Oracle
Monthly
Authentication bypass in Oracle Hyperion Calculation Manager 11.2.25.0.000 (Security component) exposes EPM calculation data to unauthenticated attackers positioned on the same physical network segment. The adjacency constraint (AV:A) limits internet-based exploitation, but an insider or attacker already present on the local segment can bypass authentication to partially read or tamper with accessible application data. No public exploit code or active exploitation has been identified at time of analysis; the CVSS 5.4 Medium score accurately reflects the constrained attack surface and limited data impact.
Local information disclosure in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows an unauthenticated attacker with OS-level logon access to the infrastructure host to read a subset of Hyperion application data without authenticating to the application itself. The vulnerability resides in the Installation and Configuration component and is tagged as an authentication bypass, suggesting the local access path circumvents the application's authentication layer. No public exploit code or CISA KEV listing is identified at time of analysis, and the confidentiality impact is limited in scope.
Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 contains a low-severity local vulnerability in its Installation and Configuration component that allows a highly privileged local attacker to perform limited unauthorized data manipulation and cause a partial denial of service. Exploitation requires both local system logon and high privilege level, with high attack complexity - meaning special conditions beyond the attacker's direct control must also be present. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; it was disclosed as part of Oracle's August 2026 Critical Patch Update.
Integrity compromise in Oracle Hyperion Calculation Manager 11.2.25.0.000 is achievable by a low-privileged attacker physically co-located on the same network segment as the affected host. Exploitation requires high attack complexity and yields only partial data modification - unauthorized insert, update, or delete of a subset of accessible data with no confidentiality or availability impact. No public exploit code and no CISA KEV listing exist at time of analysis, making real-world exploitation unlikely outside of highly targeted scenarios.
Unauthenticated read access to Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is achievable by remote attackers over HTTP via a flaw in the Installation and Configuration component. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the vulnerability is easily exploitable with no authentication, no user interaction, and no special network position required - Oracle's own advisory characterizes it as 'easily exploitable.' Impact is limited to unauthorized read access to a subset of Hyperion-accessible data, with no integrity or availability consequences. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Unauthenticated confidentiality exposure in Oracle Hyperion Calculation Manager 11.2.25.0.000 permits any attacker with access to the same physical network segment to obtain complete read access to all data the application can access, including sensitive financial planning and business rule data. The authentication bypass (tagged explicitly by Oracle) requires no credentials and no user interaction, making it trivially exploitable by any host co-resident on the adjacent LAN or VLAN. No active exploitation has been confirmed via CISA KEV, and no public exploit code has been identified at time of analysis.
Local privilege abuse in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows a low-privileged, authenticated local user to perform unauthorized insert, update, or delete operations against data accessible to the Installation and Configuration component. The vulnerability is vendor-confirmed via Oracle's Critical Security Patch Update for August 2026 and carries a low CVSS 3.1 base score of 3.3, reflecting limited impact scope restricted to partial integrity loss with no confidentiality or availability effects. No public exploit code or CISA KEV listing exists at time of analysis, consistent with the low severity and local-access requirement.
Authentication bypass in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 exposes all accessible data to unauthenticated network attackers via TLS, with additional limited write access. The vulnerability resides in the Installation and Configuration component and, despite requiring high attack complexity (AC:H), requires no authentication or user interaction. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the high confidentiality impact makes it a meaningful risk for any organization running this specific Hyperion version.
Local confidentiality exposure in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows a low-privileged attacker with logon access to the host to access critical or complete data managed by the Hyperion platform under high-complexity conditions. The attack vector is strictly local (AV:L), requiring physical or logical access to the infrastructure host, and the high attack complexity (AC:H) significantly constrains opportunistic exploitation. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this vulnerability firmly in the insider-threat and post-compromise lateral-movement risk categories.
Local privilege escalation in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows a low-privileged OS user on the Hyperion host to gain unauthorized access to all data accessible by the platform. The vulnerability resides in the Installation and Configuration component and carries a High confidentiality impact despite a moderate CVSS base score of 5.5, reflecting the local-only attack vector. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA's KEV catalog, but the ENISA EUVD tags it as an Authentication Bypass, suggesting application-layer authorization controls are circumvented once local OS access is obtained.
Confidentiality compromise in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows a low-privileged local attacker to gain unauthorized access to critical or complete Hyperion-accessible data, with a confirmed scope change that can cascade impact to additional co-hosted Oracle Hyperion products. The vulnerable component is Installation and Configuration, and the 'Authentication Bypass' tag in the intelligence source suggests access controls within this subsystem can be circumvented despite requiring an initial local OS-level logon. No public exploit code and no CISA KEV listing have been identified at time of analysis, positioning this as an insider-threat or post-compromise lateral escalation risk rather than a remote opportunistic attack.
Local privilege-abuse in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows a high-privileged local attacker to partially corrupt data integrity and cause a partial denial of service against the Installation and Configuration component. The vulnerability requires physical or logical logon access to the host infrastructure where Hyperion executes, and exploitation is rated High Complexity, significantly constraining real-world risk. No public exploit code and no CISA KEV listing are associated with this vulnerability at time of analysis.
Local integrity and availability compromise in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows a high-privileged attacker with local system access to make unauthorized data modifications and cause partial denial of service within the Installation and Configuration component. The CVSS 3.1 base score of 3.4 (Low) reflects a tightly constrained impact scope - no confidentiality exposure and only partial integrity and availability degradation. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation at time of analysis.
Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 exposes a network-accessible vulnerability in its Installation and Configuration component that unauthenticated remote attackers can leverage via HTTP, but only with a victim's interaction, to perform unauthorized read and write operations against accessible data while also impacting additional products through a scope change. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) combined with the 'Authentication Bypass' tag and scope change is consistent with a client-side injection pattern - likely cross-site scripting or a similar reflective attack surface in the web-facing installation or configuration interface. No public exploit code has been identified at time of analysis, and exploitation has not been confirmed by CISA KEV.
Unauthenticated information disclosure in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 exposes a subset of accessible data to remote attackers over HTTP without requiring any credentials. The vulnerability resides in the Installation and Configuration component and is classified by Oracle as an authentication bypass, meaning the access control mechanism protecting configuration-related data can be circumvented without any prior authentication. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, though the low-complexity, unauthenticated attack vector lowers the barrier for opportunistic exploitation.
Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 exposes all Hyperion-accessible data to local attackers holding low operating-system privileges, through a flaw in its Installation and Configuration component. A low-privileged local user can achieve unauthorized read access to critical data - including sensitive financial planning and EPM artifacts - without requiring any user interaction. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code has been identified at time of analysis.
Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 allows a local attacker without Hyperion-level credentials to gain unauthorized read and write access to critical Hyperion data through a flaw in the Installation and Configuration component. Exploitation requires physical or logical presence on the infrastructure host and successful social engineering of a legitimate user to trigger the vulnerable condition, consistent with the CVSS 3.1 vector AV:L/AC:H/UI:R. No public exploit has been identified and the vulnerability is not listed in CISA KEV, though the high confidentiality and integrity impacts are significant for environments where Hyperion hosts sensitive financial or enterprise planning data.
SQL-based compromise of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows a network-accessible, high-privileged attacker to gain unauthorized read and write access to all critical data managed by the platform. The vulnerability resides in the Installation and Configuration component and requires no user interaction once network SQL access is established. No public exploit code has been identified at time of analysis, and the flaw is not listed in the CISA KEV catalog, though the 'Authentication Bypass' tag attached to this CVE warrants scrutiny given the high-privilege prerequisite in the CVSS vector.
Local privilege escalation of read access in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows a low-privileged local attacker to gain unauthorized access to all data accessible by the Hyperion installation, including potentially sensitive configuration secrets and credentials stored during installation. The vulnerability resides in the Installation and Configuration component, tagged as an authentication bypass, suggesting an internal authorization control can be circumvented by an already-authenticated local user. No public exploit exists at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Unauthorized read access to data in Oracle Hyperion Calculation Manager 11.2.25.0.000 is achievable by unauthenticated network attackers via HTTP, exploiting a flaw in the Security component tagged as an Authentication Bypass. The attack carries high complexity (AC:H), substantially limiting opportunistic exploitation, and impacts only a subset of accessible data with no integrity or availability consequences. No public exploit code or active exploitation in the wild has been identified at time of analysis; Oracle disclosed this through their August 2026 Critical Security Patch Update.
SQL-level data manipulation in Oracle Hyperion Calculation Manager version 11.2.25.0.000 enables a highly privileged, network-connected attacker to perform unauthorized read, insert, update, and delete operations against a subset of accessible application data through the Security component. Impact is constrained to partial confidentiality and integrity loss with no availability consequence, yielding a vendor-assigned CVSS 3.1 base score of 3.8. No active exploitation or public proof-of-concept has been identified at time of analysis; Oracle addressed this in its August 2026 Critical Patch Update.
Unauthorized data modification in Oracle Hyperion Calculation Manager 11.2.25.0.000 allows a low-privileged, network-accessible attacker to perform unsanctioned insert, update, or delete operations against accessible application data via HTTP. Exploitation requires human interaction from a third party, indicating a client-side or social-engineering attack vector such as CSRF or a crafted link. No public exploit code exists and this CVE is not listed in the CISA KEV catalog; with a CVSS 3.1 score of 3.5 and integrity-only impact, this represents a low-severity, low-urgency finding in most enterprise risk frameworks.
Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 exposes a low-severity flaw in its Common Security component that permits a highly privileged, network-adjacent attacker to perform unauthorized data modifications and induce a partial denial of service via HTTP. The CVSS 3.1 base score of 3.3 reflects genuinely constrained exploitability - both high attack complexity and pre-existing high-privilege access are required before any impact is possible. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated network-accessible data disclosure in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 exposes critical or complete confidentiality of data via HTTP, requiring human interaction from a victim to complete the attack. Tagged as an Authentication Bypass in the Common Security component, a remote attacker can circumvent authentication controls to read sensitive data accessible to the Hyperion platform. No public exploit has been identified at time of analysis, and the vulnerability is addressed in Oracle's August 2026 Critical Patch Update.
Authentication bypass in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 enables unauthenticated remote attackers to partially read and modify data within the Common Events component via HTTP under high-complexity conditions. Disclosed through Oracle's August 2026 Critical Patch Update (EUVD-2026-61525), the flaw carries a CVSS 3.1 score of 4.8 (Medium), reflecting limited impact scope and difficult exploitation prerequisites. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at the time of analysis.
Limited-impact local privilege abuse in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows an already-privileged local attacker to gain unauthorized read and write access to a restricted subset of Hyperion data. Exploitation requires both local logon access to the infrastructure host and high-level existing privileges, making this extremely constrained in scope. No public exploit code and no active exploitation (CISA KEV) have been identified; the overall risk is low and consistent with the CVSS 3.1 score of 3.0.
Unauthorized read access in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is exposed via an authentication bypass in the Installation and Configuration component, reachable over HTTP without credentials. An unauthenticated remote attacker can exploit this to read a subset of data accessible to the affected component, potentially including configuration or operational metadata. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Unauthenticated information disclosure in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 exposes the Common Events component to remote attackers over HTTP with no credentials, privileges, or user interaction required. The authentication bypass - flagged explicitly by Oracle's security team (secalert_us@oracle.com) - allows attackers to read a subset of platform data accessible to the component. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the zero-complexity attack vector makes opportunistic reconnaissance straightforward for any attacker with network access to the Hyperion server.
Unauthorized data disclosure in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows a low-privileged attacker with HTTP network access to read critical or all accessible data within the platform's Common Security component. The vulnerability is tagged as an authentication bypass, suggesting that an already-authenticated low-privilege user can escalate their data access beyond authorized scope. No public exploit code or active exploitation has been identified at this time, but the low attack complexity makes it a credible lateral movement or data exfiltration vector in environments where Oracle Hyperion is internet-facing or accessible to untrusted internal users.
Oracle Hyperion Infrastructure Technology 11.2.25.0.000 exposes a network-accessible vulnerability in its Common Security component that permits unauthenticated remote attackers to compromise data confidentiality and integrity via HTTP, provided a victim user interacts with attacker-controlled content. The CVSS scope-change designation (S:C) indicates successful exploitation can extend impact to additional Oracle Hyperion products sharing the same infrastructure. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the 'Authentication Bypass' tag in the intelligence data warrants attention as it may signal higher practical impact than the Medium CVSS score implies.
Full takeover of Oracle Shipping Execution (versions 12.2.3-12.2.15) within Oracle E-Business Suite is achievable by a high-privileged, network-based attacker over HTTP when high-complexity conditions are satisfied. Despite requiring elevated privileges and difficult attack conditions, successful exploitation yields complete compromise of confidentiality, integrity, and availability - effectively a system takeover of the Shipping Execution module. No public exploit code or CISA KEV listing has been identified at time of analysis, though the vulnerability is disclosed via Oracle's August 2026 Critical Patch Update.
Partial unauthorized data read in Oracle Hyperion Calculation Manager 11.2.25.0.000 is achievable by an unauthenticated remote attacker via HTTP, though exploitation is rated difficult and requires human interaction from a third party. The vulnerability is tagged as an authentication bypass in the Security component, resulting in low-severity confidentiality exposure with no integrity or availability impact (CVSS 3.1: 3.1). No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this firmly in the low-priority tier for most organizations.
Unauthorized data disclosure in Oracle Hyperion Calculation Manager 11.2.25.0.000 allows a low-privileged, network-accessible attacker to read a subset of application data via HTTP, with confirmed scope change indicating potential exposure of data in adjacent Oracle components. The vulnerability is tagged 'Authentication Bypass' by the reporter, suggesting the attacker can circumvent internal security controls despite holding a low-privilege account. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthorized data exposure in Oracle Hyperion Calculation Manager version 11.2.25.0.000 allows unauthenticated remote attackers to read a subset of application-accessible data via HTTP, exploiting an authentication bypass in the Security component. The CVSS 3.1 score of 5.3 (Medium) reflects low-complexity, no-privilege-required network exploitation with limited confidentiality impact and no integrity or availability consequences. No public exploit code has been identified and this CVE does not appear on the CISA Known Exploited Vulnerabilities catalog at time of analysis.
Unauthorized data access and manipulation in Oracle Hyperion Calculation Manager 11.2.25.0.000 is achievable by low-privileged network attackers via HTTP, exploiting a weakness in the product's Security component tagged as an authentication bypass. Successful exploitation permits an authenticated attacker to read a subset of accessible EPM data and perform unauthorized insert, update, or delete operations against accessible data stores, with no availability impact. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; it is addressed in Oracle's Critical Patch Update for August 2026.
Confidentiality compromise in Oracle Hyperion Calculation Manager 11.2.25.0.000 allows unauthenticated remote attackers to gain unauthorized access to critical or complete data accessible within the application via HTTP. The attack vector is network-based but requires high attack complexity and human interaction from a victim other than the attacker, limiting opportunistic exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, though the Authentication Bypass tag suggests the underlying flaw bypasses access controls in the Security component.
High-privileged local exploitation of Oracle Hyperion Calculation Manager 11.2.25.0.000 allows an attacker with existing infrastructure logon to bypass Security component controls, gaining full read access to critical Hyperion data and limited write access to accessible records, with a scope change indicating spillover risk to additional Oracle Hyperion products. The attack is confined to insiders or adversaries who have already achieved a high-privilege foothold on the Hyperion infrastructure, making this most relevant to insider threat models and post-compromise lateral movement scenarios. No public exploit code has been identified at time of analysis; Oracle addressed this vulnerability in the August 2026 Critical Patch Update.
Unauthorized data exposure in Oracle Java SE's Networking component allows unauthenticated remote attackers via HTTP to access critical or all data accessible to the affected Java process, with a confirmed scope change that can impact systems and products beyond the JDK's own security boundary. Affected versions span a wide range across Oracle Java SE (8u501 through 26.0.2), Oracle GraalVM for JDK (17.0.20 and 21.0.12), and Oracle GraalVM Enterprise Edition (21.3.19), covering both server-side Java API consumers and client-side Java Web Start or sandboxed applet deployments. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog; however, the breadth of affected LTS versions and the ubiquity of Java in enterprise environments make patch prioritization appropriate.
Local privilege escalation with scope change in Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 exposes critical data to a low-privileged local attacker. The Enterprise Manager Install component can be compromised by an authenticated local user under difficult but achievable conditions, with successful exploitation yielding complete confidentiality breach of all data accessible to the platform - including data from additional managed products due to scope change. No public exploit code has been identified at time of analysis, and CISA KEV confirmation is absent.
Unauthenticated remote access to Oracle Learning Management (E-Business Suite versions 12.2.3 through 12.2.15) enables attackers to read, insert, update, or delete subsets of application data via HTTP without any credentials. Tagged as an authentication bypass in the Internal Operations component, this vulnerability exposes organizations running these specific EBS versions to unauthorized data manipulation affecting confidentiality and integrity. No public exploit code or active exploitation has been identified at time of analysis, but the low-complexity, no-authentication attack profile warrants prompt patching under Oracle's August 2026 Critical Patch Update.
Authorization bypass in Oracle Public Sector Financials (International) - a government-focused module of Oracle E-Business Suite versions 12.2.3 through 12.2.15 - permits low-privileged, network-authenticated attackers to read sensitive financial records, perform unauthorized data manipulation (insert, update, delete), and cause a partial denial of service against the affected module via standard HTTP. Oracle disclosed this in the August 2026 Critical Security Patch Update; no public exploit code has been identified and the vulnerability is not listed in CISA KEV at the time of analysis. With a CVSS 3.1 score of 6.3 (Medium), this is a mid-tier priority that warrants timely patching particularly for public sector organizations where financial data integrity is a regulatory obligation.
Oracle Unified Directory versions 12.2.1.4.0 and 14.1.2.1.0 expose a network-exploitable authentication bypass over LDAP that grants low-privileged attackers full read and write control over directory data. Despite a moderate CVSS base score of 6.8 driven down by high attack complexity (AC:H), successful exploitation yields complete confidentiality and integrity compromise of all OUD-accessible data - a severe outcome for identity and directory infrastructure. No public exploit code or active exploitation has been identified at time of analysis; Oracle disclosed the issue as part of the Critical Patch Update for August 2026.
Unauthorized data access in Oracle PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 allows a low-privileged, authenticated network attacker to read a subset of PeopleTools data and perform unauthorized insert, update, or delete operations via the Panel Processor component, with a confirmed scope change meaning successful exploitation can extend impact to additional dependent products. The attack carries high complexity and requires human interaction from a third-party victim. No public exploit code has been identified and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, though Oracle's tagging of 'Authentication Bypass' suggests the Panel Processor may allow privilege escalation beyond what the attacker's credential level should permit.
Unauthenticated remote data compromise affects Oracle Service Delivery Platform 14.1.2.0.0 via its Messaging Enabler component, reachable over HTTP without credentials. The authentication bypass allows network attackers to read a subset of platform data and perform unauthorized insert, update, or delete operations against accessible data stores. No public exploit code or active exploitation has been identified at time of analysis, and Oracle addressed this in the August 2026 Critical Patch Update.
Unauthorized confidential data access in Oracle Service Delivery Platform (Fusion Middleware, Messaging Enabler component) is achievable by network-adjacent high-privileged attackers over HTTP, with a scope change that can impact additional Fusion Middleware products beyond the primary target. Affected versions are 14.1.2.0.0 and 12.2.1.4.0. Classified as 'easily exploitable' by Oracle, the flaw carries a CVSS 3.1 score of 6.8 with scope change flagged - though no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthorized read access in Oracle Helidon 3.2.20's Imperative Web Server component allows unauthenticated network attackers to bypass authentication controls via HTTP and retrieve a limited subset of application data. The vulnerability is tagged as an Authentication Bypass and is difficult to exploit due to high attack complexity (AC:H), materially reducing real-world risk despite the network-accessible attack vector. No active exploitation is confirmed and no public exploit code has been identified at time of analysis. The CVSS score of 3.7 accurately reflects the low-severity nature: limited data exposure with no integrity or availability impact.
Unauthorized data exposure in Oracle Workflow (E-Business Suite 12.2.3-12.2.15) allows a low-privileged, network-authenticated attacker to read all data accessible within the Oracle Workflow system via the Worklist HTTP component. Oracle classifies this as easily exploitable in its August 2026 Critical Patch Update, with a High confidentiality impact and no integrity or availability effects. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Unauthenticated remote compromise of Oracle Hyperion Financial Reporting 11.2.25.0.000 allows network-adjacent attackers to read a subset of financial reporting data and perform unauthorized insert, update, or delete operations against Repository data via HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N) combined with the 'Authentication Bypass' tag confirms that no credentials are required and exploitation is straightforward against exposed instances. No patch bypass, public exploit code, or CISA KEV listing has been identified at time of analysis, though Oracle classifies this as 'easily exploitable.'
Oracle Java SE's Security component across all current LTS and preview releases - versions 8u501 through 26.0.2 - along with GraalVM for JDK and GraalVM Enterprise Edition, permits unauthenticated remote attackers to read a limited subset of data via crafted API inputs delivered through web services. Despite the network-accessible, zero-authentication vector (AV:N/PR:N/UI:N), the high attack complexity (AC:H) and confined confidentiality impact (C:L) constrain real-world risk, yielding a CVSS 3.1 base score of 3.7. No public exploit code and no CISA KEV listing have been identified at time of analysis, and Oracle disclosed this finding through its standard August 2026 Critical Patch Update cycle rather than an emergency out-of-band advisory.
Server-Side Request Forgery in FUXA 1.3.2 and earlier allows authenticated non-admin runtime users to weaponize the FUXA server as an outbound HTTP proxy, reading responses from internal services and cloud metadata endpoints. The vulnerability exists in the device-webapi-request Socket.IO handler, which applies no ownership or allowlist validation to the user-controlled property.address parameter before issuing the request. Patch is available as of version 1.3.3; no public exploit code or CISA KEV listing identified at time of analysis.
Arbitrary file read via path traversal in MobSF prior to 4.5.1 allows authenticated users with scan-upload permissions to exfiltrate server-side files by embedding traversal sequences in the android:icon attribute of a crafted AndroidManifest.xml inside a ZIP or APK upload. The vulnerable find_icon_path_zip() function resolves the attacker-controlled icon path without containment checks, copies the target file to a predictable location in DWD_DIR, and exposes it through the /download/ endpoint. A fully functional proof-of-concept script is publicly available in the GHSA advisory; this issue is not listed in the CISA KEV catalog.
Unauthenticated Server-Side Request Forgery in MagicMirror² versions prior to 2.37.0 allows any network-reachable attacker to weaponize the smart mirror as an internal network probe. By connecting to the unguarded Socket.IO `/newsfeed` namespace and emitting a `CHECK_ARTICLE_URL` notification with an attacker-controlled URL, the server performs an unsanitized `fetch()` HEAD request and returns timing and framing data via `ARTICLE_URL_STATUS`, creating a boolean-plus-timing oracle for internal host and port enumeration. A proof-of-concept exploit is documented in the GHSA advisory; no confirmed active exploitation (CISA KEV) has been reported.
LDAP injection in Red Hat Quay 3's external LDAP authentication handler allows unauthenticated network attackers to inject filter metacharacters into LDAP queries when the directory server returns a referral response. Exploitation enables user-existence oracle attacks against the referral Directory Name and can potentially influence which Distinguished Name is used during password binding in multi-domain Active Directory environments. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog; however, the network-accessible attack vector and lack of authentication requirement elevate practical concern for organizations using LDAP-integrated Quay deployments.
Authenticated users with Perm.Download=false can extract cryptographic content hashes (MD5, SHA1, SHA256, SHA512) for any file within their scope via filebrowser's /api/resources?checksum= endpoint, bypassing the intended download permission gate. The resourceGetHandler's checksum branch reads entire file content to compute digests but omits the Perm.Download check enforced by all sibling handler paths (raw, preview, subtitle). This is an incomplete remediation of CVE-2026-35606; no public exploit is identified at time of analysis, and the CVSS 4.0 vector (PR:L, VC:L) confirms exploitation requires an authenticated session. The hash oracle enables content confirmation, change detection, and offline brute-force of low-entropy files without ever receiving the file bytes directly.
Template-literal code injection in TypeORM's migration:generate command allows an attacker with database schema write access to achieve arbitrary JavaScript execution on any host that loads the generated migration file. Affected are TypeORM npm versions prior to 0.3.31 (0.x branch) and versions 1.0.0 through 1.0.x (fixed in 1.1.0), spanning PostgreSQL, MySQL, MariaDB, and CockroachDB drivers. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis; however, the GHSA advisory provides sufficient technical detail to reproduce the attack.
RSA PKCS#1 v1.5 decryption in Oberon Microsystems AG's ocrypto library (versions 3.0.0 through 4.0.0) leaks padding validity through measurable timing differences, enabling Bleichenbacher-style padding oracle attacks that allow plaintext recovery. Affected systems must be running one of the vulnerable library versions and the attacker requires local access and the ability to submit multiple crafted decryption requests while capturing precise timing data. Vendor-released patch version 4.0.1 is available; no public exploit has been identified at time of analysis.
Timing-based padding oracle attack in Oberon Microsystems AG's Oberon PSA Crypto library (versions 1.0.0 through 2.1.0) enables plaintext recovery from RSA PKCS#1 v1.5-encrypted ciphertext. An attacker capable of submitting decryption requests and measuring response timing can exploit observable timing discrepancies during padding validation - a Bleichenbacher-class attack - to iteratively deduce encrypted data. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog; however, the confidentiality impact is rated High as successful exploitation yields full plaintext recovery.
Filesystem existence and readability probing in Budibase Cloud's MongoDB integration prior to version 3.40.1 exposes an information-disclosure oracle exploitable by authenticated builders. The `tlsCertificateKeyFile` and `tlsCAFile` fields in the MongoDB datasource configuration were passed unsanitized to the MongoDB driver as server-side filesystem paths, enabling a builder to probe arbitrary absolute paths on the shared multi-tenant server via `/api/datasources/verify` by comparing distinct driver error messages. No CISA KEV listing exists, but the GHSA advisory contains a fully working reproduction command; the vulnerability is specific to Budibase Cloud and does not affect self-hosted deployments.
Missing NETWORK ACL enforcement across Velociraptor's upload_azure, upload_sftp, upload_smb, upload_gcs, and related VQL plugins allows an authenticated analyst-role user to force the server to initiate outbound TCP connections to arbitrary attacker-controlled endpoints. This bypasses the intended NETWORK ACL permission boundary - a role separation control designed to prevent analysts from triggering server-side network activity - enabling port-oracle-based reconnaissance of the server's internal network segments and potential data exfiltration to external destinations. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation is bounded by the requirement for analyst-role authentication.
Query injection and oracle enumeration in Ash Framework (ash-project/ash) versions 1.52.0-rc.11 through pre-3.31.1 allow an attacker to forge a belongs_to relationship to a record whose identifier they cannot directly name, and to systematically recover secret lookup values via a comparison oracle. The root cause is a two-part failure in the managed_relationship on_lookup: :relate code path: client-supplied values reach Ash.Query.filter/2 without type-casting, so a nested map is interpreted as a filter predicate rather than a literal scalar, and the missing Ash.Query.limit(1) call lets Ash.read_one/2 distinguish zero, one, and multiple matches - converting boolean filter predicates into an oracle. No public exploit has been identified at time of analysis; a vendor patch is available at version 3.31.1.
Server-side request forgery in Flowise through 3.1.4 allows attackers to reach Oracle Cloud Infrastructure (OCI) and Alibaba Cloud instance metadata services by exploiting an incomplete deny-list in the SSRF guard (`httpSecurity.ts`). The DEFAULT_DENY_LIST omits the OCI metadata IP 192.0.0.192 and the Alibaba Cloud metadata IP 100.100.100.200, enabling credential theft from the cloud metadata layer. No public exploit identified at time of analysis in CISA KEV, but publicly available exploit code exists on GitHub, and the vendor's website now resolves to a sunset page, suggesting no official patch will be issued.
Cluster ID enumeration in SUSE Rancher exposes a reliable oracle via the unauthenticated `/v3/import/{token}_{clusterId}.yaml` endpoint, which performs cluster object retrieval before token validation. Remote unauthenticated attackers can distinguish valid cluster IDs (HTTP 502, triggered by a nil pointer dereference in `pkg/systemtemplate/private_registry.go` when private registry secrets exist) from non-existent ones (HTTP 200), leaking the presence and private-registry configuration status of clusters. This is not listed in CISA KEV and no public exploit code has been identified, but the zero-prerequisite network accessibility makes enumeration trivially scriptable.
Username enumeration is possible in PaperCut NG/MF via an observable timing side-channel in the authentication component, exploitable by unauthenticated remote attackers. The system conditionally executes password hash comparison only when a submitted username corresponds to a valid account, producing a measurable latency difference that reveals account existence. No public exploit code or CISA KEV listing has been identified at time of analysis; however, with a CVSS 4.0 score of 6.9 and an AV:N/PR:N vector, the attack surface is entirely remote and requires no credentials, making it accessible to any attacker with network reach to the login endpoint.
Information disclosure via path traversal in Pagy's I18n locale handler allows an attacker to verify the existence and readability of arbitrary
File existence oracle in Dompdf allows remote unauthenticated attackers to enumerate sensitive server-side files by exploiting a behavioral discrepancy in CSS @font-face processing. Crafted HTML containing thousands of @font-face declarations referencing local paths via the file:// protocol causes PHP memory exhaustion only when the target file exists, producing a detectable crash signal versus a clean render for non-existent files. Publicly available exploit code exists (detailed in the GHSA advisory); no KEV listing at time of analysis, but exploitation requires only a public HTTP endpoint that passes unsanitized HTML to Dompdf. A vendor-released patch (v3.1.6) is available.
Oracle Work in Process (part of Oracle E-Business Suite) versions 12.2.5 through 12.2.15 exposes an authorization flaw in its Internal Operations component, enabling a low-privileged authenticated attacker to perform unauthorized read, insert, update, and delete operations against accessible Work in Process data over HTTP. The scope change (S:C) in the CVSS vector confirms that successful exploitation can cascade to affect additional EBS modules beyond the directly targeted component. No public exploit code or CISA KEV listing has been identified at time of analysis, and the mandatory victim interaction requirement (UI:R) reduces opportunistic exploitation risk.
Unauthorized data access in Oracle HRMS (US) versions 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker to read critical or complete HR data via HTTP without requiring user interaction or elevated permissions. The vulnerability resides in the Internal Operations component of Oracle E-Business Suite and carries a CVSS 3.1 score of 6.5 with high confidentiality impact. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad version range spanning over a decade of releases make this a meaningful risk for any organization running unpatched Oracle EBS.
Unauthorized critical data disclosure in Oracle HRMS (US) versions 12.2.3 through 12.2.15 exposes complete read access to all HRMS-accessible data via network HTTP, with a confirmed scope change that can impact additional Oracle E-Business Suite modules beyond HRMS itself. The CVSS vector (PR:H, S:C, C:H) indicates a high-privileged authenticated attacker operating over the network with low complexity can breach data boundaries across co-deployed EBS components. An 'Authentication Bypass' tag in the intelligence feed creates analytical tension with the PR:H prerequisite and warrants vendor clarification; no public exploit code has been identified at time of analysis, and Oracle disclosed this issue via the July 2026 Critical Patch Update.
Oracle HRMS (US) Internal Operations component exposes complete HR dataset read access to any low-privileged authenticated attacker over HTTP. Versions 12.2.6 through 12.2.15 of Oracle E-Business Suite are confirmed affected, enabling an attacker holding even a basic EBS user account to bypass authorization controls and access all data visible to the HRMS application. No public exploit or CISA KEV listing exists at time of analysis, but the low attack complexity (AC:L) means exploitation is straightforward once initial credentials are obtained, making insider threat and credential-compromise scenarios the primary risk vector.
Unauthorized data access and partial denial of service in Oracle Advanced Benefits (E-Business Suite Self Service Benefits component) is achievable by low-privileged, network-authenticated attackers over HTTP. Versions 12.2.3 through 12.2.15 are confirmed affected, spanning a broad range of Oracle EBS deployments. Oracle classifies this as 'easily exploitable' in the July 2026 CPU; no public exploit identified at time of analysis and not listed in CISA KEV, but the low attack complexity and no user interaction requirement elevate realistic risk for organizations with internal threat actors or compromised credentials.
Oracle HCM Configuration Workbench versions 12.2.3 through 12.2.15, part of Oracle E-Business Suite, exposes its Install component to network-accessible exploitation by any low-privileged authenticated user over HTTP. Successful exploitation yields unauthorized read access to a subset of HCM data, unauthorized insert/update/delete capability against accessible data, and the ability to cause partial denial of service against the component. No public exploit code or active exploitation has been identified at time of analysis, and the vulnerability was disclosed as part of Oracle's Critical Patch Update for July 2026.
Import and Export component exploitation in Oracle Learning Management (Oracle E-Business Suite 12.2.3-12.2.15) allows a network-authenticated low-privileged user to partially read, manipulate, or delete LMS data and degrade service availability over HTTP. The flaw is rated CVSS 6.3 with low attack complexity and no user interaction required beyond a valid account. No public exploit code or CISA KEV listing has been identified at time of analysis, positioning this as a credible internal-threat-actor or compromised-credential risk rather than an opportunistic internet-facing attack.
Oracle Quality within Oracle E-Business Suite versions 12.2.3 through 12.2.15 exposes partial confidentiality, integrity, and availability compromise through its Quality Workbench HTML system component. A low-privileged authenticated attacker with HTTP network access can perform unauthorized read, write, and denial-of-service operations against Quality module data. No public exploit code or active exploitation has been identified at time of analysis; this vulnerability was disclosed by Oracle via the July 2026 Critical Patch Update.
Oracle HRMS (US) US Payroll - General component in Oracle E-Business Suite versions 12.2.3 through 12.2.15 exposes payroll data and service availability to low-privileged authenticated network attackers over HTTP. Successful exploitation yields partial unauthorized read of payroll records, unauthorized insert, update, or delete of accessible payroll data, and partial denial of service - impacts that are especially sensitive given the nature of US payroll information. Disclosed as part of Oracle's July 2026 Critical Patch Update, no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Oracle Succession Planning within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) exposes a medium-severity, network-exploitable vulnerability in the Succession Plan component that allows low-privileged attackers to read, modify, or partially disrupt succession planning data via HTTP. The CVSS 3.1 vector confirms low attack complexity with no user interaction required, making exploitation straightforward for any authenticated EBS user. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthorized access to critical data in Oracle Production Scheduling (versions 12.2.3 through 12.2.15) is achievable by unauthenticated remote attackers via a network-based authentication bypass in the Internal Operations component, though exploitation requires high attack complexity and human interaction from a third party. The confidentiality impact is complete - attackers can access all data accessible to Production Scheduling - while integrity and availability remain unaffected. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle disclosed this through the July 2026 Critical Patch Update.
Partial denial-of-service affecting Oracle Time and Labor (E-Business Suite versions 12.2.3 through 12.2.15) is exploitable by a low-privileged network attacker over HTTP under high-complexity conditions. Successful exploitation degrades availability of the Internal Operations component only, with zero confidentiality or integrity impact. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog, placing it at the low end of operational priority.
Integrity compromise in Oracle Time and Labor (E-Business Suite versions 12.2.3 through 12.2.15) allows a low-privileged, network-authenticated attacker to create, delete, or modify critical application data via HTTP under high-complexity conditions. The vulnerability resides in the Internal Operations component and is tagged as an Authentication Bypass, suggesting insufficient internal authorization enforcement rather than a perimeter access failure. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the I:H integrity impact makes successful exploitation consequential for workforce and payroll data integrity.
Cross-site scripting or request-forgery class vulnerability in Oracle Time and Labor (E-Business Suite component: Internal Operations) enables unauthenticated remote attackers to compromise confidentiality and integrity via HTTP when a victim user interacts with attacker-controlled content, with scope change indicating impact extends beyond the vulnerable component to additional E-Business Suite products. Affected deployments span versions 12.2.3 through 12.2.15. The Oracle July 2026 CPU addresses this; no public exploit code or CISA KEV listing has been identified at time of analysis.
Oracle Time and Labor (part of Oracle E-Business Suite) versions 12.2.3 through 12.2.15 allows a high-privileged, network-accessible attacker to achieve full confidentiality and integrity compromise of all accessible labor data, plus limited availability disruption via HTTP. The 'Authentication Bypass' tag in associated intelligence sources introduces a notable discrepancy with the CVSS PR:H rating - if the flaw enables privilege escalation or access-control bypass within the product, the effective impact of an already-privileged session would be materially higher than the base CVSS score of 6.7 suggests. No public exploit code exists and exploitation is not confirmed by CISA KEV at time of analysis.
Confidential data exposure in Oracle Contracts Integration (Oracle E-Business Suite) versions 12.2.3 through 12.2.15 enables a low-privileged authenticated attacker with HTTP network access to bypass internal authorization controls in the Internal Operations component, gaining unauthorized access to critical or all accessible contract data. The CVSS confidentiality impact is rated High despite the moderate overall score of 5.3, reflecting complete in-scope data exposure when exploitation succeeds. No public exploit code or active exploitation has been identified at time of analysis; the high attack complexity (AC:H) constrains real-world opportunistic risk.
Partial authorization bypass in Oracle Contracts Integration (Oracle E-Business Suite 12.2.3-12.2.15) allows an authenticated low-privileged network attacker to perform unauthorized read, insert, update, or delete operations against a subset of contract data via HTTP under high-complexity conditions. Tagged as an Authentication Bypass, suggesting the flaw permits a low-privileged session to exceed its intended access boundary within the Internal Operations component. No public exploit code or CISA KEV listing has been identified at time of analysis, and the high attack complexity substantially limits opportunistic exploitation.
Unauthorized data manipulation in Oracle Contracts Integration (versions 12.2.3-12.2.15) allows a low-privileged authenticated attacker over HTTP to create, delete, or modify critical contract data without proper authorization. The 'Authentication Bypass' tag in source intelligence conflicts with the CVSS PR:L metric - this appears to be an authorization bypass within the Internal Operations component rather than a full authentication bypass, permitting privilege escalation beyond the attacker's intended access scope. Disclosed as part of Oracle's July 2026 Critical Patch Update; no public exploit has been identified at time of analysis.
Unauthorized data manipulation and read access in Oracle Contracts Integration (E-Business Suite 12.2.3-12.2.15) is achievable by unauthenticated network attackers over HTTP when a victim user interacts with a crafted request. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) combined with the reported 'Authentication Bypass' tag indicates a web-injection pattern - most likely reflected or stored Cross-Site Scripting - within the Internal Operations component, where a successful attack can pivot beyond the directly vulnerable module to affect adjacent Oracle EBS components due to scope change. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog.
Oracle Contracts Integration within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) exposes a network-accessible HTTP endpoint susceptible to exploitation by unauthenticated remote attackers, contingent on high attack complexity and required victim interaction. Successful exploitation yields limited unauthorized read access to a subset of Contracts Integration data, unauthorized data manipulation (insert, update, delete), and partial denial of service against the component. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists; the AC:H and UI:R constraints substantially lower real-world exploitation likelihood relative to the raw CVSS vector.
Oracle Contracts Integration (E-Business Suite Internal Operations component, versions 12.2.3-12.2.15) exposes a network-accessible authentication bypass that allows unauthenticated remote attackers to create, delete, or modify critical contract data via HTTP. The attack requires high complexity (AC:H), indicating specific timing, system state, or protocol conditions must be satisfied - ruling out trivial mass exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the Authentication Bypass tag combined with PR:N and network exposure makes this a meaningful integrity risk for organizations running Oracle EBS in environments reachable from untrusted networks.
Integrity compromise in Oracle Project Contracts (E-Business Suite versions 12.2.3-12.2.15) exposes an authorization bypass in the Internal Operations component, allowing a low-privileged, network-authenticated attacker to perform unauthorized insert, update, or delete operations on accessible contract data via HTTP. The tag 'Authentication Bypass' from the EUVD entry indicates the flaw permits a legitimately authenticated but restricted user to exceed their intended data-access boundaries within the application. No public exploit or CISA KEV listing exists at time of analysis, limiting immediate mass-exploitation risk, though the low attack complexity and no required user interaction make the vulnerability straightforwardly exploitable once an attacker holds any valid application credential.
Unauthorized data access in Oracle Public Sector Financials (component: Internal Operations) within Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker to read a subset of financial data and perform unauthorized insert, update, or delete operations via HTTP. The 'Authentication Bypass' tag associated with this vulnerability suggests the flaw may permit a low-privilege user to exceed their intended authorization scope within the Internal Operations component, rather than bypassing authentication entirely. No public exploit code or confirmed active exploitation has been identified at time of analysis, though Oracle's July 2026 Critical Patch Update addresses this issue.
Unauthorized read access to all data within Oracle Public Sector Financials (E-Business Suite versions 12.2.3-12.2.15) is achievable by a low-privileged attacker over HTTP, requiring no user interaction and no elevated privileges beyond a basic network account. The Internal Operations component fails to enforce appropriate access controls, enabling complete confidentiality compromise of government financial records. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog, though the 'Authentication Bypass' tag in available intelligence suggests the flaw may involve bypassing intra-application authorization rather than authentication itself.
Oracle Public Sector Financials (E-Business Suite component: Internal Operations) versions 12.2.3 through 12.2.15 allows an authenticated low-privileged network attacker to exploit an authorization control weakness via HTTP, requiring a victim user to interact with attacker-influenced content to trigger a scope change affecting additional Oracle EBS products. Successful exploitation yields unauthorized read access to a subset of data and unauthorized write/insert/delete capability against accessible data, with impact propagating beyond the directly targeted component. No public exploit code or CISA KEV listing has been identified at time of analysis, though the Oracle July 2026 CPU discloses this as part of a batch advisory.
Authentication bypass in Oracle Hyperion Calculation Manager 11.2.25.0.000 (Security component) exposes EPM calculation data to unauthenticated attackers positioned on the same physical network segment. The adjacency constraint (AV:A) limits internet-based exploitation, but an insider or attacker already present on the local segment can bypass authentication to partially read or tamper with accessible application data. No public exploit code or active exploitation has been identified at time of analysis; the CVSS 5.4 Medium score accurately reflects the constrained attack surface and limited data impact.
Local information disclosure in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows an unauthenticated attacker with OS-level logon access to the infrastructure host to read a subset of Hyperion application data without authenticating to the application itself. The vulnerability resides in the Installation and Configuration component and is tagged as an authentication bypass, suggesting the local access path circumvents the application's authentication layer. No public exploit code or CISA KEV listing is identified at time of analysis, and the confidentiality impact is limited in scope.
Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 contains a low-severity local vulnerability in its Installation and Configuration component that allows a highly privileged local attacker to perform limited unauthorized data manipulation and cause a partial denial of service. Exploitation requires both local system logon and high privilege level, with high attack complexity - meaning special conditions beyond the attacker's direct control must also be present. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; it was disclosed as part of Oracle's August 2026 Critical Patch Update.
Integrity compromise in Oracle Hyperion Calculation Manager 11.2.25.0.000 is achievable by a low-privileged attacker physically co-located on the same network segment as the affected host. Exploitation requires high attack complexity and yields only partial data modification - unauthorized insert, update, or delete of a subset of accessible data with no confidentiality or availability impact. No public exploit code and no CISA KEV listing exist at time of analysis, making real-world exploitation unlikely outside of highly targeted scenarios.
Unauthenticated read access to Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is achievable by remote attackers over HTTP via a flaw in the Installation and Configuration component. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the vulnerability is easily exploitable with no authentication, no user interaction, and no special network position required - Oracle's own advisory characterizes it as 'easily exploitable.' Impact is limited to unauthorized read access to a subset of Hyperion-accessible data, with no integrity or availability consequences. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Unauthenticated confidentiality exposure in Oracle Hyperion Calculation Manager 11.2.25.0.000 permits any attacker with access to the same physical network segment to obtain complete read access to all data the application can access, including sensitive financial planning and business rule data. The authentication bypass (tagged explicitly by Oracle) requires no credentials and no user interaction, making it trivially exploitable by any host co-resident on the adjacent LAN or VLAN. No active exploitation has been confirmed via CISA KEV, and no public exploit code has been identified at time of analysis.
Local privilege abuse in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows a low-privileged, authenticated local user to perform unauthorized insert, update, or delete operations against data accessible to the Installation and Configuration component. The vulnerability is vendor-confirmed via Oracle's Critical Security Patch Update for August 2026 and carries a low CVSS 3.1 base score of 3.3, reflecting limited impact scope restricted to partial integrity loss with no confidentiality or availability effects. No public exploit code or CISA KEV listing exists at time of analysis, consistent with the low severity and local-access requirement.
Authentication bypass in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 exposes all accessible data to unauthenticated network attackers via TLS, with additional limited write access. The vulnerability resides in the Installation and Configuration component and, despite requiring high attack complexity (AC:H), requires no authentication or user interaction. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the high confidentiality impact makes it a meaningful risk for any organization running this specific Hyperion version.
Local confidentiality exposure in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows a low-privileged attacker with logon access to the host to access critical or complete data managed by the Hyperion platform under high-complexity conditions. The attack vector is strictly local (AV:L), requiring physical or logical access to the infrastructure host, and the high attack complexity (AC:H) significantly constrains opportunistic exploitation. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this vulnerability firmly in the insider-threat and post-compromise lateral-movement risk categories.
Local privilege escalation in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows a low-privileged OS user on the Hyperion host to gain unauthorized access to all data accessible by the platform. The vulnerability resides in the Installation and Configuration component and carries a High confidentiality impact despite a moderate CVSS base score of 5.5, reflecting the local-only attack vector. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA's KEV catalog, but the ENISA EUVD tags it as an Authentication Bypass, suggesting application-layer authorization controls are circumvented once local OS access is obtained.
Confidentiality compromise in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows a low-privileged local attacker to gain unauthorized access to critical or complete Hyperion-accessible data, with a confirmed scope change that can cascade impact to additional co-hosted Oracle Hyperion products. The vulnerable component is Installation and Configuration, and the 'Authentication Bypass' tag in the intelligence source suggests access controls within this subsystem can be circumvented despite requiring an initial local OS-level logon. No public exploit code and no CISA KEV listing have been identified at time of analysis, positioning this as an insider-threat or post-compromise lateral escalation risk rather than a remote opportunistic attack.
Local privilege-abuse in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows a high-privileged local attacker to partially corrupt data integrity and cause a partial denial of service against the Installation and Configuration component. The vulnerability requires physical or logical logon access to the host infrastructure where Hyperion executes, and exploitation is rated High Complexity, significantly constraining real-world risk. No public exploit code and no CISA KEV listing are associated with this vulnerability at time of analysis.
Local integrity and availability compromise in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows a high-privileged attacker with local system access to make unauthorized data modifications and cause partial denial of service within the Installation and Configuration component. The CVSS 3.1 base score of 3.4 (Low) reflects a tightly constrained impact scope - no confidentiality exposure and only partial integrity and availability degradation. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation at time of analysis.
Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 exposes a network-accessible vulnerability in its Installation and Configuration component that unauthenticated remote attackers can leverage via HTTP, but only with a victim's interaction, to perform unauthorized read and write operations against accessible data while also impacting additional products through a scope change. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) combined with the 'Authentication Bypass' tag and scope change is consistent with a client-side injection pattern - likely cross-site scripting or a similar reflective attack surface in the web-facing installation or configuration interface. No public exploit code has been identified at time of analysis, and exploitation has not been confirmed by CISA KEV.
Unauthenticated information disclosure in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 exposes a subset of accessible data to remote attackers over HTTP without requiring any credentials. The vulnerability resides in the Installation and Configuration component and is classified by Oracle as an authentication bypass, meaning the access control mechanism protecting configuration-related data can be circumvented without any prior authentication. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, though the low-complexity, unauthenticated attack vector lowers the barrier for opportunistic exploitation.
Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 exposes all Hyperion-accessible data to local attackers holding low operating-system privileges, through a flaw in its Installation and Configuration component. A low-privileged local user can achieve unauthorized read access to critical data - including sensitive financial planning and EPM artifacts - without requiring any user interaction. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code has been identified at time of analysis.
Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 allows a local attacker without Hyperion-level credentials to gain unauthorized read and write access to critical Hyperion data through a flaw in the Installation and Configuration component. Exploitation requires physical or logical presence on the infrastructure host and successful social engineering of a legitimate user to trigger the vulnerable condition, consistent with the CVSS 3.1 vector AV:L/AC:H/UI:R. No public exploit has been identified and the vulnerability is not listed in CISA KEV, though the high confidentiality and integrity impacts are significant for environments where Hyperion hosts sensitive financial or enterprise planning data.
SQL-based compromise of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows a network-accessible, high-privileged attacker to gain unauthorized read and write access to all critical data managed by the platform. The vulnerability resides in the Installation and Configuration component and requires no user interaction once network SQL access is established. No public exploit code has been identified at time of analysis, and the flaw is not listed in the CISA KEV catalog, though the 'Authentication Bypass' tag attached to this CVE warrants scrutiny given the high-privilege prerequisite in the CVSS vector.
Local privilege escalation of read access in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows a low-privileged local attacker to gain unauthorized access to all data accessible by the Hyperion installation, including potentially sensitive configuration secrets and credentials stored during installation. The vulnerability resides in the Installation and Configuration component, tagged as an authentication bypass, suggesting an internal authorization control can be circumvented by an already-authenticated local user. No public exploit exists at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Unauthorized read access to data in Oracle Hyperion Calculation Manager 11.2.25.0.000 is achievable by unauthenticated network attackers via HTTP, exploiting a flaw in the Security component tagged as an Authentication Bypass. The attack carries high complexity (AC:H), substantially limiting opportunistic exploitation, and impacts only a subset of accessible data with no integrity or availability consequences. No public exploit code or active exploitation in the wild has been identified at time of analysis; Oracle disclosed this through their August 2026 Critical Security Patch Update.
SQL-level data manipulation in Oracle Hyperion Calculation Manager version 11.2.25.0.000 enables a highly privileged, network-connected attacker to perform unauthorized read, insert, update, and delete operations against a subset of accessible application data through the Security component. Impact is constrained to partial confidentiality and integrity loss with no availability consequence, yielding a vendor-assigned CVSS 3.1 base score of 3.8. No active exploitation or public proof-of-concept has been identified at time of analysis; Oracle addressed this in its August 2026 Critical Patch Update.
Unauthorized data modification in Oracle Hyperion Calculation Manager 11.2.25.0.000 allows a low-privileged, network-accessible attacker to perform unsanctioned insert, update, or delete operations against accessible application data via HTTP. Exploitation requires human interaction from a third party, indicating a client-side or social-engineering attack vector such as CSRF or a crafted link. No public exploit code exists and this CVE is not listed in the CISA KEV catalog; with a CVSS 3.1 score of 3.5 and integrity-only impact, this represents a low-severity, low-urgency finding in most enterprise risk frameworks.
Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 exposes a low-severity flaw in its Common Security component that permits a highly privileged, network-adjacent attacker to perform unauthorized data modifications and induce a partial denial of service via HTTP. The CVSS 3.1 base score of 3.3 reflects genuinely constrained exploitability - both high attack complexity and pre-existing high-privilege access are required before any impact is possible. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated network-accessible data disclosure in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 exposes critical or complete confidentiality of data via HTTP, requiring human interaction from a victim to complete the attack. Tagged as an Authentication Bypass in the Common Security component, a remote attacker can circumvent authentication controls to read sensitive data accessible to the Hyperion platform. No public exploit has been identified at time of analysis, and the vulnerability is addressed in Oracle's August 2026 Critical Patch Update.
Authentication bypass in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 enables unauthenticated remote attackers to partially read and modify data within the Common Events component via HTTP under high-complexity conditions. Disclosed through Oracle's August 2026 Critical Patch Update (EUVD-2026-61525), the flaw carries a CVSS 3.1 score of 4.8 (Medium), reflecting limited impact scope and difficult exploitation prerequisites. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at the time of analysis.
Limited-impact local privilege abuse in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows an already-privileged local attacker to gain unauthorized read and write access to a restricted subset of Hyperion data. Exploitation requires both local logon access to the infrastructure host and high-level existing privileges, making this extremely constrained in scope. No public exploit code and no active exploitation (CISA KEV) have been identified; the overall risk is low and consistent with the CVSS 3.1 score of 3.0.
Unauthorized read access in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is exposed via an authentication bypass in the Installation and Configuration component, reachable over HTTP without credentials. An unauthenticated remote attacker can exploit this to read a subset of data accessible to the affected component, potentially including configuration or operational metadata. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Unauthenticated information disclosure in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 exposes the Common Events component to remote attackers over HTTP with no credentials, privileges, or user interaction required. The authentication bypass - flagged explicitly by Oracle's security team (secalert_us@oracle.com) - allows attackers to read a subset of platform data accessible to the component. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the zero-complexity attack vector makes opportunistic reconnaissance straightforward for any attacker with network access to the Hyperion server.
Unauthorized data disclosure in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows a low-privileged attacker with HTTP network access to read critical or all accessible data within the platform's Common Security component. The vulnerability is tagged as an authentication bypass, suggesting that an already-authenticated low-privilege user can escalate their data access beyond authorized scope. No public exploit code or active exploitation has been identified at this time, but the low attack complexity makes it a credible lateral movement or data exfiltration vector in environments where Oracle Hyperion is internet-facing or accessible to untrusted internal users.
Oracle Hyperion Infrastructure Technology 11.2.25.0.000 exposes a network-accessible vulnerability in its Common Security component that permits unauthenticated remote attackers to compromise data confidentiality and integrity via HTTP, provided a victim user interacts with attacker-controlled content. The CVSS scope-change designation (S:C) indicates successful exploitation can extend impact to additional Oracle Hyperion products sharing the same infrastructure. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the 'Authentication Bypass' tag in the intelligence data warrants attention as it may signal higher practical impact than the Medium CVSS score implies.
Full takeover of Oracle Shipping Execution (versions 12.2.3-12.2.15) within Oracle E-Business Suite is achievable by a high-privileged, network-based attacker over HTTP when high-complexity conditions are satisfied. Despite requiring elevated privileges and difficult attack conditions, successful exploitation yields complete compromise of confidentiality, integrity, and availability - effectively a system takeover of the Shipping Execution module. No public exploit code or CISA KEV listing has been identified at time of analysis, though the vulnerability is disclosed via Oracle's August 2026 Critical Patch Update.
Partial unauthorized data read in Oracle Hyperion Calculation Manager 11.2.25.0.000 is achievable by an unauthenticated remote attacker via HTTP, though exploitation is rated difficult and requires human interaction from a third party. The vulnerability is tagged as an authentication bypass in the Security component, resulting in low-severity confidentiality exposure with no integrity or availability impact (CVSS 3.1: 3.1). No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this firmly in the low-priority tier for most organizations.
Unauthorized data disclosure in Oracle Hyperion Calculation Manager 11.2.25.0.000 allows a low-privileged, network-accessible attacker to read a subset of application data via HTTP, with confirmed scope change indicating potential exposure of data in adjacent Oracle components. The vulnerability is tagged 'Authentication Bypass' by the reporter, suggesting the attacker can circumvent internal security controls despite holding a low-privilege account. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthorized data exposure in Oracle Hyperion Calculation Manager version 11.2.25.0.000 allows unauthenticated remote attackers to read a subset of application-accessible data via HTTP, exploiting an authentication bypass in the Security component. The CVSS 3.1 score of 5.3 (Medium) reflects low-complexity, no-privilege-required network exploitation with limited confidentiality impact and no integrity or availability consequences. No public exploit code has been identified and this CVE does not appear on the CISA Known Exploited Vulnerabilities catalog at time of analysis.
Unauthorized data access and manipulation in Oracle Hyperion Calculation Manager 11.2.25.0.000 is achievable by low-privileged network attackers via HTTP, exploiting a weakness in the product's Security component tagged as an authentication bypass. Successful exploitation permits an authenticated attacker to read a subset of accessible EPM data and perform unauthorized insert, update, or delete operations against accessible data stores, with no availability impact. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; it is addressed in Oracle's Critical Patch Update for August 2026.
Confidentiality compromise in Oracle Hyperion Calculation Manager 11.2.25.0.000 allows unauthenticated remote attackers to gain unauthorized access to critical or complete data accessible within the application via HTTP. The attack vector is network-based but requires high attack complexity and human interaction from a victim other than the attacker, limiting opportunistic exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, though the Authentication Bypass tag suggests the underlying flaw bypasses access controls in the Security component.
High-privileged local exploitation of Oracle Hyperion Calculation Manager 11.2.25.0.000 allows an attacker with existing infrastructure logon to bypass Security component controls, gaining full read access to critical Hyperion data and limited write access to accessible records, with a scope change indicating spillover risk to additional Oracle Hyperion products. The attack is confined to insiders or adversaries who have already achieved a high-privilege foothold on the Hyperion infrastructure, making this most relevant to insider threat models and post-compromise lateral movement scenarios. No public exploit code has been identified at time of analysis; Oracle addressed this vulnerability in the August 2026 Critical Patch Update.
Unauthorized data exposure in Oracle Java SE's Networking component allows unauthenticated remote attackers via HTTP to access critical or all data accessible to the affected Java process, with a confirmed scope change that can impact systems and products beyond the JDK's own security boundary. Affected versions span a wide range across Oracle Java SE (8u501 through 26.0.2), Oracle GraalVM for JDK (17.0.20 and 21.0.12), and Oracle GraalVM Enterprise Edition (21.3.19), covering both server-side Java API consumers and client-side Java Web Start or sandboxed applet deployments. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog; however, the breadth of affected LTS versions and the ubiquity of Java in enterprise environments make patch prioritization appropriate.
Local privilege escalation with scope change in Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 exposes critical data to a low-privileged local attacker. The Enterprise Manager Install component can be compromised by an authenticated local user under difficult but achievable conditions, with successful exploitation yielding complete confidentiality breach of all data accessible to the platform - including data from additional managed products due to scope change. No public exploit code has been identified at time of analysis, and CISA KEV confirmation is absent.
Unauthenticated remote access to Oracle Learning Management (E-Business Suite versions 12.2.3 through 12.2.15) enables attackers to read, insert, update, or delete subsets of application data via HTTP without any credentials. Tagged as an authentication bypass in the Internal Operations component, this vulnerability exposes organizations running these specific EBS versions to unauthorized data manipulation affecting confidentiality and integrity. No public exploit code or active exploitation has been identified at time of analysis, but the low-complexity, no-authentication attack profile warrants prompt patching under Oracle's August 2026 Critical Patch Update.
Authorization bypass in Oracle Public Sector Financials (International) - a government-focused module of Oracle E-Business Suite versions 12.2.3 through 12.2.15 - permits low-privileged, network-authenticated attackers to read sensitive financial records, perform unauthorized data manipulation (insert, update, delete), and cause a partial denial of service against the affected module via standard HTTP. Oracle disclosed this in the August 2026 Critical Security Patch Update; no public exploit code has been identified and the vulnerability is not listed in CISA KEV at the time of analysis. With a CVSS 3.1 score of 6.3 (Medium), this is a mid-tier priority that warrants timely patching particularly for public sector organizations where financial data integrity is a regulatory obligation.
Oracle Unified Directory versions 12.2.1.4.0 and 14.1.2.1.0 expose a network-exploitable authentication bypass over LDAP that grants low-privileged attackers full read and write control over directory data. Despite a moderate CVSS base score of 6.8 driven down by high attack complexity (AC:H), successful exploitation yields complete confidentiality and integrity compromise of all OUD-accessible data - a severe outcome for identity and directory infrastructure. No public exploit code or active exploitation has been identified at time of analysis; Oracle disclosed the issue as part of the Critical Patch Update for August 2026.
Unauthorized data access in Oracle PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 allows a low-privileged, authenticated network attacker to read a subset of PeopleTools data and perform unauthorized insert, update, or delete operations via the Panel Processor component, with a confirmed scope change meaning successful exploitation can extend impact to additional dependent products. The attack carries high complexity and requires human interaction from a third-party victim. No public exploit code has been identified and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, though Oracle's tagging of 'Authentication Bypass' suggests the Panel Processor may allow privilege escalation beyond what the attacker's credential level should permit.
Unauthenticated remote data compromise affects Oracle Service Delivery Platform 14.1.2.0.0 via its Messaging Enabler component, reachable over HTTP without credentials. The authentication bypass allows network attackers to read a subset of platform data and perform unauthorized insert, update, or delete operations against accessible data stores. No public exploit code or active exploitation has been identified at time of analysis, and Oracle addressed this in the August 2026 Critical Patch Update.
Unauthorized confidential data access in Oracle Service Delivery Platform (Fusion Middleware, Messaging Enabler component) is achievable by network-adjacent high-privileged attackers over HTTP, with a scope change that can impact additional Fusion Middleware products beyond the primary target. Affected versions are 14.1.2.0.0 and 12.2.1.4.0. Classified as 'easily exploitable' by Oracle, the flaw carries a CVSS 3.1 score of 6.8 with scope change flagged - though no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthorized read access in Oracle Helidon 3.2.20's Imperative Web Server component allows unauthenticated network attackers to bypass authentication controls via HTTP and retrieve a limited subset of application data. The vulnerability is tagged as an Authentication Bypass and is difficult to exploit due to high attack complexity (AC:H), materially reducing real-world risk despite the network-accessible attack vector. No active exploitation is confirmed and no public exploit code has been identified at time of analysis. The CVSS score of 3.7 accurately reflects the low-severity nature: limited data exposure with no integrity or availability impact.
Unauthorized data exposure in Oracle Workflow (E-Business Suite 12.2.3-12.2.15) allows a low-privileged, network-authenticated attacker to read all data accessible within the Oracle Workflow system via the Worklist HTTP component. Oracle classifies this as easily exploitable in its August 2026 Critical Patch Update, with a High confidentiality impact and no integrity or availability effects. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Unauthenticated remote compromise of Oracle Hyperion Financial Reporting 11.2.25.0.000 allows network-adjacent attackers to read a subset of financial reporting data and perform unauthorized insert, update, or delete operations against Repository data via HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N) combined with the 'Authentication Bypass' tag confirms that no credentials are required and exploitation is straightforward against exposed instances. No patch bypass, public exploit code, or CISA KEV listing has been identified at time of analysis, though Oracle classifies this as 'easily exploitable.'
Oracle Java SE's Security component across all current LTS and preview releases - versions 8u501 through 26.0.2 - along with GraalVM for JDK and GraalVM Enterprise Edition, permits unauthenticated remote attackers to read a limited subset of data via crafted API inputs delivered through web services. Despite the network-accessible, zero-authentication vector (AV:N/PR:N/UI:N), the high attack complexity (AC:H) and confined confidentiality impact (C:L) constrain real-world risk, yielding a CVSS 3.1 base score of 3.7. No public exploit code and no CISA KEV listing have been identified at time of analysis, and Oracle disclosed this finding through its standard August 2026 Critical Patch Update cycle rather than an emergency out-of-band advisory.
Server-Side Request Forgery in FUXA 1.3.2 and earlier allows authenticated non-admin runtime users to weaponize the FUXA server as an outbound HTTP proxy, reading responses from internal services and cloud metadata endpoints. The vulnerability exists in the device-webapi-request Socket.IO handler, which applies no ownership or allowlist validation to the user-controlled property.address parameter before issuing the request. Patch is available as of version 1.3.3; no public exploit code or CISA KEV listing identified at time of analysis.
Arbitrary file read via path traversal in MobSF prior to 4.5.1 allows authenticated users with scan-upload permissions to exfiltrate server-side files by embedding traversal sequences in the android:icon attribute of a crafted AndroidManifest.xml inside a ZIP or APK upload. The vulnerable find_icon_path_zip() function resolves the attacker-controlled icon path without containment checks, copies the target file to a predictable location in DWD_DIR, and exposes it through the /download/ endpoint. A fully functional proof-of-concept script is publicly available in the GHSA advisory; this issue is not listed in the CISA KEV catalog.
Unauthenticated Server-Side Request Forgery in MagicMirror² versions prior to 2.37.0 allows any network-reachable attacker to weaponize the smart mirror as an internal network probe. By connecting to the unguarded Socket.IO `/newsfeed` namespace and emitting a `CHECK_ARTICLE_URL` notification with an attacker-controlled URL, the server performs an unsanitized `fetch()` HEAD request and returns timing and framing data via `ARTICLE_URL_STATUS`, creating a boolean-plus-timing oracle for internal host and port enumeration. A proof-of-concept exploit is documented in the GHSA advisory; no confirmed active exploitation (CISA KEV) has been reported.
LDAP injection in Red Hat Quay 3's external LDAP authentication handler allows unauthenticated network attackers to inject filter metacharacters into LDAP queries when the directory server returns a referral response. Exploitation enables user-existence oracle attacks against the referral Directory Name and can potentially influence which Distinguished Name is used during password binding in multi-domain Active Directory environments. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog; however, the network-accessible attack vector and lack of authentication requirement elevate practical concern for organizations using LDAP-integrated Quay deployments.
Authenticated users with Perm.Download=false can extract cryptographic content hashes (MD5, SHA1, SHA256, SHA512) for any file within their scope via filebrowser's /api/resources?checksum= endpoint, bypassing the intended download permission gate. The resourceGetHandler's checksum branch reads entire file content to compute digests but omits the Perm.Download check enforced by all sibling handler paths (raw, preview, subtitle). This is an incomplete remediation of CVE-2026-35606; no public exploit is identified at time of analysis, and the CVSS 4.0 vector (PR:L, VC:L) confirms exploitation requires an authenticated session. The hash oracle enables content confirmation, change detection, and offline brute-force of low-entropy files without ever receiving the file bytes directly.
Template-literal code injection in TypeORM's migration:generate command allows an attacker with database schema write access to achieve arbitrary JavaScript execution on any host that loads the generated migration file. Affected are TypeORM npm versions prior to 0.3.31 (0.x branch) and versions 1.0.0 through 1.0.x (fixed in 1.1.0), spanning PostgreSQL, MySQL, MariaDB, and CockroachDB drivers. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis; however, the GHSA advisory provides sufficient technical detail to reproduce the attack.
RSA PKCS#1 v1.5 decryption in Oberon Microsystems AG's ocrypto library (versions 3.0.0 through 4.0.0) leaks padding validity through measurable timing differences, enabling Bleichenbacher-style padding oracle attacks that allow plaintext recovery. Affected systems must be running one of the vulnerable library versions and the attacker requires local access and the ability to submit multiple crafted decryption requests while capturing precise timing data. Vendor-released patch version 4.0.1 is available; no public exploit has been identified at time of analysis.
Timing-based padding oracle attack in Oberon Microsystems AG's Oberon PSA Crypto library (versions 1.0.0 through 2.1.0) enables plaintext recovery from RSA PKCS#1 v1.5-encrypted ciphertext. An attacker capable of submitting decryption requests and measuring response timing can exploit observable timing discrepancies during padding validation - a Bleichenbacher-class attack - to iteratively deduce encrypted data. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog; however, the confidentiality impact is rated High as successful exploitation yields full plaintext recovery.
Filesystem existence and readability probing in Budibase Cloud's MongoDB integration prior to version 3.40.1 exposes an information-disclosure oracle exploitable by authenticated builders. The `tlsCertificateKeyFile` and `tlsCAFile` fields in the MongoDB datasource configuration were passed unsanitized to the MongoDB driver as server-side filesystem paths, enabling a builder to probe arbitrary absolute paths on the shared multi-tenant server via `/api/datasources/verify` by comparing distinct driver error messages. No CISA KEV listing exists, but the GHSA advisory contains a fully working reproduction command; the vulnerability is specific to Budibase Cloud and does not affect self-hosted deployments.
Missing NETWORK ACL enforcement across Velociraptor's upload_azure, upload_sftp, upload_smb, upload_gcs, and related VQL plugins allows an authenticated analyst-role user to force the server to initiate outbound TCP connections to arbitrary attacker-controlled endpoints. This bypasses the intended NETWORK ACL permission boundary - a role separation control designed to prevent analysts from triggering server-side network activity - enabling port-oracle-based reconnaissance of the server's internal network segments and potential data exfiltration to external destinations. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation is bounded by the requirement for analyst-role authentication.
Query injection and oracle enumeration in Ash Framework (ash-project/ash) versions 1.52.0-rc.11 through pre-3.31.1 allow an attacker to forge a belongs_to relationship to a record whose identifier they cannot directly name, and to systematically recover secret lookup values via a comparison oracle. The root cause is a two-part failure in the managed_relationship on_lookup: :relate code path: client-supplied values reach Ash.Query.filter/2 without type-casting, so a nested map is interpreted as a filter predicate rather than a literal scalar, and the missing Ash.Query.limit(1) call lets Ash.read_one/2 distinguish zero, one, and multiple matches - converting boolean filter predicates into an oracle. No public exploit has been identified at time of analysis; a vendor patch is available at version 3.31.1.
Server-side request forgery in Flowise through 3.1.4 allows attackers to reach Oracle Cloud Infrastructure (OCI) and Alibaba Cloud instance metadata services by exploiting an incomplete deny-list in the SSRF guard (`httpSecurity.ts`). The DEFAULT_DENY_LIST omits the OCI metadata IP 192.0.0.192 and the Alibaba Cloud metadata IP 100.100.100.200, enabling credential theft from the cloud metadata layer. No public exploit identified at time of analysis in CISA KEV, but publicly available exploit code exists on GitHub, and the vendor's website now resolves to a sunset page, suggesting no official patch will be issued.
Cluster ID enumeration in SUSE Rancher exposes a reliable oracle via the unauthenticated `/v3/import/{token}_{clusterId}.yaml` endpoint, which performs cluster object retrieval before token validation. Remote unauthenticated attackers can distinguish valid cluster IDs (HTTP 502, triggered by a nil pointer dereference in `pkg/systemtemplate/private_registry.go` when private registry secrets exist) from non-existent ones (HTTP 200), leaking the presence and private-registry configuration status of clusters. This is not listed in CISA KEV and no public exploit code has been identified, but the zero-prerequisite network accessibility makes enumeration trivially scriptable.
Username enumeration is possible in PaperCut NG/MF via an observable timing side-channel in the authentication component, exploitable by unauthenticated remote attackers. The system conditionally executes password hash comparison only when a submitted username corresponds to a valid account, producing a measurable latency difference that reveals account existence. No public exploit code or CISA KEV listing has been identified at time of analysis; however, with a CVSS 4.0 score of 6.9 and an AV:N/PR:N vector, the attack surface is entirely remote and requires no credentials, making it accessible to any attacker with network reach to the login endpoint.
Information disclosure via path traversal in Pagy's I18n locale handler allows an attacker to verify the existence and readability of arbitrary
File existence oracle in Dompdf allows remote unauthenticated attackers to enumerate sensitive server-side files by exploiting a behavioral discrepancy in CSS @font-face processing. Crafted HTML containing thousands of @font-face declarations referencing local paths via the file:// protocol causes PHP memory exhaustion only when the target file exists, producing a detectable crash signal versus a clean render for non-existent files. Publicly available exploit code exists (detailed in the GHSA advisory); no KEV listing at time of analysis, but exploitation requires only a public HTTP endpoint that passes unsanitized HTML to Dompdf. A vendor-released patch (v3.1.6) is available.
Oracle Work in Process (part of Oracle E-Business Suite) versions 12.2.5 through 12.2.15 exposes an authorization flaw in its Internal Operations component, enabling a low-privileged authenticated attacker to perform unauthorized read, insert, update, and delete operations against accessible Work in Process data over HTTP. The scope change (S:C) in the CVSS vector confirms that successful exploitation can cascade to affect additional EBS modules beyond the directly targeted component. No public exploit code or CISA KEV listing has been identified at time of analysis, and the mandatory victim interaction requirement (UI:R) reduces opportunistic exploitation risk.
Unauthorized data access in Oracle HRMS (US) versions 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker to read critical or complete HR data via HTTP without requiring user interaction or elevated permissions. The vulnerability resides in the Internal Operations component of Oracle E-Business Suite and carries a CVSS 3.1 score of 6.5 with high confidentiality impact. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad version range spanning over a decade of releases make this a meaningful risk for any organization running unpatched Oracle EBS.
Unauthorized critical data disclosure in Oracle HRMS (US) versions 12.2.3 through 12.2.15 exposes complete read access to all HRMS-accessible data via network HTTP, with a confirmed scope change that can impact additional Oracle E-Business Suite modules beyond HRMS itself. The CVSS vector (PR:H, S:C, C:H) indicates a high-privileged authenticated attacker operating over the network with low complexity can breach data boundaries across co-deployed EBS components. An 'Authentication Bypass' tag in the intelligence feed creates analytical tension with the PR:H prerequisite and warrants vendor clarification; no public exploit code has been identified at time of analysis, and Oracle disclosed this issue via the July 2026 Critical Patch Update.
Oracle HRMS (US) Internal Operations component exposes complete HR dataset read access to any low-privileged authenticated attacker over HTTP. Versions 12.2.6 through 12.2.15 of Oracle E-Business Suite are confirmed affected, enabling an attacker holding even a basic EBS user account to bypass authorization controls and access all data visible to the HRMS application. No public exploit or CISA KEV listing exists at time of analysis, but the low attack complexity (AC:L) means exploitation is straightforward once initial credentials are obtained, making insider threat and credential-compromise scenarios the primary risk vector.
Unauthorized data access and partial denial of service in Oracle Advanced Benefits (E-Business Suite Self Service Benefits component) is achievable by low-privileged, network-authenticated attackers over HTTP. Versions 12.2.3 through 12.2.15 are confirmed affected, spanning a broad range of Oracle EBS deployments. Oracle classifies this as 'easily exploitable' in the July 2026 CPU; no public exploit identified at time of analysis and not listed in CISA KEV, but the low attack complexity and no user interaction requirement elevate realistic risk for organizations with internal threat actors or compromised credentials.
Oracle HCM Configuration Workbench versions 12.2.3 through 12.2.15, part of Oracle E-Business Suite, exposes its Install component to network-accessible exploitation by any low-privileged authenticated user over HTTP. Successful exploitation yields unauthorized read access to a subset of HCM data, unauthorized insert/update/delete capability against accessible data, and the ability to cause partial denial of service against the component. No public exploit code or active exploitation has been identified at time of analysis, and the vulnerability was disclosed as part of Oracle's Critical Patch Update for July 2026.
Import and Export component exploitation in Oracle Learning Management (Oracle E-Business Suite 12.2.3-12.2.15) allows a network-authenticated low-privileged user to partially read, manipulate, or delete LMS data and degrade service availability over HTTP. The flaw is rated CVSS 6.3 with low attack complexity and no user interaction required beyond a valid account. No public exploit code or CISA KEV listing has been identified at time of analysis, positioning this as a credible internal-threat-actor or compromised-credential risk rather than an opportunistic internet-facing attack.
Oracle Quality within Oracle E-Business Suite versions 12.2.3 through 12.2.15 exposes partial confidentiality, integrity, and availability compromise through its Quality Workbench HTML system component. A low-privileged authenticated attacker with HTTP network access can perform unauthorized read, write, and denial-of-service operations against Quality module data. No public exploit code or active exploitation has been identified at time of analysis; this vulnerability was disclosed by Oracle via the July 2026 Critical Patch Update.
Oracle HRMS (US) US Payroll - General component in Oracle E-Business Suite versions 12.2.3 through 12.2.15 exposes payroll data and service availability to low-privileged authenticated network attackers over HTTP. Successful exploitation yields partial unauthorized read of payroll records, unauthorized insert, update, or delete of accessible payroll data, and partial denial of service - impacts that are especially sensitive given the nature of US payroll information. Disclosed as part of Oracle's July 2026 Critical Patch Update, no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Oracle Succession Planning within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) exposes a medium-severity, network-exploitable vulnerability in the Succession Plan component that allows low-privileged attackers to read, modify, or partially disrupt succession planning data via HTTP. The CVSS 3.1 vector confirms low attack complexity with no user interaction required, making exploitation straightforward for any authenticated EBS user. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthorized access to critical data in Oracle Production Scheduling (versions 12.2.3 through 12.2.15) is achievable by unauthenticated remote attackers via a network-based authentication bypass in the Internal Operations component, though exploitation requires high attack complexity and human interaction from a third party. The confidentiality impact is complete - attackers can access all data accessible to Production Scheduling - while integrity and availability remain unaffected. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle disclosed this through the July 2026 Critical Patch Update.
Partial denial-of-service affecting Oracle Time and Labor (E-Business Suite versions 12.2.3 through 12.2.15) is exploitable by a low-privileged network attacker over HTTP under high-complexity conditions. Successful exploitation degrades availability of the Internal Operations component only, with zero confidentiality or integrity impact. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog, placing it at the low end of operational priority.
Integrity compromise in Oracle Time and Labor (E-Business Suite versions 12.2.3 through 12.2.15) allows a low-privileged, network-authenticated attacker to create, delete, or modify critical application data via HTTP under high-complexity conditions. The vulnerability resides in the Internal Operations component and is tagged as an Authentication Bypass, suggesting insufficient internal authorization enforcement rather than a perimeter access failure. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the I:H integrity impact makes successful exploitation consequential for workforce and payroll data integrity.
Cross-site scripting or request-forgery class vulnerability in Oracle Time and Labor (E-Business Suite component: Internal Operations) enables unauthenticated remote attackers to compromise confidentiality and integrity via HTTP when a victim user interacts with attacker-controlled content, with scope change indicating impact extends beyond the vulnerable component to additional E-Business Suite products. Affected deployments span versions 12.2.3 through 12.2.15. The Oracle July 2026 CPU addresses this; no public exploit code or CISA KEV listing has been identified at time of analysis.
Oracle Time and Labor (part of Oracle E-Business Suite) versions 12.2.3 through 12.2.15 allows a high-privileged, network-accessible attacker to achieve full confidentiality and integrity compromise of all accessible labor data, plus limited availability disruption via HTTP. The 'Authentication Bypass' tag in associated intelligence sources introduces a notable discrepancy with the CVSS PR:H rating - if the flaw enables privilege escalation or access-control bypass within the product, the effective impact of an already-privileged session would be materially higher than the base CVSS score of 6.7 suggests. No public exploit code exists and exploitation is not confirmed by CISA KEV at time of analysis.
Confidential data exposure in Oracle Contracts Integration (Oracle E-Business Suite) versions 12.2.3 through 12.2.15 enables a low-privileged authenticated attacker with HTTP network access to bypass internal authorization controls in the Internal Operations component, gaining unauthorized access to critical or all accessible contract data. The CVSS confidentiality impact is rated High despite the moderate overall score of 5.3, reflecting complete in-scope data exposure when exploitation succeeds. No public exploit code or active exploitation has been identified at time of analysis; the high attack complexity (AC:H) constrains real-world opportunistic risk.
Partial authorization bypass in Oracle Contracts Integration (Oracle E-Business Suite 12.2.3-12.2.15) allows an authenticated low-privileged network attacker to perform unauthorized read, insert, update, or delete operations against a subset of contract data via HTTP under high-complexity conditions. Tagged as an Authentication Bypass, suggesting the flaw permits a low-privileged session to exceed its intended access boundary within the Internal Operations component. No public exploit code or CISA KEV listing has been identified at time of analysis, and the high attack complexity substantially limits opportunistic exploitation.
Unauthorized data manipulation in Oracle Contracts Integration (versions 12.2.3-12.2.15) allows a low-privileged authenticated attacker over HTTP to create, delete, or modify critical contract data without proper authorization. The 'Authentication Bypass' tag in source intelligence conflicts with the CVSS PR:L metric - this appears to be an authorization bypass within the Internal Operations component rather than a full authentication bypass, permitting privilege escalation beyond the attacker's intended access scope. Disclosed as part of Oracle's July 2026 Critical Patch Update; no public exploit has been identified at time of analysis.
Unauthorized data manipulation and read access in Oracle Contracts Integration (E-Business Suite 12.2.3-12.2.15) is achievable by unauthenticated network attackers over HTTP when a victim user interacts with a crafted request. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) combined with the reported 'Authentication Bypass' tag indicates a web-injection pattern - most likely reflected or stored Cross-Site Scripting - within the Internal Operations component, where a successful attack can pivot beyond the directly vulnerable module to affect adjacent Oracle EBS components due to scope change. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog.
Oracle Contracts Integration within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) exposes a network-accessible HTTP endpoint susceptible to exploitation by unauthenticated remote attackers, contingent on high attack complexity and required victim interaction. Successful exploitation yields limited unauthorized read access to a subset of Contracts Integration data, unauthorized data manipulation (insert, update, delete), and partial denial of service against the component. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists; the AC:H and UI:R constraints substantially lower real-world exploitation likelihood relative to the raw CVSS vector.
Oracle Contracts Integration (E-Business Suite Internal Operations component, versions 12.2.3-12.2.15) exposes a network-accessible authentication bypass that allows unauthenticated remote attackers to create, delete, or modify critical contract data via HTTP. The attack requires high complexity (AC:H), indicating specific timing, system state, or protocol conditions must be satisfied - ruling out trivial mass exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the Authentication Bypass tag combined with PR:N and network exposure makes this a meaningful integrity risk for organizations running Oracle EBS in environments reachable from untrusted networks.
Integrity compromise in Oracle Project Contracts (E-Business Suite versions 12.2.3-12.2.15) exposes an authorization bypass in the Internal Operations component, allowing a low-privileged, network-authenticated attacker to perform unauthorized insert, update, or delete operations on accessible contract data via HTTP. The tag 'Authentication Bypass' from the EUVD entry indicates the flaw permits a legitimately authenticated but restricted user to exceed their intended data-access boundaries within the application. No public exploit or CISA KEV listing exists at time of analysis, limiting immediate mass-exploitation risk, though the low attack complexity and no required user interaction make the vulnerability straightforwardly exploitable once an attacker holds any valid application credential.
Unauthorized data access in Oracle Public Sector Financials (component: Internal Operations) within Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker to read a subset of financial data and perform unauthorized insert, update, or delete operations via HTTP. The 'Authentication Bypass' tag associated with this vulnerability suggests the flaw may permit a low-privilege user to exceed their intended authorization scope within the Internal Operations component, rather than bypassing authentication entirely. No public exploit code or confirmed active exploitation has been identified at time of analysis, though Oracle's July 2026 Critical Patch Update addresses this issue.
Unauthorized read access to all data within Oracle Public Sector Financials (E-Business Suite versions 12.2.3-12.2.15) is achievable by a low-privileged attacker over HTTP, requiring no user interaction and no elevated privileges beyond a basic network account. The Internal Operations component fails to enforce appropriate access controls, enabling complete confidentiality compromise of government financial records. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog, though the 'Authentication Bypass' tag in available intelligence suggests the flaw may involve bypassing intra-application authorization rather than authentication itself.
Oracle Public Sector Financials (E-Business Suite component: Internal Operations) versions 12.2.3 through 12.2.15 allows an authenticated low-privileged network attacker to exploit an authorization control weakness via HTTP, requiring a victim user to interact with attacker-influenced content to trigger a scope change affecting additional Oracle EBS products. Successful exploitation yields unauthorized read access to a subset of data and unauthorized write/insert/delete capability against accessible data, with impact propagating beyond the directly targeted component. No public exploit code or CISA KEV listing has been identified at time of analysis, though the Oracle July 2026 CPU discloses this as part of a batch advisory.