CVE-2026-76958

SAP Integration Suite contains an XML External Entity (XXE) vulnerability in certain internal components that do not sufficiently validate XML documents accepted from untrusted sources. An attacker with low privileges can submit crafted XML payloads containing malicious external entity declaratio...

CVE-2026-76958 XML External Entity (XXE) Vulnerability in SAP Integration Suite

SAP Integration Suite does not sufficiently validate XML documents accepted from untrusted sources in certain internal components. An attacker with low privileges could submit specially crafted XML payloads containing malicious external entity declarations. Successful exploitation could allow the...

CVE-2026-58234 Denial of Service vulnerability in SAP Process Integration (SOAP Adapter)

SAP Process Integration SOAP Adapter allows a privileged user to send specially crafted requests containing deeply nested entity definitions, which under certain conditions could temporarily increase processor load and degrade system responsiveness. Successful exploitation results in low impact o...

EUVD-2026-72574

SAP Process Integration SOAP Adapter allows a privileged user to send specially crafted requests containing deeply nested entity definitions, which under certain conditions could temporarily increase processor load and degrade system responsiveness. Successful exploitation results in low impact o...

CVE-2026-58234 Denial of Service vulnerability in SAP Process Integration (SOAP Adapter)

SAP Process Integration SOAP Adapter allows a privileged user to send specially crafted requests containing deeply nested entity definitions, which under certain conditions could temporarily increase processor load and degrade system responsiveness. Successful exploitation results in low impact o...

CVE-2026-58234

SAP Process Integration (SOAP Adapter) is affected by a Denial of Service vulnerability where a privileged user can send specially crafted requests containing deeply nested entity definitions , temporarily increasing processor load and degrading system responsiveness under certain conditions. The...

CVE-2026-58234: Improper Restriction of Recursive Entity References in DTDs

SAP Process Integration SOAP Adapter allows a privileged user to send specially crafted requests containing deeply nested entity definitions, which under certain conditions could temporarily increase processor load and degrade system responsiveness. Successful exploitation results in low impact o...

PT-2026-86953

SAP Integration Suite does not sufficiently validate XML documents accepted from untrusted sources in certain internal components. An attacker with low privileges could submit specially crafted XML payloads containing malicious external entity declarations. Successful exploitation could allow the...

PT-2026-87103

A Server-Side Request Forgery SSRF vulnerability exists in the ONLYOFFICE ownCloud Integration plugin version 9.12. The /apps/onlyoffice/ajax/settings/address endpoint does not sufficiently validate the user-supplied Document Server URL before initiating outbound connections. An authenticated...

PT-2026-86962

Due to a Server-Side Request Forgery SSRF vulnerability in SAP Manufacturing Integration and Intelligence, an attacker could cause the server to initiate arbitrary outbound requests. If processed by the application, this behavior could be combined with XML/XSL processing to enable execution of...

CVE-2026-84282: Undefined Security Weakness

A Server-Side Request Forgery SSRF vulnerability exists in the ONLYOFFICE ownCloud Integration plugin version 9.12. The /apps/onlyoffice/ajax/settings/address endpoint does not sufficiently validate the user-supplied Document Server URL before initiating outbound connections. An authenticated...

CVE-2026-76971: Server-Side Request Forgery (SSRF)

Due to a Server-Side Request Forgery SSRF vulnerability in SAP Manufacturing Integration and Intelligence, an attacker could cause the server to initiate arbitrary outbound requests. If processed by the application, this behavior could be combined with XML/XSL processing to enable execution of...

PT-2026-86949

SAP Process Integration SOAP Adapter allows a privileged user to send specially crafted requests containing deeply nested entity definitions, which under certain conditions could temporarily increase processor load and degrade system responsiveness. Successful exploitation results in low impact o...

CVE-2026-78574: Untrusted Search Path

The Okta Hyperdrive Integration plugin resolves a required assembly using a registry path within the current user's hive without integrity verification. The referenced path is loaded via Assembly.LoadFrom without signature validation, resulting in an unverified assembly executing within the conte...

CVE-2026-76958: Improper Restriction of XML External Entity Reference

SAP Integration Suite does not sufficiently validate XML documents accepted from untrusted sources in certain internal components. An attacker with low privileges could submit specially crafted XML payloads containing malicious external entity declarations. Successful exploitation could allow the...

CVE-2026-78627: Insertion of Sensitive Information into Log File

The Okta Hyperdrive Integration installer does not mask the OAuth client secret when passed as an MSI property. The credential is recorded in plaintext in the installer log, the Application Event Log, and the process command line, all of which are readable by an authenticated local user on the...

CLSA-2026-1788820092 TuxCare security update for org.springframework.integration (5 CVEs)

TuxCare rebuilt 39 org.springframework.integration packages to address 5 CVEs. Fixed in 5.5.20-tuxcare.6...

Deserialization Of Untrusted Data

Spring Integration is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to SerializingHttpMessageConverter deserializing HTTP request bodies using ObjectInputStream.readObject without class filtering, which allows an unauthenticated attacker to provide a crafted serialized...

Server-Side Request Forgery (SSRF)

Spring Integration is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation of UDP inbound adapter requests, which allows an unauthenticated attacker to send a crafted UDP packet and cause the server to send UDP datagrams to arbitrary internal or...

Deserialization Of Untrusted Data

Spring Integration is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to the jsonTypeId header being used to determine the deserialization target class without a type or package allow-list, which allows an attacker to specify a malicious class and potentially achieve...