), reflecting that exploitation demands local logon, elevated privileges and a difficult-to-achieve condition; confidentiality and availability are not impacted. No public exploit code or CISA KEV entry was present in the supplied intelligence, so this is assessed as a low-priority, defense-in-depth issue rather than an urgent patch item. The vendor-reported nature of the record and the presence of an 'Authentication Bypass' tag that conflicts with the PR:H, integrity-only vector are notable data-quality caveats.
Partial denial of service in Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 (Access SDK component) can be triggered by a low-privileged, authenticated attacker who reaches the product over HTTP. The flaw is rated CVSS 3.1 base 3.1 with an availability-only, partial impact, and Oracle characterizes it as difficult to exploit (AC:H), so successful disruption requires favorable timing or state rather than a simple repeatable request. No public exploit code, EPSS score, or CISA KEV entry was present in the supplied intelligence, so there is no indication of active exploitation at time of analysis.
Information disclosure in Oracle Coherence 15.1.1.0.0 lets a low-privileged attacker with HTTP network access read critical data or the entire contents of Coherence-accessible caches, and because the CVSS vector reports a scope change, products built on top of that grid can be exposed as well. Oracle scores it 6.3 with high attack complexity, so it is not a trivial drive-by exploit; the feed contains no public exploit code and no CISA KEV entry, and the only remediation reference is Oracle's Critical Security Patch Update advisory. Authentication is required per the PR:L metric, meaning the attacker needs an existing low-privilege foothold rather than being an anonymous internet client.
A denial-of-service flaw in the Oracle Net Services component of Oracle Database Server (versions 23.4.0 through 23.26.3) lets an unauthenticated attacker with network access over TCPS hang or repeatedly crash the Net Services layer, degrading or halting database connectivity. Exploitation is network-reachable and low-complexity but requires interaction from a person other than the attacker, and it yields availability impact only (CVSS 3.1 base 6.5, C:N/I:N/A:H). No public exploit code or CISA KEV listing was identified at time of analysis, and no EPSS score was supplied with the source data.
Oracle Fusion Middleware Control 12.2.1.4.0 and 14.1.2.0.0 contain a flaw in the Framework component that lets a low-privileged attacker with HTTP network access trick a privileged user into an interaction that results in unauthorized read and modification of data, with cross-scope impact on other Oracle products. Oracle rates it CVSS 3.1 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), meaning exploitation is easy but gated by an existing low-privileged account and victim user interaction. There is no public exploit code or CISA KEV entry in the provided data, and EPSS is not supplied; treat this as a patch-cycle item rather than an emergency.
Improper access control in the CAX Client component of the Oracle Agile PLM MCAD Connector 3.6 allows a locally logged-on, low-privileged user to read critical Agile PLM data, or all data the connector can reach. The flaw is confidentiality-only (CVSS 3.1 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so it is a post-logon insider/desktop compromise risk rather than a remote pre-auth issue. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; EPSS data was not supplied in the available intelligence.
Unauthenticated attackers positioned on the adjacent network segment of a host running Oracle Helidon can read and modify critical application data through a flaw in the helidon-integrations-neo4j component. Affected releases are Helidon 3.0.0 through 3.2.20 and 4.0.0 through 4.5.4; Oracle rates this CVSS 3.1 6.8 with an AV:A/AC:H profile, meaning the attacker needs layer-2 proximity and must satisfy non-trivial conditions, but needs no credentials and no user interaction. No public exploit code and no CISA KEV entry were identified at the time of analysis, and no EPSS score was supplied with the intelligence.
A locally exploitable information-disclosure flaw in the CAX Client component of Oracle Agile PLM MCAD Connector 3.6 lets any attacker who already holds a low-privileged logon on the host read data they should not be able to reach, including critical PLM content the connector can access. Confidentiality is the only impacted metric (CVSS 3.1 base 5.5, AV:L/PR:L/UI:N/C:H/I:N/A:N), so integrity and availability of the connector are untouched. There is no CISA KEV listing and no public exploit code identified at time of analysis, and Oracle has published a fix through its Supply Chain Critical Security Patch Update.
Unauthenticated network attackers with access to the TLS interface of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 can trigger a hang or repeatedly crash the Forge component while also reading a limited subset of application-accessible data. Oracle's advisory rates it 6.5 (AV:N/AC:H/PR:N/UI:N/C:L/A:H), so impact is dominated by availability loss rather than data compromise, and the high attack complexity suggests exploitation requires carefully crafted conditions rather than a trivial request. No public exploit code or CISA KEV entry is present in the available intelligence, and the vulnerability is not confirmed as actively exploited at time of analysis.
Unauthenticated attackers with network access to the HTTP interface of the Forge component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 can exploit a difficult-to-trigger flaw to read the full set of data the platform can reach and to partially degrade its availability. The vendor rates this 6.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L), so the damage ceiling is high confidentiality loss rather than code execution. No public exploit code and no CISA KEV entry appear in the supplied intelligence, and no EPSS score was provided, so active exploitation is unconfirmed — the practical driver for patching is the exposure of complete catalogue and index data, not observed attacks.
Unauthorized read access to critical data in Oracle Process Manufacturing Intelligence (part of Oracle E-Business Suite) is achievable by a low-privileged attacker over the network via Oracle Net, because the Internal Operations component fails to properly enforce authorization for 12.2.3 through 12.2.15. The flaw is rated CVSS 3.1 6.5 (AV:N/AC:L/PR:L/UI:N, confidentiality-only) and is trivially reachable by anyone holding a valid low-privileged account and network path to the Oracle Net listener. There is no CISA KEV listing and no public exploit identified at time of analysis, but Oracle shipped an official fix in its Critical Security Patch Update, so unpatched internet- or intranet-exposed EBS instances remain the exposure.
Oracle Field Service, a component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, can be compromised over HTTP by a low-privileged attacker who induces another person to interact with a crafted request. Successful exploitation gives the attacker unauthorized read access plus insert, update, or delete capability over a subset of Field Service data, and because the CVSS scope metric is Changed, the impact may extend into additional connected products. There is no public exploit code identified and no CISA KEV listing at time of analysis, so this rates as a moderate-priority patch item rather than an emergency, with a CVSS 3.1 base score of 5.4 reflecting limited confidentiality and integrity loss and no availability impact.
A low-privileged, authenticated attacker with HTTP network access can read all data accessible through the Oracle Application Object Library (Core) component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, resulting in a full confidentiality compromise of that component with no integrity or availability impact. Oracle rates it CVSS 3.1 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) and describes it as easily exploitable, meaning an existing low-privilege EBS account is enough to reach sensitive data beyond the account's intended scope. No public exploit code or active exploitation is indicated in the available intelligence, and the patch is delivered through Oracle's Critical Security Patch Update for E-Business Suite.
Improper authorization enforcement in the Internal Operations component of Oracle Field Service, part of Oracle E-Business Suite 12.2.3 through 12.2.15, lets a low-privileged user read data that the application should have kept out of reach. The attack is delivered over HTTP with no user interaction and no special complexity, but it does require a valid account on the affected system, so it is an authorization/confidentiality failure rather than a pre-authentication bypass. Impact is limited to confidentiality (CVSS 3.1 base 6.5, C:H/I:N/A:N); no public exploit code or CISA KEV entry was present in the supplied intelligence at time of analysis.
Unauthenticated attackers with HTTP access to Oracle Forms Services can read a limited subset of data the application exposes, per Oracle's Fusion Middleware security advisory affecting versions 12.2.1.19.0 and 14.1.2.0.0. The flaw is rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/C:L/I:N/A:N), meaning low-complexity, no-credential, no-user-interaction exploitation whose only impact is partial confidentiality loss - there is no integrity or availability impact and no scope change. No public exploit code, EPSS score, or CISA KEV listing is present in the supplied intelligence, so this should be treated as a patch-now confidentiality leak rather than an actively exploited emergency.
Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 contain an easily exploitable flaw in the Forms Services, C/S and Charmode components that lets a high-privileged attacker with network access over HTTP tamper with or destroy critical Forms data and repeatedly crash the service (complete denial of service). Oracle rated it 6.5 with integrity and availability impacts only, meaning confidentiality is untouched but data can be created, deleted or modified. No public exploit code or active exploitation has been identified at time of analysis, and no EPSS or CISA KEV signal was supplied with this record.
Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component), versions 22.3 through 26.7, permits low-privileged authenticated users with HTTP network access to reach functionality they should not control, enabling unauthorized read and modification of data and affecting systems beyond the vulnerable component (scope change). The flaw is rated CVSS 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting an easily automated but credential-gated attack with limited confidentiality and integrity impact. No public exploit code or CISA KEV entry is identified at time of analysis, and no CWE classification was assigned by the reporting source.
Oracle HR Intelligence, a component of Oracle E-Business Suite (versions 12.2.3 through 12.2.15), contains a difficult-to-exploit vulnerability in its Internal Operations component that lets a low-privileged, network-positioned attacker with an authenticated HTTP session tamper with or destroy critical HR data and repeatedly crash the service. Integrity and availability are both fully impacted while confidentiality is not, giving a CVSS 3.1 base score of 6.8 (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H). No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV, so the current exposure is driven by unpatched enterprise ERP deployments rather than active exploitation.
Oracle Siebel CRM Deployment (Cloud Gateway component) versions 17.0 through 26.7 contains a hard-to-exploit flaw that lets a low-privileged attacker with HTTP network access read and modify critical CRM data, with Oracle rating both confidentiality and integrity impact as High. The vendor advisory does not disclose the root cause, and no public exploit code, EPSS score, or CISA KEV entry was supplied with this record, so real-world exploitation is unconfirmed. The associated 'Authentication Bypass' tag is not corroborated by the Oracle text, which describes unauthorized data creation, deletion, and modification rather than an explicit credential-check bypass.
Sensitive data disclosure in Oracle Web Applications Desktop Integrator (Web ADI), a component of Oracle E-Business Suite 12.2.3 through 12.2.15, where the 'File download' component fails to properly restrict which files a low-privileged user can retrieve over HTTP. An attacker holding any valid low-privileged EBS account can read files they do not own, resulting in unauthorized access to critical data (CVSS 6.5, high confidentiality impact, no integrity or availability impact). Exploitation is network-based, low complexity and requires no user interaction, making it highly automatable once credentials exist; no public exploit code has been identified and there is no CISA KEV listing at time of analysis.
Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 expose the Event Management component to low-privileged, network-positioned attackers who can abuse SOAP requests to create, delete, or modify event and management data without authorization. The flaw is rated CVSS 3.1 6.5 (AV:N/AC:L/PR:L/UI:N, integrity-only impact) and is addressed in Oracle's September 2026 Critical Security Patch Update. No EPSS score, CISA KEV listing, or public exploit code was provided in the source data, so active exploitation is unconfirmed at time of analysis.
The Bitnami Sealed Secrets controller (versions up to and including 0.38.4) turns its unauthenticated POST /v1/verify and /v1/rotate endpoints into a decryption oracle, letting an attacker with internal cluster network access — or a simple kubectl port-forward to port 8080 — recover the full plaintext of any sealed secret one character at a time. The flaw chains two weaknesses: spec.template.data is excluded from the AEAD authenticated-data label binding, so an attacker can replay a victim's metadata and encryptedData verbatim and substitute arbitrary Go template logic, and template execution errors are reflected directly in HTTP status codes (200 = success, 409 = failure), producing a reliable equality oracle. No public exploit code and no CISA KEV entry were associated with this CVE at the time of analysis, though the vendor has published a GitHub security advisory.
Server-side request forgery in OpenPanel's data importer allows authenticated organization members to probe internal network hosts, services, and cloud metadata endpoints. The flaw exists because `parseRemoteFile` in `packages/importer/src/providers/umami.ts` calls plain `fetch()` on a caller-supplied `config.fileUrl` validated only by Zod's `z.string().url()` format check, entirely bypassing the project's own SSRF guard at `apps/api/src/utils/safe-fetch.ts`; the shared `createFileImportConfig` factory exposes the same unguarded field. An additional access-control bug means even a default 'member' with no project_access rows can exploit this path, because `getProjectAccess` returns boolean `true` instead of a level object, causing the intended access-level check to be skipped. No patched release was available at time of publication, and no public exploit has been identified at time of analysis.
Cyrus IMAP before 3.12.4 exposes a Sieve-based mailbox existence oracle that allows authenticated users to enumerate private mailboxes belonging to other users and read shared mailbox annotation values. By crafting conditional Sieve filter scripts using `fileinto` branches and observing delivery outcomes during LMTP processing, an attacker can infer the existence of otherwise inaccessible mailboxes or annotation content through a side-channel. No public exploit exists and the vulnerability is not listed in CISA KEV; the EPSS risk is commensurately low, reflecting a medium-severity information disclosure limited to authenticated insiders.
Unauthenticated remote attackers can exploit sqladmin's `ModelView` list view to probe hidden model column values via an ordering oracle, bypassing the UI-level `column_sortable_list` restriction. The `sortBy` HTTP query parameter is resolved through `getattr(model, ...)` and fed directly into ORM `ORDER BY` clauses without server-side validation, meaning any column - including those deliberately hidden from `column_list` - and related-model columns via dotted paths can be sorted. By observing row-order changes across ascending and descending requests, an attacker incrementally infers relative values of unexposed fields. No public exploit code and no CISA KEV listing exist at time of analysis; vendor-released patch is available in 0.27.1.
Path traversal in GitHacker ≤1.1.7 allows a malicious git server to coerce the tool into reading arbitrary files from the victim's local filesystem via an unsanitized `ref:` value in a crafted `.git/HEAD`. The exploitable primitive is narrower than full arbitrary file-read: the recovery loop converts every 40-character hex substring in any accessed file into an outbound HTTP GET back to the attacker's server, yielding an existence oracle for arbitrary paths and hex-fragment exfiltration for files containing cryptographic material such as password hashes, HMAC-SHA1 outputs, or SSH key fingerprints. Exploitation requires the victim to actively run GitHacker against an attacker-controlled URL; no public exploit code has been identified at time of analysis, and a vendor-released patch is available as version 1.1.8.
Blind Server-Side Request Forgery in the Divi WordPress theme (all versions through 4.27.6) allows authenticated Contributor-level users to coerce the web server into making arbitrary outbound HTTP requests, including to private and reserved IP ranges unreachable from the public internet. The root cause is the use of WordPress's unrestricted `wp_remote_get()` instead of the network-safe `wp_safe_remote_get()` in the `et_pb_set_video_oembed_thumbnail_resolution()` function. Although response bodies are withheld (blind SSRF), two side-channel oracles - a status oracle based on the returned URL string and a timing oracle based on response latency - allow limited internal network reconnaissance. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; a vendor patch is available as of Divi 4.27.7.
FilterForm in ash_phoenix (versions 0.6.0-rc.1 through 2.3.24) exposes private relationship data to authenticated users by resolving attacker-controlled filter path parameters through private Ash relationship traversal rather than the public-only gate. By supplying crafted path or field form values targeting non-public relationships, an authenticated attacker converts query result row counts into a boolean oracle over data the resource author explicitly marked private. The CVSS 4.0 score is 2.3 (Low); no active exploitation is identified and no public proof-of-concept exists at time of analysis.
Composite primary key decoding in AshAdmin (ash_admin) versions 0.1.0 through 1.3.0 can be abused by authenticated users to turn any record-lookup URL into an equality oracle over arbitrary resource attributes. By crafting a Base64+ETF-encoded payload substituting a sensitive field name (e.g., api_token, reset_token) for an actual primary key, an attacker can brute-force secret attribute values one equality guess at a time. No public exploit has been identified at time of analysis, and exploitation requires authentication and specific preconditions (CVSS 4.0: 2.3, AT:P).
Path traversal in Apache Wicket's package resource URL handling exposes files outside the intended package directory to unauthenticated remote attackers, including files under WEB-INF that servlet containers ordinarily protect from direct access. Affected are all releases from 8.0.0 through 8.18.0, 9.0.0 through 9.23.0, and 10.0.0 through 10.10.0. Under default configuration the readable file set is bounded by the SecurePackageResourceGuard's extension allowlist (excluding .xml, .properties, .class), but all configurations unconditionally expose a path-existence oracle usable for reconnaissance, and applications using looser guard configurations can disclose web.xml and other sensitive configuration files. No public exploit identified at time of analysis.
Non-constant-time authentication comparisons and plaintext logging of XRES* in free5GC's AUSF component (v1.4.4 and earlier) expose two distinct vulnerability classes under CWE-208. The 5G-AKA confirmation path writes the expected XRES* value to INFO-level application logs immediately before comparison, making authentication material directly readable by any principal with AUSF log access - operators, SIEM agents, log-collection sidecars, or compromised containers. Both 5G-AKA and EAP-AKA' confirmation paths use non-constant-time Go primitives (strings.EqualFold, bytes.Equal, ==) instead of crypto/subtle.ConstantTimeCompare, though the researcher's own PoC confirmed the timing signal is too small to distinguish from HTTP/SBI noise under standard network conditions. No public exploit or CISA KEV listing; patched in v1.4.5.
Denial-of-service and minor integrity impact in Oracle Java SE 7u511 allows unauthenticated remote attackers to crash or hang the JVM via the 2D graphics rendering component, exploitable across multiple network protocols with no authentication or user interaction required. The attack surface is broadened by the component's exposure through APIs consumed by web services, sandboxed Java Web Start applications, and sandboxed Java applets loading untrusted code. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis, though the low exploitation complexity means automated scanning is feasible.
Timing oracle in Kimai's TokenAuthenticator (all 2.x versions before 2.54.0) allows unauthenticated network attackers to enumerate valid usernames by measuring a consistent ~25ms response time differential - argon2id password hashing executes only when a matched user record exists, leaking username validity despite identical HTTP 403 response bodies. No authentication, API token, or session cookie is required to exploit this flaw against default Kimai deployments. A fully functional proof-of-concept Python script is publicly available in the GitHub Security Advisory (GHSA-jrc6-fmhw-fpq2), making this a low-barrier reconnaissance primitive for follow-on credential attacks; no confirmed active exploitation (CISA KEV) has been recorded at time of analysis.
Server-Side Request Forgery in Unleash's addon and integration subsystem (versions prior to 7.5.2, 7.6.5, and 8.0.2) allows authenticated operators with CREATE_ADDON or UPDATE_ADDON permissions to cause the Unleash server to issue HTTP requests to arbitrary internal network addresses, including loopback, link-local, and cloud metadata endpoints such as the AWS Instance Metadata Service. The vulnerability exists because operator-supplied URL parameters in Webhook, Slack, Microsoft Teams, Datadog, and New Relic integration configurations were passed directly to the internal fetch function without SSRF filtering, enabling blind network probing via event status responses and credential forwarding when Authorization or API key headers are configured. Vendor-released patches are available and no public exploit code has been identified at time of analysis.
Broken cryptography in Ceph's CephX authentication subsystem enables credential scope escalation and plaintext inference for any network-adjacent attacker holding a compromised Ceph account. CephX employed AES-CBC with a hardcoded initialization vector and no message authentication code, making encrypted authentication traffic both deterministic (identical plaintexts yield identical ciphertexts) and malleable (bit-flip attacks alter decrypted credential payloads undetected). Fixed in Ceph Tentacle 20.2.4 and Squid 19.2.6 by replacing the scheme with AES-256-CTS-HMAC-SHA384-192; no public exploit has been identified at time of analysis.
Arbitrary root file read in Linuxfabrik monitoring plugins allows a local attacker controlling the nagios or icinga account to exfiltrate any root-readable file by exploiting the hidden but permanently live --test argument accepted by all sudoers-whitelisted check plugins. Invoking the deb-updates plugin via sudo with --test=/etc/shadow,,0 causes lftest.py to read the supplied path as root with no path confinement and echo its full contents to stdout; approximately 22 additional whitelisted plugins yield filtered leaks or file-existence oracles through the same mechanism. No active exploitation has been confirmed by CISA KEV, but a fully functional proof-of-concept command is publicly disclosed in the vendor's own GitHub security advisory GHSA-rh9c-rqvg-f7pr, and patches are available in linuxfabrik-lib v6.1.0 and monitoring-plugins v7.0.0.
Partial denial of service in Oracle Helidon 4.5.3 is reachable by unauthenticated network attackers over HTTP, targeting the Imperative Web Server component within Oracle Fusion Middleware. Successful exploitation degrades availability without compromising confidentiality or integrity. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS score of 5.3 (Medium) reflects a bounded, availability-only impact.
Integrity compromise in Oracle Helidon 1.4.20's Imperative Web Server component enables unauthenticated remote attackers to perform limited unauthorized data modifications via HTTP under high-complexity conditions. The vulnerability, tagged as an authentication bypass, allows circumvention of access controls to execute unauthorized update, insert, or delete operations on Helidon-accessible data without requiring credentials or user interaction. No public exploit code has been identified and no active exploitation is confirmed; the CVSS 3.7 Low score combined with high attack complexity (AC:H) significantly constrain real-world risk.
Unauthorized data access in Oracle Helidon 3.2.18's Imperative Web Server component allows low-privileged network attackers to read a subset of accessible data and perform unauthorized insert, update, or delete operations via HTTP. Tagged as an authentication bypass by Oracle, the flaw presents a moderate but concrete integrity and confidentiality risk for organizations running this specific microservice framework version. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the low attack complexity and no user interaction requirement lower the barrier for exploitation by any authenticated user.