8512 matches found
CVE-2026-66760
Technical details about CVE-2026-66760 are not publicly available in the provided documents beyond what is described in the Initial Description; monitor for updates.
CVE-2026-58248
The CVE describes an XML External Entity (XXE) injection in SAP BusinessObjects Business Intelligence Platform (Web Intelligence). A low-privileged attacker can upload a specially crafted spreadsheet as a data source; when processed, the component resolves external references and exposes contents...
EUVD-2026-55874
SAP Manufacturing Integration and Intelligence MII does not perform necessary authorization check on certain application function, allowing a low-privileged authenticated attacker to access information that should be restricted to privileged users. Successful exploitation could allow the attacker...
CVE-2026-58244
Technical details (affected components, root cause, exploitability, and remediation) are not publicly available in the provided documents. Monitor for updates.
EUVD-2026-55873
SAP ABAP Development Tools does not perform necessary authorization checks for certain functionality, allowing an attacker with low privileges to execute unauthorized database operations against SAP NetWeaver AS ABAP. Successful exploitation could allow the attacker to read sensitive data, modify...
CVE-2026-58241
Technical details about CVE-2026-58241 are not publicly available in the provided documents. Monitor for updates.
EUVD-2026-55869
WebSocket of SAP Approuter does not perform sufficient authorization checks in certain functionality. An attacker with low privileges could exploit this to access restricted functionality. Successful exploitation could allow the attacker to read sensitive information and perform limited...
PT-2026-70039
Name of the Vulnerable Software and Affected Versions SAP Approuter affected versions not specified Description SAP Approuter fails to enforce sufficient flow control in certain functionality. A low-privileged attacker can send high volumes of data without consuming responses, leading to unbounde...
PT-2026-70335
Integer overflow in the UEFI firmware for the IntelR Slim Bootloader may allow an information disclosure. System software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack...
PT-2026-70029
Name of the Vulnerable Software and Affected Versions SAP Approuter affected versions not specified Description The WebSocket component of SAP Approuter fails to perform sufficient authorization checks within certain functionality. This allows an attacker with low privileges to access restricted...
PT-2026-70046
Name of the Vulnerable Software and Affected Versions SAP Approuter affected versions not specified Description SAP Approuter fails to consistently handle specific error conditions. A low-privileged attacker could exploit this behavior under a non-default configuration. Successful exploitation is...
PT-2026-70034
Name of the Vulnerable Software and Affected Versions SAP Manufacturing Integration and Intelligence MII affected versions not specified Description SAP Manufacturing Integration and Intelligence MII fails to perform required authorization checks on certain application functions. This allows an...
PT-2026-70037
Name of the Vulnerable Software and Affected Versions SAP BusinessObjects Business Intelligence Platform Web Intelligence affected versions not specified Description An XML External Entity XXE Injection exists in the Web Intelligence component. This issue allows a low-privileged attacker to uploa...
PT-2026-70816
Adobe Commerce is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerabl...
PT-2026-70049
Name of the Vulnerable Software and Affected Versions SAP Approuter affected versions not specified Description SAP Approuter fails to sufficiently validate certain incoming requests before forwarding them to backend destinations. An attacker with low privileges can send specially crafted request...
CVE-2025-30238
In affected TP-Link Aginet devices, insufficient authorization validation allows authenticated low-privileged users to execute higher-privileged operations. An attacker may perform administrative actions such as creating privileged accounts or modifying critical configuration settings...
CVE-2026-72908
ERPNext contains an SQL injection in get_tax_template (erpnext/accounts/doctype/tax_rule/tax_rule.py) exploitable by an authenticated low-privilege user through request-influenced posting_date and args values. The issue affects pre-15.109.0 and pre-16.20.0 releases and can lead to extraction of s...
CVE-2026-13717 Rhoai maas: llm-d: maas/llm-d inference gateway: default allowedroutes.namespaces.from: all allows namespace users to hijack shared model-serving traffic (tokens, prompts, outputs)
A flaw was found in the Red Hat OpenShift AI RHOAI MaaS Gateway. Improper configuration of the Gateway in a model-serving context allows a standard user with low privileges to intercept, read, log, and alter all MaaS model traffic. This includes sensitive information such as access keys, input...
CVE-2026-72901
Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, Dokploy allows an authenticated low-privilege member to execute arbitrary commands on the control-plane host because the volumeName field accepted by volumeBackup.create and volumeBackup.runManually is interpolated...