PT-2026-86963

SAP UI5 does not sufficiently validate the parent frame's origin against the configured allowlist. An unauthenticated attacker could host a malicious page to bypass framing restrictions. If an authenticated victim visits the attacker's page and interacts with it, the attacker could trick the vict...

CVE-2026-50416-writeup-and-poc

CVE-2026-50416：桌面堆中多出的一个 QWORD 在 Windows 11 Insider 版本 10.0.28020.2149 上，Win32k 桌面堆的用户模式映射在偏移量 0x100 处暴露了一个原始的内核会话池指针。 这次读取本身小得几乎有些可笑： root@kitploit: ULONG64 leaked = ULONG64 desktopheap + 0x100; 在我的测试会话中，该读取返回： root@kitploit: 0xffffc600dcc00040...

CVE-2023-20598-PDFWKRNL

这是一个针对AMD Radeon驱动程序PDFWKRNL.sys的概念验证漏洞利用，旨在能够从低完整性进程中运行。...

Kernel-Arbitrary-Read-Vulnerability-Superfetch-EOP

内核任意读取漏洞-Superfetch-EOP 内核任意读取漏洞 + Superfetch 权限提升，基于来自 https://starlabs.sg/blog/2022/06-trying-to-exploit-a-windows-kernel-arbitrary-read-vulnerability/ 的 reacher。利用程序必须以低完整性运行。...

CVE-2026-26717

CVE-2026-26717: Ataque de Temporización HMAC en OpenFUN Richie LMS Autor: Elvin Latifli ID CVE: CVE-2026-26717 Gravedad: Media CVSS 3.1: 4.8 — AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Producto Afectado: OpenFUN Richie todas las versiones anteriores al commit a1b5bbd Componente Afectado:...

CVE-2021-44852

CVE-2021-44852 在 Biostar RACING GT Evo 2.1.1905.1700 的 BSRCIO64.sys 中发现了一个问题。低完整性进程可以打开该驱动程序的设备对象并发出 IOCTL，以读取或写入任意物理内存位置（或调用任意地址），从而导致任意代码执行。这与 0x226040、0x226044 和 0x226000 相关。 我记得曾对这个特定漏洞进行过研究，认为它不可能被利用。好吧，如果我当时分析的是正确的 IO 控制码函数，那个分析确实成立。不用说，我错得不能再离谱了。 到明天下午，这将变成一个可正常工作的漏洞利用程序。...

CVE-2026-71144

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion component: Security. The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Hyperion Financial...

PT-2026-70047

Name of the Vulnerable Software and Affected Versions SAP Approuter affected versions not specified Description SAP Approuter does not enforce cross-site request forgery CSRF protection on the authentication flow by default. CSRF is a type of attack that tricks a victim into submitting a maliciou...

CVE-2026-65922

Technical details for CVE-2026-65922 are not publicly provided in the supplied documents; monitor for updates.

CVE-2026-41853

A flaw was found in Spring MVC and WebFlux applications, components of the Spring Framework. This vulnerability allows a remote, unauthenticated attacker to perform Multipart request smuggling attacks. Such an attack can lead to a low integrity impact, potentially enabling the attacker to bypass...

CVE-2026-48805

A flaw was found in Twig, a template language for PHP. Deprecated internal wrappers in the src/Resources/core.php file do not correctly forward the sandbox state. This allows legacy function calls, such as twigarraysome, to bypass security restrictions imposed by the sandbox. An attacker could...

CVE-2026-44768

SAP CRM WebClient UI allows an attacker to inject and execute malicious scripts in the context of the application due to the absence of a Content Security Policy CSP configuration for certain restrictive directives. This vulnerability has a low impact on the integrity of the application...

EUVD-2026-43592

SAP CRM WebClient UI allows an attacker to inject and execute malicious scripts in the context of the application due to the absence of a Content Security Policy CSP configuration for certain restrictive directives. This vulnerability has a low impact on the integrity of the application...

CVE-2026-44755

SAP Business Objects Business Intelligence Platform does not sufficiently validate email sending parameters supplied by authenticated users, resulting in an email spoofing vulnerability.This vulnerability has a low impact on integrity and does not affect the confidentiality and availability of th...

CVE-2026-44755

CVE-2026-44755 affects SAP Business Objects Business Intelligence Platform. The issue arises from insufficient validation of email sending parameters by authenticated users, enabling email spoofing. Impact is described as low for integrity and no impact on confidentiality or availability (CVSS v3...

CVE-2026-44755

SAP Business Objects Business Intelligence Platform does not sufficiently validate email sending parameters supplied by authenticated users, resulting in an email spoofing vulnerability.This vulnerability has a low impact on integrity and does not affect the confidentiality and availability of th...

PT-2026-47535

SAP MDG Review Match Groups Application does not perform the necessary authorization checks for authenticated users. This could allow a low-privileged user to perform actions that would otherwise be restricted, resulting in escalation of privileges. This has a low impact on integrity, while...

OpenSSH: OpenSSH: Low integrity impact from unconfirmed proxy-mode multiplexing sessions

A flaw was found in OpenSSH. This vulnerability allows for a low integrity impact due to the omission of connection multiplexing confirmation for proxy-mode multiplexing sessions. A local user, under specific and complex conditions requiring user interaction, could potentially establish a...

OpenSSH: OpenSSH: Low integrity impact from unconfirmed proxy-mode multiplexing sessions

A flaw was found in OpenSSH. This vulnerability allows for a low integrity impact due to the omission of connection multiplexing confirmation for proxy-mode multiplexing sessions. A local user, under specific and complex conditions requiring user interaction, could potentially establish a...

Important: Red Hat Security Advisory: openssh security update

An update for openssh is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...