Information Disclosure

Availability loss in ISC BIND 9 DNS server arises when a stored DNS key record containing the PRIVATEDNS algorithm (algorithm number 253) carries a malformed identifier length field that exceeds the actual identifier data. BIND accepts the structurally invalid record without rejecting it at ingestion time, but when it subsequently attempts to render that record to text - during logging, zone display, or similar operations - the inconsistent length triggers a reachable assertion (CWE-617) that causes BIND to abort and exit. No active exploitation has been confirmed (not listed in CISA KEV) and no public exploit code has been identified at time of analysis; however, BIND 9 spans a very wide version range and is critical infrastructure, making patch urgency high despite the medium CVSS score of 6.5.

DNSSEC integrity bypass in ISC BIND 9 enables network-positioned attackers to forge authenticated NXDOMAIN responses by exploiting improper validation of NSEC3 records originating from child zones. Affected are BIND 9 versions across the 9.18, 9.20, and 9.21 branches, as well as the BIND 9 Supported Preview Edition (S-series). Because the CVSS vector carries S:C (scope changed), the integrity impact propagates beyond the resolver itself to any DNS client trusting BIND's DNSSEC-validated answers. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.

Unauthenticated file read and deletion in Progress Telerik UI for ASP.NET AJAX (all versions prior to v2026.2.708) is made possible by a hardcoded cryptographic key (CWE-321) embedded in the obsolete RadChart component's ChartImage.axd HTTP handler. Remote attackers without any credentials can exploit this to read or delete image-extension files within the application directory, bypassing standard authentication controls entirely. No public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis, but the unauthenticated network-accessible attack vector warrants prompt patching for all affected deployments.

Parameter tampering in the DialogHandler component of Progress Telerik UI for ASP.NET AJAX (all versions prior to 2026.2.708) allows unauthenticated remote attackers to manipulate server-side dialog behavior, establishing a foothold for chained exploitation of downstream application components. The CVSS vector specifies High integrity impact with no required privileges (PR:N), making the DialogHandler endpoint a meaningful attack surface in any deployment where it is network-accessible. No public exploit code has been identified at time of analysis and no CISA KEV listing exists, but the vendor's explicit mention of chained exploitation elevates the practical risk beyond the moderate base score of 5.9.

Counter exhaustion in NLnet Labs Unbound 1.20.0 through 1.25.1 enables a remote attacker to degrade DNS resolution service by triggering a missing decrement in the serve-expired discard-timeout code path. The reply-address counter for duplicate in-flight queries is never decremented when the discard-timeout branch fires under a specific non-default misconfiguration, allowing an attacker controlling a slow authoritative zone to drive the counter to its maximum and cause silent query drops for legitimate clients. No public exploit identified at time of analysis; however, the vulnerability is exploitable remotely with no authentication required once the misconfiguration is in place.

Crash-triggering memory corruption in Unbound's DNSCrypt subsystem allows any unauthenticated network client to kill the DNS resolver with a single UDP packet. Affected versions 1.7.0 through 1.25.1, compiled with DNSCrypt support, miscount valid key slots when the dnscrypt-provider-cert list outnumbers dnscrypt-secret-key entries, leaving tail slots filled with libsodium's 0xdb debug pattern; iterating beyond valid bounds then dereferences that garbage. No public exploit has been identified at time of analysis, and no KEV listing exists, but the trigger condition is trivially constructable - one 68-byte UDP datagram.

DNS cache poisoning risk in NLnet Labs Unbound 1.4.22 through 1.25.1 arises because the SO_REUSEPORT load balancing mechanism structurally leaks the secret entropy value - UDP source port randomization - that defends against Kaminsky-style attacks. Each worker thread is assigned a disjoint subset of source ports at startup, so an adjacent-network attacker who can observe Unbound's outgoing UDP queries to authoritative name servers can infer the thread-to-port-subset mapping and substantially reduce the port space to guess during a cache poisoning attempt. Proof-of-concept exploit code exists (CVSS 4.0 E:P); no confirmed active exploitation or CISA KEV listing has been identified.

Cache-clearing denial-of-service in NLnet Labs Unbound through 1.25.1 allows a remote attacker who controls a DNS delegation to indefinitely and repeatedly flush Unbound's message and rrset caches without sending a single spoofed packet. The attack exploits a logic flaw in how the iterator processes in-bailiwick glue records containing the unspecified address 0.0.0.0/::0: on Linux, such queries are routed via loopback and answered by 127.0.0.1, creating an IP mismatch that the unwanted-reply counter tallies until the configured threshold triggers a defensive cache clear - which resets the counter, enabling the loop to continue indefinitely. No public exploit identified at time of analysis; CVSS 3.1 scores this 5.3 (Medium) with Low availability impact and no confidentiality or integrity impact.

DNS response policy poisoning in NLnet Labs Unbound 1.7.0 through 1.25.1 allows an unauthenticated network attacker to become the authoritative XFR source for an auth/rpz zone by spoofing the configured primary hostname's A/AAAA record. The flaw stems from Unbound accepting a BOGUS-validated hostname resolution - one where DNSSEC validation has explicitly failed - as a valid zone transfer endpoint without requiring a valid RRSIG, violating the integrity guarantees DNSSEC is designed to enforce. Successful exploitation enables complete replacement of the resolver's response policy zone, making this a DNS firewall bypass with high real-world consequence for organizations relying on RPZ for threat blocking. No public exploit code has been identified at time of analysis.

DNS response policy rewriting in NLnet Labs Unbound 1.6.2 through 1.25.1 bypasses DNSSEC validation when the respip module is positioned ahead of the validator with response-ip or RPZ-IP redirect rules active. The rewriting handler fails to check upstream DNSSEC security status, allowing a spoofed BOGUS A/AAAA answer whose address falls within an operator-configured redirect subnet to be rewritten and returned to clients with a hardcoded INSECURE security level rather than being rejected as BOGUS. No public exploit code has been identified at time of analysis, but the integrity impact is concrete: clients receive silently misdirected responses that appear to pass through legitimate operator-controlled policy, undermining the core DNSSEC trust guarantee for affected deployments.

Fatal application termination in NLnet Labs Unbound's libunbound library (up to and including 1.25.1) can be triggered remotely when the 'unwanted-reply-threshold' feature is enabled. An attacker controlling or able to spoof responses from an authoritative nameserver can flood the resolver with wrong-transaction-ID UDP datagrams until the threshold is crossed, causing libunbound to invoke 'libworker_alloc_cleanup' - a function absent from the internal allow list - resulting in a fatal exit that crashes the embedding application. Notably, standalone Unbound is unaffected because its counterpart function 'worker_alloc_cleanup' is correctly registered; only applications embedding libunbound are at risk. No public exploit code or CISA KEV listing has been identified at time of analysis.

Ghost domain name cache extension in Unbound DNS resolver 1.16.2 through 1.25.1 allows a network-based adversary who controls a ghost zone to overwrite cached expired parent-side A/AAAA glue records, extending the effective ghost domain window by up to one full cache-max-ttl period beyond expiry. A single crafted A/AAAA client query is sufficient to trigger the overwrite; on resolvers using the non-default harden-referral-path: yes directive, Unbound performs the lookup implicitly with no client query required at all. This is a variant of CVE-2026-40622, which addressed only the NS query path - no public exploit has been identified at time of analysis and no CISA KEV listing exists.

Insecure credential storage in the Ansible Lightspeed VS Code extension exposes Google Gemini API keys to any local actor operating at user privilege level. The extension writes API keys in plaintext to both user configuration files and extension output log channels, making them readable by co-users of the workstation, other OS-level processes, or malware executing under the victim's account. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified; the primary real-world risk is API credential theft leading to unauthorized quota consumption or service abuse.

Credential exposure in n8n workflow automation platform leaks full Google Service Account PEM private keys into the JWT header's kid field, where they are trivially recoverable via Base64 decoding. Affected versions span both the 1.x line (before 1.123.64) and the 2.x line (before 2.29.8 and 2.30.1), but only deployments configured with Google Service Account credentials are at risk. An attacker who captures these JWTs from logs, network traffic, or monitoring systems can extract the raw private key and fully impersonate the service account against any Google Cloud resource it is authorized to access. No public exploit code has been identified at time of analysis, and no confirmed active exploitation is recorded in CISA KEV.

Credential exposure in n8n's LLM sub-node allows authenticated users to read plaintext API keys and secrets persisted in workflow execution records. Versions before 1.123.64 fail to mask custom HTTP header values - such as Authorization or X-API-Key headers - when those headers are used in LLM node configurations, causing secrets to be written in cleartext to execution data stored in the database. While exploitation requires a low-privilege authenticated session, the downstream impact is high because recovered credentials can be used to access external APIs and services configured in those workflows. No public exploit code or KEV listing has been identified at time of analysis.

Unauthenticated remote information disclosure in Hikvision DS-2CD and DS-2DE series IP cameras exposes partial device memory contents to network-accessible attackers without any credentials. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication and no user interaction against default configurations, making the attack surface broad given the cameras' typical internet or LAN exposure. While confidentiality impact is rated Low (partial memory only), leaked memory may contain sensitive fragments such as session tokens or configuration data, and no public exploit or CISA KEV listing is confirmed at time of analysis.

Off-by-one heap out-of-bounds read in the BlueZ SBC (Sub-Band Coding) frame decoder allows a Bluetooth-adjacent unauthenticated attacker to leak a single byte of heap memory by streaming a crafted audio payload. Red Hat Enterprise Linux 7 through 10 are confirmed affected via the bundled sbc library. No public exploit code exists and this vulnerability is not listed in CISA KEV, making active exploitation unlikely; the impact is constrained to minor information disclosure of a single heap byte.

Cross-space information disclosure in Kibana 9.4.0 through 9.4.3 allows authenticated users to access data from Kibana Spaces they are not authorized to view. The flaw (CWE-862, Missing Authorization) arises because user-supplied input can reference cross-space resources without adequate space-level authorization checks, enabling privilege boundary bypass within a multi-tenant Kibana deployment. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Kibana's multi-tenancy Spaces model can be bypassed through an Insecure Direct Object Reference (IDOR) vulnerability, allowing authenticated users to read scheduled query results belonging to Spaces they are not authorized to access. Affected versions span Kibana 9.4.0 through 9.4.3, with the fix delivered in 9.4.4. The CVSS vector (PR:L, C:L) confirms the impact is limited to low-privilege authenticated access resulting in partial confidentiality loss - no integrity or availability impact is involved. No public exploit code exists and no CISA KEV listing has been identified at time of analysis.

Unauthorized access to workflow execution outputs in Kibana 9.3.0-9.3.7 and 9.4.0-9.4.3 allows an authenticated low-privileged user to read sensitive data returned by workflow steps - including results from connected data sources they are not authorized to query - by directly calling the workflow output endpoint without the authorization the documented API requires. The flaw is classified as Missing Authorization (CWE-862) via Privilege Abuse (CAPEC-122), with impact limited to confidentiality within the user's accessible Kibana space. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; Elastic has released patched versions 9.3.8 and 9.4.4.

Cross-origin information disclosure in Google Chrome prior to 150.0.7871.182 allows a remote attacker who has already compromised the renderer process to leak sensitive data from other origins via a crafted HTML page. The vulnerability arises from an uninitialized use in the Skia graphics library. Exploitation is unlikely given high complexity and the prerequisite of a separate renderer compromise; no active exploitation or public exploit has been identified at the time of analysis.

Spoofing of the Omnibox (URL bar) in Google Chrome versions prior to 150.0.7871.182 allows a remote attacker to mislead users via a crafted HTML page, exploiting insufficient input validation in the browser's Extensions handling. This Medium-severity vulnerability (CVSS 5.4) has no evidence of active exploitation or publicly available exploit code, and its exploitation requires user interaction to visit a malicious page.

Unauthorized critical data disclosure in Oracle HRMS (US) versions 12.2.3 through 12.2.15 exposes complete read access to all HRMS-accessible data via network HTTP, with a confirmed scope change that can impact additional Oracle E-Business Suite modules beyond HRMS itself. The CVSS vector (PR:H, S:C, C:H) indicates a high-privileged authenticated attacker operating over the network with low complexity can breach data boundaries across co-deployed EBS components. An 'Authentication Bypass' tag in the intelligence feed creates analytical tension with the PR:H prerequisite and warrants vendor clarification; no public exploit code has been identified at time of analysis, and Oracle disclosed this issue via the July 2026 Critical Patch Update.

Oracle HRMS (US) Internal Operations component exposes complete HR dataset read access to any low-privileged authenticated attacker over HTTP. Versions 12.2.6 through 12.2.15 of Oracle E-Business Suite are confirmed affected, enabling an attacker holding even a basic EBS user account to bypass authorization controls and access all data visible to the HRMS application. No public exploit or CISA KEV listing exists at time of analysis, but the low attack complexity (AC:L) means exploitation is straightforward once initial credentials are obtained, making insider threat and credential-compromise scenarios the primary risk vector.

Oracle Quality within Oracle E-Business Suite versions 12.2.3 through 12.2.15 exposes partial confidentiality, integrity, and availability compromise through its Quality Workbench HTML system component. A low-privileged authenticated attacker with HTTP network access can perform unauthorized read, write, and denial-of-service operations against Quality module data. No public exploit code or active exploitation has been identified at time of analysis; this vulnerability was disclosed by Oracle via the July 2026 Critical Patch Update.

Oracle HRMS (US) US Payroll - General component in Oracle E-Business Suite versions 12.2.3 through 12.2.15 exposes payroll data and service availability to low-privileged authenticated network attackers over HTTP. Successful exploitation yields partial unauthorized read of payroll records, unauthorized insert, update, or delete of accessible payroll data, and partial denial of service - impacts that are especially sensitive given the nature of US payroll information. Disclosed as part of Oracle's July 2026 Critical Patch Update, no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

Confidential data exposure in Oracle Contracts Integration (Oracle E-Business Suite) versions 12.2.3 through 12.2.15 enables a low-privileged authenticated attacker with HTTP network access to bypass internal authorization controls in the Internal Operations component, gaining unauthorized access to critical or all accessible contract data. The CVSS confidentiality impact is rated High despite the moderate overall score of 5.3, reflecting complete in-scope data exposure when exploitation succeeds. No public exploit code or active exploitation has been identified at time of analysis; the high attack complexity (AC:H) constrains real-world opportunistic risk.

Unauthorized data disclosure in Oracle Self-Service Human Resources (E-Business Suite), Manager Self-Service component, affects versions 12.2.3 through 12.2.15. A low-privileged authenticated attacker with HTTP network access can exploit an authorization bypass to gain complete read access to all data within the Self-Service HR module - including sensitive employee and managerial records. No public exploit has been identified at time of analysis, and the vulnerability is not currently listed in the CISA KEV catalog, but the low attack complexity and broad data exposure make patching via the July 2026 CPU a priority for organizations running Oracle EBS.

Partial data compromise and denial of service in Oracle HRMS (UK) versions 12.2.3 through 12.2.15 allows low-privileged, network-authenticated attackers to perform unauthorized read, write, and partial disruption of HR data via HTTP. The vulnerability resides in the Internal Operations component of Oracle E-Business Suite and is characterized by Oracle as 'easily exploitable,' lowering the practical barrier for authenticated insiders or compromised accounts. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Oracle EDI Gateway versions 12.2.3 through 12.2.15, a component of Oracle E-Business Suite, exposes an information disclosure vulnerability allowing low-privileged network-authenticated attackers to read a subset of EDI transaction data without proper authorization. Tagged as an authentication bypass, the flaw is exploitable over HTTP with low attack complexity and no user interaction required, suggesting an access-control deficiency that permits privilege escalation within the application layer rather than a full bypass of authentication. No public exploit code and no active exploitation have been identified at time of analysis; Oracle addressed this in the July 2026 Critical Patch Update.

Oracle EDI Gateway versions 12.2.3 through 12.2.15 exposes an information disclosure vulnerability via HTTP that enables low-privileged authenticated network attackers to read a subset of EDI transaction data without proper authorization. The vulnerability is tagged 'Authentication Bypass' in threat intelligence sources, yet the CVSS vector assigns PR:L, suggesting the bypass operates within an authenticated session - likely circumventing object-level authorization controls rather than bypassing session authentication entirely. No public exploit code or CISA KEV listing has been identified at time of analysis, keeping real-world urgency moderate despite the vendor's characterization of the flaw as 'easily exploitable.'

Limited unauthorized data read in Oracle EDI Gateway (E-Business Suite versions 12.2.3-12.2.15) requires a high-privileged attacker with local logon access to the underlying infrastructure, combined with difficult exploitation conditions, to access a subset of EDI data without authorization. The confidentiality impact is narrow and no integrity or availability impact is present. No public exploit code or active exploitation has been identified at time of analysis; Oracle disclosed this via the July 2026 Critical Patch Update.

Unauthorized data disclosure in Oracle U.S. Federal Financials (Oracle E-Business Suite, Internal Operations component) allows a low-privileged, network-authenticated attacker to read a subset of sensitive financial data via HTTP. Versions 12.2.3 through 12.2.15 are confirmed affected. No public exploit code or CISA KEV listing has been identified at time of analysis, and the CVSS score of 4.3 reflects a moderate-severity information disclosure with no integrity or availability impact.

Oracle Proposals (component of Oracle E-Business Suite versions 12.2.3 through 12.2.15) is exploitable by low-privileged authenticated remote attackers over HTTP, enabling unauthorized read access to a subset of data, unauthorized data manipulation (insert, update, delete), and partial denial of service against the Proposals component. Oracle disclosed this vulnerability in its July 2026 Critical Patch Update (CPU). No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

Unauthorized payroll data exposure in Oracle E-Business Suite's HRMS (Australia) Payroll component allows a low-privileged, network-authenticated attacker to access all HR and payroll data accessible to the application. Affecting versions 12.2.3 through 12.2.15, Oracle classifies this as 'easily exploitable' in the July 2026 Critical Patch Update, requiring only low user privileges over HTTP with no user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, though the confidentiality impact against sensitive payroll records elevates practical priority for affected Australian EBS deployments.

Unauthorized data disclosure in Oracle Learning Management (E-Business Suite) versions 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker to access critical or complete LMS data via the Import and Export component over HTTP. Tagged as an Authentication Bypass, the flaw enables privilege escalation beyond the attacker's granted access level, resulting in full confidentiality compromise of all Learning Management accessible data. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and network vector make this straightforward to exploit once credentials are obtained.

Oracle Payroll within Oracle E-Business Suite (EBS) versions 12.2.3 through 12.2.15 is exploitable by low-privileged authenticated network attackers via HTTP, enabling unauthorized read, write, and partial denial-of-service against payroll data. Oracle's own advisory classifies this as 'easily exploitable,' indicating low attack complexity for any valid EBS user with HTTP reachability. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, placing this as a moderate real-world priority requiring prompt patching for exposed EBS deployments.

Partial confidentiality exposure in Oracle HRMS (UK)'s UK Payroll component allows a network-adjacent, high-privileged attacker to read a limited subset of HRMS data under difficult exploitation conditions. Affecting E-Business Suite versions 12.2.3 through 12.2.15, this low-severity (CVSS 2.2) vulnerability is tagged as an authentication bypass, suggesting an authorization control weakness within an already-authenticated session rather than a full unauthenticated bypass - consistent with the PR:H and AC:H vector. No public exploit code exists and it is not listed in the CISA KEV catalog, placing real-world risk at the lower end of the spectrum.

Oracle HRMS (US) Internal Operations component in E-Business Suite versions 12.2.3 through 12.2.15 exposes a network-accessible flaw that allows a low-privileged authenticated attacker to read a subset of HRMS data and cause partial denial of service via HTTP under high-complexity conditions. Disclosed by Oracle via the July 2026 Critical Patch Update (CPU), the vulnerability carries a CVSS 3.1 score of 4.2 (Medium), with no public exploit and no active exploitation confirmed at time of analysis. The high attack complexity (AC:H) materially constrains real-world exploitability despite the network-accessible attack vector.

Unauthorized data exfiltration in Oracle HRMS (UK), a component of Oracle E-Business Suite, exposes complete HR records to low-privileged network attackers via a scope-changing vulnerability in the Internal Operations component. Versions 12.2.8 through 12.2.15 are affected, and successful exploitation can breach data beyond the immediate HRMS (UK) boundary, impacting additional E-Business Suite products. Tagged as an authentication bypass by EUVD intelligence, the attack requires HTTP network access and low privilege credentials but no user interaction, though high attack complexity (AC:H) limits opportunistic exploitation. No public exploit is identified at time of analysis, and the issue is not listed in CISA KEV.

Unauthorized data disclosure in Oracle Order Management's Product Diagnostic Tools component (E-Business Suite 12.2.3-12.2.15) allows a low-privileged network attacker to read all data accessible to the application over HTTP with no user interaction required. The 'Authentication Bypass' tag suggests the diagnostic interface fails to enforce proper authorization boundaries, enabling a minimally privileged account to exceed its intended data access scope. No public exploit has been identified at time of analysis, but the low attack complexity and ERP-grade data sensitivity - order records, customer PII, financial data - elevate business impact well beyond the moderate CVSS 6.5 score.

Unauthorized read access to a subset of student records data is possible in Oracle PeopleSoft Enterprise CS Student Records 9.2.38 via the Research Tracking component over HTTP. An unauthenticated network attacker exploiting an authentication bypass condition (tagged explicitly by the reporter) can retrieve confidential academic data without credentials, though the high attack complexity constrains opportunistic mass exploitation. No public exploit code or active exploitation has been identified; however, even partial disclosure of student records carries regulatory significance under FERPA regardless of the low CVSS score of 3.7.

Authentication bypass in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 (Security component) enables an unauthenticated attacker positioned on the adjacent physical network segment to access critical application data and manipulate select records. The exploit is rated difficult due to adjacent-network positioning requirements and high attack complexity, yielding a moderate CVSS 5.9 score despite the high confidentiality impact. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, limiting immediate mass-exploitation risk.

Unauthorized access to critical data is achievable against MySQL Connector/J versions 9.7.0 and 9.7.1 via a network-accessible authentication bypass flaw requiring human interaction. Oracle classifies this as easily exploitable, meaning a network-positioned unauthenticated attacker can intercept or otherwise obtain complete access to all data flowing through the affected connector when a legitimate application initiates a database connection. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Unauthorized data read in MySQL Server and MySQL Cluster's Performance Schema component exposes a subset of accessible data to highly privileged, network-connected attackers. Affected releases span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, disclosed as part of Oracle's July 2026 Critical Patch Update. No public exploit code and no CISA KEV listing are identified at time of analysis; the CVSS 2.7 score reflects the limited scope and elevated privilege bar.

Unauthorized data disclosure in Oracle Production Scheduling (E-Business Suite versions 12.2.3 through 12.2.15) allows a low-privileged network attacker to gain complete read access to all data within the application via a difficult-to-exploit flaw in the User Interface component. Tagged as an authentication bypass, the vulnerability suggests improper access control enforcement in the UI layer that permits privilege escalation beyond the attacker's normally granted permissions, enabling full confidentiality compromise of Production Scheduling data. No public exploit code or active exploitation has been identified; Oracle addressed this in the Critical Patch Update for July 2026.

Unauthorized read access to Oracle Time and Labor data is achievable by unauthenticated remote attackers targeting the Internal Operations component via HTTP, affecting E-Business Suite versions 12.2.3 through 12.2.15. Tagged as an Authentication Bypass, the flaw allows network-based attackers to circumvent access controls without credentials, though the high attack complexity (AC:H) constrains reliable exploitation. Impact is confined to partial confidentiality loss - no integrity or availability impact - and no public exploit or active exploitation (CISA KEV) has been identified at time of analysis.

Partial confidentiality exposure in Oracle HRMS (Ireland), a component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, permits a network-based high-privileged attacker to read a limited subset of HRMS data via HTTP under high-complexity conditions. The impact is confined solely to confidentiality with no integrity or availability consequence, and the CVSS 3.1 base score of 2.2 reflects how constrained exploitation is in practice. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog. Notably, the intelligence tag 'Authentication Bypass' conflicts with the PR:H vector - this discrepancy warrants verification against the Oracle July 2026 CPU advisory.

Unauthorized read access in Oracle Project Contracts (E-Business Suite component: Internal Operations) can be achieved by a low-privileged network attacker under high-complexity exploit conditions, exposing a subset of Project Contracts data. Affected versions span 12.2.3 through 12.2.15, as confirmed by Oracle Security Alerts via the July 2026 Critical Patch Update. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, keeping real-world risk low despite the network-accessible attack surface and the notable 'Authentication Bypass' tag applied by ENISA EUVD.

Partial unauthorized read access in Oracle Public Sector Financials (E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged authenticated attacker over HTTP to read a limited subset of data they are not authorized to access. Despite the 'Authentication Bypass' tag in intelligence sources, the CVSS vector confirms authentication is required (PR:L), suggesting this is a partial authorization bypass or privilege boundary failure rather than a full authentication bypass. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis.

Unauthorized read access to a subset of procurement data is achievable in Oracle iSupplier Portal versions 12.2.3 through 12.2.15 via the Internal Operations component over HTTP, requiring a low-privileged account and difficult attack conditions. The intelligence tags classify this as an Authentication Bypass, creating tension with the official CVSS PR:L metric - if bypass is possible, the real-world requirement may be lower than the vector implies. No public exploit or active exploitation has been identified at time of analysis; this vulnerability is addressed in Oracle's July 2026 Critical Patch Update.

Unauthorized read access to Oracle iSupplier Portal (E-Business Suite versions 12.2.3-12.2.15) is possible for unauthenticated network attackers targeting the Internal Operations component over HTTP. The Authentication Bypass tag indicates the root cause involves inadequate access controls on internal HTTP endpoints, though exploitation is constrained by high attack complexity (AC:H), meaning specific conditions must be met. Impact is confined to partial confidentiality loss - no integrity or availability impact - with no public exploit code or active exploitation confirmed at time of analysis.

Oracle Property Manager versions 12.2.3 through 12.2.15 within Oracle E-Business Suite exposes a low-severity information disclosure flaw in the Internal Operations component that allows a highly privileged local attacker to read an unauthorized subset of Property Manager data under difficult exploitation conditions. The CVSS 3.1 score of 1.9 reflects the combined constraints of local infrastructure access, high privilege prerequisites, and high attack complexity, resulting in only partial confidentiality impact with no integrity or availability exposure. No public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis; this is addressed in Oracle's Critical Patch Update for July 2026.

Unauthorized data disclosure in Oracle HCM Configuration Workbench (Rapid Implementation component) of Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a low-privileged authenticated attacker to gain complete access to all data accessible within the application via HTTP. Tagged as an Authentication Bypass, the flaw indicates that a legitimately authenticated user with minimal privileges can circumvent authorization controls to access sensitive HCM data well beyond their entitlement - covering employee PII, compensation structures, and organizational data. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad version range spanning twelve supported minor releases elevate operational risk in large enterprise environments running externally accessible EBS instances.

Oracle Work in Process within Oracle E-Business Suite versions 12.2.3 through 12.2.15 exposes low-privileged local attackers to unauthorized partial data disclosure and partial denial-of-service conditions via the Internal Operations component. Exploitation demands an existing OS-level logon to the host infrastructure and high attack complexity, making reliable exploitation difficult and opportunistic mass exploitation implausible. No public exploit code has been identified and this vulnerability is absent from the CISA KEV catalog, consistent with the vendor-assigned CVSS 3.1 score of 3.6 (Low).

Limited local data disclosure in Oracle Work in Process (E-Business Suite component: Internal Operations) versions 12.2.3 through 12.2.15 allows a high-privileged attacker with local infrastructure access to read a subset of accessible data under difficult exploitation conditions. The CVSS 3.1 base score of 1.9 reflects an extremely constrained attack surface - local vector, high complexity, and high privilege requirements combine to make this one of the lowest-severity issues addressed in the Oracle CPU July 2026 advisory. No public exploit identified at time of analysis, and no active exploitation has been reported.

Unauthorized read access to critical data in Oracle Work in Process (E-Business Suite versions 12.2.3-12.2.15) is achievable by a low-privileged, network-connected attacker exploiting an authentication bypass in the Internal Operations component via HTTP. The flaw is rated difficult to exploit (AC:H) and carries no integrity or availability impact, but successful exploitation grants complete access to all data accessible within the Work in Process module. No public exploit code or CISA KEV listing is associated with this vulnerability at time of analysis.

Oracle Order Management's Product Diagnostic Tools component in E-Business Suite versions 12.2.3 through 12.2.15 can be compromised by a low-privileged authenticated attacker over HTTP, resulting in unauthorized read and write access to Order Management data. The scope change (S:C in CVSS) indicates successful exploitation can cascade to impact additional Oracle EBS modules beyond Order Management itself. Tagged as an Authentication Bypass, no public exploit has been identified at time of analysis, though the patch is included in Oracle's CPU July 2026 release.

Unauthorized data disclosure in Oracle Price Protection (E-Business Suite versions 12.2.3 through 12.2.15) allows a network-adjacent, low-privileged attacker to gain complete read access to all pricing data accessible by the application. The vulnerability resides in the Internal Operations component and is tagged as an Authentication Bypass, suggesting that a legitimately authenticated but low-privileged session can circumvent authorization controls to reach confidential pricing records. No public exploit or CISA KEV listing has been identified at time of analysis, though the low attack complexity and network reachability make it straightforward to exploit once credentials are obtained.

Unauthorized data disclosure in Oracle Supply Chain Trading Connector (E-Business Suite versions 12.2.3 through 12.2.15) exposes all connector-accessible data to low-privileged authenticated network attackers via HTTP. The Collaboration History component fails to enforce proper authorization controls, enabling a valid but low-privileged account to read critical trading data beyond its intended scope. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and straightforward network vector make this a realistic insider or credential-compromise escalation path.

Unauthorized access to sensitive federal financial data is possible in Oracle U.S. Federal Financials (versions 12.2.3-12.2.15, part of Oracle E-Business Suite) via a network-accessible authentication bypass in the Internal Operations component. An unauthenticated remote attacker with network access over HTTPS can, under high-complexity conditions, bypass authentication controls to read critical or complete confidential data - with scope change impact extending to additional E-Business Suite products beyond the directly targeted component. No public exploit code or CISA KEV listing has been identified at time of analysis, though the 'Authentication Bypass' tag and scope-change designation elevate concern for federal agency deployments.

Unauthorized data disclosure in Oracle BI Publisher's XML Services component allows any low-privileged, network-authenticated attacker to access all data within the application via HTTP. Affected across three major release lines - 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0 - the flaw carries a CVSS 3.1 score of 6.5 with high confidentiality impact and no integrity or availability dimension. The 'Authentication Bypass' tag suggests the vulnerability enables privilege escalation within the product's authorization model rather than a full pre-auth bypass; no public exploit or CISA KEV listing has been identified at time of analysis.

Unauthenticated read access in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 allows remote attackers to retrieve a subset of protected campus data via HTTP without credentials. The 'Authentication Bypass' tag indicates the Security component fails to enforce access controls on at least one network-accessible endpoint, exposing data - likely student records, enrollment data, or PII - to anonymous network queries. No public exploit code or CISA KEV listing has been identified at time of analysis, though Oracle explicitly characterizes this as 'easily exploitable.'

Unauthorized data disclosure in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 allows unauthenticated network attackers via HTTPS to access critical or complete application data through an authentication bypass in the Security component. Disclosed as part of Oracle's Critical Patch Update for July 2026, the CVSS 3.1 score of 5.9 (Medium) reflects high attack complexity (AC:H), meaning exploitation requires specific non-trivial conditions. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.

Unauthorized data access in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 allows a low-privileged authenticated attacker to read all data accessible within the system via HTTPS against the Communication component. Tagged as an Authentication Bypass by EUVD intelligence, the flaw appears to operate at the authorization layer - an attacker with a valid low-privilege session can exceed their permitted data scope rather than bypass authentication entirely. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low complexity and network accessibility make this a credible insider or credential-theft-follow-on threat for higher education environments.

Local unauthorized data access in Oracle PeopleSoft Enterprise CS Financial Aid 9.2.38 allows a low-privileged authenticated user with logon access to the hosting infrastructure to compromise the FM Need Analysis Calculator component and read critical or complete financial aid data. The Authentication Bypass tag from EUVD-2026-46965 suggests the component fails to enforce authorization boundaries for already-authenticated low-privilege accounts, enabling horizontal or vertical privilege escalation within the application. No public exploit code exists and this vulnerability has not been added to the CISA KEV catalog at the time of analysis.

Full takeover of Oracle Java SE 8u491 and 8u491-perf is achievable by a low-privileged local attacker exploiting a flaw in the Installation component, disclosed as part of Oracle's July 2026 Critical Patch Update. The attack chain requires high complexity - indicating race conditions or precise timing - combined with human interaction from a third party, likely a privileged user performing installation or update activity. No public exploit code has been identified and CISA KEV listing is absent at time of analysis, but the C:H/I:H/A:H impact triad makes successful exploitation fully destructive to the affected Java SE instance.

Unauthorized data read in Oracle TimesTen In-Memory Database 26.1.1.1.0 is possible through the Kubernetes Operator component via HTTPS, allowing low-privileged authenticated network attackers to access a subset of database data they should not be authorized to read. The ENISA EUVD threat intelligence tags this as 'Authentication Bypass,' suggesting the Kubernetes Operator fails to enforce proper authorization controls after initial authentication, effectively allowing privilege overreach within an authenticated session. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis.

Local information disclosure in Oracle TimesTen In-Memory Database 26.1.1.1.0 (Kubernetes Operator component) permits a low-privileged local attacker to read a subset of database-accessible data. The CVSS scope change (S:C) indicates exploitation can extend impact beyond the vulnerable component itself, potentially affecting other workloads or namespaces co-located in the same Kubernetes cluster. No public exploit code exists and no active exploitation has been confirmed at time of analysis; overall real-world risk is constrained by the requirement for local infrastructure access.

Unauthorized read access to Oracle GoldenGate data is possible through a flaw in the Admin Server Executable component, affecting three major release trains spanning versions 19.1.0.0.0 through 23.26.1. A low-privileged network attacker can exploit this Authentication Bypass issue over HTTP without user interaction to read a subset of GoldenGate-accessible data. No public exploit code and no CISA KEV listing have been identified at time of analysis; risk is elevated primarily for deployments exposing the Admin Server to untrusted networks.

Remote unauthenticated information disclosure in Oracle GoldenGate's Admin Server Executable allows network-accessible attackers to read a subset of GoldenGate-accessible data over HTTPS without any credentials. Affected versions span two active branches: 21.3-21.21 and 23.4-23.26.1. No public exploit or CISA KEV listing has been identified at time of analysis; Oracle classifies this as easily exploitable with a CVSS 5.3 Medium score reflecting limited confidentiality impact and no integrity or availability consequence.

Unauthorized data read in Oracle JDeveloper's Data Visualization Tools component exposes a subset of accessible application data to remote unauthenticated attackers via HTTP. Affected versions are 12.2.1.4.0 and 14.1.2.0.0, with Oracle tagging this as an authentication bypass class issue. Despite the network-accessible attack vector with no privilege requirement, the high attack complexity (AC:H) and limited confidentiality impact (C:L) anchor this at CVSS 3.7 (Low). No public exploit code exists and it is not listed in the CISA KEV catalog.

Unauthorized read access to a subset of Oracle JDeveloper data is possible via an unauthenticated HTTP-based attack against the ADF Faces component in Oracle Fusion Middleware. Affected versions are 12.2.1.4.0 and 14.1.2.0.0, and while exploitation requires high attack complexity, no authentication is needed. No public exploit code has been identified at time of analysis, no active exploitation is confirmed, and the CVSS 3.1 score of 3.7 (Low) reflects the limited confidentiality impact and elevated exploitation difficulty.

Local authentication bypass in Oracle JDeveloper's ADF Faces component exposes critical data to low-privileged local users on versions 12.2.1.4.0 and 14.1.2.0.0. The CVSS scope change (S:C) indicates successful exploitation can extend beyond JDeveloper itself to impact additional Oracle Fusion Middleware products sharing the same infrastructure. No public exploit has been identified at time of analysis, and neither EPSS data nor a CISA KEV listing is available - however, the low attack complexity and no user interaction requirement make exploitation straightforward once local access is established.

Oracle JDeveloper's Java Business Objects component exposes a network-accessible confidentiality and availability flaw in versions 12.2.1.4.0 and 14.1.2.0.0, allowing low-privileged remote attackers to gain unauthorized access to critical or all JDeveloper-accessible data alongside a partial denial of service. The attack complexity is rated high, requiring specific conditions to be met, but no user interaction is needed beyond initial low-privilege authentication. No public exploit code or active exploitation has been identified at time of analysis; this was disclosed as part of Oracle's Critical Patch Update for July 2026.

Unauthorized read access to a subset of project manufacturing data is possible via the PJM Command Center component in Oracle Project Manufacturing V16, exploitable over HTTP by a low-privileged authenticated network attacker. Despite the 'Authentication Bypass' tag from EUVD, the CVSS vector (PR:L) confirms valid credentials are required, indicating the bypass operates at the authorization layer within PJM Command Center rather than bypassing the EBS login mechanism entirely. Exploitation is significantly constrained by high attack complexity (AC:H), the confidentiality impact is limited (C:L), and no public exploit or active exploitation has been identified at time of analysis.

Webhook authorization headers in Gitea are decrypted and returned as plaintext in API responses, exposing Bearer tokens, Basic auth credentials, and API keys to any repository admin who queries the webhook listing endpoints. All Gitea installations running versions prior to 1.27.0 are affected, confirmed by GitHub Advisory GHSA-3r5c-2xxx-h872 and verified against commit 19f0169. Although these secrets are encrypted at rest using the server's SecretKey, the ToHook() function strips that protection before serializing the API response - effectively converting a write-only secret into a readable credential. No public exploit has been identified and this vulnerability is not listed in CISA KEV, but the business impact of leaking third-party API keys in multi-admin environments exceeds what the CVSS 2.7 Low score implies.

Cross-repository information disclosure in Gitea's org-level Actions API exposes workflow run and job metadata from private repositories to any authenticated organization member, regardless of per-repository access rights. The endpoints GET /api/v1/orgs/{org}/actions/runs and GET /api/v1/orgs/{org}/actions/jobs bypass per-repo ACL checks entirely, allowing low-privileged org members with no team or repository assignments to enumerate private repo names, commit SHAs, branch names, workflow file paths, contributor identities, CI timing, and commit messages across the entire organization. No CISA KEV listing or separately published exploit tool has been identified, but the detailed advisory with curl reproduction commands substantially lowers the exploitation barrier.

Gitea's REST API path for making repositories private omits the ClearRepoWatches cleanup present in the web UI path, exposing private repository metadata to ex-watchers from v1.25.4 through v1.26.x. When the visibility transition occurs via PATCH /api/v1/repos/{owner}/{repo} - the canonical path used by terraform-gitea, official SDKs, and CI/CD automation - the updateRepository function clears stars but leaves watch records intact, allowing former watchers to retrieve the full Repository JSON payload (description, branch, language, topics, counts, mirror metadata) via GET /api/v1/user/subscriptions despite having no access to the repository. This is a confirmed incomplete fix relative to GHSA-8fwc-qjw5-rvgp; no public exploit identified at time of analysis, though the advisory provides complete reproduction steps directly derivable from static code analysis.

Local unauthorized data read in Oracle Data Integrator's Patchset Assistant component allows a low-privileged user with local logon access to the ODI host to read a subset of data they are not entitled to access. Affected versions are 12.2.1.4.0 and 14.1.2.0.0 as confirmed by Oracle's July 2026 Critical Patch Update. With a CVSS 3.1 score of 3.3, no KEV listing, and no public exploit identified at time of analysis, real-world risk is low and constrained to insider threat or compromised local account scenarios on ODI infrastructure hosts.

Unauthorized data read in Oracle Coherence Core component affects all four supported release lines (12.2.1.4.0 through 15.1.1.0.0) via HTTP, allowing a low-privileged network attacker to access a subset of cached data without proper authorization. The vendor-assigned 'Authentication Bypass' tag suggests the root cause is an authorization control deficiency in the HTTP-facing Core layer rather than a complete absence of authentication - low-privilege credentials appear sufficient to bypass higher-tier access controls. No public exploit or active exploitation has been identified at time of analysis; EPSS data was not provided in the input.

Unauthorized read access to Oracle Coherence data is achievable by unauthenticated network attackers targeting the Core component via HTTP across all current supported releases (12.2.1.4.0 through 15.1.1.0.0). The 'Authentication Bypass' tag combined with a PR:N CVSS vector confirms that no credentials are required, but impact is bounded to a partial subset of accessible data (C:L), not full cluster compromise. No public exploit or CISA KEV listing exists at time of analysis, placing this in the medium-priority tier despite the trivially low exploitation complexity.

Unauthenticated confidentiality breach in Oracle Coherence's Core component exposes complete cached data over TLS to network attackers across all current supported versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0). The flaw is tagged as an Authentication Bypass, allowing a remote unauthenticated attacker reachable via TLS to read all data accessible within the Coherence grid - including potentially sensitive application state, session data, and business records. No active exploitation is confirmed (not in CISA KEV) and no public exploit code exists at time of analysis; however, the PR:N/UI:N profile combined with complete confidentiality loss makes this a material concern for enterprises running exposed Coherence clusters.

Unauthenticated remote read access in Oracle Coherence's Core component allows network attackers to retrieve a subset of data via HTTP without any credentials. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivially exploitable network access with no authentication barrier, consistent with the 'Authentication Bypass' tag applied to this CVE. All four current supported release lines - 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 - are affected; no public exploit or confirmed active exploitation has been identified at time of analysis.

Unauthorized data read in Oracle Coherence Core enables unauthenticated remote attackers to access a subset of data stored within the in-memory data grid via TCP, with no credentials or user interaction required. Affected versions span the three current release trains: 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, all part of Oracle Fusion Middleware. No public exploit identified at time of analysis; the 'Authentication Bypass' tag combined with a PR:N vector confirms the Core component fails to enforce access controls on inbound TCP connections.

Oracle VM VirtualBox 7.2.12 Core component exposes a local information disclosure path that allows a high-privileged host-level attacker to read a subset of VirtualBox-accessible data, with scope change indicating that impact can extend beyond the hypervisor process itself to adjacent resources such as guest VMs. The vulnerability is rated CVSS 3.2 (Low) and is confirmed by Oracle's July 2026 Critical Patch Update; no public exploit code and no CISA KEV listing exist. The combination of local-only access and mandatory high privileges severely constrains real-world exploitability, making this a low-priority finding for most organizations outside multi-tenant or shared-host VirtualBox deployments.

Unauthorized data read in Oracle APEX 24.1, 24.2, and 26.1 is achievable by unauthenticated remote attackers via HTTP, exploiting an authentication bypass in the General component. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial network reachability with no authentication required, allowing exposure of a subset of APEX-accessible data. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low complexity and zero-auth requirements make this a credible opportunistic threat against internet-facing APEX deployments.

Local privilege abuse in Oracle VM VirtualBox 7.2.12 Core component permits a high-privileged local attacker to read a subset of VirtualBox-accessible data, with confirmed scope change indicating potential exposure of data belonging to co-hosted or adjacent products. The CVSS score of 3.2 (Low) reflects the constrained attack surface - requiring local logon with high privileges - but the scope change flag (S:C) elevates the architectural concern, as information disclosed may originate outside the directly compromised VirtualBox instance. No public exploit code or active exploitation has been identified at time of analysis.

Physical-access data disclosure in Oracle Siebel CRM Integration's Event Publish and Subscribe component exposes a subset of CRM data under conditions requiring physical proximity, high privileges, and difficult exploit circumstances (CVSS 1.9). Versions 17.0 through 26.4 are affected, and a scope change in the CVSS vector signals that a successful attack may also read data from additional products beyond the Integration component itself. No public exploit code exists and this CVE does not appear in the CISA KEV catalog; real-world risk is negligible outside of insider-threat or physical-intrusion scenarios.

Unauthorized data exposure in Oracle Agile PLM 9.3.6 allows a remote unauthenticated attacker to compromise the confidentiality of all PLM-accessible data via HTTP, provided human interaction from a victim user is achieved. The vulnerability resides in the Folders, Files & Attachments component and is tagged as an Authentication Bypass, meaning access controls protecting sensitive product lifecycle and supply chain data can be circumvented without credentials. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero privilege requirement make this a meaningful risk for Oracle Agile PLM deployments exposed to untrusted networks.