PT-2026-70036

Name of the Vulnerable Software and Affected Versions SAP ABAP Platform affected versions not specified Description An unauthenticated user can send a specially crafted request to an internal component. This action may result in the disclosure of limited, non-sensitive data from previously used...

PT-2026-70046

Name of the Vulnerable Software and Affected Versions SAP Approuter affected versions not specified Description SAP Approuter fails to consistently handle specific error conditions. A low-privileged attacker could exploit this behavior under a non-default configuration. Successful exploitation is...

PT-2026-70108

An authentication bypass vulnerability in Portainer CE through 2.44.0 allows authenticated low-privileged users to bypass Docker proxy authorization checks via non-canonical URL normalization, defeating all authorization middleware. The proxy endpoint fails to normalize request paths before...

CVE-2026-66776: Improper Verification of Cryptographic Signature

SAP Approuter does not consistently enforce integrity verification on certain session-related request headers under specific conditions. An attacker with low privileges could send a specially crafted request that bypasses the integrity check and loads another user's session context. Successful...

PT-2026-70305

Out-of-bounds read for the IntelR NPU Driver for all versions within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local...

CVE-2026-21269: Improper Neutralization of Input During Web Page Generation

ColdFusion is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable...

PT-2026-70047

Name of the Vulnerable Software and Affected Versions SAP Approuter affected versions not specified Description SAP Approuter does not enforce cross-site request forgery CSRF protection on the authentication flow by default. CSRF is a type of attack that tricks a victim into submitting a maliciou...

CVE-2026-66774: Improper Check for Unusual or Exceptional Conditions

SAP Approuter does not consistently handle certain error conditions. An attacker with low privileges could exploit this under a non-default configuration. Successful exploitation is highly complex, as it depends on conditions outside the attacker's control. This could result in a low impact on...

PT-2026-70031

Name of the Vulnerable Software and Affected Versions SAP Approuter affected versions not specified Description SAP Approuter fails to sufficiently validate tenant context in inbound requests. This allows an unauthenticated attacker to send specially crafted requests to spoof the tenant context,...

PT-2026-70290

Name of the Vulnerable Software and Affected Versions IntelR PROSet/Wireless WiFi Software for Windows affected versions not specified Description An out-of-bounds write in the Ring 2 device drivers allows an unauthenticated network adversary to cause a denial of service. This issue can be...

PT-2026-70816

Name of the Vulnerable Software and Affected Versions Adobe Commerce affected versions not specified Magento Open Source affected versions not specified Adobe Commerce B2B affected versions not specified Description Stored Cross-Site Scripting XSS occurs due to insufficient protection of the web...

PT-2026-70289

Name of the Vulnerable Software and Affected Versions IntelR PROSet/Wireless WiFi Software affected versions not specified Description Improper access control within Ring 2: Device Drivers allows an unprivileged, unauthenticated local adversary to trigger a denial of service. This low-complexity...

PT-2026-70900

The firmware of the Pulsetto Vagus Nerve Stimulator accepts several undisclosed commands over its Bluetooth Low Energy BLE interface. These commands are sent without authentication or encryption, and are never issued by the companion mobile application, yet are fully processed by the device when ...

PT-2026-70294

Name of the Vulnerable Software and Affected Versions LLM Scaler software affected versions not specified Description A protection mechanism failure within Ring 3 the least privileged level of the CPU architecture where user applications run may allow an escalation of privilege. A local,...

PT-2026-70034

Name of the Vulnerable Software and Affected Versions SAP Manufacturing Integration and Intelligence MII affected versions not specified Description SAP Manufacturing Integration and Intelligence MII fails to perform required authorization checks on certain application functions. This allows an...

PT-2026-70027

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server Java Adobe Document Service affected versions not specified Description The Adobe Document Service component uses outdated open source cryptographic and data transfer libraries. A low-privileged authenticated...

PT-2026-70037

Name of the Vulnerable Software and Affected Versions SAP BusinessObjects Business Intelligence Platform Web Intelligence affected versions not specified Description An XML External Entity XXE Injection exists in the Web Intelligence component. This issue allows a low-privileged attacker to uploa...

PT-2026-70049

Name of the Vulnerable Software and Affected Versions SAP Approuter affected versions not specified Description SAP Approuter fails to sufficiently validate certain incoming requests before forwarding them to backend destinations. An attacker with low privileges can send specially crafted request...

PT-2026-70363

Name of the Vulnerable Software and Affected Versions Vitis Unified affected versions not specified Description Weak permissions in the installation path on local Windows machines could allow a low-privileged user to create arbitrary code, potentially resulting in binary hijacking, which is the...

CVE-2026-58237: Missing Authorization

WebSocket of SAP Approuter does not perform sufficient authorization checks in certain functionality. An attacker with low privileges could exploit this to access restricted functionality. Successful exploitation could allow the attacker to read sensitive information and perform limited...