EUVD-2026-98085

IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity XXE injection flaw...

EUVD-2026-98084

IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to exposure of session tokens in the HTML response...

EUVD-2026-98083

IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of file paths during archive extraction...

EUVD-2026-97971

IBM Maximo Application Suite - IoT Component 9.2.0, 9.1.0, and 9.0.0 could allow a remote attacker to cause a denial of service due to uncontrolled recursion...

CVE-2026-89118

The SAP NetWeaver Enterprise Portal is affected by an information disclosure vulnerability. An unauthenticated attacker can access restricted resources to retrieve non-critical application information . This flaw results in a Low impact on Confidentiality , with no reported impact on the integrit...

CVE-2026-89116 OS Command Injection in Yeoman-UI / Application Wizard Extension for VS Code

The affected code used childprocess.execSync with a shell string for generator installation and uninstallation. This allowed an attacker to execute arbitrary OS commands with the developer's privileges by manipulating the ApplicationWizard.installationLocation VS Code workspace configuration valu...

CVE-2026-89116

The Yeoman-UI / Application Wizard Extension for VS Code is vulnerable to OS Command Injection (CWE-78). The issue stems from the use of child_process.execSync with a shell string during generator installation and uninstallation. Specifically, the ApplicationWizard.installationLocation workspace ...

CVE-2026-89116 OS Command Injection in Yeoman-UI / Application Wizard Extension for VS Code

The affected code used childprocess.execSync with a shell string for generator installation and uninstallation. This allowed an attacker to execute arbitrary OS commands with the developer's privileges by manipulating the ApplicationWizard.installationLocation VS Code workspace configuration valu...

CVE-2026-89108 Missing Authorization check in SAP Manufacturing Integration and Intelligence (Configuration Service)

SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative functionality. An attacker with MII administrator privileges could submit a specially crafted request to provision an account with elevated privileges on the...

EUVD-2026-98191

SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative functionality. An attacker with MII administrator privileges could submit a specially crafted request to provision an account with elevated privileges on the...

CVE-2026-89108

SAP Manufacturing Integration and Intelligence (Configuration Service) contains a missing authorization check (CWE-862) within certain administrative functionalities. An attacker possessing MII administrator privileges can submit a specially crafted request to provision an account with elevated p...

CVE-2026-76976

Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP are vulnerable to a Cross-Site Scripting (XSS) vulnerability due to insufficient sanitization of user-supplied content in certain functionalities. An authenticated attacker can send malicious content to another user; ...

CVE-2026-76976 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML)

Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP do not sufficiently sanitize user-supplied content in certain functionality, allowing an authenticated attacker to send malicious content to another user. If the victim interacts with the affected content, malicious...

EUVD-2026-98187

Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP do not sufficiently sanitize user-supplied content in certain functionality, allowing an authenticated attacker to send malicious content to another user. If the victim interacts with the affected content, malicious...

CVE-2026-11713: Incorrect Authorization

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 is affected by a privilege escalation vulnerability with the restConnector-2.0 feature enabled...

Elixirgrpc Algorithmic Complexity DoS

The vulnerability of the Elixirgrpc programming language’s web application development library is related to its algorithmic complexity. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...

PT-2026-113393

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.10 Description An authentication bypass flaw exists when the samlWeb-2.0 feature is enabled. This issue allows unauthenticated remote attackers to bypass enterprise...

Cisco Application Policy Infrastructure Controller Web Interface Command Execution

The vulnerability of the Cisco Application Policy Infrastructure Controller APIC web interface management interface is related to the lack of a standardized mechanism for error handling. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary commands...

Microsoft Windows: CVE-2026-72955: Windows Application Compatibility Cache Elevation of Privilege Vulnerability

Use after free in Windows Application Compatibility Cache allows an authorized attacker to elevate privileges locally...

PT-2026-111575

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions 8.5 and 9.0 Description A flaw in the CSIv2 inbound propagation handler allows a remote attacker to bypass authentication. Recommendations At the moment, there is no information about a newer version...