EUVD-2026-55889

SAP Approuter does not sufficiently validate certain incoming requests before forwarding them to backend destinations. Due to the complexity of the required conditions, an attacker with low privileges could send specially crafted requests to bypass authorization checks and reach protected resourc...

EUVD-2026-55888

SAP Approuter does not consistently enforce integrity verification on certain session-related request headers under specific conditions. An attacker with low privileges could send a specially crafted request that bypasses the integrity check and loads another user's session context. Successful...

CVE-2026-66776

SAP Approuter (SAP Business AI Platform) contains vulnerabilities where integrity verification on certain session-related request headers can be bypassed under specific conditions, potentially exposing another user’s session context. Exploitation requires low privileges and previously observed ma...

CVE-2026-66761

CVE-2026-66761: SAP Approuter in SAP Business AI Platform suffers from insufficient flow control allowing a low-privilege attacker to send large volumes of data, leading to unbounded memory growth and low availability impact. No impact on confidentiality or integrity is claimed. CVSS 3.1 base sco...

EUVD-2026-55879

SAP Approuter does not enforce sufficient flow control in certain functionality. An attacker with low privileges could send high volumes of data without consuming responses, causing unbounded memory growth. This results in a low impact on availability. There is no impact on confidentiality and...

CVE-2026-66760

Technical details about CVE-2026-66760 are not publicly available in the provided documents beyond what is described in the Initial Description; monitor for updates.

CVE-2026-58248

The CVE describes an XML External Entity (XXE) injection in SAP BusinessObjects Business Intelligence Platform (Web Intelligence). A low-privileged attacker can upload a specially crafted spreadsheet as a data source; when processed, the component resolves external references and exposes contents...

EUVD-2026-55874

SAP Manufacturing Integration and Intelligence MII does not perform necessary authorization check on certain application function, allowing a low-privileged authenticated attacker to access information that should be restricted to privileged users. Successful exploitation could allow the attacker...

CVE-2026-58244

Technical details (affected components, root cause, exploitability, and remediation) are not publicly available in the provided documents. Monitor for updates.

EUVD-2026-55873

SAP ABAP Development Tools does not perform necessary authorization checks for certain functionality, allowing an attacker with low privileges to execute unauthorized database operations against SAP NetWeaver AS ABAP. Successful exploitation could allow the attacker to read sensitive data, modify...

CVE-2026-58241

Technical details about CVE-2026-58241 are not publicly available in the provided documents. Monitor for updates.

EUVD-2026-55869

WebSocket of SAP Approuter does not perform sufficient authorization checks in certain functionality. An attacker with low privileges could exploit this to access restricted functionality. Successful exploitation could allow the attacker to read sensitive information and perform limited...

PT-2026-70039

Name of the Vulnerable Software and Affected Versions SAP Approuter affected versions not specified Description SAP Approuter fails to enforce sufficient flow control in certain functionality. A low-privileged attacker can send high volumes of data without consuming responses, leading to unbounde...

PT-2026-70335

Integer overflow in the UEFI firmware for the IntelR Slim Bootloader may allow an information disclosure. System software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack...

PT-2026-70029

Name of the Vulnerable Software and Affected Versions SAP Approuter affected versions not specified Description The WebSocket component of SAP Approuter fails to perform sufficient authorization checks within certain functionality. This allows an attacker with low privileges to access restricted...

PT-2026-70046

Name of the Vulnerable Software and Affected Versions SAP Approuter affected versions not specified Description SAP Approuter fails to consistently handle specific error conditions. A low-privileged attacker could exploit this behavior under a non-default configuration. Successful exploitation is...

PT-2026-70034

Name of the Vulnerable Software and Affected Versions SAP Manufacturing Integration and Intelligence MII affected versions not specified Description SAP Manufacturing Integration and Intelligence MII fails to perform required authorization checks on certain application functions. This allows an...

PT-2026-70049

Name of the Vulnerable Software and Affected Versions SAP Approuter affected versions not specified Description SAP Approuter fails to sufficiently validate certain incoming requests before forwarding them to backend destinations. An attacker with low privileges can send specially crafted request...

PT-2026-70816

Adobe Commerce is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerabl...

PT-2026-70037

Name of the Vulnerable Software and Affected Versions SAP BusinessObjects Business Intelligence Platform Web Intelligence affected versions not specified Description An XML External Entity XXE Injection exists in the Web Intelligence component. This issue allows a low-privileged attacker to uploa...