Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
48891
Total
3931
Critical
14494
High
14248
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-58241 | MEDIUM | 4.2 | SAP NetWeaver and ABAP Platform (Change and Transport System - Customer Transport Integration Wizard) allows a low-privileged user to modify configuration tables that control access … | Aug 11, 2026 |
| CVE-2026-58239 | LOW | 3.7 | SAP Approuter does not sufficiently validate tenant context in inbound requests. An unauthenticated attacker could send specially crafted requests to spoof the tenant context under … | Aug 11, 2026 |
| CVE-2026-58238 | MEDIUM | 5.9 | SAP Approuter does not sufficiently handle certain requests under specific conditions. An unauthenticated attacker could send specially crafted input that causes the component to crash … | Aug 11, 2026 |
| CVE-2026-58237 | MEDIUM | 5.9 | WebSocket of SAP Approuter does not perform sufficient authorization checks in certain functionality. An attacker with low privileges could exploit this to access restricted functionality. … | Aug 11, 2026 |
| CVE-2026-58236 | MEDIUM | 5.5 | SAP NetWeaver Application Server ABAP and ABAP Platform allow an attacker with high privileges to bypass missing security controls on an internal code path leading … | Aug 11, 2026 |
| CVE-2026-58235 | MEDIUM | 6.3 | SAP NetWeaver Application Server Java (Adobe Document Service) uses outdated open source cryptographic and data transfer libraries that contain known vulnerabilities addressed in later versions. … | Aug 11, 2026 |
| CVE-2026-58230 | HIGH | 7.0 | SAP Approuter does not sufficiently validate certain token content under specific configurations. An unauthenticated attacker could send a specially crafted token to cause sensitive credential … | Aug 11, 2026 |
| CVE-2026-44765 | HIGH | 7.3 | Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated remote attacker could access scheduling-related application functions without proper authorization … | Aug 11, 2026 |
| CVE-2026-44764 | HIGH | 7.3 | Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated attacker could send crafted requests to the Cost Servlet using … | Aug 11, 2026 |
| CVE-2026-44763 | HIGH | 7.6 | SAP Manufacturing Integration and Intelligence allows a privileged attacker to exploit insufficient file path validation in certain functions using specially crafted input. Exploitation also requires … | Aug 11, 2026 |
| CVE-2026-44762 | LOW | 3.7 | SAP Data Services Management Console allows an overly permissive Content Security Policy (CSP) configuration and lacks certain restrictive directives, which could enable an authenticated malicious … | Aug 11, 2026 |
| CVE-2026-44758 | CRITICAL | 9.1 | SAP Manufacturing Integration and Intelligence (MII) allows an attacker with high privileges to submit specially crafted input to certain affected functionality, which is processed without … | Aug 11, 2026 |
| CVE-2026-40130 | MEDIUM | 5.3 | SAP SAPSPrint Service has memory corruption vulnerabilities in the handling of certain commands. An unauthenticated attacker could send specially crafted requests that trigger a buffer … | Aug 11, 2026 |
| CVE-2026-34265 | CRITICAL | 9.8 | SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to exploit logical errors in DIAG protocol parsing, resulting in memory corruption. This vulnerability could potentially … | Aug 11, 2026 |
| CVE-2026-8718 | HIGH | 8.4 | tls_opt_dtls_peer_connection_id_value_get() in subsys/net/lib/sockets/sockets_tls.c, which handles getsockopt(SOL_TLS, TLS_DTLS_PEER_CID_VALUE), passed the caller-supplied optval directly to mbedtls_ssl_get_peer_cid() without verifying the buffer was at least MBEDTLS_SSL_CID_OUT_LEN_MAX (default 32) bytes. … | Aug 10, 2026 |
| CVE-2026-48161 | UNKNOWN | — | react18-use is a React 19 use hook shim. Between 2026-05-19 01:07:01 and 2026-05-19 15:20:43, the default branch contained malicious commits 7b79148d1495a2505f9277da295a98cf176f4496 through 7b79148d1495a2505f9277da295a98cf176f4496 that executed … | Aug 10, 2026 |
| CVE-2026-11812 | LOW | 2.5 | The UpdateHub management subsystem (subsys/mgmt/updatehub/updatehub.c) drives every update operation through a single file-scope ctx structure that holds the CoAP block context, payload buffer, status code, … | Aug 10, 2026 |
| CVE-2026-11811 | LOW | 3.7 | The UpdateHub over-the-air update client's start_coap_client() in subsys/mgmt/updatehub/updatehub.c leaks the CoAP/DTLS socket descriptor on its connection-setup failure paths. The shared error: cleanup gated socket closing … | Aug 10, 2026 |
| CVE-2025-30241 | UNKNOWN | — | Certain web interface components in affected TP-Link Aginet devices do not validate and sanitize user-supplied input properly before passing it to system-level command execution functions. … | Aug 10, 2026 |
| CVE-2025-30240 | UNKNOWN | — | The affected TP-Link Aginet devices do not properly validate symbolic links created on external USB storage devices. By placing a crafted symbolic link on supported … | Aug 10, 2026 |
| CVE-2025-30239 | UNKNOWN | — | In affected TP-Link Aginet devices, use of hardcoded cryptographic keys embedded in the firmware to protect sensitive configuration data may allow an attacker who has … | Aug 10, 2026 |
| CVE-2025-30238 | UNKNOWN | — | In affected TP-Link Aginet devices, insufficient authorization validation allows authenticated low-privileged users to execute higher-privileged operations. An attacker may perform administrative actions such as creating … | Aug 10, 2026 |
| CVE-2025-30237 | UNKNOWN | — | The affected TP-Link Aginet devices contain a flaw in the web management interface where authentication checks are not consistently enforced on certain endpoints. An attacker … | Aug 10, 2026 |
| CVE-2026-72919 | MEDIUM | 4.3 | Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1, the channels.convertToTeam REST endpoint allows … | Aug 10, 2026 |
| CVE-2026-72918 | MEDIUM | 5.4 | Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1, the stream-notify-user stream in the … | Aug 10, 2026 |