Oracle
Monthly
The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and EPSS exploitation probability 94.0%.
Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 94.0%.
Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confidentiality and. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 91.5%.
Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect integrity and. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 88.4%.
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a crafted serialized Java object in T3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 63.0%.
Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 86.7%.
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 3.2.24, 4.0.26, 4.1.34, 4.2.26, and 4.3.12 allows local users to affect integrity and. Rated low severity (CVSS 3.6), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two different futex addresses, which allows local users to gain privileges via a. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Unspecified vulnerability in the Oracle Event Processing component in Oracle Fusion Middleware 11.1.1.7.0 allows remote authenticated users to affect integrity via vectors related to CEP system. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 80.0%.
Multiple array index errors in programs that are automatically generated by VBox/HostServices/SharedOpenGL/crserverlib/server_dispatch.py in Oracle VirtualBox 4.2.x through 4.2.20 and 4.3.x before. Rated medium severity (CVSS 6.9). Public exploit code available and EPSS exploitation probability 12.0%.
Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Unspecified vulnerability in the Oracle Endeca Server component in Oracle Fusion Middleware 7.4.0 and 7.5.1.1 allows remote authenticated users to affect confidentiality and integrity via unknown. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 72.2%.
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthenticated attackers to execute arbitrary code and escape security restrictions. Affects Oracle JRE 5.0 through Update 45, 6 through Update 45, 7 through Update 21, and OpenJDK 7. Confirmed actively exploited (CISA KEV) with 93.22% EPSS probability and publicly available exploit code. Oracle released patches in June 2013 CPU addressing the vulnerability through image channel verification corrections.
Java Runtime Environment 7 Update 21 and earlier allows remote attackers to escape the Java sandbox and execute arbitrary code via insufficient access checks in the tracing/serviceability component. Publicly available exploit code exists for this medium-complexity network attack, which achieved a 92.14% EPSS score (100th percentile), indicating extremely high likelihood of exploitation. Oracle addressed this vulnerability in their June 2013 Critical Patch Update, though the exact nature of the serviceability component flaw was not fully disclosed by the vendor.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 7, allows remote attackers to affect integrity via unknown vectors. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable, no authentication required. Actively exploited in the wild (cisa kev) and public exploit code available.
Unspecified vulnerability in the Oracle WebCenter Content component in Oracle Fusion Middleware 10.1.3.5.1 and 11.1.1.6.0 allows remote authenticated users to affect availability via unknown vectors. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 68.9%.
The Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 6 and 7, allows remote attackers to execute arbitrary code via unspecified vectors involving. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 86.3%.
The color management (CMM) functionality in the 2D component in Oracle Java SE 7 Update 15 and earlier, 6 Update 41 and earlier, and 5.0 Update 40 and earlier allows remote attackers to execute. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 93.0%.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, and OpenJDK 7, allows user-assisted remote attackers to bypass the Java security. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using the public getMBeanInstantiator method in the JmxMBeanServer class to obtain a. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
MySQL 5.5.19 and possibly other versions, and MariaDB 5.5.28a and possibly other versions, when configured to assign the FILE privilege to users who should not have administrative privileges, allows. Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 88.8%.
Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0 allows remote attackers to affect confidentiality and integrity via. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 91.2%.
Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0 allows remote attackers to affect confidentiality and integrity via. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3.0 allows remote attackers to affect integrity via unknown vectors related to. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 14.5%.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers to affect confidentiality, integrity, and availability via. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 79.3%.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers to affect confidentiality, integrity, and availability,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, and 6 Update 35 and earlier, allows remote attackers to affect confidentiality,. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 65.9%.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName methods, enabling complete sandbox escape for untrusted applets. Massively exploited by exploit kits in 2012.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris 11 and earlier; illumos before r13724; Joyent. Rated high severity (CVSS 7.2), this vulnerability is low attack complexity. Public exploit code available and EPSS exploitation probability 88.0%.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0 Update 33 and earlier allows remote attackers to. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Unspecified vulnerability in the Oracle WebCenter Forms Recognition component in Oracle Fusion Middleware 10.1.3.5 allows remote attackers to affect confidentiality, integrity, and availability via. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 39.6%.
Unspecified vulnerability in the Oracle AutoVue Office component in Oracle Supply Chain Products Suite 20.1.1 allows remote attackers to affect confidentiality, integrity, and availability, related. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 85.1%.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and JavaFX 2.0.2 and earlier allows remote untrusted Java. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 74.9%.
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise through malicious Java Web Start applications and untrusted applets exploiting the Scripting component. CISA KEV confirms active exploitation in the wild. EPSS score of 92.59% (100th percentile) indicates extremely high probability of mass exploitation. Public exploit code exists, making this a critical priority for any environment running affected Java versions despite the vulnerability's age.
Local file disclosure in Stirling-PDF 2.13.1: the SVG-to-PDF converter (POST /api/v1/convert/svg/pdf) renders attacker-supplied SVG through Apache Batik with a hard-coded file:///input.svg document base, so an image reference written as a scheme-less root-relative path (for example /C:/Users/.../secret.svg) defeats both the SVG sanitizer's external-URL check and Batik's same-origin resource policy, and any server file Batik can decode as an image is embedded into the PDF returned to the caller. The flaw works in the default configuration (disableSanitize=false) and requires no admin role; it is fully unauthenticated on login-disabled deployments, while with login enabled any authenticated non-admin user can trigger it because the controller carries no role check. Impact is bounded: only PNG/JPG/GIF/SVG paths can be read, text/binary files, directories, XInclude text and external entities do not leak, and the existence oracle distinguishes only decodable images - reflected in the CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/C:L). The issue is fixed in 2.13.2; a public proof-of-concept is published in the GHSA advisory and was reproduced end-to-end against a source build, and no confirmed active exploitation is reported.
Read-only mode in Bytebase DBHub before 0.22.6 can be bypassed on the MySQL and MariaDB connectors, allowing write and destructive DDL statements such as DROP TABLE to reach the database through the MCP execute-SQL tool. The root cause is an interpretation conflict: DBHub's scanner treats every '--' as a line comment, while MySQL and MariaDB only start a comment when whitespace follows, so a payload like 'SELECT 1--1;DROP TABLE victim' passes the read-only classifier and is still executed in full because the connectors run with multipleStatements enabled. Unauthenticated remote attackers must be able to influence the SQL the assistant issues - most realistically via prompt injection in content the assistant reads - and read-only mode must actually be enabled for the bypass to matter; a proof-of-concept payload is documented in the public advisory, no confirmed public exploit code or CISA KEV entry exists at time of analysis, and the issue is fixed in 0.22.6.
Botan's online OCSP client in versions up to and including 3.12.0 follows a single HTTP redirect issued in response to the revocation-status POST, letting a malicious OCSP responder or an on-path attacker who can modify the HTTP response push the client into a blind request against an otherwise unreachable internal HTTP service. The request carries no cookies or credentials, the response is never returned to the attacker, and in 3.12.0 a redirect-handling bug reduced the redirected POST to a bodyless GET, so practical impact is limited to blind SSRF against internal endpoints with non-idempotent GET handlers plus a coarse internal-service oracle derived from connection and response timing. The flaw is fixed in Botan 3.13.0, which disables redirects by default; no public exploit code was identified at time of analysis, and this is assessed as a medium-severity defense-in-depth issue rather than an urgent priority.
Server-side request forgery (CWE-918) in Psono Server CE and EE versions 0.1.0 through 7.2.3 allows an authenticated remote user to supply an arbitrary host when configuring a personal Duo MFA device, which the server then passes to the Duo client without a host allowlist or explicit timeout. Because connections still require valid TLS certificates and are confined to HTTPS on port 443, an attacker gains only a failure-mode oracle for internal DNS resolution and service reachability, plus the ability to tie up a server worker against unresponsive targets until the operating-system timeout. No public exploit is identified at time of analysis, EPSS is low at 0.24% (15th percentile), and the risk posture aligns with patching on a normal cycle; the vendor has released 7.2.4 with the fix.
Bleichenbacher padding-oracle weakness in erlang-jose's pure-Erlang RSAES-PKCS1-v1_5 decryption (jose 1.3.0 through before 1.11.13) can let an unauthenticated attacker who knows only the public RSA key recover plaintext from intercepted RSA1_5 JWE content-encryption keys via roughly 10^4 to 10^6 adaptive chosen-ciphertext queries. Exploitation requires an application that unwraps RSA1_5 JWE keys with jose and exposes the decryption outcome, either as distinguishable return values (recovered key versus error) or as observable timing; the direct return-value oracle applies when the pure-Erlang jose_jwa_pkcs1 backend is active. No CISA KEV entry or confirmed active exploitation was identified, EPSS is 0.09%, and a public PoC reference exists but it is not verified as working exploit code.
Blind server-side request forgery in WWBN AVideo before 29.4.0 allows authenticated users with uploader privileges to make the server issue GET requests to arbitrary internal hosts by storing a videoLink that points to an attacker-controlled redirector. The initial URL passes isSSRFSafeURL(), but get_headers() follows the 302 without re-validating the redirect target, and the resulting embed-versus-video render difference gives a blind oracle for internal port and service reachability. Only a limited confidentiality/integrity impact is achievable (CVSS 5.3, PR:L, scope-changed) and no public exploit code or confirmed active exploitation was identified at time of analysis; a vendor patch exists in 29.4.0.
Local privilege escalation in Checkmk 2.5.0p14 allows a low-privileged local user to execute code as root on monitored hosts where the Checkmk agent runs the 'mk-oracle' plugin, by writing a malicious library into an Oracle client library directory of an Oracle home listed in 'oratab', or by modifying 'oratab' itself. Exploitation requires three simultaneous preconditions - local access to the host, the non-default mk-oracle plugin explicitly enabled, and write permission to those Oracle paths - so opportunistic or remote exploitation is infeasible, and no public exploit code was identified at time of analysis (not listed in CISA KEV). Impact is rated on a scope-changed model because the root-run agent process can affect components beyond the plugin itself.
Slack Morphism 1.0.0 through 2.27.0 writes the correct Slack request HMAC into its error output when signature verification fails, so anyone who can both hit the app's Slack callback endpoint and read its application or service logs can use the verifier as a chosen-message HMAC oracle and replay a fully signed request within Slack's five-minute freshness window - without ever knowing the signing secret. The exposure only occurs in deployments using the default Axum or Hyper listener error handler, which logs `SlackEventWrongSignatureError` (including the public `generated_hash` field) at error level; applications with a custom handler that suppresses the hash are not affected. The vendor released 2.28.0 to remove the expected signature from the error type, and no public exploit code has been identified at time of analysis; real-world risk is bounded by the mandatory log-read access, the tight replay window, and the fact that a forged request is confined to the exact body and timestamp the oracle signed.
A local privilege-escalation-style flaw in Oracle Essbase 21.8.3.0.0's Java Based Agent component lets an attacker who already holds a low-privileged logon on the Essbase host read, modify, or delete sensitive data managed by the product. Because the vector is AV:L/AC:H/PR:L/UI:N/S:C, exploitation requires local access plus a condition outside the attacker's control, and the scope change means co-located products on the same host may also be compromised. No public exploit code or confirmed active exploitation was identified at time of analysis, and the moderate CVSS 3.1 base score of 6.4 reflects confidentiality-heavy impact with only partial integrity loss.
Oracle Essbase 21.8.3.0.0 contains a Security-component flaw that allows an authenticated low-privileged user with HTTP network access to cause a partial denial of service. The CVSS 3.1 score is 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L), so only availability is lightly affected and no confidentiality or integrity impact is possible; the required account is the main limiting factor. No public exploit code was identified at time of analysis, and no CISA KEV entry is present.
Oracle Essbase 21.8.3.0.0 has a Security-component flaw that allows a low-privileged authenticated attacker with HTTP network access to read a limited subset of Essbase data; the only impacted dimension is confidentiality, giving CVSS 3.1 score 4.3. Exploitation is low-complexity and requires no user interaction, but it is not open to fully unauthenticated outsiders because a valid low-privileged account is needed. No public exploit code or confirmed active exploitation was identified at time of analysis, and the supplied advisory does not name any affected version other than 21.8.3.0.0.
Oracle Essbase 21.8.3.0.0 exposes a Security-component flaw that lets an authenticated low-privileged attacker with network HTTP access read and modify a subset of accessible data and cause a partial denial of service. The CVSS 3.1 score is 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), so exploitation requires a valid Essbase account but no user interaction or elevated privileges. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was provided.
Low-privileged users with valid Essbase credentials can read a subset of data they should not be able to access through the Security component of Oracle Essbase 21.8.3.0.0 over HTTP, with the scope change flag indicating that disclosed data may extend into additional connected products. The issue is rated CVSS 5.0 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) - moderate severity and not high priority, because the authentication prerequisite means the attacker must already hold a low-level account, pointing to insider or post-compromise scenarios rather than anonymous internet exploitation. No public exploit code was identified and the flaw is not in CISA KEV; the primary exposure for defenders is unpatched Essbase deployments reachable over HTTP from untrusted networks.
Unauthorized read access to a subset of data in Oracle Essbase 21.8.3.0.0 is possible for unauthenticated network attackers through the Java Based Agent over HTTP, but the high attack complexity makes successful exploitation difficult. This is a low-priority, confidentiality-only issue with no integrity or availability impact and no public exploit identified at time of analysis.
High-privileged local users on hosts running Oracle Essbase 21.8.3.0.0 can obtain unauthorized read access to critical Essbase data through a flaw in the Java Based Agent component, and because the scope is changed the exposed data may include that of other products on the same host. The CVSS 3.1 score is 6.0 (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N), a confidentiality-only impact that requires an existing interactive logon and administrator-level privileges rather than network reachability. No public exploit code or CISA KEV entry was identified at time of analysis, and patching is available through the referenced Oracle Critical Patch Update.
Oracle Essbase 21.8.3.0.0's Java Based Agent can expose a limited subset of accessible data to an unauthenticated network attacker over TCP. The CVSS 3.1 base score is 5.3 with a confidentiality-only impact (C:L; no integrity or availability impact), and the assessed vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. No public exploit was identified at time of analysis, and practical risk is concentrated in deployments that expose the Essbase agent port and hold sensitive data in the readable subset.
Oracle Essbase 21.8.3.0.0 contains a difficult-to-exploit unauthenticated network vulnerability in its Security component reachable through T3 and IIOP listeners. A remote attacker who can reach those interfaces and satisfy a high-complexity precondition could read a limited subset of data, perform unauthorized insert, update, or delete operations, and cause a partial denial of service; no public exploit code or active exploitation has been identified at time of analysis. The moderate CVSS 3.1 score of 5.6 reflects limited confidentiality, integrity, and availability impact combined with high attack complexity.
An unauthenticated information-disclosure flaw in the Security component of Oracle Essbase 21.8.3.0.0 allows a remote attacker with HTTP network access to read a limited subset of data the application can access, without requiring credentials or user interaction. Confidentiality impact is partial (C:L) with no integrity or availability effect, giving a CVSS 3.1 base score of 5.3. No public exploit code or confirmed active exploitation was identified at time of analysis; the practical risk is concentrated on internet-reachable or weakly segmented Essbase HTTP deployments.
Unauthenticated remote attackers with HTTP access to the Java-based Agent in Oracle Essbase 21.8.3.0.0 can read a subset of accessible data through an easily exploitable confidentiality flaw (CVSS 3.1 base 5.3). The issue is network-reachable, low-complexity, and requires no user interaction, but its impact is limited to low confidentiality with no integrity or availability effects. No public exploit identified at time of analysis; exposure is the main risk factor, so deployments that restrict the agent endpoint to trusted networks reduce reachability.
Oracle Essbase 21.8.3.0.0 contains an access-control weakness in its Security component that lets an authenticated low-privileged user reach data beyond their intended authorization boundary over HTTP, exposing a limited subset of readable data (CVSS 3.1 base 5.0, AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N). Because the scope is changed, the disclosed data can flow into other products integrated with Essbase, so real-world impact depends on deployment topology. No public exploit code has been identified at time of analysis and the issue is not known to be actively exploited; Oracle addresses it in its October 2026 Critical Patch Update.
An information-disclosure flaw in Oracle Essbase's Security component (affecting release 21.8.3.0.0) lets a low-privileged account holder reach the server over HTTP and read a subset of Essbase-accessible data they should not see. Because the CVSS scope is changed (S:C), the exposed data can extend beyond Essbase into other dependent products, though integrity and availability are unaffected (I:N/A:N); the requirement for a valid account (PR:L) keeps the barrier to entry moderate. At time of analysis there is no public exploit identified, and the vendor has published an advisory in its October 2026 Critical Patch Update.
Oracle Essbase 21.8.3.0.0 exposes a confidentiality weakness through its WebLogic-based T3 and IIOP remote invocation listeners, letting network-reachable attackers bypass authentication and read a subset of the data the Essbase server can access. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 5.3) confirms no credentials or user interaction are needed, but impact is bounded to partial confidentiality with no integrity or availability effect. This is a moderate-severity issue rather than a top-tier priority; no public exploit code or confirmed active exploitation (CISA KEV) is identified in the available data, and exploitation depends on T3/IIOP being exposed rather than restricted to internal management networks.
Oracle Essbase 21.8.3.0.0 contains a Security-component flaw that allows a high-privileged local attacker to obtain unauthorized access to critical Essbase-accessible data, with scope change extending impact to additional products. Exploitation requires an authenticated logon to the host infrastructure (PR:H, AV:L) and no user interaction. No public exploit was identified at time of analysis, and Oracle addressed the issue in its October 2026 Critical Patch Update advisory.
Authenticated low-privileged users of Oracle Essbase 21.8.3.0.0 can exploit a Security component access-control weakness over HTTP to read a limited subset of data they should not be able to access, and because the CVSS vector sets scope change (S:C), exposed data may extend to additional integrated products. The flaw is rated CVSS 3.1 5.0 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N), so exploitation requires a valid low-privilege account and network reachability to the HTTP interface; no user interaction is needed and complexity is low. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Oracle Essbase 21.8.3.0.0 can disclose critical data to a high-privileged, authenticated attacker over HTTP through a flaw in the Security component. The 6.8 CVSS 3.1 score reflects high confidentiality impact and a scope change (S:C) that can extend exposure to connected products, but exploitation requires an existing high-privileged account (PR:H), making this a moderate-priority risk rather than an unauthenticated remote compromise. No public exploit code or confirmed active exploitation (CISA KEV) is identified at time of analysis.
Local low-privileged users on a host running Oracle Communications Billing and Revenue Management 15.x can exploit a high-complexity flaw in the Platform component to obtain unauthorized read access to confidential data managed by the application. Only deployments on 15.0.0.0.0, 15.0.1.0.0.0, 15.1.0.0.0 and 15.2.0.0.0 are affected, and the CVSS 3.1 score is 4.7 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N), with no integrity or availability impact. Exploitation requires an attacker to already hold a valid low-privileged logon to the underlying infrastructure and to satisfy conditions outside their direct control (AC:H); there is no public exploit identified at time of analysis and the issue is not in CISA KEV, so realistic exposure is largely limited to insiders or attackers who have already compromised the host.
Oracle BRM 15.x can expose critical billing and revenue data to a low-privileged user who already has local logon access to the BRM Server host. The flaw affects Oracle Communications Billing and Revenue Management versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, and 15.2.0.0.0; per the CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) it is a local, authenticated, low-complexity confidentiality-only issue rather than remote unauthenticated access. No public exploit was identified at time of analysis.
Oracle Fusion Middleware's Remote Diagnostic Agent component, within Oracle Middleware Common Libraries and Tools, allows a low-privileged user who already has local logon access to the host to read critical data, affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The CVSS 5.5 vector is confidentiality-only (C:H/I:N/A:N) and requires local authenticated access (AV:L/PR:L/UI:N), with no remote network path. No public exploit has been identified at time of analysis.
Remote, unauthenticated read access to a limited subset of diagnostic data in Oracle Fusion Middleware Common Libraries and Tools 12.2.1.4.0 and 14.1.1.0.0 is possible through the Remote Diagnostic Agent over HTTP, but exploitation is difficult (AC:H) and depends on conditions outside the attacker's control. Oracle's October 2026 CPU assigns a low CVSS 3.1 base score of 3.7 with confidentiality-only impact (C:L), and no public exploit code or confirmed active exploitation has been identified at time of analysis. Real-world risk is substantially lower where diagnostic and management endpoints are not exposed to untrusted networks.
Oracle Database Server's Java VM (Oracle JVM/OJVM) component carries an integrity-only flaw affecting versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3, reachable by a low-privileged account with network access through the SOCKS5 pathway. Oracle explicitly rates the issue as difficult to exploit (AC:H), and impact is limited to unauthorized creation, deletion, or modification of critical and Java VM-accessible data, with a scope change (S:C) meaning additional products can be affected; confidentiality and availability are unaffected. This is a moderate-priority issue rather than a top-tier emergency, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Oracle Communications Unified Inventory Management (versions 7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0 and 8.0.1) contains a low-severity confidentiality flaw in its Security component that lets a low-privileged attacker who already holds a valid local logon to the hosting infrastructure read a subset of application data. The attack is local only (AV:L, PR:L, UI:N) with no integrity or availability impact, so exposure is confined to insiders or attackers who have already established a foothold on the host. No public exploit code or CISA KEV active-exploitation signal was identified at time of analysis, and EPSS-style risk is correspondingly modest given the mandatory local access and pre-existing account.
Oracle Communications Unified Inventory Management (UIM) versions 7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0, and 8.0.1 expose a low-severity confidentiality weakness that lets an attacker who already holds a low-privileged logon on the UIM host read a subset of data the application would otherwise restrict. Per the independent assessment this is a genuinely low-priority issue: the local-access prerequisite (CVSS AV:L/PR:L) and the read-only, partial confidentiality impact (C:L, no integrity or availability effect) confine realistic exploitation to insiders or attackers who have already established a foothold on the infrastructure. There is no evidence of active exploitation (no CISA KEV listing), no public exploit code identified at time of analysis, and the reported tags reference authentication bypass, though the assessed vector and Oracle's scoring describe a local, authenticated information-read condition rather than a remotely reachable bypass.
Low-privileged local users of Oracle Communications Unified Inventory Management 7.5.0 through 8.0.1 can read a subset of application data they should not be able to access, with no write or availability impact. The issue is rated CVSS 3.1 base 3.3 and requires an attacker to already have a valid low-privileged logon on the host running UIM (AV:L/PR:L), so remote unauthenticated exploitation is not possible. No public exploit code or active exploitation has been identified at time of analysis.
Authenticated data disclosure in Oracle REST Data Services (ORDS) 24.2.0 through 26.2.1 lets a low-privileged attacker with HTTP network access read critical data - potentially all data accessible through ORDS - via the GraphQL component (CVSS 3.1 base 6.5, C:H/I:N/A:N). Exploitation requires a valid low-privileged account and a reachable, GraphQL-enabled ORDS endpoint, and is confined to confidentiality impact with no integrity or availability effect. No public exploit code has been identified at time of analysis, and Oracle addresses the flaw in its October 2026 Critical Patch Update.
Authenticated low-privileged users can read a subset of Oracle Business Intelligence Enterprise Edition data they are not authorized to see in versions 8.2.0.0.0 and 26.01.0.0.0, through the Analytics Server component exposed over HTTP. The flaw is easily triggered once an attacker holds any valid low-privilege account (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3), and it grants no write, integrity, or availability impact. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, so real-world priority is moderate-to-low and driven mainly by the population of low-privilege accounts on internet- or partner-reachable BI deployments.
Oracle BI EE 26.01.0.0.0 permits a low-privileged authenticated attacker with HTTP access to the Visual Analyzer component to read a subset of accessible data, with no user interaction and low attack complexity. This is a confidentiality-only, moderate-to-low priority issue (CVSS 3.1 4.3) that requires a valid low-privileged session per PR:L, so it is not a pre-authentication bypass. No public exploit identified at time of analysis.
A low-privileged authenticated user with network access to the Majel Mobile Service component of Oracle Business Intelligence Enterprise Edition can read a subset of BI-accessible data without authorization, affecting versions 8.2.0.0.0 and 26.01.0.0.0. The flaw is easily triggered over HTTP with no user interaction and low attack complexity, but its impact is confined to partial confidentiality loss (CVSS 3.1 base score 4.3, AV:N/AC:L/PR:L/UI:N/C:L/I:N/A:N). No public exploit code or confirmed active exploitation was identified at time of analysis, and the practical risk is moderated by the requirement for a valid low-privileged account and the read-only nature of the exposure.
Oracle BI Publisher's Web Service API exposes limited read and write access to a low-privileged account holder who can persuade another user to interact with a crafted request, and the scope change means connected Oracle products may also be affected. Only versions 8.2.0.0.0 and 26.01.0.0.0 are listed as affected, and exploitation is constrained by the need for valid credentials plus victim interaction. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Unauthorized creation, deletion, or modification of data in Oracle BIEE's BI Search component affects versions 8.2.0.0.0 and 12.2.1.4.0. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) describes an unauthenticated network attacker who must convince another user to interact with crafted HTTP content; impact is integrity-only, with no confidentiality or availability loss. This is a moderate-priority issue rather than a top-tier one, and no public exploit code was identified at time of analysis.
A partial denial of service can be triggered in Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 through the BI Search component, which is reachable over HTTP by an unauthenticated network attacker (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I/A:L, base score 3.7). Oracle characterizes the flaw as 'difficult to exploit,' meaning success depends on server-side conditions outside the attacker's direct control, and the only consequence is reduced availability of the BI service - there is no confidentiality or integrity impact. At time of analysis there is no public exploit identified, no CISA KEV listing, and no EPSS signal provided, so this is a low-priority availability nuisance rather than a realistic attack path; remediation is nonetheless available through Oracle's October 2026 Critical Patch Update advisory.
Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 allows an authenticated low-privileged user with HTTP access to the BI Platform Security component to read and modify a limited subset of BIEE data, with scope change that may affect additional Oracle products. The vector requires a valid low-tier account and no user interaction, so exposure depends on externally reachable or untrusted low-privileged BIEE accounts. It is a real-but-not-urgent, medium-severity priority; no public exploit code or CISA KEV active exploitation is identified at time of analysis.
Information disclosure in Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 lets a low-privileged, authenticated remote attacker with HTTP access read sensitive Analytics Server data, with a CVSS 3.1 base score of 6.5; integrity and availability are unaffected. No public exploit identified at time of analysis, and no CISA KEV entry is provided, so this is a moderate-severity exposure rather than an emergency. Risk rises where BI EE is internet-facing or hosts multi-tenant data with weak account segregation.
Oracle BI Publisher 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0 can disclose critical or all application-accessible data to an authenticated low-privileged attacker who can reach the BI Publisher Security component over HTTP. CVSS 6.5 reflects network attack, low complexity, required low privileges, no user interaction, and confidentiality-only impact with unchanged scope. No public exploit code or CISA KEV entry was identified at time of analysis, so this should be handled as a routine-but-real patching item.
Authenticated low-privileged users with HTTP access to Oracle Agile Product Lifecycle Management for Process 6.2.4 can exploit a high-complexity flaw in the Product Quality Management component to gain broad read access to critical data, make limited unauthorized data changes, and trigger a partial denial of service. The issue carries a CVSS 3.1 base score of 6.4 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L); the high attack-complexity rating means successful exploitation depends on conditions outside the attacker's direct control. No public exploit code or confirmed active exploitation (CISA KEV) was identified in the available intelligence at time of analysis.
PeopleSoft Enterprise FIN Inventory Brazil 9.1 allows a low-privileged user with local logon access to the infrastructure running the Inventory component to modify or delete some accessible inventory data and to cause a partial denial of service. The CVSS 3.1 score is 4.4 with a local attack vector, low privileges required, no user interaction, and only low integrity and availability impact; confidentiality is unaffected. No public exploit was identified at time of analysis, and this is not reported as confirmed actively exploited (CISA KEV).
Local tampering and partial denial of service against the Integration component of Oracle PeopleSoft Enterprise FIN Manufacturing Brazil 9.1 requires only a low-privileged authenticated logon on the host where the application runs. An attacker meeting that precondition can perform unauthorized insert, update, or delete operations on data reachable through the integration interfaces and degrade availability of the module, with no confidentiality impact (CVSS 3.1 base 4.4, AV:L/PR:L/UI:N). There is no public exploit identified at time of analysis and the flaw is not in CISA KEV; the mandatory local logon plus the narrow scope of a single Brazil localization release keeps this a low-to-moderate priority item.
Unauthenticated, network-reachable content injection in the Web Server component of Oracle BI Publisher allows an attacker to craft a link or served page that, once a victim is induced to interact with it, can read and modify a limited subset of BI Publisher data - and because the vector carries a scope change (S:C), the injected content executes in the victim's context and may affect resources beyond the vulnerable component itself. Affected releases are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0, all of which are reachable over HTTP with no credentials required of the attacker (PR:N), though the attack cannot succeed without a human in the loop (UI:R). The CVSS 3.1 base score is 6.1 with Low confidentiality and integrity impact; no public exploit code has been identified at time of analysis and the CVE is not in CISA KEV, so it should be triaged as moderate rather than critical.
Unauthenticated HTTP access to Oracle BI Publisher 12.2.1.4.0 can allow a remote attacker to read a subset of accessible data and perform limited unauthorized updates, inserts, or deletions through the Web Server component. The issue is network-reachable, low-complexity, and requires no user interaction (CVSS 3.1 6.5), but impact is limited to partial confidentiality and integrity effects with no availability impact. No public exploit code or CISA KEV active exploitation is identified in the provided data, so no public exploit identified at time of analysis.
PeopleSoft Enterprise FIN Product Configurator Brazil 9.1 permits a low-privileged user who already has local logon access to the host to tamper with some Product Configurator data and degrade availability, with no confidentiality impact (CVSS 4.4). The exposure is limited to sites running the Brazil localization of the FIN Product Configurator and requires both local access and pre-existing credentials, so there is no remote or unauthenticated path. No public exploit code has been identified and the flaw is not in CISA KEV; this is a low-to-moderate priority issue, not a high-urgency one.
The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and EPSS exploitation probability 94.0%.
Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 94.0%.
Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confidentiality and. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 91.5%.
Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect integrity and. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 88.4%.
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a crafted serialized Java object in T3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 63.0%.
Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 86.7%.
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 3.2.24, 4.0.26, 4.1.34, 4.2.26, and 4.3.12 allows local users to affect integrity and. Rated low severity (CVSS 3.6), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two different futex addresses, which allows local users to gain privileges via a. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Unspecified vulnerability in the Oracle Event Processing component in Oracle Fusion Middleware 11.1.1.7.0 allows remote authenticated users to affect integrity via vectors related to CEP system. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 80.0%.
Multiple array index errors in programs that are automatically generated by VBox/HostServices/SharedOpenGL/crserverlib/server_dispatch.py in Oracle VirtualBox 4.2.x through 4.2.20 and 4.3.x before. Rated medium severity (CVSS 6.9). Public exploit code available and EPSS exploitation probability 12.0%.
Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Unspecified vulnerability in the Oracle Endeca Server component in Oracle Fusion Middleware 7.4.0 and 7.5.1.1 allows remote authenticated users to affect confidentiality and integrity via unknown. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 72.2%.
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthenticated attackers to execute arbitrary code and escape security restrictions. Affects Oracle JRE 5.0 through Update 45, 6 through Update 45, 7 through Update 21, and OpenJDK 7. Confirmed actively exploited (CISA KEV) with 93.22% EPSS probability and publicly available exploit code. Oracle released patches in June 2013 CPU addressing the vulnerability through image channel verification corrections.
Java Runtime Environment 7 Update 21 and earlier allows remote attackers to escape the Java sandbox and execute arbitrary code via insufficient access checks in the tracing/serviceability component. Publicly available exploit code exists for this medium-complexity network attack, which achieved a 92.14% EPSS score (100th percentile), indicating extremely high likelihood of exploitation. Oracle addressed this vulnerability in their June 2013 Critical Patch Update, though the exact nature of the serviceability component flaw was not fully disclosed by the vendor.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 7, allows remote attackers to affect integrity via unknown vectors. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable, no authentication required. Actively exploited in the wild (cisa kev) and public exploit code available.
Unspecified vulnerability in the Oracle WebCenter Content component in Oracle Fusion Middleware 10.1.3.5.1 and 11.1.1.6.0 allows remote authenticated users to affect availability via unknown vectors. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 68.9%.
The Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 6 and 7, allows remote attackers to execute arbitrary code via unspecified vectors involving. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 86.3%.
The color management (CMM) functionality in the 2D component in Oracle Java SE 7 Update 15 and earlier, 6 Update 41 and earlier, and 5.0 Update 40 and earlier allows remote attackers to execute. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 93.0%.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, and OpenJDK 7, allows user-assisted remote attackers to bypass the Java security. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using the public getMBeanInstantiator method in the JmxMBeanServer class to obtain a. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
MySQL 5.5.19 and possibly other versions, and MariaDB 5.5.28a and possibly other versions, when configured to assign the FILE privilege to users who should not have administrative privileges, allows. Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 88.8%.
Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0 allows remote attackers to affect confidentiality and integrity via. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 91.2%.
Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0 allows remote attackers to affect confidentiality and integrity via. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3.0 allows remote attackers to affect integrity via unknown vectors related to. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 14.5%.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers to affect confidentiality, integrity, and availability via. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 79.3%.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers to affect confidentiality, integrity, and availability,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, and 6 Update 35 and earlier, allows remote attackers to affect confidentiality,. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 65.9%.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName methods, enabling complete sandbox escape for untrusted applets. Massively exploited by exploit kits in 2012.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris 11 and earlier; illumos before r13724; Joyent. Rated high severity (CVSS 7.2), this vulnerability is low attack complexity. Public exploit code available and EPSS exploitation probability 88.0%.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0 Update 33 and earlier allows remote attackers to. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Unspecified vulnerability in the Oracle WebCenter Forms Recognition component in Oracle Fusion Middleware 10.1.3.5 allows remote attackers to affect confidentiality, integrity, and availability via. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 39.6%.
Unspecified vulnerability in the Oracle AutoVue Office component in Oracle Supply Chain Products Suite 20.1.1 allows remote attackers to affect confidentiality, integrity, and availability, related. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 85.1%.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and JavaFX 2.0.2 and earlier allows remote untrusted Java. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 74.9%.
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise through malicious Java Web Start applications and untrusted applets exploiting the Scripting component. CISA KEV confirms active exploitation in the wild. EPSS score of 92.59% (100th percentile) indicates extremely high probability of mass exploitation. Public exploit code exists, making this a critical priority for any environment running affected Java versions despite the vulnerability's age.
Local file disclosure in Stirling-PDF 2.13.1: the SVG-to-PDF converter (POST /api/v1/convert/svg/pdf) renders attacker-supplied SVG through Apache Batik with a hard-coded file:///input.svg document base, so an image reference written as a scheme-less root-relative path (for example /C:/Users/.../secret.svg) defeats both the SVG sanitizer's external-URL check and Batik's same-origin resource policy, and any server file Batik can decode as an image is embedded into the PDF returned to the caller. The flaw works in the default configuration (disableSanitize=false) and requires no admin role; it is fully unauthenticated on login-disabled deployments, while with login enabled any authenticated non-admin user can trigger it because the controller carries no role check. Impact is bounded: only PNG/JPG/GIF/SVG paths can be read, text/binary files, directories, XInclude text and external entities do not leak, and the existence oracle distinguishes only decodable images - reflected in the CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/C:L). The issue is fixed in 2.13.2; a public proof-of-concept is published in the GHSA advisory and was reproduced end-to-end against a source build, and no confirmed active exploitation is reported.
Read-only mode in Bytebase DBHub before 0.22.6 can be bypassed on the MySQL and MariaDB connectors, allowing write and destructive DDL statements such as DROP TABLE to reach the database through the MCP execute-SQL tool. The root cause is an interpretation conflict: DBHub's scanner treats every '--' as a line comment, while MySQL and MariaDB only start a comment when whitespace follows, so a payload like 'SELECT 1--1;DROP TABLE victim' passes the read-only classifier and is still executed in full because the connectors run with multipleStatements enabled. Unauthenticated remote attackers must be able to influence the SQL the assistant issues - most realistically via prompt injection in content the assistant reads - and read-only mode must actually be enabled for the bypass to matter; a proof-of-concept payload is documented in the public advisory, no confirmed public exploit code or CISA KEV entry exists at time of analysis, and the issue is fixed in 0.22.6.
Botan's online OCSP client in versions up to and including 3.12.0 follows a single HTTP redirect issued in response to the revocation-status POST, letting a malicious OCSP responder or an on-path attacker who can modify the HTTP response push the client into a blind request against an otherwise unreachable internal HTTP service. The request carries no cookies or credentials, the response is never returned to the attacker, and in 3.12.0 a redirect-handling bug reduced the redirected POST to a bodyless GET, so practical impact is limited to blind SSRF against internal endpoints with non-idempotent GET handlers plus a coarse internal-service oracle derived from connection and response timing. The flaw is fixed in Botan 3.13.0, which disables redirects by default; no public exploit code was identified at time of analysis, and this is assessed as a medium-severity defense-in-depth issue rather than an urgent priority.
Server-side request forgery (CWE-918) in Psono Server CE and EE versions 0.1.0 through 7.2.3 allows an authenticated remote user to supply an arbitrary host when configuring a personal Duo MFA device, which the server then passes to the Duo client without a host allowlist or explicit timeout. Because connections still require valid TLS certificates and are confined to HTTPS on port 443, an attacker gains only a failure-mode oracle for internal DNS resolution and service reachability, plus the ability to tie up a server worker against unresponsive targets until the operating-system timeout. No public exploit is identified at time of analysis, EPSS is low at 0.24% (15th percentile), and the risk posture aligns with patching on a normal cycle; the vendor has released 7.2.4 with the fix.
Bleichenbacher padding-oracle weakness in erlang-jose's pure-Erlang RSAES-PKCS1-v1_5 decryption (jose 1.3.0 through before 1.11.13) can let an unauthenticated attacker who knows only the public RSA key recover plaintext from intercepted RSA1_5 JWE content-encryption keys via roughly 10^4 to 10^6 adaptive chosen-ciphertext queries. Exploitation requires an application that unwraps RSA1_5 JWE keys with jose and exposes the decryption outcome, either as distinguishable return values (recovered key versus error) or as observable timing; the direct return-value oracle applies when the pure-Erlang jose_jwa_pkcs1 backend is active. No CISA KEV entry or confirmed active exploitation was identified, EPSS is 0.09%, and a public PoC reference exists but it is not verified as working exploit code.
Blind server-side request forgery in WWBN AVideo before 29.4.0 allows authenticated users with uploader privileges to make the server issue GET requests to arbitrary internal hosts by storing a videoLink that points to an attacker-controlled redirector. The initial URL passes isSSRFSafeURL(), but get_headers() follows the 302 without re-validating the redirect target, and the resulting embed-versus-video render difference gives a blind oracle for internal port and service reachability. Only a limited confidentiality/integrity impact is achievable (CVSS 5.3, PR:L, scope-changed) and no public exploit code or confirmed active exploitation was identified at time of analysis; a vendor patch exists in 29.4.0.
Local privilege escalation in Checkmk 2.5.0p14 allows a low-privileged local user to execute code as root on monitored hosts where the Checkmk agent runs the 'mk-oracle' plugin, by writing a malicious library into an Oracle client library directory of an Oracle home listed in 'oratab', or by modifying 'oratab' itself. Exploitation requires three simultaneous preconditions - local access to the host, the non-default mk-oracle plugin explicitly enabled, and write permission to those Oracle paths - so opportunistic or remote exploitation is infeasible, and no public exploit code was identified at time of analysis (not listed in CISA KEV). Impact is rated on a scope-changed model because the root-run agent process can affect components beyond the plugin itself.
Slack Morphism 1.0.0 through 2.27.0 writes the correct Slack request HMAC into its error output when signature verification fails, so anyone who can both hit the app's Slack callback endpoint and read its application or service logs can use the verifier as a chosen-message HMAC oracle and replay a fully signed request within Slack's five-minute freshness window - without ever knowing the signing secret. The exposure only occurs in deployments using the default Axum or Hyper listener error handler, which logs `SlackEventWrongSignatureError` (including the public `generated_hash` field) at error level; applications with a custom handler that suppresses the hash are not affected. The vendor released 2.28.0 to remove the expected signature from the error type, and no public exploit code has been identified at time of analysis; real-world risk is bounded by the mandatory log-read access, the tight replay window, and the fact that a forged request is confined to the exact body and timestamp the oracle signed.
A local privilege-escalation-style flaw in Oracle Essbase 21.8.3.0.0's Java Based Agent component lets an attacker who already holds a low-privileged logon on the Essbase host read, modify, or delete sensitive data managed by the product. Because the vector is AV:L/AC:H/PR:L/UI:N/S:C, exploitation requires local access plus a condition outside the attacker's control, and the scope change means co-located products on the same host may also be compromised. No public exploit code or confirmed active exploitation was identified at time of analysis, and the moderate CVSS 3.1 base score of 6.4 reflects confidentiality-heavy impact with only partial integrity loss.
Oracle Essbase 21.8.3.0.0 contains a Security-component flaw that allows an authenticated low-privileged user with HTTP network access to cause a partial denial of service. The CVSS 3.1 score is 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L), so only availability is lightly affected and no confidentiality or integrity impact is possible; the required account is the main limiting factor. No public exploit code was identified at time of analysis, and no CISA KEV entry is present.
Oracle Essbase 21.8.3.0.0 has a Security-component flaw that allows a low-privileged authenticated attacker with HTTP network access to read a limited subset of Essbase data; the only impacted dimension is confidentiality, giving CVSS 3.1 score 4.3. Exploitation is low-complexity and requires no user interaction, but it is not open to fully unauthenticated outsiders because a valid low-privileged account is needed. No public exploit code or confirmed active exploitation was identified at time of analysis, and the supplied advisory does not name any affected version other than 21.8.3.0.0.
Oracle Essbase 21.8.3.0.0 exposes a Security-component flaw that lets an authenticated low-privileged attacker with network HTTP access read and modify a subset of accessible data and cause a partial denial of service. The CVSS 3.1 score is 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), so exploitation requires a valid Essbase account but no user interaction or elevated privileges. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was provided.
Low-privileged users with valid Essbase credentials can read a subset of data they should not be able to access through the Security component of Oracle Essbase 21.8.3.0.0 over HTTP, with the scope change flag indicating that disclosed data may extend into additional connected products. The issue is rated CVSS 5.0 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) - moderate severity and not high priority, because the authentication prerequisite means the attacker must already hold a low-level account, pointing to insider or post-compromise scenarios rather than anonymous internet exploitation. No public exploit code was identified and the flaw is not in CISA KEV; the primary exposure for defenders is unpatched Essbase deployments reachable over HTTP from untrusted networks.
Unauthorized read access to a subset of data in Oracle Essbase 21.8.3.0.0 is possible for unauthenticated network attackers through the Java Based Agent over HTTP, but the high attack complexity makes successful exploitation difficult. This is a low-priority, confidentiality-only issue with no integrity or availability impact and no public exploit identified at time of analysis.
High-privileged local users on hosts running Oracle Essbase 21.8.3.0.0 can obtain unauthorized read access to critical Essbase data through a flaw in the Java Based Agent component, and because the scope is changed the exposed data may include that of other products on the same host. The CVSS 3.1 score is 6.0 (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N), a confidentiality-only impact that requires an existing interactive logon and administrator-level privileges rather than network reachability. No public exploit code or CISA KEV entry was identified at time of analysis, and patching is available through the referenced Oracle Critical Patch Update.
Oracle Essbase 21.8.3.0.0's Java Based Agent can expose a limited subset of accessible data to an unauthenticated network attacker over TCP. The CVSS 3.1 base score is 5.3 with a confidentiality-only impact (C:L; no integrity or availability impact), and the assessed vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. No public exploit was identified at time of analysis, and practical risk is concentrated in deployments that expose the Essbase agent port and hold sensitive data in the readable subset.
Oracle Essbase 21.8.3.0.0 contains a difficult-to-exploit unauthenticated network vulnerability in its Security component reachable through T3 and IIOP listeners. A remote attacker who can reach those interfaces and satisfy a high-complexity precondition could read a limited subset of data, perform unauthorized insert, update, or delete operations, and cause a partial denial of service; no public exploit code or active exploitation has been identified at time of analysis. The moderate CVSS 3.1 score of 5.6 reflects limited confidentiality, integrity, and availability impact combined with high attack complexity.
An unauthenticated information-disclosure flaw in the Security component of Oracle Essbase 21.8.3.0.0 allows a remote attacker with HTTP network access to read a limited subset of data the application can access, without requiring credentials or user interaction. Confidentiality impact is partial (C:L) with no integrity or availability effect, giving a CVSS 3.1 base score of 5.3. No public exploit code or confirmed active exploitation was identified at time of analysis; the practical risk is concentrated on internet-reachable or weakly segmented Essbase HTTP deployments.
Unauthenticated remote attackers with HTTP access to the Java-based Agent in Oracle Essbase 21.8.3.0.0 can read a subset of accessible data through an easily exploitable confidentiality flaw (CVSS 3.1 base 5.3). The issue is network-reachable, low-complexity, and requires no user interaction, but its impact is limited to low confidentiality with no integrity or availability effects. No public exploit identified at time of analysis; exposure is the main risk factor, so deployments that restrict the agent endpoint to trusted networks reduce reachability.
Oracle Essbase 21.8.3.0.0 contains an access-control weakness in its Security component that lets an authenticated low-privileged user reach data beyond their intended authorization boundary over HTTP, exposing a limited subset of readable data (CVSS 3.1 base 5.0, AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N). Because the scope is changed, the disclosed data can flow into other products integrated with Essbase, so real-world impact depends on deployment topology. No public exploit code has been identified at time of analysis and the issue is not known to be actively exploited; Oracle addresses it in its October 2026 Critical Patch Update.
An information-disclosure flaw in Oracle Essbase's Security component (affecting release 21.8.3.0.0) lets a low-privileged account holder reach the server over HTTP and read a subset of Essbase-accessible data they should not see. Because the CVSS scope is changed (S:C), the exposed data can extend beyond Essbase into other dependent products, though integrity and availability are unaffected (I:N/A:N); the requirement for a valid account (PR:L) keeps the barrier to entry moderate. At time of analysis there is no public exploit identified, and the vendor has published an advisory in its October 2026 Critical Patch Update.
Oracle Essbase 21.8.3.0.0 exposes a confidentiality weakness through its WebLogic-based T3 and IIOP remote invocation listeners, letting network-reachable attackers bypass authentication and read a subset of the data the Essbase server can access. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 5.3) confirms no credentials or user interaction are needed, but impact is bounded to partial confidentiality with no integrity or availability effect. This is a moderate-severity issue rather than a top-tier priority; no public exploit code or confirmed active exploitation (CISA KEV) is identified in the available data, and exploitation depends on T3/IIOP being exposed rather than restricted to internal management networks.
Oracle Essbase 21.8.3.0.0 contains a Security-component flaw that allows a high-privileged local attacker to obtain unauthorized access to critical Essbase-accessible data, with scope change extending impact to additional products. Exploitation requires an authenticated logon to the host infrastructure (PR:H, AV:L) and no user interaction. No public exploit was identified at time of analysis, and Oracle addressed the issue in its October 2026 Critical Patch Update advisory.
Authenticated low-privileged users of Oracle Essbase 21.8.3.0.0 can exploit a Security component access-control weakness over HTTP to read a limited subset of data they should not be able to access, and because the CVSS vector sets scope change (S:C), exposed data may extend to additional integrated products. The flaw is rated CVSS 3.1 5.0 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N), so exploitation requires a valid low-privilege account and network reachability to the HTTP interface; no user interaction is needed and complexity is low. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Oracle Essbase 21.8.3.0.0 can disclose critical data to a high-privileged, authenticated attacker over HTTP through a flaw in the Security component. The 6.8 CVSS 3.1 score reflects high confidentiality impact and a scope change (S:C) that can extend exposure to connected products, but exploitation requires an existing high-privileged account (PR:H), making this a moderate-priority risk rather than an unauthenticated remote compromise. No public exploit code or confirmed active exploitation (CISA KEV) is identified at time of analysis.
Local low-privileged users on a host running Oracle Communications Billing and Revenue Management 15.x can exploit a high-complexity flaw in the Platform component to obtain unauthorized read access to confidential data managed by the application. Only deployments on 15.0.0.0.0, 15.0.1.0.0.0, 15.1.0.0.0 and 15.2.0.0.0 are affected, and the CVSS 3.1 score is 4.7 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N), with no integrity or availability impact. Exploitation requires an attacker to already hold a valid low-privileged logon to the underlying infrastructure and to satisfy conditions outside their direct control (AC:H); there is no public exploit identified at time of analysis and the issue is not in CISA KEV, so realistic exposure is largely limited to insiders or attackers who have already compromised the host.
Oracle BRM 15.x can expose critical billing and revenue data to a low-privileged user who already has local logon access to the BRM Server host. The flaw affects Oracle Communications Billing and Revenue Management versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, and 15.2.0.0.0; per the CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) it is a local, authenticated, low-complexity confidentiality-only issue rather than remote unauthenticated access. No public exploit was identified at time of analysis.
Oracle Fusion Middleware's Remote Diagnostic Agent component, within Oracle Middleware Common Libraries and Tools, allows a low-privileged user who already has local logon access to the host to read critical data, affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The CVSS 5.5 vector is confidentiality-only (C:H/I:N/A:N) and requires local authenticated access (AV:L/PR:L/UI:N), with no remote network path. No public exploit has been identified at time of analysis.
Remote, unauthenticated read access to a limited subset of diagnostic data in Oracle Fusion Middleware Common Libraries and Tools 12.2.1.4.0 and 14.1.1.0.0 is possible through the Remote Diagnostic Agent over HTTP, but exploitation is difficult (AC:H) and depends on conditions outside the attacker's control. Oracle's October 2026 CPU assigns a low CVSS 3.1 base score of 3.7 with confidentiality-only impact (C:L), and no public exploit code or confirmed active exploitation has been identified at time of analysis. Real-world risk is substantially lower where diagnostic and management endpoints are not exposed to untrusted networks.
Oracle Database Server's Java VM (Oracle JVM/OJVM) component carries an integrity-only flaw affecting versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3, reachable by a low-privileged account with network access through the SOCKS5 pathway. Oracle explicitly rates the issue as difficult to exploit (AC:H), and impact is limited to unauthorized creation, deletion, or modification of critical and Java VM-accessible data, with a scope change (S:C) meaning additional products can be affected; confidentiality and availability are unaffected. This is a moderate-priority issue rather than a top-tier emergency, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Oracle Communications Unified Inventory Management (versions 7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0 and 8.0.1) contains a low-severity confidentiality flaw in its Security component that lets a low-privileged attacker who already holds a valid local logon to the hosting infrastructure read a subset of application data. The attack is local only (AV:L, PR:L, UI:N) with no integrity or availability impact, so exposure is confined to insiders or attackers who have already established a foothold on the host. No public exploit code or CISA KEV active-exploitation signal was identified at time of analysis, and EPSS-style risk is correspondingly modest given the mandatory local access and pre-existing account.
Oracle Communications Unified Inventory Management (UIM) versions 7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0, and 8.0.1 expose a low-severity confidentiality weakness that lets an attacker who already holds a low-privileged logon on the UIM host read a subset of data the application would otherwise restrict. Per the independent assessment this is a genuinely low-priority issue: the local-access prerequisite (CVSS AV:L/PR:L) and the read-only, partial confidentiality impact (C:L, no integrity or availability effect) confine realistic exploitation to insiders or attackers who have already established a foothold on the infrastructure. There is no evidence of active exploitation (no CISA KEV listing), no public exploit code identified at time of analysis, and the reported tags reference authentication bypass, though the assessed vector and Oracle's scoring describe a local, authenticated information-read condition rather than a remotely reachable bypass.
Low-privileged local users of Oracle Communications Unified Inventory Management 7.5.0 through 8.0.1 can read a subset of application data they should not be able to access, with no write or availability impact. The issue is rated CVSS 3.1 base 3.3 and requires an attacker to already have a valid low-privileged logon on the host running UIM (AV:L/PR:L), so remote unauthenticated exploitation is not possible. No public exploit code or active exploitation has been identified at time of analysis.
Authenticated data disclosure in Oracle REST Data Services (ORDS) 24.2.0 through 26.2.1 lets a low-privileged attacker with HTTP network access read critical data - potentially all data accessible through ORDS - via the GraphQL component (CVSS 3.1 base 6.5, C:H/I:N/A:N). Exploitation requires a valid low-privileged account and a reachable, GraphQL-enabled ORDS endpoint, and is confined to confidentiality impact with no integrity or availability effect. No public exploit code has been identified at time of analysis, and Oracle addresses the flaw in its October 2026 Critical Patch Update.
Authenticated low-privileged users can read a subset of Oracle Business Intelligence Enterprise Edition data they are not authorized to see in versions 8.2.0.0.0 and 26.01.0.0.0, through the Analytics Server component exposed over HTTP. The flaw is easily triggered once an attacker holds any valid low-privilege account (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3), and it grants no write, integrity, or availability impact. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, so real-world priority is moderate-to-low and driven mainly by the population of low-privilege accounts on internet- or partner-reachable BI deployments.
Oracle BI EE 26.01.0.0.0 permits a low-privileged authenticated attacker with HTTP access to the Visual Analyzer component to read a subset of accessible data, with no user interaction and low attack complexity. This is a confidentiality-only, moderate-to-low priority issue (CVSS 3.1 4.3) that requires a valid low-privileged session per PR:L, so it is not a pre-authentication bypass. No public exploit identified at time of analysis.
A low-privileged authenticated user with network access to the Majel Mobile Service component of Oracle Business Intelligence Enterprise Edition can read a subset of BI-accessible data without authorization, affecting versions 8.2.0.0.0 and 26.01.0.0.0. The flaw is easily triggered over HTTP with no user interaction and low attack complexity, but its impact is confined to partial confidentiality loss (CVSS 3.1 base score 4.3, AV:N/AC:L/PR:L/UI:N/C:L/I:N/A:N). No public exploit code or confirmed active exploitation was identified at time of analysis, and the practical risk is moderated by the requirement for a valid low-privileged account and the read-only nature of the exposure.
Oracle BI Publisher's Web Service API exposes limited read and write access to a low-privileged account holder who can persuade another user to interact with a crafted request, and the scope change means connected Oracle products may also be affected. Only versions 8.2.0.0.0 and 26.01.0.0.0 are listed as affected, and exploitation is constrained by the need for valid credentials plus victim interaction. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Unauthorized creation, deletion, or modification of data in Oracle BIEE's BI Search component affects versions 8.2.0.0.0 and 12.2.1.4.0. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) describes an unauthenticated network attacker who must convince another user to interact with crafted HTTP content; impact is integrity-only, with no confidentiality or availability loss. This is a moderate-priority issue rather than a top-tier one, and no public exploit code was identified at time of analysis.
A partial denial of service can be triggered in Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 through the BI Search component, which is reachable over HTTP by an unauthenticated network attacker (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I/A:L, base score 3.7). Oracle characterizes the flaw as 'difficult to exploit,' meaning success depends on server-side conditions outside the attacker's direct control, and the only consequence is reduced availability of the BI service - there is no confidentiality or integrity impact. At time of analysis there is no public exploit identified, no CISA KEV listing, and no EPSS signal provided, so this is a low-priority availability nuisance rather than a realistic attack path; remediation is nonetheless available through Oracle's October 2026 Critical Patch Update advisory.
Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 allows an authenticated low-privileged user with HTTP access to the BI Platform Security component to read and modify a limited subset of BIEE data, with scope change that may affect additional Oracle products. The vector requires a valid low-tier account and no user interaction, so exposure depends on externally reachable or untrusted low-privileged BIEE accounts. It is a real-but-not-urgent, medium-severity priority; no public exploit code or CISA KEV active exploitation is identified at time of analysis.
Information disclosure in Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 lets a low-privileged, authenticated remote attacker with HTTP access read sensitive Analytics Server data, with a CVSS 3.1 base score of 6.5; integrity and availability are unaffected. No public exploit identified at time of analysis, and no CISA KEV entry is provided, so this is a moderate-severity exposure rather than an emergency. Risk rises where BI EE is internet-facing or hosts multi-tenant data with weak account segregation.
Oracle BI Publisher 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0 can disclose critical or all application-accessible data to an authenticated low-privileged attacker who can reach the BI Publisher Security component over HTTP. CVSS 6.5 reflects network attack, low complexity, required low privileges, no user interaction, and confidentiality-only impact with unchanged scope. No public exploit code or CISA KEV entry was identified at time of analysis, so this should be handled as a routine-but-real patching item.
Authenticated low-privileged users with HTTP access to Oracle Agile Product Lifecycle Management for Process 6.2.4 can exploit a high-complexity flaw in the Product Quality Management component to gain broad read access to critical data, make limited unauthorized data changes, and trigger a partial denial of service. The issue carries a CVSS 3.1 base score of 6.4 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L); the high attack-complexity rating means successful exploitation depends on conditions outside the attacker's direct control. No public exploit code or confirmed active exploitation (CISA KEV) was identified in the available intelligence at time of analysis.
PeopleSoft Enterprise FIN Inventory Brazil 9.1 allows a low-privileged user with local logon access to the infrastructure running the Inventory component to modify or delete some accessible inventory data and to cause a partial denial of service. The CVSS 3.1 score is 4.4 with a local attack vector, low privileges required, no user interaction, and only low integrity and availability impact; confidentiality is unaffected. No public exploit was identified at time of analysis, and this is not reported as confirmed actively exploited (CISA KEV).
Local tampering and partial denial of service against the Integration component of Oracle PeopleSoft Enterprise FIN Manufacturing Brazil 9.1 requires only a low-privileged authenticated logon on the host where the application runs. An attacker meeting that precondition can perform unauthorized insert, update, or delete operations on data reachable through the integration interfaces and degrade availability of the module, with no confidentiality impact (CVSS 3.1 base 4.4, AV:L/PR:L/UI:N). There is no public exploit identified at time of analysis and the flaw is not in CISA KEV; the mandatory local logon plus the narrow scope of a single Brazil localization release keeps this a low-to-moderate priority item.
Unauthenticated, network-reachable content injection in the Web Server component of Oracle BI Publisher allows an attacker to craft a link or served page that, once a victim is induced to interact with it, can read and modify a limited subset of BI Publisher data - and because the vector carries a scope change (S:C), the injected content executes in the victim's context and may affect resources beyond the vulnerable component itself. Affected releases are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0, all of which are reachable over HTTP with no credentials required of the attacker (PR:N), though the attack cannot succeed without a human in the loop (UI:R). The CVSS 3.1 base score is 6.1 with Low confidentiality and integrity impact; no public exploit code has been identified at time of analysis and the CVE is not in CISA KEV, so it should be triaged as moderate rather than critical.
Unauthenticated HTTP access to Oracle BI Publisher 12.2.1.4.0 can allow a remote attacker to read a subset of accessible data and perform limited unauthorized updates, inserts, or deletions through the Web Server component. The issue is network-reachable, low-complexity, and requires no user interaction (CVSS 3.1 6.5), but impact is limited to partial confidentiality and integrity effects with no availability impact. No public exploit code or CISA KEV active exploitation is identified in the provided data, so no public exploit identified at time of analysis.
PeopleSoft Enterprise FIN Product Configurator Brazil 9.1 permits a low-privileged user who already has local logon access to the host to tamper with some Product Configurator data and degrade availability, with no confidentiality impact (CVSS 4.4). The exposure is limited to sites running the Brazil localization of the FIN Product Configurator and requires both local access and pre-existing credentials, so there is no remote or unauthenticated path. No public exploit code has been identified and the flaw is not in CISA KEV; this is a low-to-moderate priority issue, not a high-urgency one.