Authentication Bypass

Unauthenticated remote attackers who can reach the HTTP interface of Oracle Communications Unified Inventory Management (versions 7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0, and 8.0.1) can read critical data without supplying any credentials, because of a flaw in the product's Security component. The exposure is purely confidentiality-focused (CVSS 3.1: 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) - no integrity or availability impact and no host-level privilege escalation - so a successful attack amounts to full disclosure of inventory data the application can access. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical barrier to abuse is network exposure: UIM is a back-office telecom OSS platform normally kept on internal management networks rather than the public internet.

Authentication bypass in Oracle Helidon 4.0.0 through 4.5.5 allows unauthenticated remote attackers to read and modify critical application data over HTTP when the helidon-microprofile-security component is used. Oracle rates the issue CVSS 9.1 with high confidentiality and integrity impact and no availability impact, and the vector shows no privileges or user interaction required. No public exploit identified at time of analysis, and the supplied data does not confirm active exploitation (CISA KEV), but the exposure is serious for network-reachable applications relying on the affected security component.

Cross-origin access controls in the helidon-cors component of Oracle Helidon 3.0.0 through 3.2.21 can be bypassed by unauthenticated remote attackers over HTTP, enabling limited unauthorized reads and inserts, updates, or deletes of Helidon-accessible data. Oracle rates the flaw 7.2 High (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N); the scope change means applications and downstream products relying on Helidon CORS may also be affected. No public exploit identified at time of analysis, and real-world CORS abuse may depend on an authenticated victim's browser being induced to make a cross-origin request, so confirm the practical prerequisites against the final Oracle advisory.

Unauthorized data modification and limited data disclosure in Oracle Helidon's helidon-grpc-server component affect versions 3.0.0 through 3.2.21, where unauthenticated HTTP/2 requests can update, insert, or delete some Helidon-accessible data and read a subset of it. The CVSS 3.1 base score is 7.2 with a scope change, meaning effects may extend to other products sharing the environment. No public exploit identified at time of analysis.

Oracle Cost Management, a module of Oracle E-Business Suite (releases 12.2.3 through 12.2.15), permits a low-privileged authenticated attacker with HTTP network access to fully compromise the Cost Planning component, resulting in high confidentiality, integrity, and availability impact. Oracle's own advisory characterizes the flaw as easily exploitable and capable of leading to takeover of the module, yielding a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The practical barrier is authentication: the attacker must already hold valid low-privilege EBS credentials, and no public exploit code or confirmed active exploitation was identified at time of analysis.

Unauthenticated HTTP requests against the Acollect component of Oracle Agile PLM 2.6 can return critical product-lifecycle data, letting any network-positioned attacker read everything the application can access without credentials or user interaction. The impact is confidentiality-only (C:H/I:N/A:N) at CVSS 7.5, so the flaw enables bulk data disclosure rather than tampering or disruption, and exploitation becomes trivial the moment the HTTP interface is reachable. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, but with PR:N/AC:L characteristics, internet-facing or partner-exposed instances should be treated as high-priority exposure.

Authenticated low-privileged users can alter or delete critical data and read limited data in Oracle Commerce Platform 11.4.0 through its Dynamo Commerce Server HTTP interface. The assessed CVSS 7.1 vector shows low attack complexity and no user interaction, but exploitation requires a valid account (PR:L), so anonymous compromise is not supported by the available data. No public exploit code or CISA KEV entry is identified at time of analysis, making this a moderate-priority patching item rather than an emergency.

Authenticated low-privileged users with network HTTP access can achieve takeover of Oracle Purchasing 12.2.3 through 12.2.15, with high confidentiality, integrity, and availability impact (CVSS 8.8). The vulnerability is low-complexity and requires no user interaction, but exploitation depends on a valid low-privileged E-Business Suite session and reachability of the Purchasing Internal Operations component. No public exploit identified at time of analysis; the October 2026 Oracle Critical Patch Update is the remediation reference.

Unauthenticated network attackers can read sensitive Oracle Applications Manager data in Oracle E-Business Suite 12.2.3 through 12.2.15 through the Oracle Diagnostics Interfaces component. The vulnerability is remotely reachable over HTTP with low attack complexity and no credentials or user interaction required, yielding a CVSS 3.1 score of 7.5 with confidentiality-only impact. No public exploit code or confirmed active exploitation was identified at time of analysis, and exposure is primarily limited by whether the Applications Manager interface is network-accessible.

Authenticated low-privileged users of Oracle E-Business Suite can read critical Oracle Capacity data-and potentially data in other linked EBS products-through HTTP requests to the Internal Operations component in versions 12.2.3 through 12.2.15. Exploitation is low-complexity and needs no user interaction, but it requires a valid EBS account (PR:L) and network access; no public exploit identified at time of analysis, making this a mid-to-high priority issue rather than an emergency.

Authenticated low-privilege users can read critical Oracle Capacity data-and, because of a scope change, potentially data from other Oracle E-Business Suite products on the same deployment-in Oracle Capacity 12.2.3 through 12.2.15. The flaw is remotely reachable over HTTP with low attack complexity and no user interaction, but it is not unauthenticated: the attacker must already hold valid EBS credentials. No public exploit code is identified in the supplied intelligence at time of analysis, and the CVSS 3.1 score is 7.7 with confidentiality-only impact.

Remote unauthenticated takeover of Oracle Solaris 11.4 is possible through a flaw in the 'Utility' component, which exposes a network-reachable TCP service to attackers with no credentials or user interaction. Oracle rates the issue CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting full confidentiality, integrity, and availability impact; the precise protocol, port, and vulnerable service configuration are not named in the available data and must be confirmed against the Oracle CPU October 2026 advisory. No public exploit code or CISA KEV entry was identified in the provided intelligence at time of analysis.

Oracle EDI Gateway in Oracle E-Business Suite 12.2.3 through 12.2.15 exposes critical EDI data to low-privileged network attackers via HTTP, allowing high confidentiality impact and limited integrity modification with a scope change that can affect additional connected Oracle products. Exploitation requires a valid low-privilege EBS/EDI Gateway account (PR:L) and network reachability to the EDI Gateway component; no public exploit or active exploitation is identified in the available intelligence. The CVSS 3.1 base score is 8.5, reflecting high confidentiality and low integrity impact.

Unauthenticated data disclosure in Oracle BI EE 8.2.0.0.0 and 26.01.0.0.0 allows a remote attacker with HTTP access to the Analytics Server to read critical data or all data accessible through the product, with a CVSS 3.1 base score of 7.5 and confidentiality-only impact. No special conditions are required beyond network reachability, so exposure is bounded mainly by whether the Analytics Server HTTP interface is Internet-facing, VPN-restricted, or behind a WAF/reverse proxy. No public exploit identified at time of analysis.

Oracle APEX versions 24.1.0 through 24.1.21, 24.2.0 through 24.2.20, and 26.1.0 through 26.1.4 contain an easily exploitable flaw in the General component that unauthenticated remote attackers can reach over HTTPS to fully compromise the APEX instance, with high confidentiality, integrity, and availability impact (CVSS 3.1 base score 9.8). The Oracle CPU October 2026 advisory is the vendor's reference for this issue, and no public exploit code or CISA KEV listing was identified in the available data at time of analysis. Network exposure is the primary gating factor: any internet-reachable or otherwise attacker-accessibly APEX deployment on an affected release should be treated as high priority for patching.

Oracle Trusted Answer Search 26.1 exposes an information-disclosure flaw in its Application expert UI component that lets an attacker with an existing low-privilege account reach critical data over HTTP without any user interaction. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, base 7.7) confirms the attack is network-reachable and low-complexity, but it is not pre-authentication: a valid low-privileged login is the primary barrier, notwithstanding the 'Authentication Bypass' tag applied by the reporter. Because of the scope change (S:C), a successful exploit can expose confidential data belonging to other Oracle products reachable from the same deployment, so the blast radius is larger than the search component alone; no public exploit code or confirmed active exploitation was identified at time of analysis.

Oracle Trusted Answer Search 26.1 can allow a low-privileged authenticated attacker with network access to the Application expert UI to create, delete, modify, or read critical data after another user is induced to interact with attacker-supplied content. The CVSS 3.1 score is 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N), reflecting high confidentiality and integrity impact and possible scope change to additional products, with no availability impact. No public exploit code or CISA KEV entry was identified at time of analysis, and exploitation requires both an existing low-privileged account and a separate human victim.

Oracle Trusted Answer Search 26.1 contains a high-severity Application expert UI flaw (CVSS 7.6) that allows a low-privileged authenticated attacker to submit crafted content over HTTP; when another user views that content, the attacker can gain unauthorized read access to critical data and limited insert/update/delete access, with the impact crossing a scope boundary. The attack is gated by valid low-privileged credentials and required victim interaction, so broad opportunistic exploitation is less likely; no public exploit identified at time of analysis.

Unauthenticated remote takeover of Oracle WebCenter Sites is possible in supported versions 12.2.1.4.0 and 14.1.2.0.0, per Oracle Fusion Middleware's October 2026 advisory. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H means network attackers need no credentials or user interaction and can fully compromise confidentiality, integrity, and availability. No public exploit code or CISA KEV entry was identified in the supplied data at time of analysis.

Oracle REST Data Services (ORDS) versions 24.2.0 through 26.2.2 expose a confidentiality-only flaw in the Core component that lets a low-privileged, network-positioned user read data well beyond their intended authorization boundary. Because the CVSS vector carries a scope change (S:C) alongside high confidentiality impact, an attacker with valid low-level ORDS credentials can reach critical data and potentially affect other Oracle products reachable through the same deployment, though integrity and availability are untouched and exploitation requires an existing account (PR:L) rather than being fully unauthenticated despite the 'Authentication Bypass' tag. No public exploit code or CISA KEV confirmation was available at time of analysis, and the primary reference is Oracle's October 2026 Critical Patch Update advisory. Note that the 7.7 score reflects confidentiality exposure only; the practical risk is meaningful but not a drop-everything emergency.

Unauthenticated attackers with TCP network reach to Oracle Secure Backup 19.1.0.0.0 or 19.1.0.1.0 can take full control of the backup service, with high confidentiality, integrity and availability impact and a CVSS 3.1 base score of 9.8. The vendor rates the attack as low-complexity with no privileges or user interaction required, so network exposure is the main constraint. No public exploit was identified at time of analysis, and no CISA KEV entry was provided.

Local privilege escalation in Oracle Secure Backup 19.1.0.0.0 and 19.1.0.1.0 lets an attacker who already holds a valid low-privileged logon on the OSB host take full control of the backup server through the Device Management and Support component. Because the vector requires local access (AV:L) and an existing account (PR:L), the realistic exposure is limited to environments where untrusted users can log on to the OSB infrastructure, but successful exploitation yields complete confidentiality, integrity, and availability impact (CVSS 7.8). No public exploit code or confirmed active exploitation was identified at time of analysis.

Oracle Secure Backup 19.1.0.0.0 and 19.1.0.1.0 can be taken over by an authenticated, low-privileged attacker who already has a local logon to the host, with scope change potentially affecting other products on that infrastructure. Exploitation is straightforward once local access exists (AV:L/AC:L/PR:L/UI:N/S:C), but it is not remotely reachable without a prior foothold; no public exploit was identified at time of analysis. This is a credible high-priority issue but not an emergency drop-everything item.

Unauthenticated information disclosure in the Oracle Siebel CRM Deployment Cloud Gateway lets any remote attacker who can reach the gateway over HTTP read critical data and, per Oracle, potentially all data accessible through that deployment; supported versions 17.0 through 26.9 are affected. The CVSS 3.1 score is 7.5 with confidentiality-only impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), meaning no user interaction, no privileges, and no integrity or availability effect. Oracle's October 2026 Critical Patch Update advisory is the cited vendor reference and is the source of the fix; no public exploit code has been identified at time of analysis, and the flaw is not listed as confirmed actively exploited (CISA KEV).

Unauthenticated network attackers can read and modify critical data in Oracle Siebel CRM End User through the Portal Framework over HTTPS in versions 17.0 through 26.9. The CVSS 7.4 rating reflects high attack complexity, meaning successful exploitation depends on conditions outside the attacker's control and mass exploitation is less likely; no public exploit code or CISA KEV active exploitation has been identified at time of analysis. Confidentiality and integrity are affected, availability is not, and impact remains within Siebel CRM End User-accessible data.

Unauthenticated attackers can read sensitive data from Oracle Siebel CRM End User versions 17.0 through 26.9 by exploiting an authentication bypass in the UIF Open UI component over HTTP. The CVSS 7.5 vector shows network reachability with low complexity, no privileges, and no user interaction, but impact is confined to confidentiality (C:H/I:N/A:N). No public exploit code or confirmed active exploitation was identified at time of analysis.

Unauthenticated remote attackers who can reach an Oracle Siebel CRM Deployment server over HTTP can read critical data or the full set of data accessible to that deployment, affecting versions 17.0 through 26.9 of the Server Infrastructure component. The flaw scores CVSS 3.1 7.5 with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, meaning no credentials, no user interaction and no special configuration are prerequisites, and impact is limited to confidentiality - no integrity or availability effect is described. Oracle published the fix in its October 2026 Critical Patch Update; no public exploit code has been identified at time of analysis, and no EPSS score was supplied with the available intelligence.

Exposes critical data in Oracle Siebel CRM Deployment 17.0 through 26.9 to unauthenticated remote attackers through the TLS-exposed Server Infrastructure component, carrying a CVSS 3.1 score of 7.5 (High). Impact is confidentiality-only: attackers can read critical or all deployment-accessible CRM data but cannot modify data or disrupt service. No public exploit identified at time of analysis, and no CISA KEV entry was provided.

Low-privileged authenticated attackers can compromise Oracle Siebel CRM Deployment 17.0 through 26.9 over HTTP, gaining high confidentiality and integrity impact and causing partial denial of service (CVSS 8.3, PR:L). The affected Server Infrastructure component allows unauthorized creation, deletion, modification, and access to critical deployment data, and no public exploit code or CISA KEV entry was identified at time of analysis. Although tagged 'Authentication Bypass', the assessed vector requires valid low-privilege credentials and does not represent unauthenticated access.

Unauthorized data access and limited data modification in Oracle Siebel CRM Deployment 17.0 through 26.9 are possible for unauthenticated network attackers able to reach the Server Infrastructure HTTP interface. The CVSS 3.1 score is 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), reflecting high confidentiality impact and low integrity impact with no availability impact; Oracle tags the issue as an authentication bypass. No CISA KEV entry or public exploit code was identified in the supplied intelligence, so exposure is chiefly governed by whether the Siebel HTTP endpoint is reachable from untrusted networks.

Authenticated low-privileged users of the Siebel Life Sciences Web UI in Oracle Siebel CRM versions 17.0 through 26.9 can exploit a scope-changing flaw over HTTP to read and modify critical data beyond their own authorization boundary, but only if they can persuade another user to interact with the attack. The CVSS 3.1 score is 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N), with high confidentiality and integrity impact and no availability impact. No public exploit was identified at time of analysis, and there is no CISA KEV entry.

Unauthenticated remote attackers can reach the Integration Broker component of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 over HTTP and, by persuading a legitimate user to open a crafted link or act on an attacker-supplied request, obtain unauthorized read access to critical PeopleTools data plus limited unauthorized insert/update/delete capability. The mandatory user-interaction prerequisite (CVSS UI:R) keeps the attack from being an interaction-free, automatable mass-exploitation vector, and the impact is bounded to confidentiality (HIGH) and integrity (LOW) with no availability effect, giving a CVSS 3.1 base score of 7.1. Exploitation status: no public exploit identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV).

Unauthenticated attackers positioned on the physical communication segment attached to the hardware running Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.9) can exploit the Siebel Cloud Manager component to obtain complete read and write access to critical application data, with scope change extending the impact to additional products. The CVSS 3.1 base score is 8.0 (AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N): no credentials or user interaction are needed, but the High attack complexity and the requirement to already reside on the adjacent/local network segment substantially constrain real-world exposure, and availability is not affected. No public exploit code was identified at time of analysis and the flaw is not listed in CISA KEV, so the practical risk is concentrated in environments where untrusted parties can reach the Siebel Cloud Manager host's local segment.

Low-privileged, network-positioned users of PeopleSoft Enterprise PeopleTools 8.61 through 8.63 can abuse the Test Framework component to cross a security boundary and obtain read/write access to critical PeopleTools data, but only if they can persuade another user to interact with attacker-supplied content. The issue is rated CVSS 8.7 with high confidentiality and integrity impact and no availability impact; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and no EPSS score was supplied.

Full compromise of Oracle PeopleSoft Enterprise PeopleTools 8.61-8.63 is achievable through its SQR reporting component, but only under narrow conditions: the attacker must already hold a logon account on the host where PeopleTools executes and must induce a different user to perform an action. Oracle scores this 7.0 High (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H), with high attack complexity and a human-interaction requirement that make it a moderate-priority issue rather than an urgent, mass-exploitation threat. No public exploit code or confirmed active exploitation was identified at time of analysis, and PR:N indicates that no PeopleSoft application authentication is needed once local host access has been obtained.

Authenticated low-privileged attackers can achieve takeover of PeopleSoft Enterprise PeopleTools 8.61-8.63 by reaching the SQR component over HTTP, although Oracle rates the flaw as difficult to exploit because of high attack complexity (AC:H). The CVSS 3.1 score is 7.5 with high confidentiality, integrity, and availability impact, and exploitation requires valid low-privileged credentials (PR:L) but no user interaction (UI:N). No public exploit identified at time of analysis, and no CISA KEV confirmation was provided, so risk is concentrated in environments that expose SQR over HTTP and allow low-privileged accounts.

Unauthenticated HTTP requests to the SQR component of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 can return critical application data to anyone who can simply reach the web tier, a confidentiality-only but high-severity exposure scored CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N). Oracle addressed the flaw in its October 2026 Critical Patch Update; no public exploit code and no CISA KEV entry were identified in the data reviewed, so real-world risk hinges on whether the PeopleSoft Internet Architecture and SQR endpoints are internet-reachable or segmented behind VPNs, reverse proxies, or internal networks. This is a credible operational priority rather than an inflated high-CVSS artifact, because the attacker needs no credentials, no user interaction, and no non-default configuration once the endpoint is reachable.

Authenticated low-privilege users can read, create, modify, or delete critical data held in PeopleSoft Enterprise PeopleTools 8.61-8.63 - and, because the CVSS scope is changed, data in connected products as well - by sending crafted requests over HTTP to the SQR component. Exploitation is low-complexity and requires no user interaction, but does require a valid account (PR:L), so exposure is bounded to those who can obtain credentials such as insiders, phished users, or broadly provisioned portal accounts. No public exploit code and no CISA KEV entry were identified at time of analysis; internet-exposed PeopleSoft portals represent the highest realistic risk, and this is a genuine high-priority vulnerability rather than an inflated score.

Oracle PeopleSoft PeopleTools 8.61 through 8.63 can be fully taken over by an unauthenticated attacker who has access to the same physical or adjacent network segment as the host running the PsAdmin component. The flaw is rated CVSS 7.5 with high confidentiality, integrity and availability impact, but exploitation is explicitly difficult (AC:H) and requires network adjacency (AV:A), so it is not reachable from arbitrary internet locations; no public exploit code has been identified and it is not confirmed actively exploited (no CISA KEV listing). Oracle addressed it in the October 2026 Critical Patch Update, so priority should be moderate - patch on a normal cycle and treat segment isolation as the main exposure control.

Unauthenticated network attackers can achieve full takeover of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 through the Business Interlink component, though the high attack complexity - Oracle characterizes the flaw as 'difficult to exploit' - means success depends on conditions beyond the attacker's control, which materially reduces real-world exploitability. The vulnerability carries a CVSS 3.1 base score of 8.1 with complete confidentiality, integrity, and availability impact; no public exploit was identified at time of analysis. This is a genuinely serious but not top-tier-urgent issue, and risk concentrates on internet-exposed PeopleSoft portals where Business Interlink is reachable or in active use.

Takeover of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 is possible through its Business Interlink component, where a low-privileged network attacker who can reach the integration endpoint over HTTP could achieve full confidentiality, integrity, and availability impact. Exploitation is constrained by high attack complexity and the need for valid authenticated access (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H; 7.5), and no public exploit identified at time of analysis, with no KEV or POC signal in the provided intelligence.

Unauthenticated HTTP requests to the Report Distribution component in PeopleSoft Enterprise PeopleTools 8.61-8.63 can read critical PeopleSoft data, with Oracle scoring the flaw CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). The weakness is described by Oracle as easily exploitable and affects confidentiality only, with no integrity or availability impact; no public exploit code or CISA KEV entry is identified at time of analysis, so risk is mid-tier and driven by the clean remote unauthenticated vector rather than confirmed exploitation.

Authenticated users of Oracle E-Business Suite's Capacity module (component: Internal Operations) in versions 12.2.3 through 12.2.15 can exploit this flaw over HTTP with low attack complexity and no user interaction to read critical Capacity data, perform limited unauthorized inserts/updates/deletes, and cause a partial denial of service within that module. The CVSS 3.1 score is 7.6 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L, meaning the attacker must already hold a valid low-privileged EBS account, but no further privilege escalation or victim interaction is required. Oracle addresses it through its Critical Patch Update program; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and scope is unchanged so the compromise does not extend beyond Capacity-accessible data.

Unauthenticated network attackers can achieve full takeover of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 by targeting the Business Interlink component over HTTP, with high impact across confidentiality, integrity, and availability. Oracle rates the flaw as 'difficult to exploit' (CVSS 8.1, AC:H), meaning success hinges on conditions outside the attacker's control such as the specific configuration state or timing of the Business Interlink service, so this is a serious but conditional risk rather than an emergency. No public exploit code or confirmed active exploitation has been identified at time of analysis, and exploitation realistically depends on whether Business Interlink is enabled and reachable from untrusted networks.

Authenticated low-privilege attackers can read critical PeopleSoft Enterprise PeopleTools data and partially disrupt availability through the Portal component in versions 8.61 through 8.63. Exploitation requires network HTTP access and a valid low-privilege PeopleSoft account (PR:L), but no user interaction and low attack complexity make it straightforward once that foothold exists; there is no KEV confirmation or public exploit identified at time of analysis. The authentication prerequisite keeps this below top-tier priority, though risk is highest where the Portal is internet-exposed and low-privilege or self-service accounts are widely provisioned.

Oracle Capacity in Oracle E-Business Suite 12.2.3 through 12.2.15 lets a low-privileged authenticated user read critical data, make limited unauthorized data changes, and cause partial denial of service through crafted HTTP requests to the Internal Operations component. No public exploit was identified at time of analysis, and this is not an anonymous authentication bypass despite the supplied tag; the PR:L vector means attackers need valid EBS credentials. The practical risk is therefore highest for insider threats or attackers who have already compromised a low-privileged EBS account.

Authentication, authorization, and rate-limiting middleware bypass in @fastify/middie 9.0.0 through 9.3.5 can let a single unauthenticated remote request reach a route handler while path-scoped middleware registered with use() is silently skipped. The flaw occurs when the middleware mount path joined to the plugin scope prefix diverges from the path Fastify's router serves, particularly when the scope prefix ends in a slash, when array mount paths are used, or when mount paths lack a leading slash. Risk is configuration-dependent: applications that rely on path-scoped middie middleware for security and use those mount-path patterns are exposed, while applications enforcing authorization in a post-routing Fastify hook are not; no public exploit identified at time of analysis, and the vendor patch is 9.3.6.

Kiro Crew before version 0.7.2 contains a missing authorization flaw in its WhatsApp group channel integration that lets a remote attacker who is a member of an operator-configured WhatsApp group control the operator's other agent sessions and execute arbitrary commands on the host. The attacker must already belong to the specific group (low privileges, PR:L), but no operator interaction is required; deployments that do not enable the WhatsApp channel are not exposed. The vendor has released version 0.7.2 to fix the issue, and no public exploit code has been identified at the time of analysis.

Cross-session task access in the MCP TypeScript SDK (@modelcontextprotocol/sdk 1.24.0 through 1.31.0) allows any client sharing a single InMemoryTaskStore to list, read, and cancel other clients' experimental task records and results, an IDOR-style authorization bypass rated 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) with high confidentiality impact and low integrity/availability impact. The flaw is only reachable where an HTTP MCP server explicitly passes a shared taskStore to McpServer or Server and serves multiple sessions from it using the deprecated experimental tasks feature; stdio servers, stateless HTTP servers, and one-store-per-session deployments are not exposed, and 2.x packages are unaffected. There is no public exploit identified at time of analysis and no confirmed active exploitation; the vendor patched the SDK in 1.32.0 by binding each task to the session that created it.

Bearer tokens accepted by the XERJ Console API v1.0.0-rc.11 can reach the API-token creation endpoint that is intended to require passkey-only authentication, allowing anyone holding such a token to mint persistent successor API credentials that survive remediation of the original token. The independent assessment scores this 9.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), while the CVE record carries a conflicting PR:N vector - the privilege requirement should be confirmed with the vendor, since the mechanism as described turns on possession of a valid bearer token rather than anonymous access. Exposure is confined to a single pre-release build of the Console API, EPSS is 0.25% (16th percentile), there is no CISA KEV listing, and no public exploit was identified at time of analysis, although the vuln.today decision label is act_now and the report originated with CERT/CC.

OpenStack Manila before 23.0.1 allows any authenticated member of an OpenStack project to act on another tenant's public share, exposing data and enabling access-rule and lifecycle tampering. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H (9.9), reflecting a low-privileged, network-reachable cross-tenant authorization failure; target shares must be public, which makes their UUIDs visible. No public exploit code was identified at time of analysis, and active exploitation is not confirmed in the supplied data.

Broken authorization in SolarWinds Observability Self-Hosted allows an authenticated low-privileged user to access and modify information beyond their assigned permissions, with high confidentiality and integrity impact (CVSS 8.8). The flaw is network-reachable and requires only a valid low-privilege session, not pre-authentication, so a compromised or over-provisioned account is sufficient. No public exploit code or confirmed active exploitation was identified in the provided intelligence at time of analysis.

SuggestArr deployments running in 'local_bypass' authentication mode can be tricked into granting a full administrative session without any credentials by spoofing the X-Forwarded-For header. Because api_service/app.py applies ProxyFix(x_for=1) and enforce_authentication() in api_service/auth/middleware.py trusts the resulting request.remote_addr, a remote attacker who can reach the instance can set X-Forwarded-For to a trusted CIDR value such as 127.0.0.1 and be automatically logged in as an admin via _load_bypass_user_context(), exposing endpoints like /api/users and /api/jobs. The CVSS 4.0 vector is unauthenticated (PR:N) with high confidentiality and integrity impact; exploitation is conditional on the non-default combination of local_bypass being enabled and the app sitting behind a reverse proxy, and no public exploit code or CISA KEV entry was identified at time of analysis.

Unauthenticated read access to the complete contents of prefixed system databases is possible in Apache CouchDB 3.5.2 and earlier because chttpd fails to enforce authorization on an API endpoint that serves those databases. Only deployments that have renamed their system databases with a prefix (a configuration the vendor calls 'very rare') are exposed - instances using the default _users and _replicator names are not exploitable - but where that condition holds, a remote attacker with network reach to the HTTP API can dump user credential documents or replication definitions without credentials or user interaction. Our assessment rates confidentiality impact as high with no integrity or availability effect, and no public exploit code or CISA KEV entry was identified at the time of analysis.

Authentication bypass in Networknt light-4j 2.1.5 before 2.4.0 lets unauthenticated attackers impersonate LDAP/AD-delegated users by sending a Basic Authorization header with a known username and an empty password. The flaw is only reachable where BasicAuthHandler uses LDAP/AD delegation and the backing directory treats a non-empty username with an empty password as a successful bind; static/config-file Basic auth and bearer-token deployments are not affected, and directories that reject empty-password binds neutralize the attack. Vendor-released patch: 2.4.0; no public exploit identified at time of analysis.

Authenticated users on Moodle instances running the Configurable Reports block before 5.3.0 can read restricted SQL reports containing user and grade data by supplying arbitrary report IDs to the block_configurable_reports_get_report_data web service. The CWE-863 authorization bypass occurs because a failed check_permissions call adds only a warning and still returns the full report table, so any valid logged-in account can access reports without the required permissions when Moodle web services are enabled. Exploitation requires a valid login but no elevated role, impact is read-only confidentiality loss, and no public exploit identified at time of analysis.

Stirling-PDF 2.13.2 through 3.2.0 lets an authenticated administrator regain Java method execution by uploading a crafted SQL backup to the import-database endpoint. The incomplete denylist in DatabaseService.validateSqlContent() does not block CREATE OR REPLACE ALIAS statements, so a RUNSCRIPT payload can define H2 Java function aliases and re-enable the code-execution path the import restrictions were meant to close (CWE-184). Publicly available exploit code exists, including a proof-of-concept repository and accompanying research writeups; there is no CISA KEV listing, and the decisive mitigating factor is the PR:H administrator prerequisite, which confines realistic risk to compromised or malicious admin accounts and to shared or multi-tenant instances where an administrator is not fully trusted.

Unauthenticated task-read disclosure in the A2A Java SDK before 1.3.0.Final lets any network caller retrieve another caller's task status, context ID, message history, and artifacts by supplying a task ID. The default no-argument InMemoryTaskStore constructor leaves authorizationProvider null, so InMemoryTaskStore.get(String taskId) returns stored tasks without any owner or caller check unless a TaskAuthorizationProvider is wired through the AuthorizationRequestHandlerDecorator - a wiring that manual DefaultRequestHandler.builder().build() setups and integrations such as Spring commonly skip. Because the default/reference transport endpoints also perform no authentication, the exposure is reachable without an account in multi-caller deployments; exploitation additionally requires the attacker to know or guess a valid task ID, and no public exploit code has been identified at time of analysis.

Authenticated low-privileged users on Nokia 1830 Global Express (GX) can bypass the SSH isolation mechanism and reach the underlying operating system shell by issuing a custom SSH command, giving them full control of the device. The flaw is present by default in GX G42, G31, G32 and G34 releases prior to GX r9.0 and is not caused by misconfiguration. No public exploit identified at time of analysis, no CISA KEV entry was provided, and EPSS is low at 0.17% (percentile 6%).

Authentication bypass in Cruise Control (Red Hat Streams for Apache Kafka 2.x and 3.x) lets adjacent-network attackers reach all 15 administrative REST endpoints without credentials by abusing exact-path Jetty security constraints and servlet path normalization. The CVSS 3.1 score is 8.8 (AV:A/AC:L/PR:N/UI:N), but in AMQ Streams the Strimzi operator NetworkPolicy limits Cruise Control port 9090 to operator pods, so realistic exposure requires that policy to be absent, disabled, or misconfigured. No public exploit was identified at time of analysis.

Missing authorization in Unblu Spark's Collaboration Server (versions 7.0 through 8.36.1-hotfix.0) lets any authenticated low-privilege user read and modify configuration data belonging to other users and accounts - and, in Unblu Cloud, other customers' tenants - crossing a security boundary. The server omits ownership checks on configuration-cascade operations, and when non-default configuration validation settings are in effect a registered user can also write configuration properties outside their permitted scope; exploitation needs a valid session but no user interaction. No public exploit code or confirmed active exploitation was identified at time of analysis, but the cross-tenant read/write impact and critical severity (CVSS 4.0 9.3; the independent CVSS 3.1 assessment is also critical) make this a high-priority fix.

Unauthenticated file disclosure in LavaLite CMS through 10.1.2 allows remote attackers to download private stored files through the Filer module's filer/download and filer/display routes. Attackers can supply arbitrary disk names and paths to FileController, exposing private local uploads or data on configured remote S3 disks when paths or disk names are known or enumerable. Publicly available exploit code exists, and no CISA KEV status is indicated in the provided data; assessed impact is confidentiality-only, with no integrity or availability effect.

Arbitrary file read in Dockhand before 1.0.46 lets authenticated non-admin users holding the stacks:edit permission read sensitive files such as /etc/shadow, /etc/passwd, .git/config credentials, and SSH keys through the path parameter of /api/system/files/content. The flaw is a CWE-863 authorization failure scored 7.1 (High) under CVSS 4.0, and exposure is limited by the requirement for a prior authenticated account with stacks:edit; reads are confined to files the Dockhand container process can access. No public exploit identified at time of analysis, and the vendor-released patch is version 1.0.46.

Missing authorization in the JSON configuration import of the Sgalinski Cookie Consent extension for TYPO3 lets a non-administrator backend user who already has access to the module import settings that inject arbitrary scripts into the website frontend. The issue is CWE-862 and is scored 7.1, with the supplied vector requiring authenticated backend access (PR:L) and no user interaction. No public exploit or CISA KEV entry was identified at time of analysis.

Any authenticated TYPO3 backend user can rewrite arbitrary page-record fields-including access permissions and configuration-when the AI Integration extension is active, because its backend write endpoint performs neither a permission check nor a field allowlist. The issue affects TYPO3 installations with typo3_ai_integration_extension installed and active and requires only a low-privileged backend session (CVSS 4.0 7.2 High; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L). No public exploit code or CISA KEV entry was identified at time of analysis.

Authentication bypass in Advantech ADAM-3600 enables unauthenticated network attackers to abuse the password-reset mechanism and gain unauthorized access, with high confidentiality, integrity, and availability impact; CVSS 4.0 scores this 9.2, while our independent CVSS 3.1 assessment rates it high with AC:H because a specific precondition in the reset flow must be met (AT:P). No public exploit code has been identified at time of analysis, and exploitation depends on network reachability to the controller's management/reset interface; OT segmentation substantially reduces exposure. This is a high priority for affected ICS/OT environments where ADAM-3600 devices are internet-facing or reachable from compromised IT segments.

Authentication bypass in Advantech ADAM-3600 remote terminal units allows unauthenticated network attackers to bypass the proprietary protocol's authentication mechanism and potentially achieve high impact on confidentiality, integrity, and availability (CVSS 9.3; assessed CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The flaw is remotely reachable with no credentials or user interaction, but realistic risk depends on whether the device's proprietary protocol service is exposed beyond segmented OT/field networks. No public exploit code or CISA KEV entry was identified at time of analysis, and EPSS data was not provided.

Stormshield Network Security's Autoupdate routine can accept unauthenticated dynamic data files because of a logic error in its signature-verification check, allowing an adjacent-network attacker who interposes on the update channel to undermine the integrity of dynamic content. Exploitation requires that Autoupdate be in use and that the attacker can supply or tamper with update files reaching the appliance, with no credentials or user interaction needed but high attack complexity due to the need to interpose on or race the update fetch. No public exploit code or CISA KEV active-exploitation signal was identified at time of analysis.

Stormshield Network Security (SNS) can accept forged update and license files because a logic error in its signature verification routine bypasses authenticity checks. A local attacker must rely on user interaction: an administrator must obtain a malicious file from a source other than the official MyStormshield servers or not use SNS automatic verification, then apply it to the appliance. No public exploit was identified at time of analysis, and the risk is neutralized when updates and licenses are retrieved only from MyStormshield with automatic SNS verification enabled.

Ghostscript as shipped with Red Hat Enterprise Linux 8-and, per CPE data, RHEL 6, 7, 9, and 10-may allow an attacker to escape -dSAFER protections when it processes a crafted PostScript file, enabling file access outside permitted paths or command execution with the Ghostscript process's privileges. The root cause is that Red Hat's 9.25-to-9.27 rebase omitted the CVE-2019-14869 correction, leaving privileged .forceput operations in the .charkeys procedure insufficiently protected; the supplied CVSS base score is 7.3, while the independent assessment treats confidentiality and integrity impact as High (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L). No CISA KEV entry is present in the supplied data and no public exploit identified at time of analysis; practical risk is conditional on a service or pipeline actually processing untrusted PostScript/EPS with an affected RHEL build.

Authorization bypass in Cloudflare Pingora before 0.9.0 can occur only in a chained HTTP/1 deployment where Pingora forwards to a downstream HTTP/1 intermediary that honors Connection-nominated headers and the origin trusts a header Pingora adds, such as X-Forwarded-For. A remote, unauthenticated attacker can use the client Connection header to nominate that trusted header; because the vulnerable HTTP/1 upstream path fails to strip hop-by-hop or nominated headers, the intermediary may remove it and bypass IP-based authorization. No public exploit was identified at time of analysis, Cloudflare CDN customers are explicitly unaffected, and 0.9.0+ default policy removes these headers, so the issue is conditional rather than broadly exploitable.

Authorization bypass in Apple iOS and iPadOS before 27 lets a malicious or compromised third-party app already installed on the device initiate calls or send messages despite intended network restrictions. Apple assigns CVSS 7.5, while the independent assessment treats the attack vector as local (AV:L) because the app must be present and running; there is no indication of network-only exploitation. No public exploit was identified at time of analysis, and EPSS is low at 0.14% (3rd percentile).

Authentication-state handling in Apple macOS can allow an attacker to impersonate other users, and the supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) scores the issue 9.1, describing network-reachable, unauthenticated exploitation with no user interaction and high confidentiality and integrity impact. Affected systems are macOS releases before Golden Gate 27, Sequoia 15.8 and Tahoe 26.7. Fixes are available in all three branches, the vuln.today priority label is act_now, EPSS is 0.20% (10th percentile), and no public exploit identified at time of analysis.

Cross-tenant impersonation in Letta through 0.16.8 allows an authenticated low-privileged API caller to read and modify another user's agents, memory, and configuration by setting the self-asserted user_id HTTP header to the victim's tenant ID, even when LETTA_SERVER_SECURE is enabled. The server trusts the client-supplied identity key during request resolution, so the bypass requires only API connectivity and a known or guessed target user_id, not credential theft or memory corruption. Publicly available exploit code exists, with no CISA KEV listing confirming active exploitation; this is a genuine high-priority issue for multi-tenant or shared Letta deployments, while single-user instances have little cross-tenant data to expose.

Coze Studio through 0.5.1 exposes cross-tenant workflow access because its workflow API trusts a client-supplied workflowID without verifying that the object belongs to the caller's space. An authenticated low-privilege user who knows or enumerates another tenant's workflowID can pair it with their own spaceID and read, run, overwrite, or delete that workflow via the save, update_meta, batch_delete, canvas, test_run, and nodeDebug routes. Publicly available exploit code exists, and exposure is highest on shared or multi-tenant deployments that allow untrusted users to register, while single-tenant private installations face lower practical risk.

Unauthenticated remote code execution in DB-GPT through 0.8.2 allows remote attackers to reach the /api/v1/chat/react-agent endpoint, where a mock get_user_from_headers function grants every caller the admin role. Crafted prompts can cause the ReAct agent's unsandboxed code_interpreter and shell_interpreter tools to execute arbitrary Python or bash as root in the webserver container, potentially reaching the bundled database with default credentials. Publicly available exploit code exists; the provided data does not confirm active exploitation, and the assessed CVSS 3.1 severity is 9.3 with network access, no privileges, and no user interaction required when the endpoint and interpreter tools are deployed and reachable.

EvoScientist 0.1.0 up to (but not including) 0.2.5 lets an attacker reach host shell execution by delegating work to async sub-agents that carry no human-approval gate: instructions planted in ingested content such as a fetched web page can cause the agent to call start_async_task, and the resulting commands run with the invoking user's OS privileges and environment secrets. The bypass is a missing-authorization flaw (CWE-862) in the approval wiring rather than a credentials attack - per CVSS 4.0 (AV:N/AC:L/PR:N/UI:N, all impact metrics High) and our assessed CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) it is unauthenticated and requires no user interaction beyond the agent processing the poisoned content, and per the fix the vulnerable async thread lacks any approval path at all, so exploitation does not depend on auto_approve being enabled. A public PoC reference exists; it is not verified as working exploit code, EPSS is low at 0.44% (37th percentile), SSVC marks exploitation as 'poc' with automatable/total technical impact, and the vuln.today decision label is act_now with a vendor fix in v0.2.5.

Unauthenticated remote command execution in Langchain-Chatchat through version 0.3.1.3 allows any network-reachable attacker to invoke the built-in shell tool through the POST /tools/call endpoint and run arbitrary OS commands as the Chatchat server user. Because the shipped Docker image runs the service as root, successful exploitation typically yields root-level command execution. Publicly available exploit code exists; there is no CISA KEV confirmation of active exploitation at time of analysis.

Missing authorization in OpenSRE through 0.1.2026.10.19 allows remote attackers to run shell commands on the agent host without any human confirmation, because the headless presenter's execution_allowed() returns True unconditionally for every shell_run request. The practical attack path is prompt injection: crafted instructions placed in an alert feed or Slack message that the agent triages get interpreted as commands, letting the attacker execute on the host and exfiltrate LLM, Slack and cloud credentials. No CISA KEV entry exists and EPSS is low at 0.45% (38th percentile), but SSVC rates exploitation proof-of-concept, automatable and total technical impact, and a public PoC reference exists that is not verified as working exploit code; the priority label is act_now.

Unauthenticated remote code execution in PiFlow 2.0.0-2.0.1 allows network attackers to drive the DeepAgents chat agent through POST /chat or POST /chat/stream and invoke the exec_shell tool, which runs arbitrary commands via subprocess.run without human approval or an allow-list. Publicly available exploit code exists, and successful exploitation can expose LLM API keys and database credentials present in the process environment. This is a genuine high-priority risk for exposed deployments where the chat agent feature is enabled and reachable, with no CISA KEV entry indicated in the supplied data.

Hard-coded credentials in IBM Verify Identity Access 11.0.3.1 and IBM Security Verify Access 10.0.9.3 appliances can let an attacker in physical or adjacent-network proximity gain elevated privileges, with CVSS 3.1 score 8.8 reflecting high confidentiality, integrity, and availability impact. The CVSS vector indicates no privileges or user interaction are required (PR:N/UI:N), but the adjacent-network attack vector limits exposure to attackers who can reach the appliance locally or on an adjacent segment. No public exploit code or confirmed active exploitation was identified at time of analysis.

Remote code execution in IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 stems from an improper-authentication weakness (CWE-287) that lets a network-reachable, low-privilege authenticated attacker execute arbitrary code with no user interaction. The CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) indicates full loss of confidentiality, integrity, and availability once the flaw is triggered. No public exploit code was identified at time of analysis, and the vulnerability has not been confirmed as actively exploited (CISA KEV); the primary constraint on attackers is the need for low-privilege authenticated access to the TRIRIGA platform.

Broken object-level authorization in IBM Langflow OSS 1.0.0 through 1.12.4 allows any authenticated low-privilege user to bulk-delete another user's messages, overwrite message content to inject malicious prompts, or reassign a conversation session ID to hijack the session. The CVSS 3.1 score is 8.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L), so exploitation requires a valid account and a shared deployment where other users' messages or sessions exist; single-user instances have little cross-user data to target. No public exploit code or confirmed active exploitation was identified at time of analysis, and this is assessed as above-average priority rather than an emergency.

Improper authentication (CWE-287) in TP-Link Tapo C210 V3.60 firmware lets an attacker positioned on the same adjacent network retrieve shared credential material and cryptographic metadata by sending unauthenticated DS JSON API requests to the camera, without any credentials or user interaction. The recovered shared credential is then accepted by the Streamd Digest authentication mechanism as the administrative password, so the attacker can establish encrypted media sessions and view the camera's protected streams without ever knowing the device account password. Impact is confined to confidentiality - high credential/crypto disclosure and unauthorized media-session access - with no integrity or availability effect cited; exploitation requires local LAN/Wi-Fi adjacency and is not reachable directly from the internet, and no public exploit code or CISA KEV entry was identified at time of analysis.

Unauthenticated arbitrary code execution in Dell Application Store affects every release prior to 26.05.0.7, reachable by an attacker who shares the same local network segment as the host. The root cause is a critical function that performs no authentication check (CWE-306), so an attacker with adjacent access (shared LAN or Wi-Fi broadcast domain, per AV:A) can invoke it without credentials or user interaction, yielding high confidentiality, integrity, and availability impact (CVSS 8.8). There is no public exploit identified at time of analysis and the issue is not in CISA KEV; the adjacency requirement keeps it off routed/internet attack paths and out of mass-scanning reach, but it is a credible priority for environments running the component on flat or untrusted Layer 2 networks.

Grav CMS 2.0.15 through 2.1.x (before 2.2.2) allows authenticated users with page-edit permission to bypass the Flex form callable allowlist and invoke arbitrary public static methods such as Folder::delete, Folder::move, and Utils::download. By renaming a Flex form field using the replace-name@ syntax, an editor can smuggle data-*@ directives past validation, enabling directory deletion, file overwrite, and arbitrary file reads. No public exploit code has been identified at time of analysis, and exploitation requires an authenticated editor account rather than anonymous access.

Authorization bypass in Craft CMS 5.0.0 through 5.10.x allows an authenticated holder of a narrowly site-scoped GraphQL token to create entries in other sites and to delete entries, categories, tags and assets shared across sites. The bypass exists because the requireAllowedSite() check applied to GraphQL queries is not enforced on mutation resolvers, so an attacker can simply supply a siteId outside the token's scope and have the write succeed. Only multi-site installations with the GraphQL API and mutation-enabled, site-scoped tokens are exposed; single-site installs and read-only GraphQL schemas are not affected, and no public exploit code or confirmed active exploitation was identified at time of analysis. Impact is integrity and availability only (no confidentiality loss), but deletion of shared elements can corrupt content consumed by multiple sites.

Account takeover in Craft CMS 5.0.0 through 5.10.x: the users/verify-email action fails to invalidate a user's emailed verification code for active accounts, so a code that has already been used to confirm an email change can be replayed against users/set-password to reset the victim's password. According to the CVSS vector no authentication is required (PR:N), but practical exploitation is gated on obtaining the victim's one-time code - via email interception or control of the change flow - and on the victim actually completing the verify-email step, which is why the assessed vector carries AC:H/UI:R and the issue is considered targeted rather than broadly remote. No public exploit code or confirmed active exploitation was identified at time of analysis, and the behavior is corrected in Craft CMS 5.11.0.

Unrestricted file upload in Eptura Archibus lets a user with a low-privileged account submit an export report containing arbitrary JSP code with a JSPX extension and then browse to the stored file, causing the Java application server to execute attacker-controlled code. Because the upload normally requires an account, the separately disclosed authentication bypass is the key force multiplier: chaining the two removes the authentication prerequisite and yields unauthenticated remote code execution on Java/JSP-capable deployments where uploads are stored in a web-executable location. Rapid7 reports the vendor has fixed the issue; no public exploit code or CISA KEV entry was identified at time of analysis.

Supply-chain malware in Rank Math SEO PRO 3.0.123 packages downloaded or updated between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC can compromise WordPress sites that activated the affected plugin, exposing credentials and enabling persistent backdoor access. The vendor-confirmed incident is limited to that roughly 11-hour distribution window and requires plugin activation; running version 3.0.123 obtained outside the window is not sufficient to establish compromise. Rank Math released version 3.0.124 as the clean replacement, and no public exploit was identified at time of analysis in the provided data.