Denial of Service

Denial-of-service in Apache NimBLE up to version 1.9.0 allows remote attackers to crash the BLE host by causing a NULL pointer dereference in the LE Long Term Key Request event handler. Exploitation requires the host to be built with assertions disabled and a bogus or misbehaving BLE controller. No active exploitation or public exploit code has been identified; the vendor rates severity as low.

Denial of service in Apache NimBLE 1.9.0 and earlier allows a remote attacker to crash the BLE host stack via a crafted ATT Read Multiple Variable Response. The vulnerability is triggered when a vulnerable device, acting as a BLE Central, sends a Read Multiple Variable Request and receives a malicious response that causes an assertion failure in the ATT parser. Exploitation is not known to be active in the wild, and a patch is available in version 1.10.0.

Denial of service in Apache Neethi versions before 3.2.3 allows remote attackers to exhaust resources by manually retrieving an oversized remote policy via the API. The vulnerability is unauthenticated and network exploitable, but no active exploitation has been reported. A patch is available in version 3.2.3, which enforces a maximum size on remote policy references.

Denial of service in Apache Neethi versions before 3.2.3 allows unauthenticated remote attackers to bypass a limit on normalized policy alternatives using crafted WS-Policy documents, causing resource exhaustion. The flaw was introduced with the limit in version 3.2.2 and has a CVSS of 7.5 but very low EPSS probability (0.33%), with no active exploitation or public exploit code reported. Upgrading to version 3.2.3 fully resolves the issue.

Denial of service via memory exhaustion in Apache Neethi versions prior to 3.2.3 allows remote unauthenticated attackers to crash services by supplying crafted policies with deep nesting or missing Policy Ids. No public exploit or active exploitation is known; EPSS score (0.33%) indicates low current exploitation probability. Users should upgrade to version 3.2.3.

Remote code execution in the Blink rendering engine of Google Chrome versions prior to 150.0.7871.186 allows an attacker to run arbitrary code inside Chrome's sandbox when a victim visits a crafted HTML page. The vulnerability has a high CVSS score (8.8) but a low EPSS exploitation probability (0.30%), and no active exploitation has been observed (CISA KEV not listed). A vendor patch is available.

Remote code execution inside a sandbox in Google Chrome prior to 150.0.7871.186 allows attackers to execute arbitrary code via a crafted HTML page. This use-after-free vulnerability requires user interaction and has a high CVSS score but low real-world exploitation probability (EPSS 0.30%). No active exploitation or public exploit code has been identified.

Denial-of-service in MZ Automation's lib60870, an open-source IEC 60870-5-101/104 telecontrol protocol library used in ICS/SCADA systems, allows remote attackers to crash the message-parsing process via a malformed protocol frame that triggers an out-of-bounds read (CWE-125). The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) indicates unauthenticated network exploitation with high availability impact and limited confidentiality exposure. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.

Denial of service in MZ Automation's libiec61850 library allows a network-adjacent attacker to crash an IEC 61850 MMS server by sending a specially crafted WriteRequest whose listOfData field is empty, triggering a NULL pointer dereference (CWE-476) in the Write Named Variable List handler. Any device or application embedding the affected library as an MMS server - commonly protection relays, RTUs, gateways, and SCADA front-ends in electric-power and industrial environments - is exposed. Reported through CISA ICS-CERT (advisory ICSA-26-204-06) with no public exploit identified at time of analysis and no CISA KEV listing.

Denial of service in MZ Automation's libiec61850 lets a network-adjacent attacker crash any application subscribing to GOOSE traffic by transmitting a single crafted L2 GOOSE or R-GOOSE frame carrying a malformed TLV. Because the fault lives in the shared parser used by both the Layer-2 and routable variants, both transport modes are affected, and successful exploitation produces a NULL pointer dereference that terminates the subscriber process. No public exploit identified at time of analysis and the issue is not listed in CISA KEV; the CVSS 4.0 base score is 7.1 with availability-only impact.

Remote code execution in MZ Automation's libiec61850 IEC 61850 library is possible via a crafted MMS Initiate request that triggers a heap-based buffer overflow (CWE-122); RCE was demonstrated on hosts with ASLR disabled, while ASLR-enabled deployments face memory corruption or denial of service. Any device or application embedding this library and exposing the MMS/TCP (typically port 102) service to attacker-reachable networks is affected. Reported through CISA ICS-CERT (ICSA-26-204-06); no public exploit identified at time of analysis and no EPSS/KEV signal is present in the source data.

Remote denial of service in find-my-way (the HTTP router underneath Fastify) affects all versions up to and including 9.6.0 when the router serves requests from a Node.js HTTP/2 server. Because the internal method-to-tree map is a plain JavaScript object, an unauthenticated attacker can send a request whose HTTP method is an inherited Object property name such as constructor, toString, or __proto__, causing find() to treat a prototype value as a router node and crash the process on currentNode.prefix.length. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the trigger is trivial and a fixed release (9.7.0) is available.

Remote memory-exhaustion denial of service in the Quinn Rust QUIC library (quinn-proto 0.1.0 through 0.11.14) lets an unauthenticated peer flood a connection with many small, non-contiguous stream fragments that leave gaps at the start of the stream. Because the in-order Assembler cannot defragment these gapped chunks, buffer overhead grows unbounded and the receiving process can be driven to exhaust memory. CVSS 7.5 (availability-only); no public exploit identified at time of analysis, but the fix and root cause are fully documented in the upstream advisory and PR.

Denial of service in Amazon's aws-smithy-http-server Rust crate (versions prior to 0.66.5) lets remote unauthenticated attackers exhaust server sockets and async tasks by opening many connections and trickling partial requests that never complete. The default serve() path ships without connection read/header timeouts or a concurrent-connection cap, so a classic slowloris-style flood can hang the service indefinitely. No public exploit has been identified at time of analysis, though the technique is well-understood and the CVSS 4.0 base score is 8.7 (High).

Out-of-bounds heap read in PyTorch torchvision's native GIF decoder (versions through 0.28.0) lets attackers who supply a malicious or truncated GIF trigger a segmentation-fault denial of service or leak adjacent heap memory. The flaw sits in the libgif read_from_tensor callback, which passes an unclamped length to memcpy. A public exploit and reproducer exist and an upstream fix is available (commit 4e05dc2), but there is no public exploit identified in the sense of confirmed active exploitation - it is not on CISA KEV. Applications that decode untrusted GIFs via torchvision are affected.

Remote attackers can bypass SAML assertion time and audience restrictions in Logto versions 1.12.0 through 1.37.1, enabling indefinite replay of modified assertions and unauthorized persistent access. No active exploitation or public exploit code has been identified, and EPSS indicates a low exploitation probability (0.13%).

Denial of service in PhpSpreadsheet (PHPOffice) versions 2.0.0 through 5.8.0 lets remote unauthenticated attackers crash a PHP worker with a ~1 KiB malformed XLS/OLE file. The library's OLERead::read() follows attacker-controlled OLE sector chains without cycle detection, so a sector that points back to itself makes the small-block depot loop append the same data until memory is exhausted. It is triggered during automatic format detection via Reader\Xls::canRead(), so any app that probes untrusted spreadsheet uploads is affected; a working proof of concept is published in the vendor advisory, though the flaw is not in CISA KEV.

Denial-of-service in PhpSpreadsheet's Gnumeric reader lets remote attackers crash PHP worker processes by uploading a tiny gzip-compressed .gnumeric file that decompresses to hundreds of megabytes. The reader's Gnumeric::canRead() calls gzdecode() with no decompressed-size cap during routine file-type detection, so a ~98 KB payload expanding to ~96 MiB exhausts a 64M memory limit and triggers a fatal error before validation. No public exploit is identified at time of analysis, but a working proof-of-concept is described in the advisory and the CVSS score is 7.5 (High) with A:H impact.

Denial of service in Apple's swift-crypto (all versions before 4.5.1) allows remote attackers to crash a process by supplying malformed RSA public key bytes. When BoringSSL fails to decode a DER- or PEM-encoded RSA public key, the underlying EVP_PKEY* is freed twice - once in the error catch block and again during deinitialization - corrupting the allocator and causing a crash on subsequent memory allocations. No public exploit identified at time of analysis; the flaw is memory-safety corruption limited to availability impact (CVSS 7.5).

Denial of service in the brace-expansion Node.js library (through version 5.0.7) lets remote attackers crash a process via memory exhaustion by supplying a short crafted string to expand(). The expand() function capped the result count (default 100,000) but not per-result length, so chaining brace groups keeps the count legal while each string grows unbounded; roughly 7.5 KB of input ('{a,b}'.repeat(1500)) triggers a fatal, uncatchable out-of-memory crash in a default Node.js process. Because the library is reached transitively through minimatch and glob, any app that feeds attacker-influenced strings into brace pattern matching is exposed. There is no CISA KEV entry, but the fix commit and README publish a working proof-of-concept trigger string.

Denial of service in OpenPrinting libcupsfilters (as shipped in Red Hat Enterprise Linux 7 through 10) allows a network-adjacent attacker to pin a CPU at 100% by broadcasting a crafted printer advertisement. The flaw lies in cfIEEE1284NormalizeMakeModel(), which enters an infinite loop (CWE-835) when parsing an IEEE-1284 device ID whose model field is empty. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; impact is limited to availability with no data compromise.

Authentication bypass in Eclipse Jetty's HTTP Digest authentication implementation allows an unauthenticated attacker who knows a target username to authenticate as any user whose password contains non-Latin-1 characters (CJK, Cyrillic, Arabic, Greek, emoji, etc.) by substituting those characters with literal '?' characters. The root defect is in DigestAuthentication.java, which uses ISO-8859-1 encoding at three points when computing H(A1), H(A2), and the final MD5 response hash - silently collapsing all code points above U+00FF to 0x3F, making collision credentials cryptographically indistinguishable from the original. A publicly available proof-of-concept demonstrates hash collision across Chinese, Korean, Cyrillic, and Greek passwords; no active exploitation has been confirmed by CISA KEV at time of analysis.

Denial of service in Netty's bzip2 compression codec allows remote unauthenticated attackers to permanently hang an event-loop thread by sending a malformed bzip2 stream, affecting applications that use the Bzip2Decoder in netty-codec (< 4.1.136.Final) or netty-codec-compression (>= 4.2.0.Final, < 4.2.16.Final). The flaw is an infinite loop (CWE-835) in the run-length-encoding state machine of Bzip2BlockDecompressor.read(), which never terminates on crafted input and starves the shared Netty I/O thread pool. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but a vendor patch is available.

ID Token signature verification bypass in OIDC::Lite Perl library through version 0.12.1 allows unauthenticated remote attackers to forge authentication tokens by controlling the algorithm allowlist used during verification. When a relying party calls the verify method without pinning a specific algorithm, the library extracts the ‘alg’ value from the attacker-controlled token header and passes it as an accepted-algorithm allowlist, enabling ‘alg=none’ (no signature check) or key‑confusion attacks (e.g., RS256 to HS256). An attacker can impersonate any user by crafting a token with arbitrary ‘sub’ claims. No active exploitation has been confirmed, and the EPSS score (0.17%) suggests low immediate threat, but the issue is critical for unpatched systems using the unpinned verification path.

Buffer over-read when forwarding messages in Thunderbird allows remote attackers to crash the application by triggering an off-by-one error in MIME header parsing, with a possible but limited information leak of one byte. Affected versions are prior to 153 and 140.13; the user must have the non-default 'view all headers' option enabled while forwarding a specifically crafted email. At time of analysis, there is no evidence of active exploitation (not listed in CISA KEV) and EPSS indicates very low exploitation likelihood.

Denial of service in MongoDB's aggregation framework allows an authenticated database user with write access to crash the mongod process by triggering a specific data type conversion operation that consumes disproportionate memory, causing the operating system's out-of-memory killer to terminate the process under memory pressure. Affected are MongoDB server deployments where low-privileged users can run aggregation queries; the CVSS 4.0 score is 7.1 with high availability impact and no confidentiality or integrity impact. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Denial of service in MongoDB Server (mongod) allows an authenticated user with aggregation privileges to force the operating system to terminate the mongod process under memory pressure by abusing the $rankFusion and $scoreFusion hybrid-search aggregation stages. The flaw sits in the server's error-handling path and requires only the ability to run aggregation queries, causing an OOM-triggered crash of the database instance. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Denial of service in MongoDB Server allows an authenticated user to exhaust CPU or trigger out-of-memory conditions by submitting a crafted Queryable Encryption 'find' payload whose unvalidated field drives an internal computation loop. The resulting resource exhaustion degrades availability for all other operations on the affected instance. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the issue is tracked internally as MongoDB SERVER-127566.

Denial of service in MongoDB Server allows an authenticated user holding only read-only privileges to crash the mongod process by submitting an aggregation pipeline that uses the $linearFill window function with a maliciously typed sortBy expression. Because the required privilege level is minimal (any read user) and the trigger is a single crafted query over the normal database wire protocol, a low-privilege account can repeatedly terminate the database node. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV; EPSS was not provided.

Denial of service in MongoDB allows an authenticated attacker to exhaust server CPU by submitting query operations that use deeply nested $jsonSchema validation constructs, producing a runaway CPU-bound operation that cannot be halted via standard administrative controls such as killOp. Reported by MongoDB's own CNA (SERVER-125872) and classified as inefficient algorithmic complexity (CWE-407), with no public exploit identified at time of analysis. The inability to interrupt the operation elevates this above a routine resource-consumption bug because normal recovery tooling is ineffective.

Denial of service in MongoDB Server (mongod) allows an authenticated user holding only basic write privileges to crash the database process by submitting a crafted transaction command that omits some required fields. The inconsistent validation of related transaction parameters trips a fatal internal invariant (CWE-617), aborting mongod and interrupting availability for all clients. No public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV; impact is limited to availability, with no data disclosure or integrity effect.

Denial of service in MongoDB Server allows an authenticated database user to submit an aggregation/query expression that generates very large arrays, forcing the server to allocate oversized intermediate objects in memory and crash with an out-of-memory (OOM) error. Reported by MongoDB's own CNA and tracked in SERVER-124355, the flaw carries a CVSS 4.0 base score of 7.1 with an availability-only impact (VA:H). No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Denial of service in MongoDB Server (mongod) lets any authenticated user with aggregation-pipeline privileges crash the database process by invoking the internal `$_internalIndexKey` aggregation expression against a compound wildcard index. The expression fails to handle compound wildcard index specifications, tripping an internal consistency check (assertion) that aborts the server. No public exploit identified at time of analysis, and the flaw is reported by MongoDB's own CNA as a Denial of Service issue with no confidentiality or integrity impact.

Denial of service in FFmpeg's libavformat RTP/ASF demuxer (versions 0.6.3 through 8.1.2) lets remote attackers exhaust CPU by delivering a crafted RTP/ASF stream. The rtp_asf_fix_header function in rtpdec_asf.c omits a minimum-chunksize check while iterating ASF objects, so a chunksize below the 24-byte ASF object header minimum leaves the loop pointer static and spins forever. There is no public exploit identified at time of analysis, and the flaw impacts availability only (no code execution or data exposure); it was reported by VulnCheck with an upstream fix committed.

Wildcard CNAME proof validation bypass in PowerDNS Recursor allows a malicious or compromised authoritative DNS server to serve crafted responses that defeat DNSSEC validation for wildcard-expanded CNAME records, undermining the integrity guarantees DNSSEC is meant to provide. Affected versions span the 5.2.x, 5.3.x, and 5.4.x release trains, all patched on July 22, 2026. The vendor classifies this as Low severity; no public exploit code and no confirmed active exploitation have been identified at time of analysis.

Remote denial of service in ISC BIND 9 lets an attacker crash a validating resolver via a maliciously crafted DNSSEC proof. When a provably-insecure delegation is covered by both NSEC and NSEC3 records at the parent but only one of those types carries an RRSIG, BIND hits a reachable assertion (CWE-617) and terminates while validating the insecurity proof. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, unauthenticated attack surface and named process termination make this a high-availability-impact issue for recursive resolvers.

Denial of service in ISC BIND 9 lets a remote unauthenticated attacker exhaust resolver memory by flooding a DNSSEC-validating resolver with random-subdomain ('water torture') queries against a DNSSEC-signed zone. When queries arrive faster than the resolver can complete validation, memory consumption grows unbounded - orders of magnitude beyond the configured max-cache-size - eventually crashing the service. Affects a broad span of 9.11 through 9.21 release and supported-preview (-S) branches; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Denial of service in ISC BIND 9 resolvers (9.20.0-9.20.24, 9.21.0-9.21.23, and 9.20.9-S1-9.20.24-S1) lets remote unauthenticated attackers exhaust CPU by luring a validating resolver to query an authoritative zone that returns many valid-but-superfluous RRSIG records, which BIND always validates even when unnecessary. The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/A:H) reflects an availability-only impact with no confidentiality or integrity loss. There is no public exploit identified at time of analysis and it is not in CISA KEV, but ISC has released fixed builds (9.20.26 and 9.21.24).

Remote denial-of-service in NLnet Labs Unbound 1.9.0 through 1.25.1 allows an unauthenticated attacker to crash the recursive DNS resolver by sending a single malicious encrypted DNSCrypt query over TCP. The TCP in-place encryption routine omits the reply-length clamp that protects the UDP path, so an oversized reply is shifted 48 bytes forward past the end of a heap allocation sized to 'msg-buffer-size' (CWE-122). Only builds compiled with '--enable-dnscrypt' and an active 'dnscrypt:' clause are affected; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Remote denial of service in NLnet Labs Unbound 1.22.0 through 1.25.1 lets an unauthenticated client exhaust configured memory when downstream DNS-over-QUIC (DoQ) is enabled. The first two bidirectional QUIC streams (stream_id 0 and 4) skip the per-stream 'quic-size' accounting gate, so large input buffers are allocated after only a 2-byte length prefix arrives, letting a single connection with two streams force Unbound to allocate roughly double the configured limit at near-zero attacker cost. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the mechanics are trivial and fully described by the vendor advisory.

Denial of service in the Netty network framework (4.2.0.Final-4.2.15.Final and 4.1.0.Final-4.1.135.Final) lets a remote unauthenticated peer exhaust JVM direct memory and crash the process. Applications that enable HTTP/2 content decompression via DelegatingDecompressorFrameListener leak one direct ByteBuf for every HTTP/2 DATA frame delivered to a stream whose decompressor has already been closed, because Http2Decompressor.decompress(...) retains the buffer for writeInbound but never releases it on the error path. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; EPSS data was not provided.

Sandbox escape in Google Chrome for Android prior to 150.0.7871.182 stems from a use-after-free in the GPU component, allowing an attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page. Chromium rates the severity High; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. As a second-stage primitive it is typically chained with a separate renderer bug to achieve full device compromise on Android.

Use-after-free in the Google Chrome UI component (fixed in 150.0.7871.182) allows a remote attacker to induce heap corruption when a victim visits a crafted HTML page and performs specific UI gestures, potentially leading to arbitrary code execution in the renderer. Rated High by Chromium and CVSS 8.8; no public exploit identified at time of analysis, though the vendor patch is available. Exploitation is gated on user interaction, reducing drive-by risk relative to zero-click browser bugs.

Data tampering and partial denial-of-service in Oracle Production Scheduling (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a low-privileged, network-authenticated attacker over HTTP create, delete, or modify critical data - with additional limited read access and a partial DoS. Oracle rates it CVSS 3.1 7.6, driven primarily by high integrity impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so this is a patch-during-normal-cycle priority rather than an emergency.

Data compromise in Oracle Installed Base (Oracle E-Business Suite, Create Item Instance component) versions 12.2.3 through 12.2.15 allows a low-privileged attacker with HTTP network access to read, create, delete, or modify all Installed Base-accessible data and cause a partial denial of service. Rated CVSS 3.1 8.3 (High) with high confidentiality and integrity impact, it was disclosed in Oracle's July 2026 Critical Patch Update. No public exploit was identified at time of analysis and it is not listed in CISA KEV, so exploitation is theoretical, but the low bar (any authenticated EBS account, no user interaction) makes it a strong patching priority.

Data tampering and partial denial-of-service in Oracle Contracts Integration (a module of Oracle E-Business Suite, Internal Operations component) affects supported EBS releases 12.2.3 through 12.2.15. An unauthenticated remote attacker who can lure a legitimate user into interacting with a crafted HTTP request can create, delete, or modify all Contracts-Integration-accessible data and partially disrupt the service. No public exploit identified at time of analysis, and it is not listed in CISA KEV; Oracle rates it CVSS 3.1 7.1.

Unauthorized data access and partial denial of service in Oracle E-Business Suite's Document Management and Collaboration module (Attachments component) allows a remote unauthenticated attacker to read, insert, update, or delete a subset of application data over HTTP. Affecting supported EBS releases 12.2.3 through 12.2.15, the flaw is rated CVSS 7.3 and is described by Oracle as easily exploitable, requiring no authentication or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low-complexity, unauthenticated network vector makes it a meaningful patching priority in a product family that has been a repeated target of mass-exploitation campaigns.

Unauthorized data manipulation in Oracle HCM Configuration Workbench (part of Oracle E-Business Suite, Spreadsheet Loading component) lets a remote unauthenticated attacker reach the application over HTTP and perform unauthorized update, insert, delete and limited read operations, plus trigger a partial denial of service. All EBS releases from 12.2.3 through 12.2.15 are affected. Rated CVSS 3.1 7.3; no public exploit identified at time of analysis and it is not listed in CISA KEV, but the pre-authentication network reach makes it a meaningful patch priority for exposed EBS deployments.

Unauthorized data compromise in Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 (eProcurement component) allows a remote, unauthenticated attacker to reach the module over HTTP and achieve high-impact modification of critical data, limited data disclosure, and a partial denial of service. Because Oracle assigns a scope change (S:C), a successful attack can reach beyond the vulnerable module and significantly impact additional PeopleSoft products, which drives the 9.9 CVSS score. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Unauthenticated remote compromise of Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 (Integration component) allows a network attacker to reach critical data and, because of a scope change, to impact additional PeopleSoft products beyond the vulnerable module. The flaw is rated CVSS 3.1 9.9 and is trivially exploitable over HTTP with no authentication or user interaction, yielding full read of accessible data plus partial write and partial denial-of-service. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the near-maximal score and unauthenticated network vector make it a high-priority patching candidate.

Remote unauthenticated compromise of Oracle PeopleSoft Enterprise FIN Expenses 9.2 (Expenses component) allows attackers with only HTTP network access to read, create, delete or modify all Expenses-accessible data and to cause a partial denial of service. Rated CVSS 3.1 9.4 and flagged by Oracle as easily exploitable, meaning no authentication or user interaction is required. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the low-complexity unauthenticated profile makes it a high-priority patch in the July 2026 Oracle Critical Patch Update.

Unauthorized critical-data access and partial denial of service in Oracle Product Lifecycle Analytics 3.6.1 (Supply Chain suite, Installation Issues component) allows a remote, unauthenticated attacker over HTTP to fully read all data the application can access and partially disrupt service. The flaw carries a scope change, so successful attacks may significantly impact adjacent Oracle products beyond the analytics component itself. Rated CVSS 3.1 9.3 (Critical); no public exploit identified at time of analysis and it is not listed in CISA KEV.

Unauthenticated data tampering and partial denial of service in Oracle Commerce Platform 11.4.0 (Dynamo Application Framework) allows a remote attacker to reach the platform over HTTP and, without any credentials, perform unauthorized insert/update/delete on some accessible data, read a subset of accessible data, and partially disrupt availability. Oracle rates it easily exploitable with a CVSS 3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so no active exploitation is confirmed.

Data tampering and partial denial of service in Oracle HRMS (UK) - the UK Payroll component of Oracle E-Business Suite (EBS) versions 12.2.3 through 12.2.15 - lets a low-privileged, authenticated attacker with HTTP network access create, modify or delete critical HRMS data and partially degrade the service. Oracle rates it CVSS 3.1 7.1 and describes it as 'easily exploitable' (AC:L), meaning any account holder on the EBS instance can abuse it. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation is currently theoretical rather than observed.

Cross-context web attack against Oracle Banking Trade Finance Process Management (OBTFPM) 14.6.0 through 14.8.0 lets an unauthenticated network attacker who lures an authenticated user into interacting with crafted content act in the victim's session, reading, creating, deleting or modifying all OBTFPM-accessible data and causing a partial denial of service. Oracle rates it CVSS 3.1 9.6 with a scope change (S:C), meaning impact can spill into other connected products beyond OBTFPM itself. No public exploit is identified at time of analysis and it is not in CISA KEV; the Critical rating is driven by the scope change plus full confidentiality/integrity impact rather than by observed exploitation.

Data tampering and partial denial of service in Oracle Time and Labor (Oracle E-Business Suite 12.2.3-12.2.15, Internal Operations component) allows a low-privileged, network-authenticated attacker to create, delete, or modify all Time and Labor accessible data and partially disrupt the service over HTTP. The CVSS 3.1 base score is 7.1 (I:H/A:L, no confidentiality impact), reflecting an integrity-focused flaw. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided.

Data tampering and partial denial of service in Oracle Project Portfolio Analysis (a module of Oracle E-Business Suite versions 12.2.3 through 12.2.15) lets a low-privileged, network-based attacker over HTTP create, delete, or modify all data accessible to the application via its Internal Operations component. Oracle rates it CVSS 3.1 7.1 with high integrity and low availability impact and no confidentiality impact. No public exploit identified at time of analysis and it is not in CISA KEV; it was disclosed and fixed in Oracle's July 2026 Critical Patch Update.

Privileged compromise of Oracle Quality, a component of Oracle E-Business Suite (versions 12.2.3 through 12.2.15), allows a high-privileged attacker with HTTP network access to read all Oracle Quality-accessible data, partially modify data, and cause partial denial of service. Because the flaw carries a scope change (S:C), successful attacks can significantly impact additional products beyond Oracle Quality itself. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 3.1 base score of 8.2 reflects meaningful confidentiality and cross-component risk.

Broad data compromise in Oracle Sales Offline (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a low-privileged, network-authenticated attacker read, create, delete, or modify all data the application can access and cause a partial denial of service over HTTP. Oracle rates it CVSS 3.1 8.3 (C:H/I:H/A:L) and describes it as easily exploitable, disclosed in the July 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and low privilege bar make it a strong patching priority.

Privilege escalation and full data compromise in Oracle BI Publisher (versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0) allows a low-privileged, network-authenticated attacker to abuse the Web Service API and read, create, delete, or modify all BI Publisher-accessible data, with a scope change that lets attacks significantly impact additional products. Rated CVSS 3.1 9.9 (Critical), it is easily exploitable over HTTP with no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Unauthorized data access in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component), versions 22.3 through 26.5, lets an unauthenticated remote attacker over HTTP read all Siebel-accessible data, tamper with some records, and cause a partial denial of service. Oracle rates it CVSS 7.0 but flags it as difficult to exploit (AC:H), and no public exploit identified at time of analysis. Disclosed via the Oracle July 2026 Critical Patch Update.

Data compromise and cross-product impact in Oracle E-Business Suite (Oracle Common Application Components, versions 12.2.3 through 12.2.15) allows a low-privileged, network-authenticated attacker to read, create, delete, or modify critical application data and cause a partial denial of service. Because the flaw carries a scope change (S:C), a successful attack can significantly affect additional Oracle products beyond the vulnerable component. Oracle rates it CVSS 3.1 8.4 but flags it as difficult to exploit (AC:H); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Sensitive data disclosure in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 (Web Content Management component) lets a low-privileged, network-based attacker read or fully access all data the application can reach and cause a partial denial of service over HTTP. Oracle rates it CVSS 3.1 7.1 and describes it as easily exploitable, though it requires an existing low-level account (PR:L). There is no public exploit identified at time of analysis and it is not listed in CISA KEV; it was disclosed in the Oracle July 2026 Critical Patch Update.

Unauthorized data compromise in Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 allows a remote unauthenticated attacker to gain access to critical data and cause limited data tampering and partial denial of service, provided a legitimate user is tricked into interacting with the attack. The flaw carries a CVSS 3.1 score of 7.6 and was disclosed in Oracle's July 2026 Critical Patch Update; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Unauthorized data access and partial denial of service in Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a remote, unauthenticated attacker compromise the platform after tricking a legitimate user into interacting with attacker-controlled content. Per Oracle's July 2026 Critical Patch Update, successful exploitation yields high confidentiality impact (complete read access to WebCenter Content data) plus limited integrity and availability damage. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, though Oracle rates it easily exploitable.

Data compromise in Oracle MySQL Connector/J (MySQL Connectors 9.7.0 through 9.7.1) allows a low-privileged attacker with network access over multiple protocols to read, create, delete, or modify all data accessible to the connector and to cause a partial denial of service. Oracle rates this CVSS 3.1 7.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L), reflecting high difficulty of exploitation but broad confidentiality and integrity impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the fix ships in Oracle's July 2026 Critical Patch Update.

Unauthorized data access and partial denial of service in Oracle Transportation Management 6.5.3 (CSV Management component) allow a low-privileged, network-authenticated attacker over HTTP to read all OTM-accessible data, perform limited unauthorized inserts/updates/deletes, and partially degrade availability. Rated CVSS 3.1 7.6 (High). No public exploit identified at time of analysis; the fix ships in Oracle's July 2026 Critical Patch Update.

Unauthenticated data compromise in Oracle SOA Suite (12.2.1.4.0 and 14.1.2.0.0) lets a remote attacker reach the B2B Engine component over HTTP and read all data accessible to the product, plus induce a partial denial of service. The flaw requires no credentials and no user interaction (CVSS 8.2, C:H/A:L), placing it among the higher-severity items in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the low-complexity, unauthenticated network vector warrants prompt patching.

Denial of service in Oracle Unified Directory (OUD Core) versions 12.2.1.4.0 and 14.1.2.1.0 lets an unauthenticated attacker with LDAP network access hang or repeatedly crash the directory server, producing a complete availability outage. Oracle rates it CVSS 3.1 7.5 with availability-only impact and describes it as easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; confidentiality and integrity are unaffected.

Remote denial-of-service in Oracle Unified Directory (OUD Core) 12.2.1.4.0 and 14.1.2.1.0 lets an unauthenticated network attacker send crafted LDAP traffic that hangs or repeatedly crashes the directory service, producing a complete availability outage. Addressed in the Oracle Critical Patch Update of July 2026, the flaw carries CVSS 7.5 (availability-only) with no impact to confidentiality or integrity. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation is currently theoretical rather than observed.

Privilege escalation and data compromise in Oracle Unified Directory 14.1.2.1.0 (OUD Core) lets a low-privileged, authenticated attacker with LDAP network access read, create, modify or delete all OUD-accessible data and cause a partial denial of service. Oracle rates it CVSS 9.9 with a scope change, meaning exploitation can significantly impact additional products beyond the directory itself. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the near-maximum score and low attack complexity make it a top patching priority.

Denial-of-service in Oracle Fusion Middleware Service Delivery Platform (Messaging Enabler component), versions 12.2.1.4.0 and 14.1.2.0.0, lets an unauthenticated remote attacker send crafted HTTP traffic that hangs or repeatedly crashes the service, producing a complete availability outage. Oracle rates it CVSS 3.1 7.5 with availability-only impact and flags it as easily exploitable. There is no public exploit identified at time of analysis and it is not on CISA KEV; no EPSS score was provided in the source data.

Privilege-abusing remote compromise in Oracle Communications Service Delivery Platform (Messaging Enabler component), versions 12.2.1.4.0 and 14.1.2.0.0, lets a low-privileged attacker reachable over the WebLogic T3/IIOP protocols read and modify all SDP-accessible data and cause partial denial of service. The CVSS 3.1 base score reaches 9.9 because of a scope change: the flaw sits in SDP but successful attacks significantly impact other products co-hosted in the WebLogic domain. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the low attack complexity over a network-facing T3/IIOP surface makes it a high-priority patch.

Memory-exhaustion denial of service in Netty's HTTP/3 codec (Http3FrameCodec) affects all releases prior to 4.2.16.Final, where decodeFrame trusts the wire-supplied payLoadLength and buffers reserved-frame-type payloads without an upper bound. A remote unauthenticated attacker (CVSS 7.5, AV:N/PR:N) can open many QUIC streams and advertise very large payload lengths on reserved HTTP/3 frames to force unbounded heap allocation and crash the server. No public exploit or CISA KEV listing exists at time of analysis; a vendor patch (4.2.16.Final) is available.

Denial-of-service in Oracle MySQL Router (versions 8.4.0-8.4.10 and 9.7.0-9.7.1) allows a remote unauthenticated attacker to send crafted HTTP traffic that hangs or repeatedly crashes the Router process, causing a complete availability outage. The flaw is rated CVSS 7.5 with only availability impact (no data confidentiality or integrity loss) and is described by Oracle as 'easily exploitable.' As of this analysis there is no public exploit identified and it is not listed in CISA KEV; the fix ships in Oracle's July 2026 Critical Patch Update.

Denial-of-service in Oracle Coherence (Core component) of Oracle Fusion Middleware lets an unauthenticated attacker with TCP network access hang or repeatedly crash the in-memory data grid, producing a complete availability outage. Affected supported releases are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0; the CVSS 3.1 base score is 7.5 with a pure availability impact (A:H). Oracle rates it 'easily exploitable,' but there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Denial of service in Oracle Coherence (Core component) of Oracle Fusion Middleware allows a remote, unauthenticated attacker with TCP network access to trigger a hang or repeatable crash, producing a complete availability outage of the affected Coherence instance. It affects supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, carries a CVSS 3.1 base score of 7.5 (availability-only), and is described by Oracle as easily exploitable. No public exploit identified at time of analysis and it is not listed in CISA KEV.

Remote unauthenticated compromise of Oracle WebLogic Server (Fusion Middleware Core component) lets network attackers read, create, delete, or modify any server-accessible data over HTTP. Tagged as an authentication bypass and scored CVSS 3.1 9.1, it affects supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 and was disclosed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the trivial exploitability (AC:L/PR:N/UI:N) makes it a high-priority patch for internet-facing deployments.

Denial of service in Oracle MySQL Connector/C++ (MySQL Connectors component) versions 9.7.0 through 9.7.1 allows an unauthenticated network attacker to trigger a hang or repeatable crash, causing a complete availability outage of the connector. The flaw is remotely and easily exploitable over multiple protocols with no user interaction, but has no confidentiality or integrity impact. No public exploit identified at time of analysis and it is not listed in CISA KEV.

Sensitive-data disclosure and partial denial of service in Oracle Payments (Oracle E-Business Suite File Transmission component, versions 12.2.3 through 12.2.15) lets a low-privileged attacker with HTTP network access read all Oracle Payments-accessible data and partially disrupt the service. Oracle rates it CVSS 3.1 7.1 (C:H/A:L), and intelligence tags flag an authentication-bypass characteristic, though the CVSS vector confirms some privilege is required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Unauthorized data access and partial denial of service in Oracle E-Business Suite's Oracle Workflow component (Workflow Notification Mailer), versions 12.2.3 through 12.2.15, lets a remote unauthenticated attacker read a subset of Workflow data, perform limited update/insert/delete operations, and partially disrupt the service over HTTP. Oracle rates it CVSS 3.1 7.3 and flags it as 'easily exploitable' with no authentication required. No public exploit is identified at time of analysis and it is not listed in CISA KEV, though its low-friction network vector warrants prompt patching in the July 2026 Critical Patch Update.

Denial-of-service in Oracle Java SE 8u491 (and 8u491-perf) and 11.0.31 lets an unauthenticated remote attacker hang or repeatedly crash the JVM by feeding crafted input to the Scripting component's APIs, for example via a web service that passes data to those APIs. There is no confidentiality or integrity impact - only availability - but the attack is network-reachable, low-complexity, and requires no authentication or user interaction, yielding a CVSS 7.5. No public exploit identified at time of analysis and the flaw is not on CISA KEV.

Complete denial of service in the RDBMS component of Oracle Database Server 23.4.0 through 23.26.2 lets an unauthenticated remote attacker reach the database over Oracle Net and trigger a hang or repeatable crash, and additionally gain unauthorized update, insert, or delete access to some database-accessible data. Rated CVSS 3.1 8.2 (High) with network attack vector and low complexity, it requires no privileges or user interaction, making it easily exploitable per Oracle's advisory. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Denial-of-service in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component, versions 22.3 through 26.5) allows an unauthenticated remote attacker to send crafted HTTPS traffic that hangs or repeatedly crashes the application, producing a complete availability loss. The flaw carries a CVSS 3.1 base score of 7.5 with pure availability impact and no confidentiality or integrity effect. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Cross-site-scripting-style compromise of Oracle PeopleSoft Enterprise PeopleTools 8.62 (PIA Core Technology) lets a remote, unauthenticated attacker who lures an authenticated user into interacting with a crafted HTTP request achieve limited read/write access to PeopleSoft data and cause partial denial of service. The scope-change flag (S:C) means the impact can extend beyond PeopleTools into additional integrated products. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; CVSS 3.1 base score is 7.1.

Data tampering and information disclosure in Oracle Enterprise Manager Base Platform (Discovery Framework component, versions 13.5 and 24.1) allows a remote, unauthenticated attacker to reach the console over HTTPS and, if the difficult-to-exploit conditions are met, create, delete, or modify critical data and read a subset of application data, plus cause a partial denial of service. Oracle rates this CVSS 3.1 7.0 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Unauthorized data access and partial denial of service in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) allows a remote, unauthenticated attacker to reach the Enterprise Config Management component over HTTP and read, insert, update, or delete a subset of EM-accessible data. Oracle rates it CVSS 3.1 7.3 and describes it as 'easily exploitable' with no authentication or user interaction, so it is a high-priority patch for internet- or intranet-reachable EM consoles. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Privilege-abusing compromise of the Oracle Enterprise Manager Base Platform UI Framework lets a low-privileged, network-adjacent attacker read all EM-accessible data and partially tamper with or degrade the platform over HTTPS. The scope-changing flaw (CVSS 9.1) means a successful attack can spill beyond EM into other managed products, and Oracle's own tags flag authentication-bypass and denial-of-service behavior. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and network vector make it a high patch priority.

Uncontrolled native-memory consumption in Netty's SPDY-to-HTTP codec (SpdyHttpDecoder) lets a remote unauthenticated peer exhaust off-heap memory and crash the server. Affected versions are 4.2.0.Final–4.2.15.Final and 4.1.0.Final–4.1.135.Final; the decoder allocates a pooled ByteBuf for an in-flight SYN_STREAM request but fails to release it when the stream is aborted via RST_STREAM or when content exceeds maxContentLength. There is no public exploit identified at time of analysis, and this CVE is not listed in CISA KEV; impact is denial of service only (VC:N/VI:N/VA:H).

Out-of-bounds read and write in the Zephyr RTOS Bluetooth Classic (BR/EDR) L2CAP signaling handlers (l2cap_br_conf_req/rsp) lets an unauthenticated peer within Bluetooth radio range corrupt host memory and crash the device, affecting released versions including v4.4.0. Because the handlers checked the whole-PDU length (buf->len) instead of the per-command length (len), a packed CONF_REQ with a tiny header length underflows opt_len to ~0xFFFF and walks the option-parsing loop past the pooled ACL receive buffer. No public exploit is identified at time of analysis; a vendor patch and GHSA advisory exist and EPSS/KEV data were not provided.