Browse All CVEs
39,850 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-66764 |
medium | 4.3 | 0.0028 | 2026-10-29 | Reprocess Bank Statement Items in SAP S/4HANA does not perform the necessary authorization | |
CVE-2026-66770 |
medium | 6.3 | 0.0027 | 2026-10-29 | Due to an SQL Injection vulnerability in SAP Social intelligence, an authenticated attacke | |
CVE-2026-66771 |
medium | 6.1 | 0.0038 | 2026-10-29 | SAPUI5 allows a key user with content adaptation privileges to inject malicious script con | |
CVE-2026-66772 |
medium | 4.3 | 0.0031 | 2026-10-29 | SAP BusinessObjects Business Intelligence Platform (Admin Tools) does not perform suffici | |
CVE-2026-66773 |
medium | 5.9 | 0.0031 | 2026-10-29 | A malicious or compromised OData service could disclose sensitive authentication informati | |
CVE-2026-66774 |
low | 3.7 | 0.0035 | 2026-10-29 | SAP Approuter does not consistently handle certain error conditions. An attacker with low | |
CVE-2026-66775 |
medium | 4.3 | 0.0016 | 2026-10-29 | SAP Approuter does not enforce cross-site request forgery protection on the authentication | |
CVE-2026-66776 |
medium | 5.9 | 0.0020 | 2026-10-29 | SAP Approuter does not consistently enforce integrity verification on certain session-rela | |
CVE-2026-66777 |
medium | 5.9 | 0.0044 | 2026-10-29 | SAP Approuter does not sufficiently validate certain incoming requests before forwarding t | |
CVE-2026-66778 |
medium | 5.3 | 0.0036 | 2026-10-29 | SAP Approuter does not sufficiently sanitize certain request headers before forwarding tra | |
CVE-2026-66779 |
medium | 6.3 | 0.0035 | 2026-10-29 | Due to a Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP | |
CVE-2026-19424 |
high | 8.7 | 0.0051 | 2026-10-29 | Chiline Cloud developed by Inventec Appliances has a Insecure Direct Object Reference vuln | |
CVE-2026-24330 |
medium | 6.5 | 0.0052 | 2026-10-29 | A flaw was found in wildfly-core. A remote attacker, authenticated as a 'deployer' account | |
CVE-2026-11893 |
medium | 5.9 | 0.0025 | 2026-10-29 | The Bluetooth HCI driver for Bouffalo Lab on-chip BLE controllers (BL60x/BL70x/BL61x), bt_ | |
CVE-2026-11985 |
low | 3.6 | 0.0013 | 2026-10-29 | On the Zephyr ARM port, enabling the hardware FPU (CONFIG_FPU) forces the "Floating point | |
CVE-2026-19425 |
critical | 9.3 | 0.0064 | 2026-10-29 | Travel Agency Management System developed by Win Men Intermational has a SQL Injection vul | |
CVE-2026-11894 |
medium | 5.9 | 0.0025 | 2026-10-29 | The Realtek BEE Bluetooth HCI driver's send callback, bt_hci_bee_send() in drivers/bluetoo | |
CVE-2026-12051 |
medium | 4.6 | 0.0023 | 2026-10-29 | The USB DFU class implementation in Zephyr's new (experimental) device_next USB device sta | |
CVE-2026-12052 |
medium | 5.2 | 0.0027 | 2026-10-29 | The USB device-side CDC NCM class control-to-host handler usbd_cdc_ncm_cth in subsys/usb/d | |
CVE-2026-13716 |
critical | 9.1 | 0.0080 | 2026-10-29 | Path traversal in server import and admin file upload in Crafty Controller. Allows a remot | |
CVE-2026-18348 |
medium | 4.1 | 0.0034 | 2026-10-29 | Missing authorization check in the upload_azure, upload_sftp, and upload_smb VQL plugins a | |
CVE-2026-4757 |
high | 7.2 | 0.0057 | 2026-10-29 | A VAPIX API parameter had improper input validation which could allow code execution and p | |
CVE-2026-5303 |
medium | 5.7 | 0.0023 | 2026-10-29 | The ACAP framework contains a Time-of-Check to Time-of-Use (TOCTOU) race condition, which | |
CVE-2026-5304 |
medium | 5.7 | 0.0031 | 2026-10-29 | An ACAP configuration file lacks input validation, which could potentially lead to privile | |
CVE-2026-6181 |
medium | 5.9 | 0.0039 | 2026-10-29 | The Device Configuration Framework is vulnerable to an authentication bypass flaw. This fl | |
CVE-2026-6505 |
medium | 5.1 | 0.0009 | 2026-10-29 | The ACAP framework contains a Time-of-Check to Time-of-Use (TOCTOU) race condition, which | |
CVE-2026-19517 |
medium | 6.5 | 0.0036 | 2026-10-29 | Improper Validation of Specified Quantity in Input and Allocation of Resources Without Lim | |
CVE-2026-19518 |
medium | 6.5 | 0.0036 | 2026-10-29 | Improper Validation of Specified Quantity in Input vulnerability in Samsung Open Source rl | |
CVE-2026-19418 |
high | 7.3 | 0.0024 | 2026-10-29 | The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 (CVE-2020-11069) became in | |
CVE-2026-73140 |
medium | 5.3 | 0.0035 | 2026-10-29 | Affected versions of cti-transmute fail to apply comment-level access-control rules when g | |
CVE-2026-73155 |
medium | 5.3 | 0.0035 | 2026-10-29 | Affected versions of cti-transmute allow authenticated users to add or remove emoji reacti | |
CVE-2026-73156 |
medium | 5.3 | 0.0044 | 2026-10-29 | Affected versions of cti-transmute fail to HTML-escape attacker-controlled values used in | |
CVE-2026-10579 |
critical | 9.8 | 0.0043 | 2026-10-29 | A flaw was found in Picketlink Federation SAML; the unsolcited response handler would acce | |
CVE-2026-15556 |
high | 8.1 | 0.0030 | 2026-10-29 | A flaw was found in Picketlink's SP signature validation; a SAML response containing zero | |
CVE-2026-15561 |
high | 7.5 | 0.0072 | 2026-10-29 | A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on si | |
CVE-2026-15567 |
high | 7.5 | 0.0089 | 2026-10-29 | A flaw was found in Wildfly. A remote unauthenticated attacker can trigger OutOfMemoryErro | |
CVE-2026-72694 |
high | 7.1 | 0.0014 | 2026-10-29 | A flaw was found in MRTG. When the MRTG daemon is started as a root user and subsequently | |
CVE-2026-73157 |
low | 2.3 | 0.0044 | 2026-10-29 | Affected versions of cti-transmute render data obtained from a remote MISP instance into t | |
CVE-2026-73158 |
medium | 5.1 | 0.0040 | 2026-10-29 | Affected versions of cti-transmute insufficiently validate saved graph configuration data. | |
CVE-2026-73159 |
medium | 5.1 | 0.0040 | 2026-10-29 | Affected versions of cti-transmute allow a tag's icon value to be stored and later interpo | |
CVE-2026-73160 |
high | 8.7 | 0.0041 | 2026-10-29 | Affected versions of cti-transmute contain an SSRF vulnerability in the /fetch_misp_event | |
CVE-2026-73161 |
medium | 5.1 | 0.0040 | 2026-10-29 | Affected versions of cti-transmute improperly handle conversion-table values passed throug | |
CVE-2026-33921 |
medium | 4.8 | 0.0013 | 2026-10-29 | The Windows installer deployed Npcap leaving its access restriction option at the insecure | |
CVE-2026-33922 |
medium | 6.8 | 0.0017 | 2026-10-29 | A path traversal vulnerability was discovered in the Offline archives functionality of the | |
CVE-2026-73162 |
medium | 5.3 | 0.0025 | 2026-10-29 | Affected versions of MISP cti-transmute expose several state-changing account operations a | |
CVE-2026-58231 |
critical | 10.0 | 0.0086 | 2026-10-29 | SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication cl | |
CVE-2026-13737 |
critical | 9.2 | 0.0067 | 2026-10-29 | CommServe contained an allowlist bypass vulnerability affecting command execution authoriz | |
CVE-2026-13738 |
critical | 9.2 | 0.0067 | 2026-10-29 | CommServe contained an authorization bypass vulnerability affecting a limited set of comma | |
CVE-2026-13739 |
high | 8.8 | 0.0048 | 2026-10-29 | A legacy endpoint in Command Center contained an unauthenticated server-side request forge | |
CVE-2026-50236 |
high | 7.4 | 0.0047 | 2026-10-29 | An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers. |