Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,431 results · page 2 of 49
Sep 7, 2026SAP S/4HANA (Manage Bank Chains app) does not perform sufficient authorization checks within certain affected functionality.CVE-2026-76962 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
SAP S/4HANA (Manage Bank Chains app) does not perform sufficient authorization checks within certain affected functionality. An attacker with low privileges could send specially crafted requests to delete specific entries that should not be accessible to them. This results in a low impact on availability. There is no impact on confidentiality and integrity.
- Product
- SAP S/4HANA (Manage Bank Chains app)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cross-Site Request Forgery protection on certain requests, due to this an attackerCVE-2026-76961 · Network & remote access · SAP_SE · reported by cna@sap.comLow 3.5
SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cross-Site Request Forgery protection on certain requests, due to this an attacker with low privileges could craft a malicious link or page. If an authenticated victim interacts with it, unintended actions could be triggered on the web server on their behalf. This results in a low impact on confidentiality and integrity. There is no impact on availability.
- Product
- SAP S/4HANA (Finance for Advanced Payment Management)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cross-Site Request Forgery protection on certain requests, due to this an attackerCVE-2026-76960 · Network & remote access · SAP_SE · reported by cna@sap.comLow 3.5
SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cross-Site Request Forgery protection on certain requests, due to this an attacker with low privileges could craft a malicious link or page. If an authenticated victim interacts with it, unintended actions could be triggered on the web server on their behalf. This results in a low impact on confidentiality and integrity. There is no impact on availability.
- Product
- SAP S/4HANA (Finance for Advanced Payment Management)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cross-Site Request Forgery protection on certain requests due to this an attacker CVE-2026-76959 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.6
SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cross-Site Request Forgery protection on certain requests due to this an attacker with low privileges could craft a malicious link or page. If an authenticated victim interacts with it, unintended actions could be triggered on the web server on their behalf. This results in a low impact on confidentiality and integrity. There is no impact on availability.
- Product
- SAP S/4HANA (Finance for Advanced Payment Management)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026SAP Integration Suite does not sufficiently validate XML documents accepted from untrusted sources in certain internal components.CVE-2026-76958 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 8.5
SAP Integration Suite does not sufficiently validate XML documents accepted from untrusted sources in certain internal components. An attacker with low privileges could submit specially crafted XML payloads containing malicious external entity declarations. Successful exploitation could allow the attacker to read sensitive file contents from the server and expose them through monitoring or logging output, resulting in a high impact on confidentiality. It could also lead to resource exhaustion, causing a low impact on availability. There is no impact on integrity.
- Product
- SAP Integration Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026SAP GUI for Java does not correctly enforce the trust level policy for certain functions invoked from a connected backend system.CVE-2026-66768 · Network & remote access · SAP_SE · reported by cna@sap.comCritical 9
SAP GUI for Java does not correctly enforce the trust level policy for certain functions invoked from a connected backend system. A low-privileged attacker could exploit this weakness by manipulating a connected backend system to trigger affected functionality. This could allow arbitrary command execution on the victim's machine, leading to a high impact on the confidentiality, integrity, and availability of the affected system.
- Product
- SAP NetWeaver (SAP GUI for Java)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated user to send a specially crafted packet that triggers reprocessing of a prCVE-2026-66767 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 7.7
SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated user to send a specially crafted packet that triggers reprocessing of a previously buffered user request, potentially hijacking another user's session under narrow timing conditions. Successful exploitation could result in high impact on confidentiality and integrity, with low impact on availability of the application.
- Product
- SAP NetWeaver Application Server for ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during registration.CVE-2026-58240 · Network & remote access · SAP_SE · reported by cna@sap.comCritical 9.8
SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during registration. An unauthenticated attacker with network access to the affected service could exploit this weakness to register an unauthorized component and potentially perform unauthorized actions within the application environment, resulting in a high impact on the confidentiality, integrity, and availability of the affected system.
- Product
- SAP NetWeaver (Message Server)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026SAP Process Integration (SOAP Adapter) allows a privileged user to send specially crafted requests containing deeply nested entity definitions, which under certCVE-2026-58234 · Network & remote access · SAP_SE · reported by cna@sap.comLow 2.2
SAP Process Integration (SOAP Adapter) allows a privileged user to send specially crafted requests containing deeply nested entity definitions, which under certain conditions could temporarily increase processor load and degrade system responsiveness. Successful exploitation results in low impact on availability with no impact on confidentiality and integrity.
- Product
- SAP Process Integration (SOAP Adapter)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026SAP S/4HANA (Intercompany Matching and Reconciliation) allows a low-privileged authenticated user to inject malicious input into certain functions, which may beCVE-2026-44766 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.5
SAP S/4HANA (Intercompany Matching and Reconciliation) allows a low-privileged authenticated user to inject malicious input into certain functions, which may be processed by the database without proper validation. This could allow the user to access sensitive information, resulting in high impact on confidentiality, with no impact on integrity and availability of the application.
- Product
- SAP S/4HANA (Intercompany Matching and Reconciliation)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026A memory safety vulnerability exists in the Extended Passport Protocol (EPP) processing library.CVE-2026-44756 · Network & remote access · SAP_SE · reported by cna@sap.comCritical 10
A memory safety vulnerability exists in the Extended Passport Protocol (EPP) processing library. Under specific conditions, an unauthenticated attacker could exploit a crafted network request containing a malformed EPP header, potentially resulting in undefined behavior and abnormal program termination. Successful exploitation may have a high impact on the confidentiality, integrity, and availability of the application.
- Product
- SAP Extended Passport (EPP) Processing
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2026IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 SAP Adapter is CVE-2026-81832 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.7
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 SAP Adapter is vulnerable to an XML external entity (XXE) attack.
- Product
- App Connect Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2026Improper resource exposure in StreamsAPI in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially bypass web origin policy into a privilCVE-2026-79068 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 4.3
Improper resource exposure in StreamsAPI in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially bypass web origin policy into a privileged page via a crafted HTML page. (Chromium security severity: Medium)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Aug 25, 2026Incorrect authorization in StorageAccessAPI in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypassCVE-2026-79060 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 6.5
Incorrect authorization in StorageAccessAPI in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Aug 25, 2026Incorrect authorization in StorageAccessAPI in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypassCVE-2026-79005 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 6.5
Incorrect authorization in StorageAccessAPI in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Aug 25, 2026Improper input validation in StorageAccessAPI in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypaCVE-2026-78976 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 4.3
Improper input validation in StorageAccessAPI in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Aug 25, 2026Information leak in StorageAccessAPI in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page.CVE-2026-78896 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 4.3
Information leak in StorageAccessAPI in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Low)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Aug 24, 2026SAP S/4HANA (Private Cloud) uses a third-party component that contains a Regular Expression Denial of Service (ReDoS) vulnerability.CVE-2026-66766 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 7.5
SAP S/4HANA (Private Cloud) uses a third-party component that contains a Regular Expression Denial of Service (ReDoS) vulnerability. An unauthenticated attacker could supply specially crafted input that triggers excessive processing within the affected functionality. Successful exploitation could exhaust system resources and make the service unavailable, resulting in a high impact on availability. There is no impact on confidentiality and integrity.
- Product
- SAP S/4HANA (Manage Supply Protection)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 15, 2026In the Linux kernel, the following vulnerability has been resolved: llc: fix SAP refcount leak in llc_ui_autobind() llc_ui_autobind() opens a SAP after choosiCVE-2026-72022 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: llc: fix SAP refcount leak in llc_ui_autobind() llc_ui_autobind() opens a SAP after choosing a dynamic LSAP. llc_sap_open() returns a reference owned by the caller, and llc_sap_add_socket() takes a second reference for the socket's membership in the SAP hash tables. llc_ui_bind() drops the caller's reference after adding the socket, but llc_ui_autobind() keeps it. When the socket is closed, llc_sap_remove_socket() releases only the socket reference, leaving the SAP on llc_sap_list with sk_count == 0. This is user-visible because repeated autobind and close cycles can consume all dynamic SAP values and make later autobinds fail with -EUSERS. Drop the caller's reference after a successful autobind, matching llc_ui_bind()'s ownership model.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Aug 13, 2026Improper enforcement of message integrity in PostgreSQL GSSAPI support allows a user to negotiate GSSAPI contrary to pg_hba.conf rules, via initial direct TLS cCVE-2026-14681 · Other software · Postgresql · reported by f86ef6dc-4d3a-42ad-8f28-e6d5547a5007Medium 4.2
Improper enforcement of message integrity in PostgreSQL GSSAPI support allows a user to negotiate GSSAPI contrary to pg_hba.conf rules, via initial direct TLS connection. Despite a pg_hba.conf that appears to require GSSAPI, the connection may exchange data over TLS encryption alone. If the TLS settings are more permissive than the GSS settings, the connection may continue with lesser protection. Within major versions 17-18, minor versions before PostgreSQL 18.6 and 17.11 are affected. Versions before PostgreSQL 17 are unaffected.
- Product
- Postgresql
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to certain functions lacking sCVE-2026-58231 · Websites & servers · SAP_SE · reported by cna@sap.comCritical 10
SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to certain functions lacking sufficient validation. Successful exploitation could enable arbitrary code execution and compromise internal components, resulting in high impact on confidentiality, integrity, and availability of the application.
- Product
- SAP Commerce Cloud (Data Hub Adapter)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026Due to a Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP, an authenticated attacker could generate a malicious link and make iCVE-2026-66779 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.3
Due to a Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP, an authenticated attacker could generate a malicious link and make it publicly accessible. If an authenticated victim accesses this link, the injected input is processed and reflected within the DOM on the client side during page rendering, resulting in the execution of malicious content in the victim's browser context. Successful exploitation could result in a high impact to the confidentiality and a low impact to the integrity of the system, while availability remains unaffected.
- Product
- SAP NetWeaver Application Server ABAP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026SAP Approuter does not sufficiently sanitize certain request headers before forwarding traffic to internal components.CVE-2026-66778 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.3
SAP Approuter does not sufficiently sanitize certain request headers before forwarding traffic to internal components. An unauthenticated attacker could send a specially crafted request to obtain limited unauthorized access to information. This results in a low impact on confidentiality. There is no impact on integrity and availability.
- Product
- SAP Business AI Platform (Approuter)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026SAP Approuter does not sufficiently validate certain incoming requests before forwarding them to backend destinations.CVE-2026-66777 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.9
SAP Approuter does not sufficiently validate certain incoming requests before forwarding them to backend destinations. Due to the complexity of the required conditions, an attacker with low privileges could send specially crafted requests to bypass authorization checks and reach protected resources beyond their assigned scope. Successful exploitation could allow the attacker to read sensitive data and perform limited modifications on protected resources, resulting in a high impact on confidentiality and a low impact on integrity. There is no impact on availability.
- Product
- SAP Business AI Platform (Approuter)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026SAP Approuter does not consistently enforce integrity verification on certain session-related request headers under specific conditions.CVE-2026-66776 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.9
SAP Approuter does not consistently enforce integrity verification on certain session-related request headers under specific conditions. An attacker with low privileges could send a specially crafted request that bypasses the integrity check and loads another user's session context. Successful exploitation requires the attacker to have previously observed matching session values out-of-band, which makes the attack complex to execute. This could result in a high impact on confidentiality and a low impact on integrity. There is no impact on availability.
- Product
- SAP Business AI Platform (Approuter)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026SAP Approuter does not enforce cross-site request forgery protection on the authentication flow by default.CVE-2026-66775 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
SAP Approuter does not enforce cross-site request forgery protection on the authentication flow by default. An unauthenticated attacker could craft a malicious link and trick a victim into following it. Successful exploitation could allow the attacker to bind the victim's session to an attacker-controlled identity, resulting in a low impact on integrity. There is no impact on confidentiality and availability.
- Product
- SAP Business AI Platform (Approuter)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026SAP Approuter does not consistently handle certain error conditions.CVE-2026-66774 · Network & remote access · SAP_SE · reported by cna@sap.comLow 3.7
SAP Approuter does not consistently handle certain error conditions. An attacker with low privileges could exploit this under a non-default configuration. Successful exploitation is highly complex, as it depends on conditions outside the attacker's control. This could result in a low impact on availability. There is no impact on confidentiality and integrity.
- Product
- SAP Business AI Platform (Approuter)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026A malicious or compromised OData service could disclose sensitive authentication information and inject untrusted data into the application, which may leads to CVE-2026-66773 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.9
A malicious or compromised OData service could disclose sensitive authentication information and inject untrusted data into the application, which may leads to a high impact on confidentiality and low impact on integrity and no impact on Availability.
- Product
- Odata
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026SAP BusinessObjects Business Intelligence Platform (Admin Tools) does not perform sufficient authorization check on certain administrative functionality.CVE-2026-66772 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
SAP BusinessObjects Business Intelligence Platform (Admin Tools) does not perform sufficient authorization check on certain administrative functionality. An attacker authenticated as a non-administrative user could bypass this restriction to gain limited information about affected functionality. This results in a low impact on confidentiality. There is no impact on integrity and availability.
- Product
- SAP BusinessObjects Business Intelligence Platform (Admin Tools)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026SAPUI5 allows a key user with content adaptation privileges to inject malicious script content into persisted application changes.CVE-2026-66771 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.1
SAPUI5 allows a key user with content adaptation privileges to inject malicious script content into persisted application changes. When another user subsequently opens the adapted application, the injected script executes in the victim's browser session. Successful exploitation could allow the attacker to access sensitive session data and perform unauthorized actions on behalf of the victim, resulting in a high impact on confidentiality and integrity. There is no impact on availability.
- Product
- SAPUI5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026Due to an SQL Injection vulnerability in SAP Social intelligence, an authenticated attacker could directly inject an SQL DDL (Data Definition Language) string iCVE-2026-66770 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.3
Due to an SQL Injection vulnerability in SAP Social intelligence, an authenticated attacker could directly inject an SQL DDL (Data Definition Language) string into the underlying database without further authorization. Successful exploitation could allow the attacker to make malicious changes to the database structure, resulting in a low impact to the confidentiality, integrity, and availability of the system.
- Product
- SAP Social Intelligence
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026Reprocess Bank Statement Items in SAP S/4HANA does not perform the necessary authorization checks for authenticated users, allowing them to use rules that have CVE-2026-66764 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
Reprocess Bank Statement Items in SAP S/4HANA does not perform the necessary authorization checks for authenticated users, allowing them to use rules that have not been shared with them, resulting in privilege escalation.This vulnerability has a low impact on confidentiality, with no impact on integrity and availability of the application
- Product
- SAP S/4 HANA (Reprocess Bank Statement Items)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026SAP BusinessObjects Business Intelligence Platform stores certain sensitive credentials associated with user objects using a hard-coded cryptographic key.CVE-2026-66763 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 7.9
SAP BusinessObjects Business Intelligence Platform stores certain sensitive credentials associated with user objects using a hard-coded cryptographic key. An attacker with high privileges and local access to the server could retrieve these objects and decrypt the stored credentials. Successful exploitation could allow the attacker to obtain sensitive authentication data and modify protected information, resulting in a high impact on confidentiality and integrity. There is no impact on availability.
- Product
- SAP BusinessObjects Business Intelligence Platform (Central Management Server)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026SAP Approuter does not enforce sufficient flow control in certain functionality.CVE-2026-66761 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
SAP Approuter does not enforce sufficient flow control in certain functionality. An attacker with low privileges could send high volumes of data without consuming responses, causing unbounded memory growth. This results in a low impact on availability. There is no impact on confidentiality and integrity.
- Product
- SAP Business AI Platform (Approuter)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026SAP Approuter does not correctly validate client certificates in certain callback flows.CVE-2026-66760 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.4
SAP Approuter does not correctly validate client certificates in certain callback flows. An attacker with low privileges, holding a certificate from the same trusted authority with matching subject values, could bypass the identity check. This complexity makes the attack difficult to execute. Successful exploitation could allow impersonation of a trusted internal component, resulting in a high impact on integrity and a low impact on confidentiality and availability.
- Product
- SAP Business AI Platform (Approuter)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026SAP BusinessObjects Business Intelligence Platform (Web Intelligence) allows a low-privileged attacker to upload a specially crafted spreadsheet file containingCVE-2026-58248 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.5
SAP BusinessObjects Business Intelligence Platform (Web Intelligence) allows a low-privileged attacker to upload a specially crafted spreadsheet file containing malicious external references. When the file is processed as a data source, the affected component resolves these references and exposes the contents of sensitive server-side files within the resulting report. This results in a high impact on confidentiality, with no impact on integrity and availability.
- Product
- SAP BusinessObjects Business Intelligence
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026SAP ABAP Platform allows an unauthenticated user to send a specially crafted request to an internal component.CVE-2026-58247 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.3
SAP ABAP Platform allows an unauthenticated user to send a specially crafted request to an internal component. This could disclose limited, non-sensitive data from previously used memory, leading to a low on confidentiality, with no impact on integrity and availability of the application.
- Product
- SAP ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026SAP Advanced Planning and Optimization (Model Mix Planning) contains a hardcoded credential within the source code of the application to perform authorization cCVE-2026-58245 · Network & remote access · SAP_SE · reported by cna@sap.comLow 3.8
SAP Advanced Planning and Optimization (Model Mix Planning) contains a hardcoded credential within the source code of the application to perform authorization check to access certain functionalities in the application. An attacker with high privileges could leverage this hardcoded credential to bypass authorization and delete specific planning-related restrictions in the application. Successful exploitation could result in a low impact on confidentiality and integrity, with no impact on availability of the application.
- Product
- SAP Advanced Planning and Optimization (Model Mix Planning)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026SAP Manufacturing Integration and Intelligence (MII) does not perform necessary authorization check on certain application function, allowing a low-privileged aCVE-2026-58244 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
SAP Manufacturing Integration and Intelligence (MII) does not perform necessary authorization check on certain application function, allowing a low-privileged authenticated attacker to access information that should be restricted to privileged users. Successful exploitation could allow the attacker to access the users account information in the application, which could be leveraged to facilitate further attacks against the identified user accounts. This vulnerability results in low impact on confidentiality of the data, with no impact on the integrity and availability
- Product
- SAP Manufacturing Integration and Intelligence
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026SAP ABAP Development Tools does not perform necessary authorization checks for certain functionality, allowing an attacker with low privileges to execute unauthCVE-2026-58243 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 8.8
SAP ABAP Development Tools does not perform necessary authorization checks for certain functionality, allowing an attacker with low privileges to execute unauthorized database operations against SAP NetWeaver AS ABAP. Successful exploitation could allow the attacker to read sensitive data, modify application data, and disrupt access for legitimate users, resulting in high impact on confidentiality, integrity, and availability.
- Product
- SAP ABAP Developer Tools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026SAP NetWeaver and ABAP Platform (Change and Transport System - Customer Transport Integration Wizard) allows a low-privileged user to modify configuration tableCVE-2026-58241 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.2
SAP NetWeaver and ABAP Platform (Change and Transport System - Customer Transport Integration Wizard) allows a low-privileged user to modify configuration tables that control access to data objects during specific operations. These unauthorized modifications could result in processing delays and operational disruption, leading to a low impact on the integrity and availability of the application with no impact on confidentiality.
- Product
- SAP NetWeaver and ABAP Platform (Change and Transport System - Customer Transport Integration Wizard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026SAP Approuter does not sufficiently validate tenant context in inbound requests.CVE-2026-58239 · Network & remote access · SAP_SE · reported by cna@sap.comLow 3.7
SAP Approuter does not sufficiently validate tenant context in inbound requests. An unauthenticated attacker could send specially crafted requests to spoof the tenant context under conditions not fully within their control. Successful exploitation could allow limited access to another tenant's information, resulting in a low impact on confidentiality. There is no impact on integrity and availability.
- Product
- SAP Business AI Platform (Approuter)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026SAP Approuter does not sufficiently handle certain requests under specific conditions.CVE-2026-58238 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.9
SAP Approuter does not sufficiently handle certain requests under specific conditions. An unauthenticated attacker could send specially crafted input that causes the component to crash and restart. Successful exploitation requires specific runtime conditions to be met, making the attack complex to execute. This results in a high impact on availability. There is no impact on confidentiality and integrity.
- Product
- SAP Business AI Platform (Approuter)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026WebSocket of SAP Approuter does not perform sufficient authorization checks in certain functionality.CVE-2026-58237 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.9
WebSocket of SAP Approuter does not perform sufficient authorization checks in certain functionality. An attacker with low privileges could exploit this to access restricted functionality. Successful exploitation could allow the attacker to read sensitive information and perform limited modifications, resulting in a high impact on confidentiality and a low impact on integrity. There is no impact on availability.
- Product
- SAP Business AI Platform (Approuter)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026SAP NetWeaver Application Server ABAP and ABAP Platform allow an attacker with high privileges to bypass missing security controls on an internal code path leadCVE-2026-58236 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.5
SAP NetWeaver Application Server ABAP and ABAP Platform allow an attacker with high privileges to bypass missing security controls on an internal code path leading to operating system command execution. Successful exploitation could allow the attacker to execute OS-level commands that write to the operating system or stop the SAP system, resulting in no impact on confidentiality, low impact on integrity, and high impact on availability.
- Product
- SAP NetWeaver Application Server ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026SAP NetWeaver Application Server Java (Adobe Document Service) uses outdated open source cryptographic and data transfer libraries that contain known vulnerabilCVE-2026-58235 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.3
SAP NetWeaver Application Server Java (Adobe Document Service) uses outdated open source cryptographic and data transfer libraries that contain known vulnerabilities addressed in later versions. A low-privileged authenticated attacker could potentially leverage these weaknesses against the affected component, though no specific exploit is currently known. Successful exploitation could result in low impact on confidentiality, integrity, and availability of the system.
- Product
- SAP NetWeaver AS Java (Adobe Document Services)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026SAP Approuter does not sufficiently validate certain token content under specific configurations.CVE-2026-58230 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 7
SAP Approuter does not sufficiently validate certain token content under specific configurations. An unauthenticated attacker could send a specially crafted token to cause sensitive credential material to be sent to an attacker-controlled destination. The attack complexity is high due to non-default preconditions required in the target environment. This results in a high impact on confidentiality and a low impact on integrity and availability.
- Product
- SAP Business AI Platform (Approuter)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated remote attacker could access schedulingCVE-2026-44765 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 7.3
Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated remote attacker could access scheduling-related application functions without proper authorization validation. Successful exploitation could allow the attacker to retrieve, create, modify, or delete application-managed scheduling data, causing a low impact on confidentiality, integrity, and availability.
- Product
- SAP Manufacturing Integration and Intelligence
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated attacker could send crafted requests toCVE-2026-44764 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 7.3
Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated attacker could send crafted requests to the Cost Servlet using specific parameter values. If processed by the application, these requests enable access to backend operations. Successful exploitation could allow the attacker to read, create, modify, or delete application-managed business data, resulting in a limited impact on the confidentiality, integrity, and availability of the affected system.
- Product
- SAP Manufacturing Integration and Intelligence
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026SAP Manufacturing Integration and Intelligence allows a privileged attacker to exploit insufficient file path validation in certain functions using specially crCVE-2026-44763 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 7.6
SAP Manufacturing Integration and Intelligence allows a privileged attacker to exploit insufficient file path validation in certain functions using specially crafted input. Exploitation also requires a legitimate user to subsequently access the attacker-influenced content and depends on conditions outside the attacker�s control. Successful exploitation could allow files to be written outside the intended directory and affect other components, resulting in a high impact on confidentiality, integrity, and availability.
- Product
- SAP Manufacturing Integration and Intelligence
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.