CVE-2026-66776

SAP Approuter does not consistently enforce integrity verification on certain session-related request headers under specific conditions. An attacker with low privileges could send a specially crafted request that bypasses the integrity check and loads another user's session context. Successful...

CVE-2026-66775

SAP Approuter does not enforce cross-site request forgery protection on the authentication flow by default. An unauthenticated attacker could craft a malicious link and trick a victim into following it. Successful exploitation could allow the attacker to bind the victim's session to an...

CVE-2026-66771

SAPUI5 allows a key user with content adaptation privileges to inject malicious script content into persisted application changes. When another user subsequently opens the adapted application, the injected script executes in the victim's browser session. Successful exploitation could allow the...

CVE-2026-66776

SAP Approuter (SAP Business AI Platform) contains vulnerabilities where integrity verification on certain session-related request headers can be bypassed under specific conditions, potentially exposing another user’s session context. Exploitation requires low privileges and previously observed ma...

EUVD-2026-55888

SAP Approuter does not consistently enforce integrity verification on certain session-related request headers under specific conditions. An attacker with low privileges could send a specially crafted request that bypasses the integrity check and loads another user's session context. Successful...

EUVD-2026-55887

SAP Approuter does not enforce cross-site request forgery protection on the authentication flow by default. An unauthenticated attacker could craft a malicious link and trick a victim into following it. Successful exploitation could allow the attacker to bind the victim's session to an...

CVE-2026-66775

CVE-2026-66775 affects SAP Approuter (SAP Business AI Platform). The vulnerability is a CSRF flaw where cross-site request forgery protection is not enforced on the authentication flow by default. An unauthenticated attacker could craft a malicious link to lure a victim and bind the victim’s sess...

EUVD-2026-55883

SAPUI5 allows a key user with content adaptation privileges to inject malicious script content into persisted application changes. When another user subsequently opens the adapted application, the injected script executes in the victim's browser session. Successful exploitation could allow the...

CVE-2026-66771

CVE-2026-66771 concerns a cross-site scripting vulnerability in SAPUI5. A key user with content-adaptation privileges can inject malicious script into persisted application changes; when another user opens the adapted app, the script runs in the victim’s browser session. The impact is limited to ...

SUSE CVE-2026-56750

Gitea Remember-Me Token Theft Not Invalidating Attacker Session...

PT-2026-70255

TypeBot is a chatbot builder tool. Prior to version 3.17.0, an authenticated user who has read access to any typebot can resume a waiting webhook session that belongs to a different typebot by mixing an authorized typebotId and blockId and a foreign live resultId. The webhook resume handler...

PT-2026-70198

Craft CMS before 5.10.5 fails to persist updated credential counters after WebAuthn assertion validation in the passkey login endpoint. Attackers can replay captured login request bodies containing requestOptions and response to create additional authenticated sessions for victim accounts...

PT-2026-70360

Name of the Vulnerable Software and Affected Versions Vitis Embedded Single File Download SFD affected versions not specified Description Uncontrolled search paths in the local Windows installation of the Vitis Embedded Single File Download SFD may allow a low-privileged user to achieve arbitrary...

PT-2026-70790

A DLL hijacking vulnerability within the AMD Ryzen Master installation could allow a local user-privileged attacker to escalate privileges, potentially resulting in arbitrary code execution...

PT-2026-70048

Name of the Vulnerable Software and Affected Versions SAP Approuter affected versions not specified Description SAP Approuter fails to consistently enforce integrity verification on specific session-related request headers. A low-privileged attacker can send a specially crafted request to bypass...

PT-2026-70333

Uncontrolled search path for some EquiTriton before version f5ddbb5 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially...

PT-2026-70703

Name of the Vulnerable Software and Affected Versions Windows 11 affected versions not specified Description Improper access control in the Windows Cross Device Service allows an authorized attacker to elevate privileges locally. The issue occurs because a standard user can create the...

AMD Ryzen™ Master Vulnerability

CVE Details Refer to Glossary for explanation of terms CVE| CVE Description| CVSS Base Score ---|---|--- CVE-2025-54512| A DLL hijacking vulnerability within the AMD Ryzen™ Master installation may allow a local user-privileged attacker to escalate privileges, potentially resulting in arbitrary co...

AMD Power Design Manager (PDM) Vulnerabilities

CVE Details Refer to Glossary for explanation of terms CVE| CVE Description| CVSS Base Score ---|---|--- CVE-2025-8087| A DLL hijacking vulnerability within AMD Power Design Manager can allow a malicious local attacker to escalate privileges during uninstallation potentially resulting in arbitrar...

PT-2026-70253

A Cross Site Scripting XSS vulnerability in the Web Portals of AtHoc IWS in versions earlier than 7.21 HF-734 could allow an attacker to potentially execute actions in the context of the victim's session...