37498 matches found
CVE-2026-58237
WebSocket of SAP Approuter does not perform sufficient authorization checks in certain functionality. An attacker with low privileges could exploit this to access restricted functionality. Successful exploitation could allow the attacker to read sensitive information and perform limited...
EUVD-2025-210674
In affected TP-Link Aginet devices, insufficient authorization validation allows authenticated low-privileged users to execute higher-privileged operations. An attacker may perform administrative actions such as creating privileged accounts or modifying critical configuration settings...
CVE-2026-66777
SAP Approuter in SAP Business AI Platform is affected by vulnerabilities where incoming requests are not sufficiently validated before being forwarded to backend destinations. An attacker with low privileges could craft requests to bypass authorization and access protected resources beyond their ...
EUVD-2026-55889
SAP Approuter does not sufficiently validate certain incoming requests before forwarding them to backend destinations. Due to the complexity of the required conditions, an attacker with low privileges could send specially crafted requests to bypass authorization checks and reach protected resourc...
CVE-2026-66776
SAP Approuter (SAP Business AI Platform) contains vulnerabilities where integrity verification on certain session-related request headers can be bypassed under specific conditions, potentially exposing another user’s session context. Exploitation requires low privileges and previously observed ma...
EUVD-2026-55888
SAP Approuter does not consistently enforce integrity verification on certain session-related request headers under specific conditions. An attacker with low privileges could send a specially crafted request that bypasses the integrity check and loads another user's session context. Successful...
EUVD-2026-55886
SAP Approuter does not consistently handle certain error conditions. An attacker with low privileges could exploit this under a non-default configuration. Successful exploitation is highly complex, as it depends on conditions outside the attacker's control. This could result in a low impact on...
CVE-2026-66774
SAP Approuter in SAP Business AI Platform contains multiple vulnerabilities related to error handling under non-default configurations. An attacker with low privileges could exploit conditions outside their control to affect availability , with no impact on confidentiality or integrity reported. ...
EUVD-2026-55885
A malicious or compromised OData service could disclose sensitive authentication information and inject untrusted data into the application, which may leads to a high impact on confidentiality and low impact on integrity and no impact on Availability...
EUVD-2026-55884
SAP BusinessObjects Business Intelligence Platform Admin Tools does not perform sufficient authorization check on certain administrative functionality. An attacker authenticated as a non-administrative user could bypass this restriction to gain limited information about affected functionality. Th...
CVE-2026-66770
Technical details about CVE-2026-66770 are not publicly available in the provided documents. Monitor for updates.
EUVD-2026-55881
Reprocess Bank Statement Items in SAP S/4HANA does not perform the necessary authorization checks for authenticated users, allowing them to use rules that have not been shared with them, resulting in privilege escalation.This vulnerability has a low impact on confidentiality, with no impact on...
CVE-2026-66764
CVE-2026-66764 affects SAP S/4HANA, specifically the Reprocess Bank Statement Items functionality. The root cause is missing authorization checks for authenticated users, enabling them to use rules not shared with them. This results in privilege escalation with a low impact on confidentiality (C:...
CVE-2026-66761
CVE-2026-66761: SAP Approuter in SAP Business AI Platform suffers from insufficient flow control allowing a low-privilege attacker to send large volumes of data, leading to unbounded memory growth and low availability impact. No impact on confidentiality or integrity is claimed. CVSS 3.1 base sco...
EUVD-2026-55879
SAP Approuter does not enforce sufficient flow control in certain functionality. An attacker with low privileges could send high volumes of data without consuming responses, causing unbounded memory growth. This results in a low impact on availability. There is no impact on confidentiality and...
CVE-2026-66760
Technical details about CVE-2026-66760 are not publicly available in the provided documents beyond what is described in the Initial Description; monitor for updates.
CVE-2026-58248
The CVE describes an XML External Entity (XXE) injection in SAP BusinessObjects Business Intelligence Platform (Web Intelligence). A low-privileged attacker can upload a specially crafted spreadsheet as a data source; when processed, the component resolves external references and exposes contents...
EUVD-2026-55876
SAP ABAP Platform allows an unauthenticated user to send a specially crafted request to an internal component. This could disclose limited, non-sensitive data from previously used memory, leading to a low on confidentiality, with no impact on integrity and availability of the application...
EUVD-2026-55874
SAP Manufacturing Integration and Intelligence MII does not perform necessary authorization check on certain application function, allowing a low-privileged authenticated attacker to access information that should be restricted to privileged users. Successful exploitation could allow the attacker...