Information Disclosure

Improper certificate validation in Apereo CAS Client 4.1.0 and Jasig CAS Client 3.6.4 allows a man-in-the-middle attacker to intercept Ticket-Granting Tickets (TGTs) by presenting any CA-signed certificate for a hostname matching the client's allowlist. An attacker with a network interception position can then obtain service tickets on behalf of the victim. No active exploitation or public exploit code is confirmed, and EPSS indicates low exploitation probability (0.17%).

Memory corruption and use-after-free in Imagination Technologies Graphics DDK allows local attackers to escalate privileges. The vulnerability stems from improper reference counting on synchronization primitives during fence export, enabling a low-privileged user to achieve kernel read/write and full system compromise. No active exploitation or public exploit is confirmed, and EPSS indicates low exploitation probability.

Local privilege/code execution in GeoVision's GV-IP Device Utility is possible via DLL hijacking (CWE-427): the Windows desktop application loads one or more DLLs from an unsafe search path, letting a local attacker who can plant a malicious DLL run code in the context of the user who launches the utility. Exploitation requires the victim to execute the application (UI:R) and the attacker to already have a foothold with low privileges on the host (PR:L). There is no public exploit identified at time of analysis and it is not listed in CISA KEV; CVSS is 7.3 (High).

Remote code execution in Microsoft Surface Management Services exposes networks to exploitation by authenticated low-privilege users who can send malformed input over the network to trigger arbitrary code execution. Affecting all tracked versions per CPE cpe:2.3:a:microsoft:surface_management_services:*:*:*:*:*:*:*:*, the vulnerability carries a CVSS 8.8 High rating with full confidentiality, integrity, and availability impact. No public exploits identified at time of analysis and EPSS at 0.71% suggests low current exploitation probability; the vulnerability is absent from the CISA KEV catalog.

Sensitive information disclosure in Pronetiqs IntraVUE (marketed as Panduit IntraVUE) versions 3.2.1a14 and prior allows remote unauthenticated attackers to read the underlying host and network share filesystem through the industrial-network visualization application. Rated CVSS 4.0 9.2 (Critical) by ICS-CERT, the flaw exposes files outside the application's intended access boundary. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-facing, no-authentication profile makes it a high-priority patch for OT environments.

Credential theft in Pronetiqs/Panduit IntraVUE (versions 3.2.1a14 and prior) stems from the use of a cryptographically weak password hash, allowing an attacker who obtains the stored or transmitted hash to recover or replay administrator credentials via a pass-the-hash attack. The flaw affects the IntraVUE industrial network visualization platform and can yield full administrative access to the console. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the vulnerability was coordinated through CISA ICS-CERT (advisory ICSA-26-204-04).

Cleartext credential exposure in Pronetiqs IntraVUE (Panduit IntraVUE) versions 3.2.1a14 and prior allows an attacker to retrieve stored passwords in plaintext via the product's API, because credentials are never hashed or encrypted at rest. This industrial-network visualization tool is affected across all builds up to and including 3.2.1a14, and per the CVSS 4.0 vector the disclosure is reachable over the network without authentication (VC:H). There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but the ICS-CERT advisory (ICSA-26-204-04) confirms the flaw.

Predictable cryptographic randomness in Silicon Labs' Matter implementation for the SiWx917 wireless SoC allows attackers to reconstruct DRBG output because an entropy-initialization bug seeds the deterministic random bit generator with a predictable value, so every device produces the same stream of 'random' numbers. Any keys, nonces, or session material derived from this generator in the affected Matter code are therefore guessable, undermining confidentiality of secured communications on affected devices. The issue was found only after the repository was deprecated; no public exploit identified at time of analysis and it is not in CISA KEV.

Denial-of-service in MZ Automation's lib60870, an open-source IEC 60870-5-101/104 telecontrol protocol library used in ICS/SCADA systems, allows remote attackers to crash the message-parsing process via a malformed protocol frame that triggers an out-of-bounds read (CWE-125). The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) indicates unauthenticated network exploitation with high availability impact and limited confidentiality exposure. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.

Session-handling weakness in Progress MOVEit Transfer (all builds before 2025.1.5, and 2026.0.0 before 2026.0.3) leaves sessions valid longer than they should be, so an attacker who obtains a still-active session token can access the managed file transfer application without re-authenticating. Progress rates this CVSS 9.8 with total technical impact, though the CWE-613 root cause makes the unauthenticated network vector worth verifying. No public exploit identified at time of analysis, and EPSS is low at 0.18% (8th percentile).

Information disclosure in Progress MOVEit Transfer (all versions before 2025.1.5, and 2026.0.0 before 2026.0.3) stems from an overly permissive cross-domain (CORS) security policy that trusts untrusted origins, allowing a malicious website to read sensitive responses from an authenticated victim's MOVEit session. The vendor rates it CVSS 9.8, though the underlying weakness (CWE-942) and vendor tags point squarely at cross-origin data leakage rather than direct server compromise. No public exploit identified at time of analysis, and EPSS is low at 0.18% (8th percentile).

Out-of-bounds heap read in PyTorch torchvision's native GIF decoder (versions through 0.28.0) lets attackers who supply a malicious or truncated GIF trigger a segmentation-fault denial of service or leak adjacent heap memory. The flaw sits in the libgif read_from_tensor callback, which passes an unclamped length to memcpy. A public exploit and reproducer exist and an upstream fix is available (commit 4e05dc2), but there is no public exploit identified in the sense of confirmed active exploitation - it is not on CISA KEV. Applications that decode untrusted GIFs via torchvision are affected.

Broken access control in JoomShaper's EasyStore extension for Joomla (versions 1.0.0 through 2.0.1) lets any authenticated Joomla user enumerate and read the orders and customer records belonging to other customers. Because order objects are returned without an ownership/authorization check, a single low-privilege account can harvest names, contact details and purchase data across the entire store. No public exploit has been identified at time of analysis and the flaw is not listed in CISA KEV, but the disclosure is public via a third-party security writeup.

Session replay in Logto IdP-initiated SAML sessions allows unauthenticated remote attackers to reuse captured session tokens, leading to unauthorized account access. Affected versions 1.21.0 through 1.37.1 silently fail to delete sessions, enabling replay within the session's validity window. No active exploitation confirmed but the attack requires no user interaction, and EPSS indicates very low exploitation likelihood.

Arbitrary file read in PostCSS (npm postcss <= 8.5.11) lets an attacker who controls CSS input embed a `/*# sourceMappingURL=PATH */` comment that the PreviousMap parser dereferences directly against the local filesystem with no scheme, allowlist, or traversal check. Because the read fires under default options (no `from`, `map`, or plugins), any pipeline that processes untrusted CSS is reachable; when the resulting `JSON.parse` SyntaxError is surfaced to the caller it leaks roughly the first 10 bytes of the targeted file, and the same code path yields a file-existence oracle and a DoS primitive. Publicly available exploit code exists (POC), but there is no public evidence of active exploitation, and EPSS is low at 0.50% (40th percentile).

Out-of-bounds memory access in Apple swift-nio-ssl allows information disclosure and denial of service when parsing X.509 certificates with non-ASN1_STRING Subject Alternative Names. The vulnerability affects versions prior to 2.37.2 and can be triggered locally by a crafted certificate, leading to potential data leakage or process crash. Public proof-of-concept code exists, but no active exploitation has been reported at this time.

Local File Inclusion in the Vino WordPress theme (elated-themes) affects all versions up to and including 1.9, letting an attacker holding a low-privileged Contributor account cause the theme to include and disclose arbitrary local files (e.g. wp-config.php) on the server. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the flaw was reported through Patchstack's WordPress vulnerability program. Because it requires a valid Contributor login and Patchstack rated attack complexity as high, real-world exploitation is gated behind account access rather than being fully open to the internet.

Local File Inclusion in the Tonda Core WordPress plugin (versions 2.1.2 and earlier by Select Themes) allows an authenticated user with only Contributor-level privileges to force the PHP application to include arbitrary local files, exposing sensitive server-side content and potentially escalating to code execution. The flaw was reported by Patchstack and is classified as CWE-98 (PHP file inclusion). No public exploit identified at time of analysis, and it is not listed in CISA KEV; the CVSS 3.1 base score is 7.5 with high attack complexity.

Broken authentication in the Ziina WordPress payment plugin (versions <= 1.2.21) lets remote unauthenticated attackers bypass authentication controls, with the CVSS integrity-high rating indicating attackers can manipulate protected state or actions they should not be able to reach. Reported by Patchstack and classified under CWE-1390 (Weak Authentication), the issue is network-reachable with low complexity and no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Authentication bypass in the miniOrange Discord Integration plugin for WordPress (versions 2.2.4 and earlier) lets remote unauthenticated attackers defeat the plugin's identity verification (CWE-288) and assume the identity of legitimate WordPress users, including potentially privileged accounts. Rated CVSS 8.1 (High) by Patchstack, the flaw carries full confidentiality, integrity, and availability impact but a high attack complexity that tempers real-world exploitability. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Authentication bypass in the odh-dashboard web console of Red Hat OpenShift AI (RHOAI) lets a low-privileged actor already inside the cluster impersonate any user — including cluster administrators — by supplying an arbitrary access token to a component that was incorrectly bound to a reachable network interface. Because the impersonated identity is honored against the Kubernetes API, this escalates to arbitrary code execution, privilege escalation, and information disclosure across the cluster. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was provided, but the CVSS 8.8 (High) rating and full C/I/A impact make it a serious internal-threat priority.

Unauthenticated information disclosure in the Convert Forms extension for Joomla (versions 2.5.0 through 5.2.2) lets any anonymous visitor enumerate and read a form's stored submissions because the front-end Submissions view fails to enforce access control. Submitted data frequently contains PII such as names, email addresses, phone numbers, and free-text messages, so exposure can be significant. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.

Information disclosure in Regular Labs Articles Anywhere and Users Anywhere extensions for Joomla allows unauthenticated remote attackers to view content that should be expired or unpublished. Date-sensitive query caching generates cache keys lacking a bounded time component, so results cached during a valid period persist and can be served after content becomes unavailable. No active exploitation or public proof-of-concept has been identified, and EPSS indicates a low probability of widespread exploitation.

Exposure of CDN credentials in administrator request URLs in the Cache Cleaner Pro extension for Joomla versions 1.0.0 through

Information disclosure in the GeoIP extension for Joomla 1.0.0 through 6.3.8 exposes MaxMind API credentials directly in request URLs. Unauthenticated remote attackers can intercept these credentials from network traffic or server logs, gaining unauthorized access to the victim’s MaxMind geolocation service. No active exploitation or public exploit code is known, and EPSS probability of exploitation is very low (0.19%).

Denial of service in Next.js App Router with Server Actions allows remote attackers to exhaust CPU resources and block request processing. Affected versions include all 13.0.0–15.5.20 and 16.0.0–16.2.10 releases. No active exploitation or public exploit code has been identified at time of analysis.

Full compromise of Oracle Platform Security for Java (OPSS) in Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0 is possible by a low-privileged attacker over HTTP, targeting the Centralized Thirdparty Jars component. Oracle rates the flaw 8.8 and describes it as 'easily exploitable,' with successful attacks yielding complete takeover (high confidentiality, integrity, and availability impact). No public exploit is identified at time of analysis and the CVE is not listed in CISA KEV.

Full takeover of Oracle Platform Security for Java (OPSS), a security framework within Oracle Fusion Middleware, is possible for a low-privileged attacker positioned on the same physical communication segment as the host. Disclosed in Oracle's July 2026 Critical Patch Update, the flaw carries a CVSS 3.1 score of 8.0 and a scope change, meaning successful exploitation can significantly impact additional products beyond OPSS itself. Exploitation is rated difficult (AC:H) and there is no public exploit identified at time of analysis, so risk is elevated by potential blast radius rather than by ease of attack.

Full takeover of Oracle Platform Security for Java (OPSS) is possible in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0, where a low-privileged attacker with network access can compromise the component via crafted SOAP requests. Oracle rates this CVSS 8.8 with high confidentiality, integrity, and availability impact, meaning successful exploitation yields complete control of the OPSS component rather than mere data exposure. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

TLS certificate-revocation bypass in Netty's OcspServerCertificateValidator (netty-handler-ssl-ocsp, versions <4.1.136.Final and 4.2.0.Final-4.2.16.Final) allows a malicious server presenting a revoked certificate to receive sensitive client data during a race window. The validator forwards the SslHandshakeCompletionEvent to downstream handlers before the asynchronous OCSP check finishes, so client applications treat the connection as trusted and may transmit or process application data before the revoked channel is closed. Publicly available exploit code exists (PoC in the GHSA advisory); no public active exploitation has been reported and the vulnerability is not in CISA KEV.

Predictable persistent login keys in IP Login extension for Joomla allow unauthenticated attackers to compromise accounts. Versions 1.0.0 through 6.2.5 generate keys using a non-cryptographic random generator with insufficient entropy, enabling brute-force guessing. No public exploit is known, but the low-entropy PRNG makes key prediction feasible.

Information disclosure in multiple Regular Labs Joomla extensions allows unauthenticated visitors to retrieve administrator-only content indexed via Smart Search. Affected extensions include Articles Anywhere, Conditional Content, Modules Anywhere, ReReplacer, Sourcerer, Snippets Pro, and Tabs & Accordions Pro. No public exploit or active exploitation is known, and EPSS probability is low (0.19%).

Denial of service in MongoDB Server allows an authenticated user to crash the database process by submitting a query whose sort specification embeds a `$meta` expression in raw BSONObj form. Because query planning fails to explicitly handle the meta-expression case when reading the sort pattern, it performs an incorrect transformation that trips an internal invariant, terminating the mongod process. No public exploit identified at time of analysis; the issue is tracked in MongoDB's Jira as SERVER-128341 and reported by MongoDB's own CNA.

Persistent authentication bypass in Question2Answer through 1.8.8 lets an attacker holding a stolen 'Remember me' (qa_session) cookie keep authenticated access to an account even after its password is reset via the forgot-password flow. The reset handler qa_finish_reset_user() fails to clear the user's sessioncode field, so previously issued persistent cookies remain valid - defeating the primary account-recovery defense used after a compromise. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the fix is an upstream GitHub pull request rather than a tagged release.

Out-of-bounds heap read in MongoDB Server's BSON CodeWScope element accessors lets an authenticated user disclose adjacent heap memory or crash the server (denial of service) by submitting a crafted aggregation pipeline. The exploit path abuses malformed BSONColumn (columnar/compressed BSON) data whose CodeWScope element bypasses the normal wire-level BSON validation, so an unchecked size field is trusted during decompression. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the CVSS 4.0 base score is 7.1, driven mainly by high availability impact.

Denial of service in MongoDB's mongod server allows any authenticated user holding only read privileges to crash the database by submitting aggregation pipeline expressions that invoke server-side JavaScript, triggering a use-after-free (CWE-416) during document processing. The flaw affects availability only and requires valid low-privilege credentials; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Information disclosure in MongoDB's server-side JavaScript engine allows authenticated database users to read fragments of internal server process memory. The flaw stems from improper handling of DBPointer objects during BSON serialization, causing uninitialized or adjacent memory contents to be returned to the client. Only deployments that enable server-side JavaScript are affected; no public exploit has been identified at time of analysis and it is not listed in CISA KEV.

Integrity corruption in MongoDB's Queryable Encryption on sharded clusters lets an authenticated user with write access to a QE-enabled collection tamper with server-controlled encryption metadata by routing crafted write commands through the mongos router, breaking the correctness of encrypted queries. The CVSS 4.0 vector (VI:H, VC:N, VA:N) confirms this is an integrity-only issue despite the input's 'Information Disclosure' tag, which appears mislabeled. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Out-of-bounds memory read in FFmpeg's S/PDIF muxer (spdifenc.c) affects versions 0.7.1 through 8.1.2 when re-muxing DTS-HD audio to an S/PDIF (IEC 61937) container. The spdif_header_dts4 function trusts an attacker-controlled core_size field from a crafted DTS stream without validating it against the actual packet length, letting a malicious input read memory past the packet buffer to leak small amounts of adjacent process memory or crash the process. Reported by VulnCheck with an upstream fix available; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Information disclosure and potential data corruption in the Linux kernel's XFS filesystem can allow a local attacker with low privileges to achieve high integrity, confidentiality, and availability impact. The vulnerability resides in the reflink copy-on-write logic where stale data fork mappings are used after cycling the ILOCK, leading to inaccurate shared-extent tracking. No active exploitation or public exploit code has been identified at time of analysis, and a vendor patch is available.

Remote code execution in Dell PowerProtect Data Manager versions prior to 20.2.0.0 stems from improper input validation in the product's REST API, allowing a high-privileged, remotely authenticated attacker to escalate into arbitrary code execution on the data-protection appliance. Dell (the reporting vendor) rates it CVSS 7.2 (High) with full confidentiality, integrity, and availability impact but requiring high privileges (PR:H). There is no public exploit identified at time of analysis, the EPSS probability is low (0.61%, 46th percentile), and CISA SSVC marks exploitation status as none.

Elevation of privilege in Dell PowerProtect Data Manager (all versions prior to 20.2.0.0) stems from the Identity and Access Management (IAM) subsystem generating incorrect security tokens, letting an already-authenticated low-privileged user obtain rights beyond those granted to their account. The flaw is remotely reachable over the network and requires no user interaction, and while the CVSS base score is 8.8 (High), there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because the impact is full compromise of confidentiality, integrity and availability of the data-protection platform, it should be prioritized in any environment running affected versions.

Elevation of privilege in Dell PowerProtect Data Manager versions prior to 20.2.0.0 allows an already high-privileged, remotely authenticated attacker to abuse improper input validation in the REST API to gain further control over the appliance. Exploitation yields total technical impact (full confidentiality, integrity, and availability compromise) but requires existing high privileges, keeping practical risk moderate. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.

Elevation of privilege in Dell PowerProtect Data Manager before 20.2.0.0 lets an already high-privileged, remote authenticated attacker abuse an improperly validated REST API input to gain further control over the backup and recovery appliance. Per the CVSS vector the attacker starts with high privileges (PR:H), yet the flaw yields total confidentiality, integrity, and availability impact on the affected system. There is no public exploit identified at time of analysis, and CISA's SSVC framework rates exploitation as 'none' with a low EPSS probability of 0.50%.

Elevation of privilege in Dell PowerProtect Data Manager (versions prior to 20.2.0.0) allows a remote, high-privileged attacker to abuse improper input validation and gain elevated privileges, with full confidentiality, integrity, and availability impact per the CVSS vector. The flaw was reported by Dell, which has published advisory DSA-2026-287 and a fixed release. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so risk is currently limited by the requirement for pre-existing high privileges.

DNSSEC validation bypass in ISC BIND 9 resolvers (9.11.0 through 9.21.23 and S-editions) allows an attacker controlling a signed zone to inject validly-signed NSEC records whose 'Next Domain Name' field points outside the signer's own zone, letting forged proofs of non-existence be applied to names the zone was never authorized to speak for. Because BIND fails to enforce that the NSEC chain stays within the signer's authority, an attacker can assert that arbitrary names in other zones do not exist, poisoning resolver behavior across zone boundaries (CVSS 8.6, Scope:Changed, integrity impact). There is no public exploit identified at time of analysis and the issue is not in CISA KEV.

Remote denial of service in ISC BIND 9 lets an off-path attacker crash a recursive resolver by controlling the timing and content of authoritative responses to paired queries. When a client asks named to resolve a DNAME plus an A record beneath it (or a CNAME plus an A record for the same name) and the attacker-controlled authoritative server answers the A query positively but delays the DNAME/CNAME response before returning a negative or self-referential answer, named hits a fatal assertion and terminates. The flaw is unauthenticated and network-reachable (CVSS 7.5, availability-only); there is no public exploit identified at time of analysis and it is not on CISA KEV.

Cache poisoning in ISC BIND 9 recursive resolvers allows an attacker who controls an authoritative zone to inject forged records by returning an RRSIG with fewer labels than its containing zone, tricking `named` into synthesizing a wildcard name for a zone shorter than the attacker's own. Affected versions span the 9.11.x through 9.21.x branches (including -S subscription editions), and the flaw is exploitable against default deployments because the triggering feature `synth-from-dnssec` is enabled by default. No public exploit identified at time of analysis; the issue was reported by ISC and vendor patches (9.20.26, 9.21.24) are available.

RPZ policy bypass and remote denial-of-service in ISC BIND 9 resolvers lets unauthenticated attackers defeat Response Policy Zone protections or crash the daemon by sending queries with names long enough to trigger a NAMETOOLONG condition during RPZ processing. Affected are BIND 9.16.0-9.18.50, 9.20.0-9.20.24, 9.21.0-9.21.23 and the corresponding -S (subscription) editions, but only where RPZ is configured with wildcard CNAME policies. No public exploit identified at time of analysis; the vendor (ISC) has released fixed builds 9.20.26 and 9.21.24.

Server-side file path manipulation and forced server-side requests in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 stem from insufficient validation of the language (DictionaryLanguage) parameter in the spell check handler, letting remote attackers coerce the server into resolving attacker-influenced file paths and issuing unintended outbound requests. Classified as information disclosure (CWE-36, absolute path traversal) with a CVSS 7.5 confidentiality-only impact, it exposes sensitive server-side file contents. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Provider type tampering in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 lets remote attackers manipulate the DialogHandler's provider type input to alter dialog processing, serving as a stepping stone for chained exploitation. The flaw stems from unsafe reflection (CWE-470), where externally-controlled input selects the class/code path handling dialog operations, and carries a CVSS 8.1 (high). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though Telerik components have a notable history of being targeted once weaponized.

Cryptographic key predictability in Progress Telerik UI for ASP.NET AJAX prior to v2026.2.708 lets remote unauthenticated attackers forge integrity-protected upload metadata when Telerik.Upload.ConfigurationHashKey is absent and no explicit machineKey is configured, causing the upload handler to fall back to a predictable default key. This forgery capability is not the end goal but a stepping stone: it unlocks further exploit chains (notably the RAU unauthenticated deserialization chain referenced in the vendor KB). There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; EPSS was not provided.

Information disclosure in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 allows remote unauthenticated attackers to exploit a timing oracle in RadAsyncUpload's upload metadata processing, recovering protected (encrypted/signed) metadata values through measurable response-time differences during cryptographic validation. The flaw stems from non-constant-time comparison of the metadata's cryptographic integrity, letting an attacker probe validity incrementally. No public exploit was identified at time of analysis, and it is not listed in CISA KEV; EPSS and POC data were not provided.

Information disclosure in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 lets remote unauthenticated attackers abuse the RadAsyncUpload control's client-state handling as a cryptographic oracle. Because the server distinguishes decryption failures from invalid-JSON parse failures, an attacker can iteratively probe the encrypted rauPostData token and recover protected metadata values. No public exploit identified at time of analysis, and it is not listed in CISA KEV; EPSS was not provided.

Remote denial-of-service in NLnet Labs Unbound 1.23.0 through 1.25.1 lets an attacker who controls a delegated DNS zone crash the resolver daemon with a single crafted upstream response, but only when the non-default 'dns-error-reporting: yes' option is enabled. The flaw is a stack write triggered while building a DNS Error Report query name from a malformed EDNS Report-Channel option (code 18). No public exploit has been identified at time of analysis and it is not listed in CISA KEV; the CVSS 7.5 reflects a pure availability impact (A:H) with no data disclosure despite the vendor's 'Information Disclosure' tag.

Arbitrary code execution in the Visual Studio Code Ansible Lightspeed extension lets an attacker embed shell metacharacters in an Ansible playbook filename that the AnsiblePlaybookRunProvider passes unsanitized to a command invocation. When a developer opens the malicious project and runs the playbook, the injected characters execute arbitrary commands with the privileges of the VS Code user. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but the local high-impact profile (CVSS 7.8, C:H/I:H/A:H) makes it a meaningful supply-chain/repository-poisoning risk for Ansible developers.

Information disclosure in the firmware of multiple Hikvision network camera families (DS-2CD, DS-2DE, DS-2DP, DS-2TD series) allows remote unauthenticated attackers to retrieve partial sensitive data by sending requests with improperly validated input parameters. The flaw was self-reported by Hikvision and rated CVSS 7.5 (confidentiality-only impact); no public exploit identified at time of analysis. Because these cameras are frequently internet-exposed, the network-reachable, no-authentication nature of the issue makes it a meaningful exposure risk despite the absence of integrity or availability impact.

Domain spoofing in Google Chrome on Linux prior to 150.0.7871.182 lets an attacker in a privileged network position present a malicious site under a trusted domain identity by exploiting insufficient validation of untrusted certificate input. The flaw carries a High Chromium severity and a CVSS of 7.5 driven entirely by integrity impact (I:H, C:N, A:N); Google's release notes confirm a fix is available. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

An out-of-bounds read and write in ANGLE within Google Chrome on Android allows a remote attacker to potentially escape the browser sandbox via a crafted HTML page. The flaw is patched in Chrome 150.0.7871.182. No public exploit or active exploitation has been reported; EPSS estimates a low 0.16% probability of exploitation.

Sandbox escape in Google Chrome's Chromecast component allows a local attacker with low privileges to potentially execute arbitrary code outside the sandbox by sending malicious network traffic. Affects Chrome versions prior to 150.0.7871.182. EPSS 0.1% and no KEV listing suggest low real-world exploitation risk despite the high-severity CVSS 7.8 score.

Unauthenticated information disclosure in Feedbin (self-hosted RSS reader, commit 739884a) lets remote attackers read any user's private article content via GET /api/v2/entries/:id/text, which explicitly skipped the authorization filter. Because entry IDs are sequential integers, an attacker can enumerate and harvest plain-text bodies of private newsletters, page-saves, and articles from every user's private subscriptions across the instance. No public exploit identified at time of analysis, though a technical write-up describing the flaw exists; the CVSS 4.0 base score is 8.7 (High) driven purely by confidentiality impact.

Unauthorized data disclosure in Oracle HRMS (UK) UK Payroll component of Oracle E-Business Suite 12.2.3 through 12.2.15 allows a low-privileged, authenticated remote attacker over HTTP to read all HRMS (UK)-accessible data, with a scope change that can significantly impact additional products beyond the vulnerable module. Rated CVSS 3.1 7.7 (High) for confidentiality-only impact, it was reported by Oracle and patched in the July 2026 Critical Patch Update; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Unauthorized data access in Oracle E-Business Suite HRMS (Norway) allows a low-privileged remote attacker to read all HRMS-accessible data over HTTP, with a scope change that may significantly impact other integrated products. The flaw affects EBS releases 12.2.3 through 12.2.15 and is addressed in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the confidentiality-only, network-exploitable nature nonetheless makes it a meaningful data-exposure risk in HR environments.

Data tampering and partial denial-of-service in Oracle Production Scheduling (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a low-privileged, network-authenticated attacker over HTTP create, delete, or modify critical data - with additional limited read access and a partial DoS. Oracle rates it CVSS 3.1 7.6, driven primarily by high integrity impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so this is a patch-during-normal-cycle priority rather than an emergency.

Data compromise in Oracle Installed Base (Oracle E-Business Suite, Create Item Instance component) versions 12.2.3 through 12.2.15 allows a low-privileged attacker with HTTP network access to read, create, delete, or modify all Installed Base-accessible data and cause a partial denial of service. Rated CVSS 3.1 8.3 (High) with high confidentiality and integrity impact, it was disclosed in Oracle's July 2026 Critical Patch Update. No public exploit was identified at time of analysis and it is not listed in CISA KEV, so exploitation is theoretical, but the low bar (any authenticated EBS account, no user interaction) makes it a strong patching priority.

Unauthorized data manipulation in Oracle HCM Configuration Workbench (part of Oracle E-Business Suite, Spreadsheet Loading component) lets a remote unauthenticated attacker reach the application over HTTP and perform unauthorized update, insert, delete and limited read operations, plus trigger a partial denial of service. All EBS releases from 12.2.3 through 12.2.15 are affected. Rated CVSS 3.1 7.3; no public exploit identified at time of analysis and it is not listed in CISA KEV, but the pre-authentication network reach makes it a meaningful patch priority for exposed EBS deployments.

Unauthorized data access in Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 (eSettlements component) lets an unauthenticated attacker on the adjacent network segment read confidential PeopleSoft data and make limited unauthorized modifications. The flaw carries a scope change, so a successful attack can significantly impact products beyond the vulnerable module. No public exploit identified at time of analysis, and no EPSS or KEV signal is provided; the 8.2 CVSS score is driven by high confidentiality impact plus scope change rather than remote internet exploitability.

Full compromise of Oracle PeopleSoft Enterprise FIN Common Objects Brazil 9.1 (Integration component) is possible by an unauthenticated remote attacker over HTTP, with Oracle rating the flaw CVSS 9.8 and describing 'takeover' of the affected module. Disclosed in Oracle's July 2026 Critical Patch Update (CPUJUL2026), the issue affects the Brazilian financial-localization objects of the PeopleSoft Financials suite. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Unauthorized data disclosure in Oracle Agile Product Lifecycle Management for Process 6.2.4 (Installation component) allows an unauthenticated attacker on the adjacent network segment to compromise confidentiality and, due to a scope change, impact additional connected products. The flaw is rated CVSS 3.1 7.4 with confidentiality-only impact and no integrity or availability effect. There is no public exploit identified at time of analysis, and it was disclosed by Oracle in the July 2026 Critical Patch Update.

Unauthorized critical-data access and partial denial of service in Oracle Product Lifecycle Analytics 3.6.1 (Supply Chain suite, Installation Issues component) allows a remote, unauthenticated attacker over HTTP to fully read all data the application can access and partially disrupt service. The flaw carries a scope change, so successful attacks may significantly impact adjacent Oracle products beyond the analytics component itself. Rated CVSS 3.1 9.3 (Critical); no public exploit identified at time of analysis and it is not listed in CISA KEV.

Denial-of-service and information disclosure in Oracle Commerce Guided Search Platform Services 11.4.0 (Forge component) lets a low-privileged, network-adjacent attacker send crafted HTTP requests to hang or repeatedly crash the service (complete DoS) and read a subset of accessible data. The flaw is rated CVSS 3.1 7.1 and was disclosed by Oracle in the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle characterizes it as easily exploitable.

Unauthorized data disclosure in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 lets a remote, unauthenticated attacker read all data accessible to the Experience Manager component over HTTP. Oracle rates it CVSS 7.5 with high confidentiality impact and no integrity or availability effect, and the reporter tags it as an authentication bypass. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-facing, no-privilege profile makes it a straightforward information-disclosure risk.

Unauthorized data disclosure in Oracle Commerce Platform 11.4.0 lets a remote, unauthenticated attacker reaching the Dynamo Application Framework's LDAP integration read critical application data, potentially all data accessible to the platform. Oracle rates this CVSS 3.1 7.5 with confidentiality-only impact and describes it as easily exploitable. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score in the provided data, so this is a serious-but-not-yet-weaponized disclosure flaw disclosed in the July 2026 Oracle Critical Patch Update.

Unauthorized data disclosure in Oracle Configure to Order (Supply to Order Workbench component) of Oracle E-Business Suite 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker over HTTP to read all data accessible to the application and, because of a scope change, to impact additional Oracle products beyond Configure to Order. Oracle rates it CVSS 3.1 7.7 with confidentiality-only impact and describes it as easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though it was reported through Oracle's own security alert channel for the July 2026 Critical Patch Update.

Unauthorized data disclosure in Oracle Application Object Library (a core component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) allows a remote, unauthenticated attacker to compromise confidentiality over HTTP, resulting in unauthorized access to critical data or complete access to all data accessible to Oracle Application Object Library. Fixed in Oracle's July 2026 Critical Patch Update, the flaw is tagged as an authentication bypass and carries a CVSS 3.1 base score of 7.5 driven entirely by confidentiality impact (C:H, I:N, A:N). There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.

Unauthorized data disclosure in Oracle Inventory Management (Internal Operations component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) lets a low-privileged, network-authenticated attacker read all data accessible to the application, with a scope change that can significantly impact other Oracle EBS products. Rated CVSS 3.1 7.7 (confidentiality-only), the flaw is easily exploitable over HTTP and is tagged as an authentication-bypass class issue. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; fixes ship in Oracle's July 2026 Critical Patch Update.

Unauthorized data disclosure in Oracle E-Business Suite's Oracle Capacity module (Internal Operations component), versions 12.2.3 through 12.2.15, allows a low-privileged attacker with HTTP network access to read all Oracle Capacity-accessible data and, due to a scope change, impact additional connected products. The flaw is easily exploitable and requires only a low-privilege account, no user interaction. It is addressed in Oracle's July 2026 Critical Patch Update; no public exploit has been identified at time of analysis.

Compromise of Oracle Work in Process, a manufacturing module of Oracle E-Business Suite (versions 12.2.3 through 12.2.15, Internal Operations component), allows a low-privileged authenticated attacker with HTTP network access to read all data accessible to Work in Process and to alter some of it, with a scope change that can significantly impact additional Oracle products. Exploitation is rated easy by Oracle but requires human interaction from a victim other than the attacker (UI:R), pointing to a social-engineering or cross-user trigger. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; the fix ships in the Oracle Critical Patch Update of July 2026.

Elevated data compromise in Oracle E-Business Suite's Customer Support module (Update Service Request component), versions 12.2.3 through 12.2.15, lets a low-privileged attacker with HTTP network access read and modify all Customer Support-accessible data. The flaw carries high confidentiality and integrity impact (CVSS 8.1) but no availability impact, and Oracle rates it easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; remediation is delivered via Oracle's July 2026 Critical Patch Update.

Unauthorized data access in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component), versions 22.3 through 26.5, lets an unauthenticated remote attacker over HTTP read all Siebel-accessible data, tamper with some records, and cause a partial denial of service. Oracle rates it CVSS 7.0 but flags it as difficult to exploit (AC:H), and no public exploit identified at time of analysis. Disclosed via the Oracle July 2026 Critical Patch Update.

Account/instance takeover in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 (Web Content Management component) allows a low-privileged, authenticated attacker with HTTP network access to fully compromise the product after luring a victim user into an action. Oracle rates it CVSS 3.1 8.0 with High impact to confidentiality, integrity, and availability, and the ecalert tag flags Information Disclosure. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; it was disclosed in Oracle's July 2026 Critical Patch Update.

Full application takeover in Oracle WebCenter Content (Fusion Middleware, Web Content Management component) versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged, network-based attacker to compromise confidentiality, integrity, and availability once a legitimate user is tricked into interacting with attacker-influenced content. The flaw carries an Oracle-assigned CVSS 3.1 score of 8.0 (AV:N/AC:L/PR:L/UI:R) and is addressed in the Oracle Critical Patch Update of July 2026. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Sensitive data disclosure in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 (Web Content Management component) lets a low-privileged, network-based attacker read or fully access all data the application can reach and cause a partial denial of service over HTTP. Oracle rates it CVSS 3.1 7.1 and describes it as easily exploitable, though it requires an existing low-level account (PR:L). There is no public exploit identified at time of analysis and it is not listed in CISA KEV; it was disclosed in the Oracle July 2026 Critical Patch Update.

Full takeover of Oracle WebCenter Content (Content Server component) is possible when a remote, unauthenticated attacker lures a legitimate user into interacting with a malicious HTTP request, yielding high confidentiality, integrity, and availability impact plus a scope change to adjacent products. It affects Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 and carries a CVSS 3.1 score of 8.3. No public exploit identified at time of analysis and it is not listed in CISA KEV, though exploitation complexity is high.

Full takeover of Oracle WebCenter Content (Content Server component) in Oracle Fusion Middleware allows a remote unauthenticated attacker to fully compromise confidentiality, integrity, and availability, but only after luring an authenticated victim into interacting with an attacker-supplied trigger (UI:R). It affects supported versions 12.2.1.4.0 and 14.1.2.0.0, carries a CVSS 3.1 base score of 8.8, and is addressed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Full takeover of Oracle WebCenter Content (Content Server component of Oracle Fusion Middleware) is possible in supported versions 12.2.1.4.0 and 14.1.2.0.0. A remote, unauthenticated attacker sending crafted HTTP traffic can compromise confidentiality, integrity, and availability, but the attack requires human interaction from a user other than the attacker (UI:R). No public exploit has been identified at time of analysis, and the flaw is fixed in Oracle's July 2026 Critical Patch Update.

Full compromise of Oracle WebCenter Content (Content Server component) in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 can be achieved by a remote, unauthenticated attacker over HTTP, provided a legitimate user is lured into a triggering interaction. Rated CVSS 8.8 with high confidentiality, integrity, and availability impact, successful exploitation yields takeover of the WebCenter Content instance. There is no public exploit identified at time of analysis and no CISA KEV listing, but the low attack complexity and network vector make this a priority patch item.

Full product takeover in Oracle WebCenter Content (Content Server component) 12.2.1.4.0 and 14.1.2.0.0 allows a remote unauthenticated attacker to compromise confidentiality, integrity, and availability by luring a victim into interacting with a malicious HTTP request or link. The flaw carries a CVSS 3.1 base score of 8.8 and results in complete takeover, but exploitation requires human interaction from a legitimate user. No public exploit identified at time of analysis and the issue is not listed in CISA KEV; it was fixed in Oracle's July 2026 Critical Patch Update.

Full takeover of Oracle WebCenter Content (Content Server component) in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 is achievable by a remote, unauthenticated attacker over HTTP, but only after luring a legitimate user into interacting with attacker-controlled input (UI:R). The CVSS 3.1 base score is 8.8 with High impact to confidentiality, integrity and availability, meaning a successful attack yields complete compromise of the product. There is no public exploit identified at time of analysis and it is not on the CISA KEV list, so exploitation is theoretical rather than confirmed.

Full takeover of Oracle WebCenter Content (Content Server component) in Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0 is achievable by a remote, unauthenticated attacker over HTTP when a legitimate user is lured into interacting with attacker-influenced content. Because the CVSS vector is AV:N/AC:L/PR:N/UI:R with high Confidentiality, Integrity and Availability impact (8.8), the flaw yields complete compromise of the content management system, though the required human interaction meaningfully narrows practical exploitation. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, so exploitation status remains theoretical based on Oracle's July 2026 CPU disclosure.