KOMTEK Cassa Kurier Module Authentication Bypass

Vulnerability of the “KOMTEK Cassa Kurier” module of the 1C-Bitrix content management system: Website management is associated with the absence of authentication for a critical function. Exploitation of this vulnerability may allow an attacker to compromise the integrity and accessibility of...

CVE-2026-120014

The SAP HANA XSA Web Dispatcher is vulnerable to insufficient request validation in certain administrative functionalities. An unauthenticated attacker can trick a logged-on administrator into visiting a malicious link, leading to unintended actions within the administrator's session. Successful ...

CVE-2026-109793

SAP NetWeaver Application Server ABAP and SAP Web Dispatcher are vulnerable to a denial-of-service condition because they do not sufficiently validate certain header values during inbound request handling. An unauthenticated attacker could exploit this by sending a specially crafted request, caus...

EUVD-2026-120697

SAP HANA XSA Web Dispatcher does not perform sufficient request validation in certain administrative functionality. In the context of SAP HANA XSA Web Dispatcher, an unauthenticated attacker could trick a logged-on administrator into visiting a malicious link. Visiting the link could cause...

EUVD-2026-120662

SAP Gateway activates the default Access Control List with high privileges allowing categorization of external attacker as internal application server. As a result an unauthenticated attacker with network access to the SAP Gateway could exploit this weakness to potentially perform unauthorized...

PT-2026-141262

SAP HANA XSA Web Dispatcher does not perform sufficient request validation in certain administrative functionality. In the context of SAP HANA XSA Web Dispatcher, an unauthenticated attacker could trick a logged-on administrator into visiting a malicious link. Visiting the link could cause...

PT-2026-141249

SAP NetWeaver Application Server for ABAP does not properly validate certain input values. An authenticated user could send specially crafted requests to trigger an error in internal processing. This could crash the affected work process and make the system unavailable. This results in a high...

PT-2026-141280

SAP Gateway activates the default Access Control List with high privileges allowing categorization of external attacker as internal application server. As a result an unauthenticated attacker with network access to the SAP Gateway could exploit this weakness to potentially perform unauthorized...

EUVD-2026-117826

Kubeflow Pipelines: RBAC bypass on shared pipelines allows any authenticated user to delete or modify global pipelines...

ROOT-OS-DEBIAN-13-CVE-2025-68307 CVE-2025-68307 in linux - Patched by Root

Root has patched CVE-2025-68307 in the linux package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2025-71113 CVE-2025-71113 in linux - Patched by Root

Root has patched CVE-2025-71113 in the linux package for Root:Debian:13. Multiple fixed versions available...

Visual Tools DVR VX16 4.2.28.0 - Unauthenticated OS Command Injection

Visual Tools DVR VX16 4.2.28.0 could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. id: CVE-2021-42071 info: name: Visual Tools DVR VX16 4.2.28.0 - Unauthenticated OS Command Injection author: gy741 severity: critical description: Visual...

CVE-2026-123544 OpenAM before 16.1.4 Insufficient Response Validation in Internal SOAP Channel

OpenAM before 16.1.4 and its client SDK fail to sufficiently validate responses on the internal server-to-server SOAP channel, allowing network-positioned attackers to affect integrity and availability. Attackers who intercept unencrypted traffic or control a site server can crash receiving...

EUVD-2026-119429

OpenAM before 16.1.4 and its client SDK fail to sufficiently validate responses on the internal server-to-server SOAP channel, allowing network-positioned attackers to affect integrity and availability. Attackers who intercept unencrypted traffic or control a site server can crash receiving...

CVE-2026-123544

OpenAM versions prior to 16.1.4 and its associated client SDK are vulnerable to insufficient response validation on the internal server-to-server SOAP channel. This flaw allows network-positioned attackers who can intercept unencrypted traffic or control a site server to target the integrity and ...

CVE-2026-123531 Vikunja 1.0.0 before 2.7.1 Pagination Limit Bypass via page=0 Parameter

Vikunja from 1.0.0 before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated users to bypass service.maxitemsperpage by sending page=0 to /api/v1 list endpoints. Attackers can self-register and repeatedly request page=0 to force unbounded SQL queries, memo...

CVE-2026-123531

The software Vikunja (versions 1.0.0 before 2.7.1) is vulnerable to an uncontrolled resource consumption vulnerability (CWE-400). Authenticated users can bypass the service.maxitemsperpage limit by sending a page=0 parameter to /api/v1 list endpoints. This flaw allows an attacker who can self-reg...

CVE-2026-123531 Vikunja 1.0.0 before 2.7.1 Pagination Limit Bypass via page=0 Parameter

Vikunja from 1.0.0 before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated users to bypass service.maxitemsperpage by sending page=0 to /api/v1 list endpoints. Attackers can self-register and repeatedly request page=0 to force unbounded SQL queries, memo...

PT-2026-139825

OpenAM before 16.1.4 and its client SDK fail to sufficiently validate responses on the internal server-to-server SOAP channel, allowing network-positioned attackers to affect integrity and availability. Attackers who intercept unencrypted traffic or control a site server can crash receiving...

CVE-2026-123544: OpenIdentityPlatform OpenAM: OpenAM before 16.1.4 and its client SDK fail to sufficiently validate responses on the internal server-to-server SOAP…

OpenAM before 16.1.4 and its client SDK fail to sufficiently validate responses on the internal server-to-server SOAP channel, allowing network-positioned attackers to affect integrity and availability. Attackers who intercept unencrypted traffic or control a site server can crash receiving...