Oracle
Monthly
Oracle Applications Framework's Personalization component in E-Business Suite versions 12.2.9 through 12.2.15 allows an authenticated, high-privileged attacker to exceed intended authorization boundaries via HTTP, resulting in unauthorized data read, write, and partial denial of service against the framework. Root cause is CWE-284 (Improper Access Control), confirmed by Oracle's April 2026 Critical Patch Update. No public exploit code exists and EPSS sits at 0.03% (10th percentile), aligning with SSVC's 'Exploitation: none' assessment - this is a low-urgency, medium-severity finding gated entirely by the requirement for pre-existing high-privilege access.
Information disclosure in Oracle Agile Product Lifecycle Management for Process 6.2.4 allows low-privileged authenticated network attackers to read a subset of application data via HTTP through the Product Quality Management component. The vulnerability carries a CVSS 3.1 score of 4.3 and is classified as CWE-200, reflecting improper exposure of sensitive information. No public exploit code exists and no active exploitation has been identified; EPSS stands at 0.03% (8th percentile), consistent with SSVC's 'exploitation: none' signal.
PeopleSoft Enterprise SCM Purchasing 9.2 exposes critical procurement data to low-privileged authenticated attackers over HTTP, enabling complete unauthorized read access to all data within the Purchasing module. The flaw is rooted in improper access control (CWE-284), allowing a low-privileged PeopleSoft account holder to bypass post-authentication authorization restrictions and retrieve sensitive purchasing records they should not have access to. No public exploit code exists and EPSS sits at a very low 0.03%, but Oracle's April 2026 Critical Patch Update addresses the vulnerability and should be applied to any internet-facing or multi-tenant PeopleSoft deployment.
Improper access control in Oracle Identity Manager Connector 12.2.1.4.0 exposes the Microsoft Active Directory component to network-based exploitation via LDAP, enabling low-privileged authenticated attackers to perform unauthorized creation, deletion, or modification of critical data and read a subset of accessible data. The vulnerability carries a CVSS 3.1 score of 5.9 (Medium), tempered by high attack complexity (AC:H) and a near-zero EPSS of 0.03% (8th percentile). No public exploit code exists and no active exploitation has been reported; this is a real but difficult-to-trigger integrity-focused flaw in Oracle's enterprise identity management stack.
MySQL Server versions 8.0.0 through 8.0.45 expose a denial-of-service condition in the DML processing component, enabling a highly privileged, network-authenticated attacker to crash or hang the database server. Oracle patched this in the April 2026 Critical Patch Update; no active exploitation has been observed (EPSS 0.04%, 11th percentile; SSVC exploitation: none). The mandatory high-privilege authentication requirement significantly constrains the realistic attacker pool to insiders or post-compromise scenarios.
Oracle Identity Manager Connector 12.2.1.4.0 exposes a missing authentication control (CWE-306) in its Core component, reachable over HTTPS by unauthenticated network attackers. Successful exploitation yields unauthorized read access to critical data or complete access to all data accessible by the connector - a significant confidentiality breach in an identity governance system. No public exploit code has been identified at time of analysis, and EPSS at 0.03% (9th percentile) alongside SSVC's 'none' exploitation rating indicate low real-world exploitation pressure despite the network-accessible vector.
Unauthenticated network access to Oracle Identity Manager Connector 12.2.1.4.0 enables complete confidentiality compromise of all data accessible by the connector via an authentication bypass in its Core component. The flaw (CWE-306, Missing Authentication for Critical Function) is reachable over HTTP without credentials but carries high attack complexity, constraining exploitation to actors capable of meeting undisclosed preconditions. No active exploitation has been identified - EPSS sits at the 9th percentile (0.03%) and CISA SSVC rates it as non-automatable with partial technical impact - suggesting limited near-term risk despite the identity management context.
Cross-site scripting or improper access control in the Human Workflow component of Oracle Business Process Management Suite (versions 12.2.1.4.0 and 14.1.2.0.0) allows unauthenticated remote attackers to read a subset of BPM data and perform unauthorized data modifications via HTTP, provided a legitimate user interacts with attacker-controlled content. The attack carries a scope change, meaning successful exploitation can impact components beyond the BPM Suite itself within the Oracle Fusion Middleware stack. No public exploit code has been identified and CISA has not listed this in KEV; EPSS places exploitation probability at 0.03% (8th percentile), consistent with low near-term exploitation risk.
Improper access control in Oracle Identity Manager's Identity Console component (versions 12.2.1.4.0 and 14.1.2.0.0) allows unauthenticated remote attackers to partially compromise confidentiality and integrity via HTTP when a victim user interacts with attacker-controlled content. The scope change designation confirms that a successful attack can cascade beyond OIM itself to additional Oracle Fusion Middleware components integrated within the same environment. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS score of 0.03% (8th percentile) reflects very low real-world exploitation probability.
Local denial-of-service in the Oracle Solaris 11.4 Kernel component allows a low-privileged authenticated attacker to hang or crash the operating system with scope change implications for co-hosted workloads. The vulnerability stems from uncontrolled resource consumption (CWE-400) in the kernel and is addressed in Oracle's April 2026 Critical Patch Update. No public exploit or active exploitation has been identified; EPSS at 0.01% (2nd percentile) and SSVC exploitation rating of none confirm negligible exploitation activity at time of analysis.
PeopleSoft Enterprise HCM Human Resources 9.2 exposes critical HR data to unauthorized access and modification through a missing authentication control (CWE-306) in the Job Profile Manager component. High-privileged authenticated attackers with network HTTP access can read or modify all data accessible within the HCM module, including sensitive employee records and job profile configurations. No active exploitation is confirmed (CISA KEV absent, EPSS 0.03%), but the SSVC technical impact is rated 'total', indicating full data compromise potential upon successful exploitation.
MySQL Server's Optimizer component, across all 8.0.x releases from 8.0.0 through 8.0.45, is susceptible to uncontrolled resource consumption (CWE-400) that allows a high-privileged, network-authenticated attacker to cause a complete denial of service via server hang or repeatable crash. Oracle disclosed this in the April 2026 Critical Patch Update and has released a fix; no active exploitation has been identified (EPSS 0.04%, CISA SSVC exploitation: none). The combination of a required PR:H attack and availability-only impact considerably reduces real-world urgency compared to the network-vector framing alone.
Improper access control in the Fluid Core component of Oracle PeopleSoft Enterprise PeopleTools 8.61-8.62 allows a high-privileged network attacker to perform unauthorized data reads, writes, and partial denial-of-service with scope change affecting adjacent PeopleSoft products. Despite a network-accessible attack vector and no user interaction required, exploitation is gated by the requirement for high-privilege credentials, and SSVC signals (exploitation: none, automatable: no) confirm no active exploitation at time of analysis. Oracle disclosed this through its April 2026 Critical Patch Update; no public exploit code has been identified.
Uncontrolled resource consumption in the Group Replication Plugin of Oracle MySQL Server (versions 8.0.0-8.0.45, 8.4.0-8.4.8, and 9.0.0-9.6.0) allows a low-privileged network attacker to hang or repeatedly crash the database server, resulting in complete denial of service. Oracle patched this issue in the April 2026 Critical Patch Update; no active exploitation has been confirmed (absent from CISA KEV), and EPSS of 0.04% (12th percentile) reflects very low current exploitation probability. Downstream distribution advisories from Red Hat and SUSE indicate broad ecosystem acknowledgement of the issue.
Cross-site scripting or improper access control in Oracle Configurator's User Interface component allows unauthenticated remote attackers to compromise data confidentiality and integrity across Oracle E-Business Suite. Affected versions span the full supported range of 12.2.3 through 12.2.15, requiring an authenticated victim to interact with attacker-controlled content to trigger the flaw. The scope change (S:C) signals that exploitation can pivot beyond Oracle Configurator itself into adjacent E-Business Suite products; no public exploit code has been identified and SSVC confirms exploitation status as none at time of analysis.
Unauthenticated information disclosure in Oracle GoldenGate versions 23.4 through 23.10 exposes a subset of accessible data to remote attackers via HTTP, requiring no credentials or user interaction. The Libraries component contains a CWE-200 flaw that allows network-based attackers to read protected data, though impact is limited to partial confidentiality - integrity and availability are unaffected. No active exploitation has been identified (not in CISA KEV), and EPSS places exploitation probability at 0.03%, consistent with the SSVC exploitation status of none despite the automatable flag.
MySQL Server's Optimizer component in versions 9.0.0 through 9.6.0 is susceptible to uncontrolled resource consumption triggered by a low-privileged authenticated attacker over the network, resulting in a complete denial of service via hang or repeated crash. The attack surface spans multiple protocols and requires no user interaction beyond valid database credentials. No public exploit code has been identified and exploitation probability is minimal (EPSS 0.04%, SSVC exploitation: none), but the low complexity and broad version range make it relevant for any organization running MySQL 9.x in multi-tenant or externally reachable deployments.
Uncontrolled resource consumption in Oracle MySQL Server's Group Replication Plugin allows a low-privileged authenticated network attacker to cause a complete denial of service - server hang or repeatable crash - across three major release lines (8.0.x, 8.4.x, and 9.x). The vulnerability carries a CVSS 3.1 score of 6.5 with network attack vector and low attack complexity, though real-world exploitation pressure is minimal: EPSS sits at 0.04% (12th percentile), SSVC marks exploitation status as none and the attack as non-automatable, and no public exploit code has been identified at time of analysis. Oracle has released a patch via the April 2026 Critical Patch Update.
Uncontrolled resource consumption in the MySQL Server Group Replication Plugin enables low-privileged, network-accessible attackers to cause a complete denial of service - forcing MySQL Server into a hang or repeatedly reproducible crash across versions 8.0.0-8.0.45, 8.4.0-8.4.8, and 9.0.0-9.6.0. Oracle has released a patch via its April 2026 Critical Patch Update, and no active exploitation has been identified at time of analysis. EPSS stands at 0.04% (12th percentile) and SSVC classifies exploitation as 'none' and the attack as non-automatable, indicating low real-world exploitation probability despite a medium CVSS score.
Improper access control (CWE-284) in the Portal component of Oracle PeopleSoft Enterprise PeopleTools 8.61-8.62 permits unauthenticated remote attackers to perform unauthorized data reads and writes against PeopleTools and connected downstream products, contingent on luring an authenticated user into triggering the vulnerable endpoint via HTTP. The CVSS vector pattern (AV:N/PR:N/UI:R/S:C) combined with the Authentication Bypass tag strongly suggests a client-side injection vector such as reflected XSS or CSRF that operates within the victim's session context. No public exploit code has been identified and CISA has not added this to the KEV catalog; EPSS of 0.03% (8th percentile) and SSVC Exploitation:none corroborate the absence of observed active exploitation at time of analysis.
Unauthorized read access to a subset of JVM-accessible data is achievable in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition via a flaw in the Security component, exploitable by a local unauthenticated attacker with infrastructure logon access. The attack carries high complexity (AC:H), limiting opportunistic exploitation, and is confirmed by Oracle's April 2026 Critical Patch Update with patches available. All exploitation signals are minimal: EPSS is 0.01% at the 2nd percentile, SSVC registers exploitation as none and not automatable, and neither KEV listing nor public exploit code has been identified.
Uncontrolled resource consumption in the Optimizer component of MySQL Server 8.0.0 through 8.0.45 enables a high-privileged, network-connected attacker to cause a complete denial of service via a hang or repeatable crash. The impact is availability-only - no confidentiality or integrity risk exists - and the CVSS vector (PR:H) confirms exploitation is gated behind high-level database credentials. Oracle addressed this in the April 2026 Critical Patch Update; no active exploitation is confirmed (absent from CISA KEV), and the EPSS score of 0.04% (11th percentile) reflects minimal observed exploitation probability.
PeopleSoft Enterprise HCM Absence Management version 9.2 exposes a missing-authentication function (CWE-306) in its Absence Management component, accessible over HTTP by network-reachable, high-privileged attackers. Successful exploitation grants unauthorized read and write access to critical HR absence data - including creation, deletion, or modification of all data accessible within the component. No active exploitation has been confirmed (not in CISA KEV), EPSS is 0.03% (8th percentile), and no public proof-of-concept code has been identified, positioning this as a targeted risk rather than an opportunistic threat.
Uncontrolled resource consumption in Oracle Java SE's JSSE (Java Secure Socket Extension) component allows unauthenticated remote attackers to cause partial denial of service against HTTPS-enabled Java services and GraalVM deployments. Affected versions span all major Java SE release trains from 8u481 through 26, as well as GraalVM for JDK and GraalVM Enterprise Edition. Oracle confirmed the vulnerability in the April 2026 Critical Patch Update; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Improper access control in the Person Search component of Oracle PeopleSoft Enterprise HCM Shared Components 9.2 enables an authenticated low-privileged attacker to compromise confidentiality and integrity of HCM data, with scope change indicating the impact extends to additional PeopleSoft products beyond the vulnerable component. Exploitation requires human interaction from a victim other than the attacker, consistent with a client-side injection pattern. No public exploit or KEV listing is present, and EPSS at 0.03% (8th percentile) with SSVC exploitation status of 'none' confirms low real-world exploitation activity at time of analysis.
Partial denial-of-service exposure in the Libraries component of Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition allows unauthenticated remote attackers to degrade service availability across a wide range of versions from Java 8u481 through 26. The flaw (CWE-770) can be triggered via APIs exposed by web services consuming attacker-controlled input, or through client-side Java Web Start and applet environments loading untrusted code. No active exploitation has been observed (not in CISA KEV), no public proof-of-concept has been identified, and both EPSS (0.04%, 12th percentile) and SSVC (Exploitation: none, Automatable: no) classify this as low operational urgency.
MySQL Server's Optimizer component allows a low-privileged, network-connected attacker to repeatedly crash or hang the database server across three active release trains. Affected versions span 8.0.0 through 8.0.45, 8.4.0 through 8.4.8, and 9.0.0 through 9.6.0, representing a wide swath of currently deployed MySQL installations. Oracle confirmed a patch in the April 2026 Critical Patch Update; no public exploit code exists and EPSS remains at 0.04% with SSVC exploitation status of none, though the breadth of affected versions and low attack complexity make patching a meaningful operational priority for any network-accessible deployment.
Information disclosure in Oracle MySQL Server's Information Schema component exposes a subset of server data to authenticated low-privileged network attackers across three major release branches (8.0.0-8.0.45, 8.4.0-8.4.8, and 9.0.0-9.6.0). The flaw is exploitable via multiple protocols with low attack complexity but requires a valid database account, limiting opportunistic mass exploitation. No public exploit exists and this vulnerability is absent from the CISA KEV catalog; an EPSS score of 0.03% at the 8th percentile reflects negligible observed exploitation pressure.
Improper access control in Oracle User Management (E-Business Suite component: Workflow and Business Events) exposes versions 12.2.7 through 12.2.15 to unauthorized data access and manipulation by highly privileged, authenticated network attackers over HTTP. Successful exploitation yields limited confidentiality and integrity impact - read access to a subset of data and the ability to insert, update, or delete some records - with no availability impact. No active exploitation is confirmed (absent from CISA KEV), EPSS stands at 0.03% (7th percentile), and SSVC rates exploitation status as none, making this a low operational priority despite the network-reachable attack vector.
Unauthorized full data disclosure in Oracle Java SE's JGSS component allows unauthenticated remote attackers to read all data accessible by the Java runtime, but only against sandboxed client deployments running untrusted code such as Java Web Start applications or applets. Affected releases span Oracle Java SE 8u481 through 26, GraalVM for JDK 17.0.18 and 21.0.10, and GraalVM Enterprise Edition 21.3.17. No active exploitation is confirmed - EPSS sits at 0.03% (9th percentile) and CISA has not listed this in KEV - but the confidentiality impact is rated high when exploitation conditions are met.
MySQL Server's Optimizer component allows any low-privileged authenticated user with network access to trigger a complete denial of service via an uncontrolled resource consumption flaw. Affected across three active release lines - 8.0.x through 8.0.45, 8.4.x through 8.4.8, and 9.0.x through 9.6.0 - this vulnerability is broadly deployed given MySQL's ubiquity, but real-world exploitation risk is low: EPSS sits at 0.04% (12th percentile), SSVC marks exploitation as 'none' and the attack as non-automatable, and no public exploit code exists at time of analysis. Oracle released a patch in the April 2026 Critical Patch Update.
Oracle Java SE 25.0.1 exposes an integrity-bypass in its Libraries component that allows a remote unauthenticated attacker, via multiple protocols, to perform unauthorized data writes against accessible Java SE data. The attack is constrained to client-side deployments - specifically sandboxed Java Web Start applications and sandboxed Java applets loading untrusted internet code - and carries a vendor-assigned CVSS 3.7 (Low). No active exploitation is confirmed (SSVC: none, EPSS: 0.03%), and a vendor patch is available via the April 2026 Oracle Critical Patch Update.
Information disclosure in Oracle Java SE (8u481 through 26) and Oracle GraalVM (for JDK 17.0.18/21.0.10; Enterprise Edition 21.3.17) exposes a subset of data accessible to the Java process via the Security component. Exploitation requires local infrastructure logon and high attack complexity (AC:H), limiting the realistic threat surface significantly. No public exploit has been identified, EPSS is at the 2nd percentile (0.01%), and CISA SSVC classifies exploitation status as none - making this a low-priority finding despite the breadth of affected product versions.
Cross-site scripting or equivalent client-side injection in Oracle PeopleSoft Enterprise HCM Human Resources 9.2 - specifically the Employee Snapshot component - enables a low-privileged authenticated attacker to compromise confidentiality and integrity of HR data and trigger a scope change affecting additional products, provided a victim user interacts with attacker-controlled content over HTTP. The CVSS 3.1 score is 5.4 Medium (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), reflecting the scope change that elevates impact beyond the directly vulnerable system. No public exploit code exists and EPSS is 0.03% (8th percentile), indicating very low likelihood of opportunistic exploitation at time of analysis.
MySQL Server's Optimizer component crashes or hangs when high-privileged authenticated attackers submit crafted SQL queries over the network, affecting all active release branches (8.0.0-8.0.45, 8.4.0-8.4.8, 9.0.0-9.6.0). The uncontrolled resource consumption (CWE-400) results in complete availability loss for the database service, though confidentiality and integrity are unaffected. No public exploit has been identified at time of analysis and EPSS at 0.04% (11th percentile) places this among the lowest-exploitation-probability CVEs, consistent with the SSVC determination of no active exploitation.
Denial of service in MySQL Server's InnoDB component allows a high-privileged, network-connected attacker to cause the server to hang or crash repeatedly, achieving complete availability disruption. All three active release branches are affected: 8.0.0 through 8.0.45, 8.4.0 through 8.4.8, and 9.0.0 through 9.6.0. No public exploit has been identified at time of analysis, EPSS sits at 0.04% (11th percentile), and CISA SSVC confirms no active exploitation - placing this firmly in a patch-and-monitor posture rather than emergency response.
Integrity and availability compromise in Oracle Java SE's Hotspot component affects versions 8u481 and 8u481-b50, as well as GraalVM Enterprise Edition 21.3.17, but exclusively in client-side sandboxed deployments running untrusted code via Java Web Start or applets. A low-privileged local attacker who can also induce human interaction from a third-party victim may trigger uncontrolled resource consumption (CWE-400) in Hotspot, resulting in unauthorized modification or deletion of critical data accessible to the JVM, or a complete denial of service via hang or repeatable crash. No public exploit code exists and no active exploitation has been confirmed; EPSS at 0.01% (2nd percentile) and SSVC Exploitation=none corroborate negligible current threat activity.
Uncontrolled resource consumption in the MySQL Server Optimizer component allows a high-privileged, network-accessible attacker to cause a complete denial of service across all three actively maintained release trains (8.0.0-8.0.45, 8.4.0-8.4.8, 9.0.0-9.6.0). The Oracle April 2026 CPU addresses this flaw; no public exploit code is identified and EPSS stands at 0.04% (11th percentile), reflecting low real-world exploitation probability. The scope extends to MySQL Server packages distributed by Red Hat and SUSE, broadening the patching surface for enterprise Linux environments.
Information disclosure in Oracle MySQL Server's Information Schema component allows high-privileged remote attackers to read an unauthorized subset of MySQL Server data across three major version lines. Affected are versions 8.0.0-8.0.45, 8.4.0-8.4.8, and 9.0.0-9.6.0. No public exploit code exists, EPSS exploitation probability sits at 0.03% (7th percentile), and CISA has not added this to KEV - all signals converge on this being a low-priority, low-severity finding appropriate for routine patch cycle treatment.
Unauthorized disclosure of sensitive XML data from Oracle Database Server's XML Database component is possible via network-accessible HTTPS endpoints in versions 23.4.0 through 23.26.1. An unauthenticated remote attacker exploiting this CWE-200 information exposure flaw - tagged as involving authentication bypass - can obtain complete access to all XML Database accessible data, but success requires high attack complexity and human interaction from a victim user. No active exploitation is confirmed (EPSS 0.03%, 9th percentile; CISA KEV absent; SSVC exploitation: none), placing this firmly in the patch-on-schedule category despite the high confidentiality impact stated in the CVSS.
Denial-of-service in MySQL Server's Optimizer component allows high-privileged, network-authenticated attackers to cause a complete crash or hang across three active release trains (8.0.x, 8.4.x, 9.x). The broad version coverage and multi-protocol attack surface are notable, but the PR:H requirement limits the attacker pool to actors who already hold elevated MySQL credentials. No public exploit has been identified and EPSS at 0.04% (11th percentile) confirms low observed exploitation probability; Oracle has released a patch via the April 2026 Critical Patch Update.
LatePoint WordPress plugin versions up to 5.3.2 expose a public, unauthenticated endpoint (OsStripeConnectController::create_payment_intent_for_transaction) that allows sequential enumeration of invoice IDs and unauthorized creation of transaction intent records containing sensitive financial data, customer identifiers, and Stripe payment secrets. Unauthenticated remote attackers can exploit this Insecure Direct Object Reference (IDOR) vulnerability to leak confidential payment information and Stripe Connect tokens without authentication or user interaction. No active exploitation has been confirmed at the time of analysis.
Padding oracle vulnerability in wolfSSL's PKCS7 CBC decryption allows unauthenticated remote attackers to recover plaintext through repeated decryption queries with modified ciphertext, exploiting insufficient validation of interior padding bytes. The vulnerability requires high attack complexity and persistent attacker interaction but presents practical risk to systems using affected wolfSSL versions for PKCS7-encrypted communications.
Parse Server versions prior to 8.6.70 and 9.7.0-alpha.18 allow authenticated users with find class-level permissions to bypass protectedFields restrictions on LiveQuery subscriptions by submitting array-like objects with numeric keys instead of proper arrays in $or, $and, or $nor operators. This enables information disclosure through a binary oracle attack that reveals whether protected fields match attacker-supplied values. The vulnerability requires prior authentication and find-level access but no user interaction, affecting all deployments of vulnerable Parse Server versions.
Node.js versions 20.x, 22.x, 24.x, and 25.x use non-constant-time comparison for HMAC signature verification, allowing remote attackers to infer valid HMAC values through timing oracle attacks. The vulnerability leaks information proportional to matching bytes and requires high-resolution timing measurement capability, making exploitation feasible in controlled network conditions. CVSS 5.9 (confidentiality impact only); no public exploit identified at time of analysis.
Navicat for Oracle 12.1.15 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long string in the password field. Rated medium severity (CVSS 6.9), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
OX Dovecot Pro's doveadm HTTP service is vulnerable to timing oracle attacks during credential verification, allowing remote unauthenticated attackers to enumerate valid credentials through timing analysis and gain full administrative access to the doveadm management interface. The vulnerability affects OX Dovecot Pro installations with exposed doveadm HTTP service ports, carries a CVSS score of 7.4, and has no public exploit identified at time of analysis.
AVideo password verification API endpoint allows unauthenticated attackers to brute-force video access passwords at network speed with no rate limiting, enabling compromise of password-protected video content across the platform. The vulnerable endpoint pkg:composer/wwbn_avideo returns a boolean confirmation for any password guess without authentication, CAPTCHA, or throttling mechanisms, combined with plaintext password storage and loose equality comparison that further weakens defenses. Publicly available exploit code exists demonstrating rapid password enumeration against any video ID.
An information disclosure vulnerability in Parse Server's LiveQuery functionality allows attackers to infer the values of protected fields by monitoring whether update events are generated when those fields change, effectively creating a binary oracle that reveals field modifications despite the field values themselves being stripped from event payloads. The vulnerability affects Parse Server npm package across multiple versions, and while no public exploit code or active exploitation has been documented, the attack requires only standard subscription capabilities without elevated privileges. The vendor has released patches that validate the watch parameter against protected fields at subscription time, mirroring existing where clause protections.
The DTrace dtprobed component contains a path traversal vulnerability (CWE-22) that allows local attackers with limited privileges to create arbitrary files on the system by supplying crafted USDT provider names. This vulnerability affects Oracle Linux 8, 9, and 10, and while it carries a CVSS score of 5.5, the EPSS score of 0.01% (percentile 2%) indicates very low exploitation probability in the wild, with no evidence of active exploitation or public proof-of-concept code.
Authlib's implementation of the JWE RSA1_5 key management algorithm contains a padding oracle vulnerability that leaks decryption failures through timing and exception patterns, allowing attackers to decrypt sensitive data without the private key. The library disabled the constant-time protections provided by the underlying cryptography library and raises exceptions before tag validation completes, creating a reliable side-channel. Public exploit code exists for this vulnerability affecting Authlib users in Python and related Oracle products.
AutohomeCorp's frostmourne application (version 1.0 and earlier) allows attackers to inject malicious code through the EXPRESSION parameter in the ExpressionRule.java component, which uses Oracle's Nashorn JavaScript engine without proper input validation. This vulnerability affects users of frostmourne and can be exploited remotely by unauthenticated attackers to execute arbitrary code on affected systems. The vendor has not responded to disclosure attempts, leaving users vulnerable to potential system compromise.
### Summary The ha-mcp OAuth consent form (beta feature) accepts a user-supplied `ha_url` and makes a server-side HTTP request to `{ha_url}/api/config` with no URL validation. An unauthenticated attacker can submit arbitrary URLs to perform internal network reconnaissance via an error oracle. Two additional code paths in OAuth tool calls (REST and WebSocket) are affected by the same primitive. The primary deployment method (private URL with pre-configured `HOMEASSISTANT_TOKEN`) is not affected. ### Details **Code path 1 - Consent form validation** (reported) When a user submits the OAuth consent form, `_validate_ha_credentials()` (`provider.py`) makes a server-side GET request to `{ha_url}/api/config` with no scheme, IP, or domain validation. Different exception types produce distinct error messages, creating an error oracle: | Outcome | Message returned | Information leaked | |---------|------------------|--------------------| | `ConnectError` | "Could not connect..." | Host down or port closed | | `TimeoutException` | "Connection timed out..." | Host up, port filtered | | HTTP 401 | "Invalid access token..." | Service alive, requires auth | | HTTP 403 | "Access forbidden..." | Service alive, forbidden | | HTTP ≥ 400 | "Failed to connect: HTTP {N}" | Service alive, exact status | An attacker can drive the flow programmatically: register a client via open DCR (`POST /register`), initiate authorization, extract a `txn_id`, and submit arbitrary `ha_url` values. No user interaction required. **Code path 2 - REST tool calls with forged token** OAuth access tokens are stateless base64-encoded JSON payloads (`{"ha_url": "...", "ha_token": "..."}`). Since tokens are not signed, an attacker can forge a token with an arbitrary `ha_url`. REST tool calls then make HTTP requests to hardcoded HA API paths on that host (`/config`, `/states`, `/services`, etc.). JSON responses are returned to the caller. In practice, path control is limited - most endpoints use absolute paths that ignore the `ha_url` path component. Useful exfiltration requires the target to return JSON at HA API paths, which is unlikely for non-HA services. **Code path 3 - WebSocket tool calls with forged token** The same forged token triggers WebSocket connections to `ws://{ha_url}/api/websocket`. The client follows the HA WebSocket handshake protocol (waits for `auth_required`, sends `auth`, expects `auth_ok`). Non-HA targets fail at the protocol level and return nothing useful. Realistic exploitation is limited to pivoting to another HA instance on the internal network. ### Impact **Confirmed:** Internal network reconnaissance via error oracle (all 3 code paths). An attacker can map reachable hosts and open ports from the server's network position. ### Scope OAuth mode is a **beta** feature, documented separately in `docs/OAUTH.md` and not part of the main setup instructions. The standard deployment method (pre-configured `HOMEASSISTANT_URL` and `HOMEASSISTANT_TOKEN`) is not affected. ### Fix Upgrade to 7.0.0
Vm Virtualbox versions up to 7.1.14 contains a vulnerability that allows attackers to unauthorized access to critical data or complete access to all Oracle VM Virtual (CVSS 6.0).
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. [CVSS 4.6 MEDIUM]
Life Sciences Central Coding versions up to 7.0.1.0 contains a vulnerability that allows attackers to unauthorized update, insert or delete access to some of Oracle Life Sciences Cen (CVSS 6.5).
Unauthorized data access in Oracle Planning and Budgeting Cloud Service (version 25.04.07) can be achieved by high-privileged attackers with local infrastructure access through the EPM Agent component. The vulnerability requires user interaction from a non-attacker and allows complete compromise of accessible Planning and Budgeting data. No patch is currently available.
Flexcube Universal Banking contains a vulnerability that allows attackers to unauthorized access to critical data or complete access to all Oracle FLEXCUBE U (CVSS 6.5).
Vulnerability in the Oracle Zero Data Loss Recovery Appliance Software product of Oracle Zero Data Loss Recovery Appliance (component: Security). Supported versions that are affected are 23.1.0-23.1.202509. [CVSS 3.1 LOW]
Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19.3-19.29 and 21.3-21.20. [CVSS 4.5 MEDIUM]
Unauthenticated attackers can read sensitive data from Oracle Life Sciences Central Designer 7.0.1.0 through an easily exploitable information disclosure vulnerability accessible via HTTP. The flaw requires no user interaction or privileges, allowing remote attackers with network access to gain unauthorized access to a subset of application data. No patch is currently available for this vulnerability.
Configurator contains a vulnerability that allows attackers to unauthorized read access to a subset of Oracle Configurator accessible data (CVSS 5.3).
Peoplesoft Supply Chain Management Purchasing versions up to 9.2 contains a vulnerability that allows attackers to unauthorized update, insert or delete access to some of PeopleSoft Enterprise SC (CVSS 5.4).
Life Sciences Central Designer versions up to 7.0.1.0 contains a vulnerability that allows attackers to unauthorized access to critical data or complete access to all Oracle Life Scien (CVSS 6.5).
Mysql Server contains a vulnerability that allows attackers to unauthorized ability to cause a hang or frequently repeatable crash (complete DO (CVSS 6.5).
Hospitality Opera 5 versions up to 5.6.19.23 contains a vulnerability that allows attackers to unauthorized update, insert or delete access to some of Oracle Hospitality OPERA (CVSS 6.1).
Mysql Server contains a vulnerability that allows attackers to unauthorized ability to cause a partial denial of service (partial DOS) of MySQL (CVSS 2.7).
Mysql contains a vulnerability that allows attackers to unauthorized ability to cause a hang or frequently repeatable crash (complete DO (CVSS 4.9).
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. [CVSS 6.0 MEDIUM]
Unauthenticated attackers can exploit a cross-site request forgery vulnerability in Oracle PeopleSoft Enterprise HCM Human Resources 9.2 through the Company Directory/Org Chart Viewer component to read, modify, or delete sensitive employee data via HTTP with user interaction. The vulnerability requires a victim to click a malicious link but impacts multiple PeopleSoft products and modules beyond the initial target. No patch is currently available for this medium-severity issue (CVSS 6.1).
Oracle Applications DBA versions 12.2.3-12.2.15 contain an authorization flaw in the Java utilities component that allows high-privileged attackers to gain unauthorized read and write access to sensitive data via HTTP. An authenticated attacker with administrative credentials can exploit this vulnerability to create, modify, or delete critical application data without restriction. A patch is available and should be prioritized for deployment in affected Oracle E-Business Suite environments.
Unauthorized data disclosure in Oracle Workflow Loader (versions 12.2.3-12.2.15) allows high-privileged attackers with network access to extract sensitive information from the Oracle E-Business Suite environment. The vulnerability requires administrator-level credentials and HTTP connectivity but can result in complete exposure of workflow-accessible data. A patch is available to remediate this confidentiality issue.
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions that are affected are 9.0.0-9.5.0. [CVSS 4.9 MEDIUM]
Peoplesoft Enterprise Peopletools versions up to 8.60 is affected by cross-site scripting (xss) (CVSS 6.1).
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 9.0.0-9.5.0. [CVSS 6.5 MEDIUM]
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 9.0.0-9.5.0. [CVSS 6.5 MEDIUM]
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and 9.0.0-9.5.0. [CVSS 4.9 MEDIUM]
Vulnerability in Oracle Java SE (component: JavaFX). Supported versions that are affected are Oracle Java SE: 8u471-b50. [CVSS 3.1 LOW]
JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.0 are vulnerable to cross-site scripting (XSS) in the Web Runtime SEC component, allowing unauthenticated attackers to manipulate data and read sensitive information through HTTP with user interaction. The vulnerability has network-wide scope, potentially compromising connected systems beyond the primary application. No patch is currently available.
Agile Product Lifecycle Management For Process versions up to 6.2.4 is affected by cross-site scripting (xss) (CVSS 6.5).
Reflected cross-site scripting in Oracle E-Business Suite Scripting Admin (versions 12.2.3-12.2.15) allows unauthenticated attackers to modify or read sensitive data via malicious HTTP requests that require user interaction. The vulnerability can impact other Oracle products due to scope changes and currently lacks an available patch. CVSS 6.1 (Medium) reflects low-complexity network-based exploitation with confidentiality and integrity impacts.
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystems). Supported versions that are affected are 10 and 11. [CVSS 5.0 MEDIUM]
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and 9.0.0-9.5.0. [CVSS 4.9 MEDIUM]
Peoplesoft Enterprise Peopletools versions up to 8.60 contains a vulnerability that allows attackers to unauthorized update, insert or delete access to some of PeopleSoft Enterprise Pe (CVSS 6.1).
Mysql Server contains a vulnerability that allows attackers to unauthorized ability to cause a hang or frequently repeatable crash (complete DO (CVSS 4.9).
Mysql Cluster contains a vulnerability that allows attackers to unauthorized ability to cause a hang or frequently repeatable crash (complete DO (CVSS 4.9).
Solaris versions up to 11 contains a vulnerability that allows attackers to unauthorized creation, deletion or modification access to critical data or all O (CVSS 5.8).
Peoplesoft Enterprise Peopletools versions up to 8.60 contains a vulnerability that allows attackers to unauthorized update, insert or delete access to some of PeopleSoft Enterprise Pe (CVSS 5.4).
Graalvm versions up to 21.3.16 contains a vulnerability that allows attackers to unauthorized update, insert or delete access to some of Oracle Java SE, Oracle G (CVSS 6.1).
Apex versions up to 23.2.0 contains a vulnerability that allows attackers to unauthorized update, insert or delete access to some of Oracle APEX Sample Appli (CVSS 5.4).
Oracle Applications Framework's Personalization component in E-Business Suite versions 12.2.9 through 12.2.15 allows an authenticated, high-privileged attacker to exceed intended authorization boundaries via HTTP, resulting in unauthorized data read, write, and partial denial of service against the framework. Root cause is CWE-284 (Improper Access Control), confirmed by Oracle's April 2026 Critical Patch Update. No public exploit code exists and EPSS sits at 0.03% (10th percentile), aligning with SSVC's 'Exploitation: none' assessment - this is a low-urgency, medium-severity finding gated entirely by the requirement for pre-existing high-privilege access.
Information disclosure in Oracle Agile Product Lifecycle Management for Process 6.2.4 allows low-privileged authenticated network attackers to read a subset of application data via HTTP through the Product Quality Management component. The vulnerability carries a CVSS 3.1 score of 4.3 and is classified as CWE-200, reflecting improper exposure of sensitive information. No public exploit code exists and no active exploitation has been identified; EPSS stands at 0.03% (8th percentile), consistent with SSVC's 'exploitation: none' signal.
PeopleSoft Enterprise SCM Purchasing 9.2 exposes critical procurement data to low-privileged authenticated attackers over HTTP, enabling complete unauthorized read access to all data within the Purchasing module. The flaw is rooted in improper access control (CWE-284), allowing a low-privileged PeopleSoft account holder to bypass post-authentication authorization restrictions and retrieve sensitive purchasing records they should not have access to. No public exploit code exists and EPSS sits at a very low 0.03%, but Oracle's April 2026 Critical Patch Update addresses the vulnerability and should be applied to any internet-facing or multi-tenant PeopleSoft deployment.
Improper access control in Oracle Identity Manager Connector 12.2.1.4.0 exposes the Microsoft Active Directory component to network-based exploitation via LDAP, enabling low-privileged authenticated attackers to perform unauthorized creation, deletion, or modification of critical data and read a subset of accessible data. The vulnerability carries a CVSS 3.1 score of 5.9 (Medium), tempered by high attack complexity (AC:H) and a near-zero EPSS of 0.03% (8th percentile). No public exploit code exists and no active exploitation has been reported; this is a real but difficult-to-trigger integrity-focused flaw in Oracle's enterprise identity management stack.
MySQL Server versions 8.0.0 through 8.0.45 expose a denial-of-service condition in the DML processing component, enabling a highly privileged, network-authenticated attacker to crash or hang the database server. Oracle patched this in the April 2026 Critical Patch Update; no active exploitation has been observed (EPSS 0.04%, 11th percentile; SSVC exploitation: none). The mandatory high-privilege authentication requirement significantly constrains the realistic attacker pool to insiders or post-compromise scenarios.
Oracle Identity Manager Connector 12.2.1.4.0 exposes a missing authentication control (CWE-306) in its Core component, reachable over HTTPS by unauthenticated network attackers. Successful exploitation yields unauthorized read access to critical data or complete access to all data accessible by the connector - a significant confidentiality breach in an identity governance system. No public exploit code has been identified at time of analysis, and EPSS at 0.03% (9th percentile) alongside SSVC's 'none' exploitation rating indicate low real-world exploitation pressure despite the network-accessible vector.
Unauthenticated network access to Oracle Identity Manager Connector 12.2.1.4.0 enables complete confidentiality compromise of all data accessible by the connector via an authentication bypass in its Core component. The flaw (CWE-306, Missing Authentication for Critical Function) is reachable over HTTP without credentials but carries high attack complexity, constraining exploitation to actors capable of meeting undisclosed preconditions. No active exploitation has been identified - EPSS sits at the 9th percentile (0.03%) and CISA SSVC rates it as non-automatable with partial technical impact - suggesting limited near-term risk despite the identity management context.
Cross-site scripting or improper access control in the Human Workflow component of Oracle Business Process Management Suite (versions 12.2.1.4.0 and 14.1.2.0.0) allows unauthenticated remote attackers to read a subset of BPM data and perform unauthorized data modifications via HTTP, provided a legitimate user interacts with attacker-controlled content. The attack carries a scope change, meaning successful exploitation can impact components beyond the BPM Suite itself within the Oracle Fusion Middleware stack. No public exploit code has been identified and CISA has not listed this in KEV; EPSS places exploitation probability at 0.03% (8th percentile), consistent with low near-term exploitation risk.
Improper access control in Oracle Identity Manager's Identity Console component (versions 12.2.1.4.0 and 14.1.2.0.0) allows unauthenticated remote attackers to partially compromise confidentiality and integrity via HTTP when a victim user interacts with attacker-controlled content. The scope change designation confirms that a successful attack can cascade beyond OIM itself to additional Oracle Fusion Middleware components integrated within the same environment. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS score of 0.03% (8th percentile) reflects very low real-world exploitation probability.
Local denial-of-service in the Oracle Solaris 11.4 Kernel component allows a low-privileged authenticated attacker to hang or crash the operating system with scope change implications for co-hosted workloads. The vulnerability stems from uncontrolled resource consumption (CWE-400) in the kernel and is addressed in Oracle's April 2026 Critical Patch Update. No public exploit or active exploitation has been identified; EPSS at 0.01% (2nd percentile) and SSVC exploitation rating of none confirm negligible exploitation activity at time of analysis.
PeopleSoft Enterprise HCM Human Resources 9.2 exposes critical HR data to unauthorized access and modification through a missing authentication control (CWE-306) in the Job Profile Manager component. High-privileged authenticated attackers with network HTTP access can read or modify all data accessible within the HCM module, including sensitive employee records and job profile configurations. No active exploitation is confirmed (CISA KEV absent, EPSS 0.03%), but the SSVC technical impact is rated 'total', indicating full data compromise potential upon successful exploitation.
MySQL Server's Optimizer component, across all 8.0.x releases from 8.0.0 through 8.0.45, is susceptible to uncontrolled resource consumption (CWE-400) that allows a high-privileged, network-authenticated attacker to cause a complete denial of service via server hang or repeatable crash. Oracle disclosed this in the April 2026 Critical Patch Update and has released a fix; no active exploitation has been identified (EPSS 0.04%, CISA SSVC exploitation: none). The combination of a required PR:H attack and availability-only impact considerably reduces real-world urgency compared to the network-vector framing alone.
Improper access control in the Fluid Core component of Oracle PeopleSoft Enterprise PeopleTools 8.61-8.62 allows a high-privileged network attacker to perform unauthorized data reads, writes, and partial denial-of-service with scope change affecting adjacent PeopleSoft products. Despite a network-accessible attack vector and no user interaction required, exploitation is gated by the requirement for high-privilege credentials, and SSVC signals (exploitation: none, automatable: no) confirm no active exploitation at time of analysis. Oracle disclosed this through its April 2026 Critical Patch Update; no public exploit code has been identified.
Uncontrolled resource consumption in the Group Replication Plugin of Oracle MySQL Server (versions 8.0.0-8.0.45, 8.4.0-8.4.8, and 9.0.0-9.6.0) allows a low-privileged network attacker to hang or repeatedly crash the database server, resulting in complete denial of service. Oracle patched this issue in the April 2026 Critical Patch Update; no active exploitation has been confirmed (absent from CISA KEV), and EPSS of 0.04% (12th percentile) reflects very low current exploitation probability. Downstream distribution advisories from Red Hat and SUSE indicate broad ecosystem acknowledgement of the issue.
Cross-site scripting or improper access control in Oracle Configurator's User Interface component allows unauthenticated remote attackers to compromise data confidentiality and integrity across Oracle E-Business Suite. Affected versions span the full supported range of 12.2.3 through 12.2.15, requiring an authenticated victim to interact with attacker-controlled content to trigger the flaw. The scope change (S:C) signals that exploitation can pivot beyond Oracle Configurator itself into adjacent E-Business Suite products; no public exploit code has been identified and SSVC confirms exploitation status as none at time of analysis.
Unauthenticated information disclosure in Oracle GoldenGate versions 23.4 through 23.10 exposes a subset of accessible data to remote attackers via HTTP, requiring no credentials or user interaction. The Libraries component contains a CWE-200 flaw that allows network-based attackers to read protected data, though impact is limited to partial confidentiality - integrity and availability are unaffected. No active exploitation has been identified (not in CISA KEV), and EPSS places exploitation probability at 0.03%, consistent with the SSVC exploitation status of none despite the automatable flag.
MySQL Server's Optimizer component in versions 9.0.0 through 9.6.0 is susceptible to uncontrolled resource consumption triggered by a low-privileged authenticated attacker over the network, resulting in a complete denial of service via hang or repeated crash. The attack surface spans multiple protocols and requires no user interaction beyond valid database credentials. No public exploit code has been identified and exploitation probability is minimal (EPSS 0.04%, SSVC exploitation: none), but the low complexity and broad version range make it relevant for any organization running MySQL 9.x in multi-tenant or externally reachable deployments.
Uncontrolled resource consumption in Oracle MySQL Server's Group Replication Plugin allows a low-privileged authenticated network attacker to cause a complete denial of service - server hang or repeatable crash - across three major release lines (8.0.x, 8.4.x, and 9.x). The vulnerability carries a CVSS 3.1 score of 6.5 with network attack vector and low attack complexity, though real-world exploitation pressure is minimal: EPSS sits at 0.04% (12th percentile), SSVC marks exploitation status as none and the attack as non-automatable, and no public exploit code has been identified at time of analysis. Oracle has released a patch via the April 2026 Critical Patch Update.
Uncontrolled resource consumption in the MySQL Server Group Replication Plugin enables low-privileged, network-accessible attackers to cause a complete denial of service - forcing MySQL Server into a hang or repeatedly reproducible crash across versions 8.0.0-8.0.45, 8.4.0-8.4.8, and 9.0.0-9.6.0. Oracle has released a patch via its April 2026 Critical Patch Update, and no active exploitation has been identified at time of analysis. EPSS stands at 0.04% (12th percentile) and SSVC classifies exploitation as 'none' and the attack as non-automatable, indicating low real-world exploitation probability despite a medium CVSS score.
Improper access control (CWE-284) in the Portal component of Oracle PeopleSoft Enterprise PeopleTools 8.61-8.62 permits unauthenticated remote attackers to perform unauthorized data reads and writes against PeopleTools and connected downstream products, contingent on luring an authenticated user into triggering the vulnerable endpoint via HTTP. The CVSS vector pattern (AV:N/PR:N/UI:R/S:C) combined with the Authentication Bypass tag strongly suggests a client-side injection vector such as reflected XSS or CSRF that operates within the victim's session context. No public exploit code has been identified and CISA has not added this to the KEV catalog; EPSS of 0.03% (8th percentile) and SSVC Exploitation:none corroborate the absence of observed active exploitation at time of analysis.
Unauthorized read access to a subset of JVM-accessible data is achievable in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition via a flaw in the Security component, exploitable by a local unauthenticated attacker with infrastructure logon access. The attack carries high complexity (AC:H), limiting opportunistic exploitation, and is confirmed by Oracle's April 2026 Critical Patch Update with patches available. All exploitation signals are minimal: EPSS is 0.01% at the 2nd percentile, SSVC registers exploitation as none and not automatable, and neither KEV listing nor public exploit code has been identified.
Uncontrolled resource consumption in the Optimizer component of MySQL Server 8.0.0 through 8.0.45 enables a high-privileged, network-connected attacker to cause a complete denial of service via a hang or repeatable crash. The impact is availability-only - no confidentiality or integrity risk exists - and the CVSS vector (PR:H) confirms exploitation is gated behind high-level database credentials. Oracle addressed this in the April 2026 Critical Patch Update; no active exploitation is confirmed (absent from CISA KEV), and the EPSS score of 0.04% (11th percentile) reflects minimal observed exploitation probability.
PeopleSoft Enterprise HCM Absence Management version 9.2 exposes a missing-authentication function (CWE-306) in its Absence Management component, accessible over HTTP by network-reachable, high-privileged attackers. Successful exploitation grants unauthorized read and write access to critical HR absence data - including creation, deletion, or modification of all data accessible within the component. No active exploitation has been confirmed (not in CISA KEV), EPSS is 0.03% (8th percentile), and no public proof-of-concept code has been identified, positioning this as a targeted risk rather than an opportunistic threat.
Uncontrolled resource consumption in Oracle Java SE's JSSE (Java Secure Socket Extension) component allows unauthenticated remote attackers to cause partial denial of service against HTTPS-enabled Java services and GraalVM deployments. Affected versions span all major Java SE release trains from 8u481 through 26, as well as GraalVM for JDK and GraalVM Enterprise Edition. Oracle confirmed the vulnerability in the April 2026 Critical Patch Update; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Improper access control in the Person Search component of Oracle PeopleSoft Enterprise HCM Shared Components 9.2 enables an authenticated low-privileged attacker to compromise confidentiality and integrity of HCM data, with scope change indicating the impact extends to additional PeopleSoft products beyond the vulnerable component. Exploitation requires human interaction from a victim other than the attacker, consistent with a client-side injection pattern. No public exploit or KEV listing is present, and EPSS at 0.03% (8th percentile) with SSVC exploitation status of 'none' confirms low real-world exploitation activity at time of analysis.
Partial denial-of-service exposure in the Libraries component of Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition allows unauthenticated remote attackers to degrade service availability across a wide range of versions from Java 8u481 through 26. The flaw (CWE-770) can be triggered via APIs exposed by web services consuming attacker-controlled input, or through client-side Java Web Start and applet environments loading untrusted code. No active exploitation has been observed (not in CISA KEV), no public proof-of-concept has been identified, and both EPSS (0.04%, 12th percentile) and SSVC (Exploitation: none, Automatable: no) classify this as low operational urgency.
MySQL Server's Optimizer component allows a low-privileged, network-connected attacker to repeatedly crash or hang the database server across three active release trains. Affected versions span 8.0.0 through 8.0.45, 8.4.0 through 8.4.8, and 9.0.0 through 9.6.0, representing a wide swath of currently deployed MySQL installations. Oracle confirmed a patch in the April 2026 Critical Patch Update; no public exploit code exists and EPSS remains at 0.04% with SSVC exploitation status of none, though the breadth of affected versions and low attack complexity make patching a meaningful operational priority for any network-accessible deployment.
Information disclosure in Oracle MySQL Server's Information Schema component exposes a subset of server data to authenticated low-privileged network attackers across three major release branches (8.0.0-8.0.45, 8.4.0-8.4.8, and 9.0.0-9.6.0). The flaw is exploitable via multiple protocols with low attack complexity but requires a valid database account, limiting opportunistic mass exploitation. No public exploit exists and this vulnerability is absent from the CISA KEV catalog; an EPSS score of 0.03% at the 8th percentile reflects negligible observed exploitation pressure.
Improper access control in Oracle User Management (E-Business Suite component: Workflow and Business Events) exposes versions 12.2.7 through 12.2.15 to unauthorized data access and manipulation by highly privileged, authenticated network attackers over HTTP. Successful exploitation yields limited confidentiality and integrity impact - read access to a subset of data and the ability to insert, update, or delete some records - with no availability impact. No active exploitation is confirmed (absent from CISA KEV), EPSS stands at 0.03% (7th percentile), and SSVC rates exploitation status as none, making this a low operational priority despite the network-reachable attack vector.
Unauthorized full data disclosure in Oracle Java SE's JGSS component allows unauthenticated remote attackers to read all data accessible by the Java runtime, but only against sandboxed client deployments running untrusted code such as Java Web Start applications or applets. Affected releases span Oracle Java SE 8u481 through 26, GraalVM for JDK 17.0.18 and 21.0.10, and GraalVM Enterprise Edition 21.3.17. No active exploitation is confirmed - EPSS sits at 0.03% (9th percentile) and CISA has not listed this in KEV - but the confidentiality impact is rated high when exploitation conditions are met.
MySQL Server's Optimizer component allows any low-privileged authenticated user with network access to trigger a complete denial of service via an uncontrolled resource consumption flaw. Affected across three active release lines - 8.0.x through 8.0.45, 8.4.x through 8.4.8, and 9.0.x through 9.6.0 - this vulnerability is broadly deployed given MySQL's ubiquity, but real-world exploitation risk is low: EPSS sits at 0.04% (12th percentile), SSVC marks exploitation as 'none' and the attack as non-automatable, and no public exploit code exists at time of analysis. Oracle released a patch in the April 2026 Critical Patch Update.
Oracle Java SE 25.0.1 exposes an integrity-bypass in its Libraries component that allows a remote unauthenticated attacker, via multiple protocols, to perform unauthorized data writes against accessible Java SE data. The attack is constrained to client-side deployments - specifically sandboxed Java Web Start applications and sandboxed Java applets loading untrusted internet code - and carries a vendor-assigned CVSS 3.7 (Low). No active exploitation is confirmed (SSVC: none, EPSS: 0.03%), and a vendor patch is available via the April 2026 Oracle Critical Patch Update.
Information disclosure in Oracle Java SE (8u481 through 26) and Oracle GraalVM (for JDK 17.0.18/21.0.10; Enterprise Edition 21.3.17) exposes a subset of data accessible to the Java process via the Security component. Exploitation requires local infrastructure logon and high attack complexity (AC:H), limiting the realistic threat surface significantly. No public exploit has been identified, EPSS is at the 2nd percentile (0.01%), and CISA SSVC classifies exploitation status as none - making this a low-priority finding despite the breadth of affected product versions.
Cross-site scripting or equivalent client-side injection in Oracle PeopleSoft Enterprise HCM Human Resources 9.2 - specifically the Employee Snapshot component - enables a low-privileged authenticated attacker to compromise confidentiality and integrity of HR data and trigger a scope change affecting additional products, provided a victim user interacts with attacker-controlled content over HTTP. The CVSS 3.1 score is 5.4 Medium (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), reflecting the scope change that elevates impact beyond the directly vulnerable system. No public exploit code exists and EPSS is 0.03% (8th percentile), indicating very low likelihood of opportunistic exploitation at time of analysis.
MySQL Server's Optimizer component crashes or hangs when high-privileged authenticated attackers submit crafted SQL queries over the network, affecting all active release branches (8.0.0-8.0.45, 8.4.0-8.4.8, 9.0.0-9.6.0). The uncontrolled resource consumption (CWE-400) results in complete availability loss for the database service, though confidentiality and integrity are unaffected. No public exploit has been identified at time of analysis and EPSS at 0.04% (11th percentile) places this among the lowest-exploitation-probability CVEs, consistent with the SSVC determination of no active exploitation.
Denial of service in MySQL Server's InnoDB component allows a high-privileged, network-connected attacker to cause the server to hang or crash repeatedly, achieving complete availability disruption. All three active release branches are affected: 8.0.0 through 8.0.45, 8.4.0 through 8.4.8, and 9.0.0 through 9.6.0. No public exploit has been identified at time of analysis, EPSS sits at 0.04% (11th percentile), and CISA SSVC confirms no active exploitation - placing this firmly in a patch-and-monitor posture rather than emergency response.
Integrity and availability compromise in Oracle Java SE's Hotspot component affects versions 8u481 and 8u481-b50, as well as GraalVM Enterprise Edition 21.3.17, but exclusively in client-side sandboxed deployments running untrusted code via Java Web Start or applets. A low-privileged local attacker who can also induce human interaction from a third-party victim may trigger uncontrolled resource consumption (CWE-400) in Hotspot, resulting in unauthorized modification or deletion of critical data accessible to the JVM, or a complete denial of service via hang or repeatable crash. No public exploit code exists and no active exploitation has been confirmed; EPSS at 0.01% (2nd percentile) and SSVC Exploitation=none corroborate negligible current threat activity.
Uncontrolled resource consumption in the MySQL Server Optimizer component allows a high-privileged, network-accessible attacker to cause a complete denial of service across all three actively maintained release trains (8.0.0-8.0.45, 8.4.0-8.4.8, 9.0.0-9.6.0). The Oracle April 2026 CPU addresses this flaw; no public exploit code is identified and EPSS stands at 0.04% (11th percentile), reflecting low real-world exploitation probability. The scope extends to MySQL Server packages distributed by Red Hat and SUSE, broadening the patching surface for enterprise Linux environments.
Information disclosure in Oracle MySQL Server's Information Schema component allows high-privileged remote attackers to read an unauthorized subset of MySQL Server data across three major version lines. Affected are versions 8.0.0-8.0.45, 8.4.0-8.4.8, and 9.0.0-9.6.0. No public exploit code exists, EPSS exploitation probability sits at 0.03% (7th percentile), and CISA has not added this to KEV - all signals converge on this being a low-priority, low-severity finding appropriate for routine patch cycle treatment.
Unauthorized disclosure of sensitive XML data from Oracle Database Server's XML Database component is possible via network-accessible HTTPS endpoints in versions 23.4.0 through 23.26.1. An unauthenticated remote attacker exploiting this CWE-200 information exposure flaw - tagged as involving authentication bypass - can obtain complete access to all XML Database accessible data, but success requires high attack complexity and human interaction from a victim user. No active exploitation is confirmed (EPSS 0.03%, 9th percentile; CISA KEV absent; SSVC exploitation: none), placing this firmly in the patch-on-schedule category despite the high confidentiality impact stated in the CVSS.
Denial-of-service in MySQL Server's Optimizer component allows high-privileged, network-authenticated attackers to cause a complete crash or hang across three active release trains (8.0.x, 8.4.x, 9.x). The broad version coverage and multi-protocol attack surface are notable, but the PR:H requirement limits the attacker pool to actors who already hold elevated MySQL credentials. No public exploit has been identified and EPSS at 0.04% (11th percentile) confirms low observed exploitation probability; Oracle has released a patch via the April 2026 Critical Patch Update.
LatePoint WordPress plugin versions up to 5.3.2 expose a public, unauthenticated endpoint (OsStripeConnectController::create_payment_intent_for_transaction) that allows sequential enumeration of invoice IDs and unauthorized creation of transaction intent records containing sensitive financial data, customer identifiers, and Stripe payment secrets. Unauthenticated remote attackers can exploit this Insecure Direct Object Reference (IDOR) vulnerability to leak confidential payment information and Stripe Connect tokens without authentication or user interaction. No active exploitation has been confirmed at the time of analysis.
Padding oracle vulnerability in wolfSSL's PKCS7 CBC decryption allows unauthenticated remote attackers to recover plaintext through repeated decryption queries with modified ciphertext, exploiting insufficient validation of interior padding bytes. The vulnerability requires high attack complexity and persistent attacker interaction but presents practical risk to systems using affected wolfSSL versions for PKCS7-encrypted communications.
Parse Server versions prior to 8.6.70 and 9.7.0-alpha.18 allow authenticated users with find class-level permissions to bypass protectedFields restrictions on LiveQuery subscriptions by submitting array-like objects with numeric keys instead of proper arrays in $or, $and, or $nor operators. This enables information disclosure through a binary oracle attack that reveals whether protected fields match attacker-supplied values. The vulnerability requires prior authentication and find-level access but no user interaction, affecting all deployments of vulnerable Parse Server versions.
Node.js versions 20.x, 22.x, 24.x, and 25.x use non-constant-time comparison for HMAC signature verification, allowing remote attackers to infer valid HMAC values through timing oracle attacks. The vulnerability leaks information proportional to matching bytes and requires high-resolution timing measurement capability, making exploitation feasible in controlled network conditions. CVSS 5.9 (confidentiality impact only); no public exploit identified at time of analysis.
Navicat for Oracle 12.1.15 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long string in the password field. Rated medium severity (CVSS 6.9), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
OX Dovecot Pro's doveadm HTTP service is vulnerable to timing oracle attacks during credential verification, allowing remote unauthenticated attackers to enumerate valid credentials through timing analysis and gain full administrative access to the doveadm management interface. The vulnerability affects OX Dovecot Pro installations with exposed doveadm HTTP service ports, carries a CVSS score of 7.4, and has no public exploit identified at time of analysis.
AVideo password verification API endpoint allows unauthenticated attackers to brute-force video access passwords at network speed with no rate limiting, enabling compromise of password-protected video content across the platform. The vulnerable endpoint pkg:composer/wwbn_avideo returns a boolean confirmation for any password guess without authentication, CAPTCHA, or throttling mechanisms, combined with plaintext password storage and loose equality comparison that further weakens defenses. Publicly available exploit code exists demonstrating rapid password enumeration against any video ID.
An information disclosure vulnerability in Parse Server's LiveQuery functionality allows attackers to infer the values of protected fields by monitoring whether update events are generated when those fields change, effectively creating a binary oracle that reveals field modifications despite the field values themselves being stripped from event payloads. The vulnerability affects Parse Server npm package across multiple versions, and while no public exploit code or active exploitation has been documented, the attack requires only standard subscription capabilities without elevated privileges. The vendor has released patches that validate the watch parameter against protected fields at subscription time, mirroring existing where clause protections.
The DTrace dtprobed component contains a path traversal vulnerability (CWE-22) that allows local attackers with limited privileges to create arbitrary files on the system by supplying crafted USDT provider names. This vulnerability affects Oracle Linux 8, 9, and 10, and while it carries a CVSS score of 5.5, the EPSS score of 0.01% (percentile 2%) indicates very low exploitation probability in the wild, with no evidence of active exploitation or public proof-of-concept code.
Authlib's implementation of the JWE RSA1_5 key management algorithm contains a padding oracle vulnerability that leaks decryption failures through timing and exception patterns, allowing attackers to decrypt sensitive data without the private key. The library disabled the constant-time protections provided by the underlying cryptography library and raises exceptions before tag validation completes, creating a reliable side-channel. Public exploit code exists for this vulnerability affecting Authlib users in Python and related Oracle products.
AutohomeCorp's frostmourne application (version 1.0 and earlier) allows attackers to inject malicious code through the EXPRESSION parameter in the ExpressionRule.java component, which uses Oracle's Nashorn JavaScript engine without proper input validation. This vulnerability affects users of frostmourne and can be exploited remotely by unauthenticated attackers to execute arbitrary code on affected systems. The vendor has not responded to disclosure attempts, leaving users vulnerable to potential system compromise.
### Summary The ha-mcp OAuth consent form (beta feature) accepts a user-supplied `ha_url` and makes a server-side HTTP request to `{ha_url}/api/config` with no URL validation. An unauthenticated attacker can submit arbitrary URLs to perform internal network reconnaissance via an error oracle. Two additional code paths in OAuth tool calls (REST and WebSocket) are affected by the same primitive. The primary deployment method (private URL with pre-configured `HOMEASSISTANT_TOKEN`) is not affected. ### Details **Code path 1 - Consent form validation** (reported) When a user submits the OAuth consent form, `_validate_ha_credentials()` (`provider.py`) makes a server-side GET request to `{ha_url}/api/config` with no scheme, IP, or domain validation. Different exception types produce distinct error messages, creating an error oracle: | Outcome | Message returned | Information leaked | |---------|------------------|--------------------| | `ConnectError` | "Could not connect..." | Host down or port closed | | `TimeoutException` | "Connection timed out..." | Host up, port filtered | | HTTP 401 | "Invalid access token..." | Service alive, requires auth | | HTTP 403 | "Access forbidden..." | Service alive, forbidden | | HTTP ≥ 400 | "Failed to connect: HTTP {N}" | Service alive, exact status | An attacker can drive the flow programmatically: register a client via open DCR (`POST /register`), initiate authorization, extract a `txn_id`, and submit arbitrary `ha_url` values. No user interaction required. **Code path 2 - REST tool calls with forged token** OAuth access tokens are stateless base64-encoded JSON payloads (`{"ha_url": "...", "ha_token": "..."}`). Since tokens are not signed, an attacker can forge a token with an arbitrary `ha_url`. REST tool calls then make HTTP requests to hardcoded HA API paths on that host (`/config`, `/states`, `/services`, etc.). JSON responses are returned to the caller. In practice, path control is limited - most endpoints use absolute paths that ignore the `ha_url` path component. Useful exfiltration requires the target to return JSON at HA API paths, which is unlikely for non-HA services. **Code path 3 - WebSocket tool calls with forged token** The same forged token triggers WebSocket connections to `ws://{ha_url}/api/websocket`. The client follows the HA WebSocket handshake protocol (waits for `auth_required`, sends `auth`, expects `auth_ok`). Non-HA targets fail at the protocol level and return nothing useful. Realistic exploitation is limited to pivoting to another HA instance on the internal network. ### Impact **Confirmed:** Internal network reconnaissance via error oracle (all 3 code paths). An attacker can map reachable hosts and open ports from the server's network position. ### Scope OAuth mode is a **beta** feature, documented separately in `docs/OAUTH.md` and not part of the main setup instructions. The standard deployment method (pre-configured `HOMEASSISTANT_URL` and `HOMEASSISTANT_TOKEN`) is not affected. ### Fix Upgrade to 7.0.0
Vm Virtualbox versions up to 7.1.14 contains a vulnerability that allows attackers to unauthorized access to critical data or complete access to all Oracle VM Virtual (CVSS 6.0).
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. [CVSS 4.6 MEDIUM]
Life Sciences Central Coding versions up to 7.0.1.0 contains a vulnerability that allows attackers to unauthorized update, insert or delete access to some of Oracle Life Sciences Cen (CVSS 6.5).
Unauthorized data access in Oracle Planning and Budgeting Cloud Service (version 25.04.07) can be achieved by high-privileged attackers with local infrastructure access through the EPM Agent component. The vulnerability requires user interaction from a non-attacker and allows complete compromise of accessible Planning and Budgeting data. No patch is currently available.
Flexcube Universal Banking contains a vulnerability that allows attackers to unauthorized access to critical data or complete access to all Oracle FLEXCUBE U (CVSS 6.5).
Vulnerability in the Oracle Zero Data Loss Recovery Appliance Software product of Oracle Zero Data Loss Recovery Appliance (component: Security). Supported versions that are affected are 23.1.0-23.1.202509. [CVSS 3.1 LOW]
Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19.3-19.29 and 21.3-21.20. [CVSS 4.5 MEDIUM]
Unauthenticated attackers can read sensitive data from Oracle Life Sciences Central Designer 7.0.1.0 through an easily exploitable information disclosure vulnerability accessible via HTTP. The flaw requires no user interaction or privileges, allowing remote attackers with network access to gain unauthorized access to a subset of application data. No patch is currently available for this vulnerability.
Configurator contains a vulnerability that allows attackers to unauthorized read access to a subset of Oracle Configurator accessible data (CVSS 5.3).
Peoplesoft Supply Chain Management Purchasing versions up to 9.2 contains a vulnerability that allows attackers to unauthorized update, insert or delete access to some of PeopleSoft Enterprise SC (CVSS 5.4).
Life Sciences Central Designer versions up to 7.0.1.0 contains a vulnerability that allows attackers to unauthorized access to critical data or complete access to all Oracle Life Scien (CVSS 6.5).
Mysql Server contains a vulnerability that allows attackers to unauthorized ability to cause a hang or frequently repeatable crash (complete DO (CVSS 6.5).
Hospitality Opera 5 versions up to 5.6.19.23 contains a vulnerability that allows attackers to unauthorized update, insert or delete access to some of Oracle Hospitality OPERA (CVSS 6.1).
Mysql Server contains a vulnerability that allows attackers to unauthorized ability to cause a partial denial of service (partial DOS) of MySQL (CVSS 2.7).
Mysql contains a vulnerability that allows attackers to unauthorized ability to cause a hang or frequently repeatable crash (complete DO (CVSS 4.9).
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. [CVSS 6.0 MEDIUM]
Unauthenticated attackers can exploit a cross-site request forgery vulnerability in Oracle PeopleSoft Enterprise HCM Human Resources 9.2 through the Company Directory/Org Chart Viewer component to read, modify, or delete sensitive employee data via HTTP with user interaction. The vulnerability requires a victim to click a malicious link but impacts multiple PeopleSoft products and modules beyond the initial target. No patch is currently available for this medium-severity issue (CVSS 6.1).
Oracle Applications DBA versions 12.2.3-12.2.15 contain an authorization flaw in the Java utilities component that allows high-privileged attackers to gain unauthorized read and write access to sensitive data via HTTP. An authenticated attacker with administrative credentials can exploit this vulnerability to create, modify, or delete critical application data without restriction. A patch is available and should be prioritized for deployment in affected Oracle E-Business Suite environments.
Unauthorized data disclosure in Oracle Workflow Loader (versions 12.2.3-12.2.15) allows high-privileged attackers with network access to extract sensitive information from the Oracle E-Business Suite environment. The vulnerability requires administrator-level credentials and HTTP connectivity but can result in complete exposure of workflow-accessible data. A patch is available to remediate this confidentiality issue.
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions that are affected are 9.0.0-9.5.0. [CVSS 4.9 MEDIUM]
Peoplesoft Enterprise Peopletools versions up to 8.60 is affected by cross-site scripting (xss) (CVSS 6.1).
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 9.0.0-9.5.0. [CVSS 6.5 MEDIUM]
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 9.0.0-9.5.0. [CVSS 6.5 MEDIUM]
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and 9.0.0-9.5.0. [CVSS 4.9 MEDIUM]
Vulnerability in Oracle Java SE (component: JavaFX). Supported versions that are affected are Oracle Java SE: 8u471-b50. [CVSS 3.1 LOW]
JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.0 are vulnerable to cross-site scripting (XSS) in the Web Runtime SEC component, allowing unauthenticated attackers to manipulate data and read sensitive information through HTTP with user interaction. The vulnerability has network-wide scope, potentially compromising connected systems beyond the primary application. No patch is currently available.
Agile Product Lifecycle Management For Process versions up to 6.2.4 is affected by cross-site scripting (xss) (CVSS 6.5).
Reflected cross-site scripting in Oracle E-Business Suite Scripting Admin (versions 12.2.3-12.2.15) allows unauthenticated attackers to modify or read sensitive data via malicious HTTP requests that require user interaction. The vulnerability can impact other Oracle products due to scope changes and currently lacks an available patch. CVSS 6.1 (Medium) reflects low-complexity network-based exploitation with confidentiality and integrity impacts.
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystems). Supported versions that are affected are 10 and 11. [CVSS 5.0 MEDIUM]
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and 9.0.0-9.5.0. [CVSS 4.9 MEDIUM]
Peoplesoft Enterprise Peopletools versions up to 8.60 contains a vulnerability that allows attackers to unauthorized update, insert or delete access to some of PeopleSoft Enterprise Pe (CVSS 6.1).
Mysql Server contains a vulnerability that allows attackers to unauthorized ability to cause a hang or frequently repeatable crash (complete DO (CVSS 4.9).
Mysql Cluster contains a vulnerability that allows attackers to unauthorized ability to cause a hang or frequently repeatable crash (complete DO (CVSS 4.9).
Solaris versions up to 11 contains a vulnerability that allows attackers to unauthorized creation, deletion or modification access to critical data or all O (CVSS 5.8).
Peoplesoft Enterprise Peopletools versions up to 8.60 contains a vulnerability that allows attackers to unauthorized update, insert or delete access to some of PeopleSoft Enterprise Pe (CVSS 5.4).
Graalvm versions up to 21.3.16 contains a vulnerability that allows attackers to unauthorized update, insert or delete access to some of Oracle Java SE, Oracle G (CVSS 6.1).
Apex versions up to 23.2.0 contains a vulnerability that allows attackers to unauthorized update, insert or delete access to some of Oracle APEX Sample Appli (CVSS 5.4).