CVEs published March 10, 2026
346 CVEs were published on March 10, 2026: 28 critical, 183 high.
- Published
- 346
- Critical
- 28
- High
- 183
- Medium
- 121
- Low
- 14
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 200
Most affected products
- Microsoft Windows
- 44
- Google Android
- 20
- InternationalColorConsortium iccDEV
- 16
- parse-community parse-server · parse-server
- 14
- Adobe Substance3D - Painter
- 9
- Adobe Illustrator Desktop
- 7
- Sylius · sylius/sylius
- 7
- Adobe Substance3D - Stager
- 6
- craftcms commerce · craftcms/commerce
- 6
- Fortinet FortiWeb
- 6
Critical 28
- CVE-2026-28806Improper authorization in device bulk actions and device update API allows cross-organization device controlnerves-hub nerves_hub_web
- CVE-2026-0124There is a possible out of bounds write due to a missing bounds check.Google Android
- CVE-2026-0120In modem, there is a possible out of bounds write due to an incorrect bounds check.Google Android
- CVE-2026-0116In __mfc_handle_released_buf of mfc_core_isr.c, there is a possible out of bounds write due to a missing bounds check.Google Android
- CVE-2026-0114In Modem, there is a possible out of bounds write due to an incorrect bounds check.Google Android
- CVE-2026-0113In ns_GetUserData of ns_SmscbUtilities.c, there is a possible out of bounds write due to an incorrect bounds check.Google Android
- CVE-2026-0111In ns_GetUserData of ns_SmscbUtilities.c, there is a possible out of bounds write due to an incorrect bounds check.Google Android
- CVE-2026-0110In MM_DATA_IND of cn_NrSmMsgHdlrFromMM.cpp, there is a possible EoP due to memory corruption.Google Android
- CVE-2026-30966Parse Server role escalation and CLP bypass via direct `_Join` table writeparse-community parse-server · parse-server
- CVE-2026-30965Parse Server session token exfiltration via `redirectClassNameForKey` query parameterparse-community parse-server · parse-server
- CVE-2026-29793NoSQL Injection via WebSocket id Parameter in MongoDB Adapter@feathersjs mongodb · @feathersjs/mongodb
- CVE-2026-29792Feathersjs has an OAuth Callback Account Takeoverfeathersjs feathers · @feathersjs authentication-oauth +1
- CVE-2025-48611In DeviceId of DeviceId.java, there is a possible desync in persistence due to a missing bounds check.Google Android
- CVE-2026-28495GetSimple CMS has CSRF to Remote Code Execution via Arbitrary PHP Write in gsconfig.phpGetSimpleCMS-CE
- CVE-2026-27825MCP Atlassian has an arbitrary file write leading to arbitrary code execution via unconstrained download_path in confluence_download_attachmentsooperset mcp-atlassian · mcp-atlassian
- CVE-2026-28292simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key that enables RCEsteveukx simple-git · simple-git
- CVE-2026-23240tls: Fix race condition in tls_sw_cancel_work_tx()Linux
- CVE-2026-30960RSSN has Arbitrary Code Execution via Unvalidated JIT Instruction Generation in C-FFI InterfaceApich-Organization rssn · rssn
- CVE-2026-30957OneUptime Synthetic Monitor RCE via exposed Playwright browser objectoneuptime · @oneuptime/common
- CVE-2026-30956OneUptime has authorization bypass via client‑controlled is-multi-tenant-query headeroneuptime · @oneuptime/common
- CVE-2025-40943Affected devices do not properly sanitize contents of trace files.Siemens SIMATIC Drive Controller CPU 1504D TF · Siemens… +78
- CVE-2026-3843SQL Injection in Nefteprodukttekhnika BUK TS-G Allows Remote Code ExecutionNefteprodukttekhnika BUK TS-G Gas Station Automation System
- CVE-2025-41709Command injection in power analyzer via Modbus-TCP and Modbus-RTUJanitza UMG 96RM-E · Weidmueller ENERGY METER 750-230 +1
- CVE-2026-0953Tutor LMS Pro <= 3.9.5 - Authentication Bypass via Social Loginthemeum Tutor LMS Pro
- CVE-2026-27685Insecure Deserialization in SAP NetWeaver Enterprise Portal AdministrationSAP_SE SAP NetWeaver Enterprise Portal Administration
- CVE-2025-56422A deserialization vulnerability in LimeSurvey before v6.15.0+250623 allows a remote attacker to execute arbitrary code on the server.
- CVE-2025-69614Incorrect Access Control via activation token reuse on the password-reset endpoint allowing unauthorized password resets and full account ta
- CVE-2025-69615Incorrect Access Control via missing 2FA rate-limiting allowing unlimited brute-force retries and full MFA bypass with no user interaction r
High 183
- CVE-2026-27271Illustrator | Heap-based Buffer Overflow (CWE-122)Adobe Illustrator Desktop
- CVE-2026-21333Illustrator | Untrusted Search Path (CWE-426)Adobe Illustrator Desktop
- CVE-2026-21362Illustrator | Out-of-bounds Write (CWE-787)Adobe Illustrator Desktop
- CVE-2026-27272Illustrator | Out-of-bounds Write (CWE-787)Adobe Illustrator Desktop
- CVE-2026-27267Illustrator | Stack-based Buffer Overflow (CWE-121)Adobe Illustrator Desktop
- CVE-2025-20105Improper input validation in some UEFI firmware SMM module for the Intel(R) reference platforms may allow an escalation of privilege.Intel(R) reference platforms may allow an escalation of pri…
- CVE-2025-20068Improper input validation in the UEFI ImcErrorHandler module for some Intel(R) reference platforms may allow an escalation of privilege.Intel(R) reference platforms may allow an escalation of pri…
- CVE-2025-20064Improper input validation in the UEFI FlashUcAcmSmm module for some Intel(R) reference platforms may allow an escalation of privilege.Intel(R) reference platforms may allow an escalation of pri…
- CVE-2025-20028Time-of-check time-of-use race condition in the WheaERST SMM module for some Intel(R) reference platforms may allow an escalation of privileIntel(R) reference platforms may allow an escalation of pri…
- CVE-2025-20027Improper input validation in the UEFI WheaERST module for some Intel(R) reference platforms may allow an escalation of privilege.Intel(R) reference platforms may allow an escalation of pri…
- CVE-2026-31837Istio JWKS resolver to prevent private key material from being exposed when JWKS fetch fails.istio
- CVE-2026-31834Umbraco Affected by Vertical Privilege Escalation via Missing Authorization ChecksUmbraco-CMS · Umbraco.Cms
- CVE-2026-31830sigstore-ruby verifier returns success for DSSE bundles with mismatched in-toto subject digestsigstore-ruby · sigstore
- CVE-2026-31829Flowise affected by Server-Side Request Forgery (SSRF) in HTTP Node Leading to Internal Network AccessFlowiseAI Flowise · flowise +1
- CVE-2026-27278Acrobat Reader | Use After Free (CWE-416)Adobe Acrobat DC · Adobe Acrobat Reader DC +1
- CVE-2026-27220Acrobat Reader | Use After Free (CWE-416)Adobe Acrobat DC · Adobe Acrobat Reader DC +1
- CVE-2026-31827Alienbin: TTL Index Race Condition allows unauthorized deletion of other users dataBlue-B Alienbin
- CVE-2026-28807Path Traversal in wisp.serve_static allows arbitrary file readgleam-wisp wisp
- CVE-2026-31824Sylius has a Promotion Usage Limit Bypass via Race ConditionSylius · sylius/sylius
- CVE-2026-31820Sylius affected by IDOR in Cart and Checkout LiveComponentsSylius · sylius/sylius
- CVE-2026-31817OliveTin's unsafe parsing of UniqueTrackingId can be used to write filesOliveTin · github.com/OliveTin/OliveTin
- CVE-2026-31812Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsingquinn-rs quinn · quinn-proto
- CVE-2026-31801zot create-only policy allows overwrite attempts of existing latest tag (update permission not required)project-zot zot · zotregistry.dev/zot/v2 +1
- CVE-2026-31800Parse Server: Classes `_GraphQLConfig` and `_Audience` master key bypass via generic class routesparse-community parse-server · parse-server
- CVE-2026-0123In EfwApTransport::ProcessRxRing of efw_ap_transport.cc, there is a possible out of bounds write due to a missing bounds check.Google Android
- CVE-2026-0122In multiple places, there is a possible out of bounds write due to memory corruption.Google Android
- CVE-2026-0118In oobconfig, there is a possible bypass of carrier restrictions due to a logic error.Google Android
- CVE-2026-0117In mfc_dec_dqbuf of mfc_dec_v4l2.c, there is a possible out of bounds write due to an incorrect bounds check.Google Android
- CVE-2026-0112In vpu_open_inst of vpu_ioctl.c, there is a possible use after free due to a race condition.Google Android
- CVE-2026-30967Parse Server OAuth2 authentication adapter account takeover via identity spoofingparse-community parse-server · parse-server
- CVE-2026-0109In dhd_tcpdata_info_get of dhd_ip.c, there is a possible Denial of Service due to a precondition check failure.Google Android
- CVE-2026-0107In gmc_ddr_handle_mba_mr_req of gmc_mba_ddr.c, there is a possible escalation of privileges due to a confused deputy.Google Android
- CVE-2025-36920In hyp_alloc of arch/arm64/kvm/hyp/nvhe/alloc.c, there is a possible out of bounds write due to improper input validation.Google Android
- CVE-2026-30962Parse Server has a protected fields bypass via logical query operatorsparse-community parse-server · parse-server
- CVE-2026-30953LinkAce affected by SSRF via link creation: NoPrivateIpRule not applied to LinkStoreRequestKovah LinkAce
- CVE-2025-66413Git for Windows leaks NTLM hash when cloning from an attacker-controlled servergit-for-windows git
- CVE-2026-30952liquidjs has a path traversal fallback vulnerabilityharttle liquidjs · liquidjs
- CVE-2026-30951Sequelize v6 Vulnerable to SQL Injection via JSON Column Cast Typesequelize
- CVE-2026-30949Parse Server is missing audience validation in Keycloak authentication adapterparse-community parse-server · parse-server
- CVE-2026-30948Parse Server has stored cross-site scripting (XSS) via SVG file uploadparse-community parse-server · parse-server
- CVE-2026-30947Parse Server ha a bypass of class-level permissions in LiveQueryparse-community parse-server · parse-server
- CVE-2026-30946Parse Server affected by denial-of-service via unbounded query complexity in REST and GraphQL APIparse-community parse-server · parse-server
- CVE-2026-30837Elysia has a string URL format redoselysiajs elysia · elysia
- CVE-2026-29175Multiple Stored XSS in Commerce Inventory Page Leading to Session Hijackingcraftcms commerce · craftcms/commerce
- CVE-2026-29174Craft Commerce has a SQL Injection in Commerce Inventory Table Sortingcraftcms commerce · craftcms/commerce
- CVE-2026-2713IBM Trusteer Rapport installer affected by uncontrolled search path element vulnerabilityIBM Trusteer Rapport installer
- CVE-2026-29172Craft Commerce has a SQL Injection in Commerce Purchasables Table Sortingcraftcms commerce · craftcms/commerce
- CVE-2026-26308Envoy has an RBAC Header Validation Bypass via Multi-Value Header Concatenationenvoyproxy envoy · github.com/envoyproxy/envoy
- CVE-2026-2266Improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allowed cross-site scripting via task list content and enabled arbitrary HTML injectionGitHub Enterprise Server
- CVE-2026-27826MCP Atlassian has SSRF via unvalidated X-Atlassian-Jira-Url / X-Atlassian-Confluence-Url headerssooperset mcp-atlassian · mcp-atlassian
- CVE-2026-27274Substance3D - Stager | Out-of-bounds Write (CWE-787)Adobe Substance3D - Stager
- CVE-2026-27277Substance3D - Stager | Use After Free (CWE-416)Adobe Substance3D - Stager
- CVE-2026-27273Substance3D - Stager | Out-of-bounds Write (CWE-787)Adobe Substance3D - Stager
- CVE-2026-27275Substance3D - Stager | Out-of-bounds Write (CWE-787)Adobe Substance3D - Stager
- CVE-2026-27276Substance3D - Stager | Use After Free (CWE-416)Adobe Substance3D - Stager
- CVE-2026-27279Substance3D - Stager | Out-of-bounds Write (CWE-787)Adobe Substance3D - Stager
- CVE-2026-27269Premiere Pro | Out-of-bounds Read (CWE-125)Adobe Premiere
- CVE-2026-27280DNG SDK | Out-of-bounds Write (CWE-787)Adobe DNG Software Development Kit
- CVE-2026-31796iccDEV has a heap-based buffer overflow in icCurvesFromXml()InternationalColorConsortium iccDEV
- CVE-2026-31795iccDEV has a stack buffer overflow write in CIccXform3DLut::Apply()InternationalColorConsortium iccDEV
- CVE-2026-31792iccDEV has a null pointer dereference in CIccTagXmlStruct::ParseTag()InternationalColorConsortium iccDEV
- CVE-2026-30987iccDEV has a stack buffer overflow in CIccTagNum<(icTagTypeSignature)>::GetValues()InternationalColorConsortium iccDEV
- CVE-2026-30985iccDEV has a heap-based buffer overflow write in CIccMatrixMath::SetRange()InternationalColorConsortium iccDEV
- CVE-2026-30983iccDEV has a stack buffer overflow in icFixXml()InternationalColorConsortium iccDEV
- CVE-2026-30979iccDEV has a heap-based buffer overflow in CIccCalculatorFunc::InitSelectOp()InternationalColorConsortium iccDEV
- CVE-2026-30978Heap-use-after-free in CIccCmm::AddXform()InternationalColorConsortium iccDEV
- CVE-2026-3854Remote code execution via git push option injection in GitHub Enterprise ServerGitHub Enterprise Server
- CVE-2026-30970Session authentication bypass in Coral Server session creation endpointCoral-Protocol coral-server
- CVE-2026-23239espintcp: Fix race condition in espintcp_close()Linux
- CVE-2026-30969Coral Server has insufficient agent authentication in session communication channelsCoral-Protocol coral-server
- CVE-2026-30968Coral Server has insufficient validation of agent identity for SSE connectionsCoral-Protocol coral-server
- CVE-2026-2273CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exist that could cause execution of untrusted commands on thSchneider Electric EcoStruxure™ Automation Expert
- CVE-2026-1286CWE-502: Deserialization of untrusted data vulnerability exists that could lead to loss of confidentiality, integrity and potential remote cSchneider Electric EcoStruxure™ Foxboro DCS
- CVE-2026-26144Microsoft Excel Information Disclosure VulnerabilityMicrosoft 365 Apps for Enterprise
- CVE-2026-26141Hybrid Worker Extension (Arc‑enabled Windows VMs) Elevation of Privilege VulnerabilityMicrosoft Azure Automation Hybrid Worker Windows Extension
- CVE-2026-26130ASP.NET Core Denial of Service VulnerabilityMicrosoft ASP.NET Core · Microsoft.AspNetCore.App.Runti… +11
- CVE-2026-26118Azure MCP Server Tools Elevation of Privilege VulnerabilityMicrosoft Azure MCP Server Tools · Azure.Mcp +2
- CVE-2026-26117Arc Enabled Servers - Azure Connected Machine Agent Elevation of Privilege VulnerabilityMicrosoft Arc Enabled Servers - Azure Connected Machine Age…
- CVE-2026-26110Microsoft Office Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office
- CVE-2026-26109Microsoft Excel Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Excel +1
- CVE-2026-26108Microsoft Excel Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Excel +1
- CVE-2026-26107Microsoft Excel Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Excel +1
- CVE-2026-26106Microsoft SharePoint Server Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2026-23665Linux Azure Diagnostic extension (LAD) Elevation of Privilege VulnerabilityMicrosoft Azure Linux Virtual Machines with Azure Diagnosti…
- CVE-2026-23662Azure IoT Explorer Information Disclosure VulnerabilityMicrosoft Azure IoT Explorer
- CVE-2026-23661Azure IoT Explorer Information Disclosure VulnerabilityMicrosoft Azure IoT Explorer
- CVE-2026-23654GitHub: Zero Shot SCFoundation Remote Code Execution VulnerabilityMicrosoft GitHub Repo: Zero Shot scFoundation
- CVE-2026-26148Microsoft Azure AD SSH Login extension for Linux Elevation of Privilege VulnerabilityMicrosoft Azure AD SSH Login extension for Linux
- CVE-2026-23674MapUrlToZone Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2026-26127.NET Denial of Service VulnerabilityMicrosoft .NET · Microsoft.Bcl.Memory +12
- CVE-2026-26134Microsoft Office Elevation of Privilege VulnerabilityMicrosoft Office for Android
- CVE-2026-26132Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-26131.NET Elevation of Privilege VulnerabilityMicrosoft .NET · Microsoft.NetCore.App.Runtime.linux-arm +5
- CVE-2026-26128Windows SMB Server Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-26116SQL Server Elevation of Privilege VulnerabilityMicrosoft SQL Server
- CVE-2026-26115SQL Server Elevation of Privilege VulnerabilityMicrosoft SQL Server 2016 Service Pack · Microsoft SQL Serv…
- CVE-2026-26121Azure IOT Explorer Spoofing VulnerabilityMicrosoft Azure IoT Explorer
- CVE-2026-20967System Center Operations Manager (SCOM) Elevation of Privilege VulnerabilityMicrosoft System Center Operations Manager
- CVE-2026-26114Microsoft SharePoint Server Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2026-26113Microsoft Office Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office +2
- CVE-2026-26112Microsoft Excel Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Excel +1
- CVE-2026-26111Windows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2026-26105Microsoft SharePoint Server Spoofing VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2026-25190Windows GDI Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2026-25189Windows DWM Core Library Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-25188Windows Telephony Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-25187Winlogon Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-25181GDI+ Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2026-25179Windows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-25178Windows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-25177Active Directory Domain Services Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-25176Windows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-25175Windows NTFS Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-25174Windows Extensible File Allocation Table Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-25173Windows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2026-25172Windows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2026-25171Windows Authentication Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-25170Windows Hyper-V Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-25167Microsoft Brokering File System Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-25166Windows System Image Manager Assessment and Deployment Kit (ADK) Remote Code Execution VulnerabilityMicrosoft Windows ADK for Windows 10, · Microsoft Window… +1
- CVE-2026-25165Performance Counters for Windows Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-24296Windows Device Association Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-24295Windows Device Association Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-24294Windows SMB Server Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-24293Windows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-24292Windows Connected Devices Platform Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-24291Windows Accessibility Infrastructure (ATBroker.exe) Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-24290Windows Projected File System Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-24289Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-24287Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-24285Win32k Elevation of Privilege VulnerabilityMicrosoft Office for Android · Microsoft Windows
- CVE-2026-24283Multiple UNC Provider Kernel Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-23673Windows Resilient File System (ReFS) Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-23672Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-23671Windows Bluetooth RFCOM Protocol Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-23669RPC Runtime Library Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2026-23668Windows Graphics Component Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-23667Broadcast DVR Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-23664Azure IoT Explorer Information Disclosure VulnerabilityMicrosoft Azure IoT Explorer
- CVE-2026-23660Windows Admin Center in Azure Portal Elevation of Privilege VulnerabilityMicrosoft Windows Admin Center in Azure Portal
- CVE-2026-21262SQL Server Elevation of Privilege VulnerabilityMicrosoft SQL Server 2016 Service Pack · Microsoft SQL Serv…
- CVE-2026-30958OneUptime: Path Traversal — Arbitrary File Read (No Auth)oneuptime
- CVE-2026-30945StudioCMS: IDOR — Arbitrary API Token Revocation Leading to Denial of Servicewithstudiocms studiocms · studiocms
- CVE-2026-30944StudioCMS Affected by Privilege Escalation via Insecure API Token Generationwithstudiocms studiocms · studiocms
- CVE-2026-24017An Improper Control of Interaction Frequency vulnerability [CWE-799] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 Fortinet FortiWeb
- CVE-2026-24018A UNIX symbolic link (Symlink) following vulnerability in Fortinet FortiClientLinux 7.4.0 through 7.4.4, FortiClientLinux 7.2.2 through 7.2.Fortinet FortiClientLinux
- CVE-2026-22627A buffer copy without checking size of input ('classic buffer overflow') vulnerability in Fortinet FortiSwitchAXFixed 1.0.0 through 1.0.1 maFortinet FortiSwitchAXFixed
- CVE-2025-54820A Stack-based Buffer Overflow vulnerability [CWE-121] vulnerability in Fortinet FortiManager 7.4.0 through 7.4.2, FortiManager 7.2.0 throughFortinet FortiManager
- CVE-2026-30942Flare has a Path Traversal in /api/avatars/[filename]FlintSH Flare
- CVE-2026-30941Parse Server has a NoSQL injection via token type in password reset and email verification endpointsparse-community parse-server · parse-server
- CVE-2026-30939Parse Server has Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain Resolutionparse-community parse-server · parse-server
- CVE-2026-30930Glances has SQL Injection via Process Names in TimescaleDB Exportnicolargo glances · glances
- CVE-2026-30928Glances Exposes Unauthenticated Configuration Secretsnicolargo glances · glances
- CVE-2026-30934FileBrowser Quantum: Stored XSS in public share page via unsanitized share metadata (text/template misuse)gtsteffaniak filebrowser · github.com/gtsteffaniak/filebrow…
- CVE-2026-30933FileBrowser Quantum Incomplete Remediation of CVE-2026-27611: Password-Protected Share Bypass via /public/api/share/infogtsteffaniak filebrowser · github.com/gtsteffaniak/filebrow…
- CVE-2026-25573A vulnerability has been identified in SICAM SIAPP SDK (All versions < V2.1.7).Siemens SICAM SIAPP SDK
- CVE-2026-25570A vulnerability has been identified in SICAM SIAPP SDK (All versions < V2.1.7).Siemens SICAM SIAPP SDK
- CVE-2026-25569A vulnerability has been identified in SICAM SIAPP SDK (All versions < V2.1.7).Siemens SICAM SIAPP SDK
- CVE-2026-3847Memory safety bugs fixed in Firefox 148.0.2Mozilla Firefox
- CVE-2026-3845Heap buffer overflow in the Audio/Video: Playback component in Firefox for AndroidMozilla Firefox
- CVE-2026-3483An exposed dangerous method in Ivanti DSM before version 2026.1.1 allows a local authenticated attacker to escalate their privileges.Ivanti Desktop and Server Management
- CVE-2026-2339RCE in TUBITAK BILGEM's LiderahenkTUBITAK BILGEM Software Technologies Research Institute Lid…
- CVE-2025-11739CWE‑502: Deserialization of Untrusted Data vulnerability exists that could cause arbitrary code execution with administrative privileges wheSchneider Electric EcoStruxure™ Power Monitoring Expert · S…
- CVE-2025-13957CWE-798: Use of Hard-coded Credentials vulnerability exists that could cause information disclosure and remote code execution when SOCKS ProSchneider Electric EcoStruxure™ IT Data Center Expert
- CVE-2026-2724Unlimited Elements For Elementor <= 2.0.5 - Unauthenticated Stored Cross-Site Scripting via Form Entry Fieldsunitecms Unlimited Elements For Elementor
- CVE-2026-1261MetForm Pro <= 3.9.6 - Unauthenticated Stored Cross-Site ScriptingWpmet MetForm Pro
- CVE-2026-2364CODESYS Installer TOCTOU Privilege EscalationCODESYS Installer
- CVE-2026-3585The Events Calendar <= 6.15.17 - Authenticated (Author+) Arbitrary File Read via ajax_create_importstellarwp The Events Calendar
- CVE-2026-27689Denial of service (DOS) in SAP Supply Chain ManagementSAP_SE SAP Supply Chain Management
- CVE-2025-56421SQL Injection vulnerability in LimeSurvey before v.6.15.4+250710 allows a remote attacker to obtain sensitive information from the database.limesurvey/limesurvey
- CVE-2025-70227Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the nextPage parameter to goform/formLanguageChange.
- CVE-2025-70242Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the webPage parameter to goform/formSetWanPPTP.
- CVE-2025-70244Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the webPage parameter to goform/formWlanSetup.
- CVE-2025-70246Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formVirtualServ.
- CVE-2025-70247Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetWizard1.
- CVE-2025-70249Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetWizard2.
- CVE-2025-70251Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the webPage parameter to goform/formWlanGuestSetup.
- CVE-2025-70798Tenda i24V3.0si V3.0.0.5 Firmware V3.0.0.5 was discovered to contain a hardcoded password vulnerability in /etc_ro/shadow, which allows atta
- CVE-2025-70802Tenda G1V3.1si V16.01.7.8 Firmware V16.01.7.8 was discovered to contain a hardcoded password vulnerability in /etc_ro/shadow, which allows a
- CVE-2026-26738Buffer Overflow vulnerability in Uderzo Software SpaceSniffer v.2.0.5.18 allows a remote attacker to execute arbitrary code via a crafted .s
- CVE-2026-26741PX4 Autopilot versions 1.12.x through 1.15.x contain a logic flaw in the mode switching mechanism.
- CVE-2026-26742PX4 Autopilot versions 1.12.x through 1.15.x contain a protection mechanism failure in the "Re-arm Grace Period" logic.
- CVE-2026-26801Server-Side Request Forgery (SSRF) vulnerability in pdfmake versions 0.3.0-beta.2 through 0.3.5 allows a remote attacker to obtain sensitivepdfmake
Medium, low and unrated 135
- CVE-2026-2569Dear Flipbook <= 2.4.20 - Authenticated (Auhtor+) Stored Cross-Site Scripting via PDF Page Labelsdearhive Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF emb…
- CVE-2026-27270Illustrator | Out-of-bounds Read (CWE-125)Adobe Illustrator Desktop
- CVE-2026-27268Illustrator | Out-of-bounds Read (CWE-125)Adobe Illustrator Desktop
- CVE-2025-22850Time-of-check time-of-use race condition in the UEFI PdaSmm module for some Intel(R) reference platforms may allow an information disclosureIntel(R) reference platforms may allow an information discl…
- CVE-2025-22444Exposure of resource to wrong sphere in the UEFI PdaSmm module for some Intel(R) reference platforms may allow an information disclosure.Intel(R) reference platforms may allow an information discl…
- CVE-2025-20073Improper buffer restrictions in the UEFI DXE module for some Intel(R) Reference Platforms within UEFI may allow an information disclosure.Intel(R) Reference Platforms
- CVE-2025-20005Improper buffer restrictions in some UEFI firmware for some Intel(R) reference platforms may allow an escalation of privilege.Intel(R) reference platforms may allow an escalation of pri…
- CVE-2025-20096Improper input validation in the UEFI firmware for some Intel Reference Platforms may allow an escalation of privilege.Intel Reference Platforms may allow an escalation of privil…
- CVE-2026-31838Istio HTTP debug endpoints on port 15014 to enforce namespace-based authorization, preventing cross-namespace proxy data access.istio
- CVE-2026-31833Umbraco has Stored XSS in UFM Rendering Pipeline via Permissive DOMPurify Attribute FilteringUmbraco-CMS · Umbraco.Cms
- CVE-2026-31832Umbraco Backoffice API Allows Unauthorized Modification of Domain DataUmbraco-CMS · Umbraco.Cms
- CVE-2026-31828Parse Server has an LDAP injection via unsanitized user input in DN and group filter constructionparse-community parse-server · parse-server
- CVE-2026-27221Acrobat Reader | Improper Certificate Validation (CWE-295)Adobe Acrobat DC · Adobe Acrobat Reader DC +1
- CVE-2026-31826pypdf: manipulated stream length values can exhaust RAMpy-pdf pypdf · pypdf
- CVE-2026-31825Sylius has a DQL Injection via API Order FiltersSylius · sylius/sylius
- CVE-2026-31823Sylius has Authenticated Stored XSSSylius · sylius/sylius
- CVE-2026-31822Sylius has a XSS vulnerability in checkout login formSylius · sylius/sylius
- CVE-2026-31821Sylius is Missing Authorization in API v2 Add Item EndpointSylius · sylius/sylius
- CVE-2026-31819Sylius has an Open Redirect via Referer HeaderSylius · sylius/sylius
- CVE-2026-31815django-unicorn affected by component state manipulation via unvalidated attribute accessdjango-commons django-unicorn · django-unicorn
- CVE-2026-31808file-type affected by infinite loop in ASF parser on malformed input with zero-size sub-headersindresorhus file-type · file-type
- CVE-2026-31809SiYuan has a SVG Sanitizer Bypass via Whitespace in `javascript:` URI — Unauthenticated XSSsiyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2026-31807SiYuan has a SVG Sanitizer Bypass via `<animate>` Element — Unauthenticated XSSsiyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2026-30972Parse Server has a rate limit bypass via batch request endpointparse-community parse-server · parse-server
- CVE-2026-0121In VPU, there is a possible use-after-free read due to a race condition.Google Android
- CVE-2026-0119In usim_SendMCCMNCIndMsg of usim_Registration.c, there is a possible out of bounds write due to memory corruption.Google Android
- CVE-2026-0115In Trusted Execution Environment, there is a possible key leak due to side channel information disclosure.Google Android
- CVE-2026-0108The register protection of the PowerVR GPU is incorrectly configured.Google Android
- CVE-2026-30954LinkAce has a Cross-User Tag/List Attachment IDOR in processTaxonomy()Kovah LinkAce
- CVE-2025-13213Multiple vulnerabilities in IBM Aspera OrchestratorIBM Aspera Orchestrator
- CVE-2025-13219Multiple vulnerabilities in IBM Aspera OrchestratorIBM Aspera Orchestrator
- CVE-2026-29177Craft Commerce has Stored XSS in Craft Commerce Order Details Slideoutcraftcms commerce · craftcms/commerce
- CVE-2026-29176Craft Commerce has Stored XSS in Inventory Location Namecraftcms commerce · craftcms/commerce
- CVE-2025-36226Multiple vulnerabilities in IBM Aspera FaspexIBM Aspera Faspex
- CVE-2025-36227Multiple vulnerabilities in IBM Aspera FaspexIBM Aspera Faspex
- CVE-2026-29173Craft Commerce has Stored XSS while updating Order Status from Orders Tablecraftcms commerce · craftcms/commerce
- CVE-2026-29113Craft has a potential information disclosure vulnerability in preview tokenscraftcms cms · craftcms/cms
- CVE-2026-26330Envoy global rate limit may crash when the response phase limit is enabled and the response phase request is failed directlyenvoyproxy envoy · github.com/envoyproxy/envoy
- CVE-2026-26311Envoy HTTP: filter chain execution on reset streams causing UAF crashenvoyproxy envoy · github.com/envoyproxy/envoy
- CVE-2026-26310Crash for scoped ip address in Envoy during DNSenvoyproxy envoy · github.com/envoyproxy/envoy
- CVE-2026-26309Envoy has an off-by-one write in JsonEscaper::escapeString()envoyproxy envoy · github.com/envoyproxy/envoy
- CVE-2026-26123Microsoft Authenticator Information Disclosure VulnerabilityMicrosoft Authenticator for Android · Microsoft Authenticat…
- CVE-2026-3582Incorrect Authorization in GitHub Enterprise Server allows access to issue and commit search results without repo scopeGitHub Enterprise Server
- CVE-2026-23868Giflib contains a double-free vulnerability that is the result of a shallow copy in GifMakeSavedImage and incorrect error handling.giflib
- CVE-2026-27218Substance3D - Painter | NULL Pointer Dereference (CWE-476)Adobe Substance3D - Painter
- CVE-2026-27219Substance3D - Painter | Out-of-bounds Read (CWE-125)Adobe Substance3D - Painter
- CVE-2026-27214Substance3D - Painter | NULL Pointer Dereference (CWE-476)Adobe Substance3D - Painter
- CVE-2026-21364Substance3D - Painter | NULL Pointer Dereference (CWE-476)Adobe Substance3D - Painter
- CVE-2026-21365Substance3D - Painter | Out-of-bounds Read (CWE-125)Adobe Substance3D - Painter
- CVE-2026-27217Substance3D - Painter | NULL Pointer Dereference (CWE-476)Adobe Substance3D - Painter
- CVE-2026-27216Substance3D - Painter | Out-of-bounds Read (CWE-125)Adobe Substance3D - Painter
- CVE-2026-21363Substance3D - Painter | NULL Pointer Dereference (CWE-476)Adobe Substance3D - Painter
- CVE-2026-27215Substance3D - Painter | NULL Pointer Dereference (CWE-476)Adobe Substance3D - Painter
- CVE-2026-27281DNG SDK | Integer Overflow or Wraparound (CWE-190)Adobe DNG Software Development Kit
- CVE-2026-30980iccDEV has a stack overflow in CIccBasicStructFactory::CreateStruct()InternationalColorConsortium iccDEV
- CVE-2026-31797iccDEV has a heap out-of-bounds read in CTiffImg::ReadLine()InternationalColorConsortium iccDEV
- CVE-2026-31794iccDEV has a SEGV in CIccCLUT::Interp3d()InternationalColorConsortium iccDEV
- CVE-2026-31793iccDEV has a SEGV in CIccCalculatorFunc::ApplySequence()InternationalColorConsortium iccDEV
- CVE-2026-30986iccDEV has a heap-based buffer overflow write in CIccCLUT::Interp3d()InternationalColorConsortium iccDEV
- CVE-2026-30984iccDEV has a heap out-of-bounds read in CIccCalculatorFunc::ApplySequence()InternationalColorConsortium iccDEV
- CVE-2026-30982iccDEV has a heap out-of-bounds read in CIccPcsXform::pushXYZConvert()InternationalColorConsortium iccDEV
- CVE-2026-30981iccDEV has a heap-buffer-overflow read in CIccXmlArrayType<>InternationalColorConsortium iccDEV
- CVE-2026-3306Improper authorization in GitHub Projects allows modification of issue and pull request metadata without repository write accessGitHub Enterprise Server
- CVE-2026-30977RenderBlocking has Stored XSS in renderblocking-css with Inline Assets modelihaohong6 RenderBlocking
- CVE-2026-30974Copyparty volflag `nohtml` did not block javascript in svg files9001 copyparty · copyparty
- CVE-2026-30973Zip Slip arbitrary file write in @appium/support ZIP extraction@appium support · @appium/support
- CVE-2026-30964Webauthn Framework: allowed_origins collapses URL-like origins to host-only values, bypassing exact origin validationweb-auth webauthn-framework · web-auth webauthn-lib +4
- CVE-2026-30959OneUptime has WhatsApp Resend Verification Authorization Bypassoneuptime · @oneuptime/common
- CVE-2025-13902CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause condition Schneider Electric Modicon Controllers M241/M251 · Schneide…
- CVE-2026-23656Windows App Installer Spoofing VulnerabilityMicrosoft Windows App Client for Windows Desktop
- CVE-2026-25186Windows Accessibility Infrastructure (ATBroker.exe) Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2026-25185Windows Shell Link Processing Spoofing VulnerabilityMicrosoft Windows
- CVE-2026-25180Windows Graphics Component Information Disclosure VulnerabilityMicrosoft Office for Android · Microsoft Windows
- CVE-2026-25169Windows Graphics Component Denial of Service VulnerabilityMicrosoft Windows
- CVE-2026-25168Windows Graphics Component Denial of Service VulnerabilityMicrosoft Windows
- CVE-2026-24297Windows Kerberos Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2026-24288Windows Mobile Broadband Driver Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2026-24282Push message Routing Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-13901CWE-404 Improper Resource Shutdown or Release vulnerability exists that could cause partial Denial of Service on Machine Expert protocol wheSchneider Electric Modicon M241/M251 · Schneider Electric M…
- CVE-2025-66178A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiWeb 8.0.0 througFortinet FortiWeb
- CVE-2026-24641A NULL Pointer Dereference vulnerability [CWE-476] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, ForFortinet FortiWeb
- CVE-2026-24640A Stack-based Buffer Overflow vulnerability [CWE-121] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, Fortinet FortiWeb
- CVE-2025-54659An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] vulnerability in Fortinet FortiSOARFortinet FortiSOAR Agent Communication Bridge
- CVE-2026-25972An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSIEM 7.4.0, FortiSIEMFortinet FortiSIEM
- CVE-2026-22629An improper restriction of excessive authentication attempts vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4 Fortinet FortiAnalyzer · Fortinet FortiManager Cloud +1
- CVE-2025-68482A improper certificate validation vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.8, FortiAnalyFortinet FortiAnalyzer · Fortinet FortiManager
- CVE-2025-48418A hidden functionality vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.3, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2.0 tFortinet FortiAnalyzer · Fortinet FortiManager
- CVE-2025-49784An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAnalyzer 7.6.0 througFortinet FortiAnalyzer-BigData · Fortinet FortiAnalyzer
- CVE-2026-22572An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.3, FortiAnalyzer 7.4.0Fortinet FortiManager · Fortinet FortiAnalyzer
- CVE-2025-68648A use of externally-controlled format string vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7,Fortinet FortiManager Cloud · Fortinet FortiAnalyzer Clo… +2
- CVE-2026-25689An improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiDeceptor 6.2.0, FortiDeFortinet FortiDeceptor
- CVE-2025-53608An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet ForFortinet FortiSandbox
- CVE-2025-48840An authentication bypass by spoofing vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3, FortiWeb 7.4.0 through 7.4.8, FortiWeb 7.2 all Fortinet FortiWeb
- CVE-2025-55717A cleartext storage of sensitive information vulnerability [CWE-312] vulnerability in Fortinet FortiMail 7.6.0 through 7.6.2, FortiMail 7.4.Fortinet FortiVoice · Fortinet FortiMail +1
- CVE-2026-25836An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox Cloud 5Fortinet FortiSandbox Cloud · Fortinet FortiSandbox PaaS
- CVE-2026-30897A stack-based buffer overflow vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7Fortinet FortiWeb
- CVE-2026-22628An improper access control vulnerability in Fortinet FortiSwitchAXFixed 1.0.0 through 1.0.1 may allow an authenticated admin to execute systFortinet FortiSwitchAXFixed
- CVE-2026-30938Parse Server has denylist `requestKeywordDenylist` keyword scan bypass through nested object placementparse-community parse-server · parse-server
- CVE-2026-27661A vulnerability has been identified in SINEC Security Monitor (All versions < V4.9.0).Siemens SINEC Security Monitor
- CVE-2026-25605A vulnerability has been identified in SICAM SIAPP SDK (All versions < V2.1.7).Siemens SICAM SIAPP SDK
- CVE-2026-25572A vulnerability has been identified in SICAM SIAPP SDK (All versions < V2.1.7).Siemens SICAM SIAPP SDK
- CVE-2026-25571A vulnerability has been identified in SICAM SIAPP SDK (All versions < V2.1.7).Siemens SICAM SIAPP SDK
- CVE-2025-27769A vulnerability has been identified in Heliox Flex 180 kW EV Charging Station (All versions < F4.11.1), Heliox Mobile DC 40 kW EV Charging SSiemens Heliox Flex 180 kW EV Charging Station · Siemens He…
- CVE-2026-3846Same-origin policy bypass in the CSS Parsing and Computation componentMozilla Firefox
- CVE-2026-3862Cross-Site Scripting Vulnerability in SiteMinder Administrative UIBroadcom SiteMinder
- CVE-2026-2742Unauthorized session creation via reserved framework path accessvaadin · com.vaadin:flow-server +1
- CVE-2026-2741Zip Slip Path Traversal on Node Unpackvaadin · com.vaadin:flow-project
- CVE-2026-22614The encryption mechanism used in Eaton's EasySoft project file was insecure and susceptible to brute force attacks, an attacker with access Eaton EasySoft
- CVE-2026-21791HCL Sametime for Android is affected by sensitive information disclosureHCL Sametime
- CVE-2026-3228NextScripts: Social Networks Auto-Poster <= 4.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'nxs_fbembed' ShortcodeNextScripts: Social Networks Auto-Poster
- CVE-2026-23907Apache PDFBox Examples: Path Traversal in PDFBox ExtractEmbeddedFiles Example CodeApache Software Foundation Apache PDFBox Examples · org.apa…
- CVE-2026-3315Local Privilege Escalation Due to Writable Executable in Privileged Visionline Service PathASSA ABLOY Visionline
- CVE-2025-41712Incorrect Permission Assignment on power analyzerJanitza UMG 96RM-E · Weidmueller ENERGY METER 750-230 +1
- CVE-2025-41711Use of a Broken or Risky Cryptographic Algorithm for firmware images of power analyzerJanitza UMG 96RM-E · Weidmueller ENERGY METER 750-230 +1
- CVE-2025-41710Use of Hard-coded Credentials in power analyzerJanitza UMG 96RM-E · Weidmueller ENERGY METER 750-230 +1
- CVE-2026-1508Court Reservation < 1.10.9 - Event Deletion via CSRFCourt Reservation
- CVE-2025-2399Denial of Service (DoS) Vulnerability in Mitsubishi Electric CNC SeriesMitsubishi Electric CNC M800V Series M800VW · Mitsubish… +16
- CVE-2026-1919Booktics <= 1.0.16 - Missing Authorization to Get Items via REST API endpointsarraytics Booktics – Booking Calendar for Appointments and…
- CVE-2026-1920Booktics <= 1.0.16 - Missing Authorization to Addon Plugin Installationarraytics Booktics – Booking Calendar for Appointments and…
- CVE-2025-36173InfoSphere Data Architect (IDA) 9.2.1 Vulnerability Fixes.IBM InfoSphere Data Architect
- CVE-2025-36105IBM Planning Analytics Advanced Certified Containers is vulnerable to a sensitive information disclosure vulnerabilityIBM Planning Analytics Advanced Certified Containers
- CVE-2026-27688Missing Authorization check in SAP NetWeaver Application Server for ABAPSAP_SE SAP NetWeaver Application Server for ABAP
- CVE-2026-27687Missing Authorization check in SAP S/4HANA HCM Portugal and SAP ERP HCM PortugalSAP_SE SAP S/4HANA HCM Portugal and SAP ERP HCM Portugal
- CVE-2026-27686Missing Authorization check in SAP Business Warehouse (Service API)SAP_SE SAP Business Warehouse
- CVE-2026-27684SQL Injection Vulnerability in SAP NetWeaver (Feedback Notification)SAP_SE SAP NetWeaver
- CVE-2026-24317DLL Hijacking vulnerability in SAP GUI for Windows with active GuiXTSAP_SE SAP GUI for Windows with active GuiXT
- CVE-2026-24316Server-Side Request Forgery (SSRF) in SAP NetWeaver Application Server for ABAPSAP_SE SAP NetWeaver Application Server for ABAP
- CVE-2026-24313Missing Authorization check in SAP Solution Tools Plug-In (ST-PI)SAP_SE SAP Solution Tools Plug-In
- CVE-2026-24311Insecure Storage Protection vulnerability in SAP Customer Checkout 2.0SAP_SE SAP Customer Checkout
- CVE-2026-24310Missing Authorization check in SAP NetWeaver Application Server for ABAPSAP_SE SAP NetWeaver Application Server for ABAP
- CVE-2026-24309Missing Authorization check in SAP NetWeaver Application Server for ABAPSAP_SE SAP NetWeaver Application Server for ABAP
- CVE-2026-0489DOM-based Cross-Site Scripting (XSS) Vulnerability in SAP Business One (Job Service)SAP_SE SAP Business One
- CVE-2025-70025An issue pertaining to CWE-79: Improper Neutralization of Input During Web Page Generation was discovered in benkeen generatedata 4.0.14.
- CVE-2025-70128A Stored Cross-Site Scripting (XSS) vulnerability exists in the PluXml article comments feature for PluXml versions 5.8.22 and earlier.
- CVE-2025-70129If the anti spam-captcha functionality in PluXml versions 5.8.22 and earlier is enabled, a captcha challenge is generated with a format that