CVE-2026-89126

SAP Web Dispatcher does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption condition in the affected functionality. Successful exploitation could allow the...

CVE-2026-76964

SAP NetWeaver Application Server ABAP does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption condition in the affected functionality. Successful exploitation...

CVE-2026-120009

SAP ABAP Developer Tools AMDP Data Preview does not perform sufficient validation and authorization checks within certain affected functionality. An attacker with high privileges could submit specially crafted input to inject and execute arbitrary code on the system. Successful exploitation could...

CVE-2026-109803

SAP NetWeaver Knowledge Management XML Forms does not sufficiently restrict the selection of XSL transformations processed by the affected functionality. Under certain conditions, an authenticated user with access to the affected functionality could cause an unauthorized XSL transformation to be...

CVE-2026-109795

SAP NetWeaver does not perform necessary authorization checks and lacks sufficient input validation in certain remote-enabled functionality. An attacker with low privileges could send specially crafted input through a remote interface to inject and execute arbitrary code within the affected syste...

CVE-2026-107246

The Plesk extension "Site Import" before 1.13.2 does not properly validate domain and session identifiers, allowing path traversal. This lets a non-owner subscription user redirect a privileged backend session into a directory they control, resulting in arbitrary code execution as root...

EUVD-2026-120631

The Plesk extension "Site Import" before 1.13.2 does not properly validate domain and session identifiers, allowing path traversal. This lets a non-owner subscription user redirect a privileged backend session into a directory they control, resulting in arbitrary code execution as root...

EUVD-2026-120559

Ghostscript before 10.08.0 contains a -dSAFER bypass vulnerability in the .putgstringcopy procedure in gsfonts.ps, which calls the privileged .forceput operator without checking operand types. Attackers can supply crafted PostScript or PDF documents that trigger a type error, recover .forceput vi...

CVE-2026-125396

Ghostscript versions before 10.08.0 are vulnerable to a -dSAFER bypass in the .putgstringcopy procedure within gs_fonts.ps. The root cause is the call to the privileged .forceput operator without proper operand type checking. An attacker can provide crafted PostScript or PDF documents to trigger ...

EUVD-2026-120656

SAP NetWeaver Application Server ABAP does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption condition in the affected functionality. Successful exploitation...

RLSA-2026:96226 Important: nodejs:24 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: undici: undici: Denial of Service via unrequested WebSocket subprotocol CVE-2026-19534 brace-expansion: brace-expansion: Denial of Service via...

nodejs:24 security update

An update is available for nodejs-packaging, module.nodejs-packaging. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Node.js is a software development platform...

CVE-2026-104989

Uncontrolled search path element in package upload feature in Chaos Software V-Ray versions through 2.0.19 allows remote unauthenticated attackers to execute arbitrary code via redirecting access to libraries...

CVE-2026-104989

Chaos Software V-Ray versions through 2.0.19 are vulnerable to an uncontrolled search path element in the package upload feature. This flaw allows remote unauthenticated attackers to achieve arbitrary code execution by redirecting access to libraries. No specific exploit information or remediatio...

EUVD-2026-120119

Uncontrolled search path element in package upload feature in Chaos Software V-Ray versions through 2.0.19 allows remote unauthenticated attackers to execute arbitrary code via redirecting access to libraries...

TrueConf Server Code Execution

The vulnerability of the TrueConf Server software is related to the lack of measures taken to neutralize special elements. Exploiting this vulnerability allows a malicious actor operating remotely to execute arbitrary code...

ReadyScript SQL Injection

The vulnerability of the ReadyScript e-commerce management system lies in the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

vvdecapp reconstructCoeff Memory Use After Free

The vulnerability of the reconstructCoeff function in the vvdecapp VVdeC decoder is related to the use of memory after it is freed during the processing of specially created VVC streams. Exploiting this vulnerability can allow a hacker to cause a service failure or execute arbitrary code...

vvdecapp Decoder Heap Buffer Overflow DoS

The vulnerability of the createSubPicRefBufs function in the vvdecapp VVdeC decoder lies in the use of memory after it is freed during the processing of specially created VVC streams. Exploiting this vulnerability can allow an attacker to cause a service failure or execute arbitrary code...

DIAFAN.CMS SQL Injection

The vulnerability of the DIAFAN.CMS website content management system is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...