Export limit exceeded: 407196 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 407196 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (407196 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-89113 | 1 Sap Se | 1 Sap Commerce Cloud (ootb Code) | 2026-10-13 | 8.8 High |
| SAP Commerce Cloud does not sufficiently validate certain user-supplied input before it is incorporated into a database query. An authenticated user could send specially crafted requests to affected functionality to inject arbitrary SQL commands. Successful exploitation could allow the user to read, modify or delete sensitive data from the application's database, resulting in a high impact on confidentiality, integrity and availability of the application. | ||||
| CVE-2026-89112 | 1 Sap | 1 Cla-assistant | 2026-10-13 | 6.5 Medium |
| The admin API endpoint used to retrieve CLA signature records does not consistently enforce the required authorization checks when the target organisation is specified using an organisation ID.An authenticated user with limited privileges could potentially access CLA signature records containing contributor information belonging to an organisation they are not authorized to administer. | ||||
| CVE-2026-89110 | 1 Sap Se | 1 Sap Netweaver Visual Composer | 2026-10-13 | 9.9 Critical |
| SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality. An attacker with low privileges could invoke internal operations on a preconfigured remote system. Depending on the remote connection configuration, this could lead to a full compromise of the remote system. This results in a high impact on confidentiality, integrity and availability. | ||||
| CVE-2026-89108 | 1 Sap Se | 1 Sap Manufacturing Integration And Intelligence (configuration Service) | 2026-10-13 | 9.1 Critical |
| SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative functionality. An attacker with MII administrator privileges could submit a specially crafted request to provision an account with elevated privileges on the underlying Java application server. Successful exploitation could allow the attacker to gain administrative control over the underlying system, extending the impact beyond the vulnerable application. This results in a high impact on confidentiality, integrity and availability. | ||||
| CVE-2026-89107 | 1 Sap Se | 1 Sap S/4hana (manage Substitution/validation Rules) | 2026-10-13 | 9.9 Critical |
| SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validate input processed by rule definition functionality that utilizes a domain-specific scripting language. An authenticated attacker with specific business privileges could submit specially crafted input, which is interpreted as executable ABAP code by the rule processing logic. Successful exploitation could allow the attacker to execute ABAP arbitrary code into the system, resulting in full compromise of the affected system and high impact on confidentiality, integrity, and availability of the system. | ||||
| CVE-2026-89106 | 1 Sap Se | 1 Sapui5 | 2026-10-13 | 4.4 Medium |
| SAP UI5 does not perform sufficient input validation under certain configurations. An attacker with low privileges could submit specially crafted content that is later rendered in a victim's browser. This vulnerability has a low impact on confidentiality and integrity. There is no impact on availability. | ||||
| CVE-2026-89105 | 1 Sap | 1 Cloud-security-services-integration-library | 2026-10-13 | 4.2 Medium |
| The HybridTokenAuthenticator component of the SAP/cloud-security-services-integration-library accepts tokens from unintended ambient IAS/XSUAA bindings, potentially allowing unauthorized access. This vulnerability allows an attacker to gain unauthorized access to the system by using tokens that should not be accepted, leading to a breach of security. | ||||
| CVE-2026-81858 | 1 Ibm | 1 I | 2026-10-13 | 5.4 Medium |
| IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to cause a denial of service and obtain information due to an out-of-bounds read in the File Server. | ||||
| CVE-2026-76976 | 1 Sap Se | 1 Sap Netweaver Application Server Abap (applications Based On Sap Gui For Html) | 2026-10-13 | 5.4 Medium |
| Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP do not sufficiently sanitize user-supplied content in certain functionality, allowing an authenticated attacker to send malicious content to another user. If the victim interacts with the affected content, malicious scripts could be executed in the victim's browser context. This vulnerability has a low impact on the confidentiality and integrity of the data and no impact on the availability of the application. | ||||
| CVE-2026-76975 | 1 Sap Se | 1 Sapui5 (support Assistant Overlay) | 2026-10-13 | 6.1 Medium |
| Due to a DOM-Based Cross-Site Scripting (XSS) vulnerability, an unauthenticated attacker could generate a malicious link and make it publicly accessible. If an authenticated user accesses this link, client-side code reads the attacker-controlled input and writes it into the DOM without proper sanitization, causing attacker-supplied script to execute in the victim�s browser context. This could allow the attacker to access or modify information within the victim�s browser scope, impacting confidentiality and integrity, while availability remains unaffected. | ||||
| CVE-2026-76972 | 1 Sap | 1 Manufacturing Integration And Intelligence | 2026-10-13 | 6.5 Medium |
| Due to a Cross-Site Scripting (XSS) vulnerability in SAP Manufacturing Integration and Intelligence, an attacker could store malicious content that is later rendered by the application. If an authenticated victim accesses a page that displays this stored content, the injected input is processed during web page generation, resulting in the execution of malicious content in the victim�s browser context. This could allow the attacker to access or modify information within the victim�s browser scope. Successful exploitation could allow the attacker to access session information, modify rendered page content and disrupt the victim's use of the application, resulting in a low impact on confidentiality, integrity and availability. | ||||
| CVE-2026-75881 | 1 Ibm | 1 Maximo Application Suite Iot Component | 2026-10-13 | 7.5 High |
| IBM Maximo Application Suite - IoT Component 9.2.0, 9.1.0, and 9.0.0 could allow a remote attacker to cause a denial of service due to an infinite parsing loop when processing certain inputs. | ||||
| CVE-2026-75621 | 1 Ibm | 1 Aspera Enterprise Webapps | 2026-10-13 | 6.2 Medium |
| IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker to obtain sensitive information due to excessive permissions assigned to a service account. | ||||
| CVE-2026-75095 | 1 Ibm | 1 Aspera Enterprise Webapps | 2026-10-13 | 7.5 High |
| IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption. | ||||
| CVE-2026-75063 | 1 Ibm | 1 Planning Analytics | 2026-10-13 | 5.4 Medium |
| IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to execute arbitrary JavaScript due to improper output encoding. | ||||
| CVE-2026-75061 | 1 Ibm | 1 Planning Analytics | 2026-10-13 | 7.5 High |
| IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to write arbitrary files on the system. | ||||
| CVE-2026-74045 | 1 Wazuh | 1 Wazuh | 2026-10-13 | 7.1 High |
| Wazuh from 3.12.0 before 4.14.8 contains a heap buffer overflow in fim_generate_alert() where full_log is sized from input but written bounded by OS_MAXSTR. An enrolled agent can send a crafted FIM syscheck event to corrupt manager heap memory and deterministically crash wazuh-analysisd, causing a fleet-wide detection outage. | ||||
| CVE-2026-73642 | 1 Dayforce | 2 Ess Excelity, Payroll | 2026-10-13 | N/A |
| Dayforce ESS Excelity is vulnerable to Path Traversal in file download functionality. An unauthenticated attacker can sent GET request with file path parameter set to any path including an absolute local file path. This issue was fixed in version V4. | ||||
| CVE-2026-73641 | 1 Dayforce | 2 Ess Excelity, Payroll | 2026-10-13 | N/A |
| Dayforce ESS Excelity is vulnerable to Reflected XSS in multiple endpoints. An attacker can prepare a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. This issue was fixed in version V4. | ||||
| CVE-2026-73640 | 1 Dayforce | 2 Ess Excelity, Payroll | 2026-10-13 | N/A |
| Dayforce ESS Excelity is vulnerable to Time Based-Blind SQL Injection in password recovery functionality. The unauthenticated attacker can prepare GET request with one of the parameters filled in with an arbitrary SQL query. The parameter is interpreted as part of SQL predicate resulting in Time-Based Blind SQL Injection. This issue was fixed in version V3. | ||||