CVE-2026-66770 SQL Injection vulnerability in SAP Social Intelligence

Due to an SQL Injection vulnerability in SAP Social intelligence, an authenticated attacker could directly inject an SQL DDL Data Definition Language string into the underlying database without further authorization. Successful exploitation could allow the attacker to make malicious changes to th...

CVE-2026-58248 XML External Entity Injection in SAP BusinessObjects Business Intelligence

SAP BusinessObjects Business Intelligence Platform Web Intelligence allows a low-privileged attacker to upload a specially crafted spreadsheet file containing malicious external references. When the file is processed as a data source, the affected component resolves these references and exposes t...

EUVD-2026-55877

SAP BusinessObjects Business Intelligence Platform Web Intelligence allows a low-privileged attacker to upload a specially crafted spreadsheet file containing malicious external references. When the file is processed as a data source, the affected component resolves these references and exposes t...

CVE-2026-58248

The CVE describes an XML External Entity (XXE) injection in SAP BusinessObjects Business Intelligence Platform (Web Intelligence). A low-privileged attacker can upload a specially crafted spreadsheet as a data source; when processed, the component resolves external references and exposes contents...

PT-2026-70042

Name of the Vulnerable Software and Affected Versions SAP Social intelligence affected versions not specified Description An authenticated attacker can exploit an SQL Injection flaw to inject SQL DDL Data Definition Language strings directly into the underlying database without additional...

CVE-2026-66772: Missing Authorization

SAP BusinessObjects Business Intelligence Platform Admin Tools does not perform sufficient authorization check on certain administrative functionality. An attacker authenticated as a non-administrative user could bypass this restriction to gain limited information about affected functionality. Th...

CVE-2026-44758: Improper Control of Generation of Code

SAP Manufacturing Integration and Intelligence MII allows an attacker with high privileges to submit specially crafted input to certain affected functionality, which is processed without sufficient validation. Successful exploitation could allow the attacker to execute arbitrary commands on the...

CVE-2026-44764: Missing Authorization

Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated attacker could send crafted requests to the Cost Servlet using specific parameter values. If processed by the application, these requests enable access to backend operations...

CVE-2026-44765: Missing Authorization

Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated remote attacker could access scheduling-related application functions without proper authorization validation. Successful exploitation could allow the attacker to retrieve,...

CVE-2026-66770: Improper Neutralization of Special Elements used in an SQL Command

Due to an SQL Injection vulnerability in SAP Social intelligence, an authenticated attacker could directly inject an SQL DDL Data Definition Language string into the underlying database without further authorization. Successful exploitation could allow the attacker to make malicious changes to th...

CVE-2026-66763: Use of Hard-coded Cryptographic Key

SAP BusinessObjects Business Intelligence Platform stores certain sensitive credentials associated with user objects using a hard-coded cryptographic key. An attacker with high privileges and local access to the server could retrieve these objects and decrypt the stored credentials. Successful...

CVE-2026-44763: Improper Limitation of a Pathname to a Restricted Directory

SAP Manufacturing Integration and Intelligence allows a privileged attacker to exploit insufficient file path validation in certain functions using specially crafted input. Exploitation also requires a legitimate user to subsequently access the attacker-influenced content and depends on condition...

PT-2026-70037

Name of the Vulnerable Software and Affected Versions SAP BusinessObjects Business Intelligence Platform Web Intelligence affected versions not specified Description An XML External Entity XXE Injection exists in the Web Intelligence component. This issue allows a low-privileged attacker to uploa...

CVE-2026-58244: Missing Authorization

SAP Manufacturing Integration and Intelligence MII does not perform necessary authorization check on certain application function, allowing a low-privileged authenticated attacker to access information that should be restricted to privileged users. Successful exploitation could allow the attacker...

CVE-2026-58248: Improper Restriction of XML External Entity Reference

SAP BusinessObjects Business Intelligence Platform Web Intelligence allows a low-privileged attacker to upload a specially crafted spreadsheet file containing malicious external references. When the file is processed as a data source, the affected component resolves these references and exposes t...

CVE-2026-72915

creationtimestamp| type| source ---|---|--- 2026-08-10 23:00:13+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msr7ckt7oy23 2026-08-10 23:04:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/fjk6ypp3ovspk 2026-08-12 06:12:39+00:00| seen|...

Shipping 10–50× More Code? Watch This Webinar on Securing AI-Speed Development

AI is helping development teams produce far more code, far faster. But security teams still have to review vulnerabilities, manage dependencies, prioritize fixes, and control risk at human speed. When software output jumps 10 to 50 times, the problem is no longer just finding vulnerabilities. It ...

CERTFR-2026-ACT-034

creationtimestamp| type| source ---|---|--- 2026-08-10 13:20:51+00:00| seen| https://bsky.app/profile/cert-fr.bsky.social/post/3msq6wlexks2z 2026-08-10 13:20:52+00:00| seen| https://social.numerique.gouv.fr/users/certfr/statuses/117071416518732349...

CVE-2026-68269

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Add missing nospec on parallel submit slot Add missing Spectre mitigation for userspace controlled parallel submission slot. Discovered using AI-assisted static analysis confirmed by Intel Product Security. cherry...

Kimsuky Builds Offline AI Stack to Boost Phishing and Automate Malware Development

North Korea's state hackers are no longer content to type prompts into public chatbots. One of the country's main espionage groups has begun running artificial intelligence AI offline on its own servers, connecting document-search tools to files in its possession, and collecting the software part...