CVE-2026-75621

IBM Aspera Enterprise Webapps Execution with Unnecessary Privileges

IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker to obtain sensitive information due to excessive permissions assigned to a service account.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Aspera Enterprise Webapps

CVE-2026-75095

IBM Aspera Enterprise Webapps Denial of Service

IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Aspera Enterprise Webapps

CVE-2026-75063

IBM Planning Analytics Local is affected by security vulnerabilities

IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to execute arbitrary JavaScript due to improper output encoding.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Planning Analytics

CVE-2026-75061

IBM Planning Analytics Local is affected by security vulnerabilities

IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to write arbitrary files on the system.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Planning Analytics

CVE-2026-74045

Wazuh 3.12.0 before 4.14.8 Heap Buffer Overflow in wazuh-analysisd FIM Decoder

Wazuh from 3.12.0 before 4.14.8 contains a heap buffer overflow in fim_generate_alert() where full_log is sized from input but written bounded by OS_MAXSTR. An enrolled agent can send a crafted FIM syscheck event to corrupt manager heap memory and deterministically crash wazuh-analysisd, causing a fleet-wide detection outage.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Wazuh

Products

Wazuh

CVE-2026-73642

Path Traversal in Dayforce ESS Excelity

Dayforce ESS Excelity is vulnerable to Path Traversal  in file download functionality. An unauthenticated attacker can sent GET request with file path parameter set to any path including an absolute local file path. This issue was fixed in version V4.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Dayforce

Products

Ess Excelity Payroll

CVE-2026-73641

Multiple Reflected XSS in Dayforce ESS Excelity

Dayforce ESS Excelity is vulnerable to Reflected XSS in multiple endpoints. An attacker can prepare a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. This issue was fixed in version V4.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Dayforce

Products

Ess Excelity Payroll

CVE-2026-73640

Time-based SQL Injection in Dayforce ESS Excelity

Dayforce ESS Excelity is vulnerable to Time Based-Blind SQL Injection in password recovery functionality. The unauthenticated attacker can prepare GET request with one of the parameters filled in with an arbitrary SQL query. The parameter is interpreted as part of SQL predicate resulting in Time-Based Blind SQL Injection. This issue was fixed in version V3.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Dayforce

Products

Ess Excelity Payroll

CVE-2026-58249

Memory Corruption vulnerability in SAP NetWeaver and SAP Web Dispatcher (Internet Communication Manager)

SAP NetWeaver and SAP Web Dispatcher do not properly validate certain fields in specially crafted requests handled by an internal protocol component. An unauthenticated attacker could send a malicious request that triggers a memory-handling error, causing the affected process to crash. Successful exploitation can therefore result in a high impact on the availability of the affected application. There is no impact on the confidentiality or integrity of the application.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Sap Se

Products

Sap Netweaver And Sap Web Dispatcher (internet Communication Manager)

CVE-2026-58242

Improper Authorization check in SAP Cloud Connector

SAP Cloud Connector contains an improper authorization check, which could be exploited by a low-privileged attacker through specially crafted requests. Exploitation requires the attacker to be on an adjacent network. Successful exploitation could allow the attacker to obtain limited information about internal systems, resulting in low impact on confidentiality. There is no impact on integrity and availability.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Sap

Products

Cloud Connector

CVE-2026-54459

FileRise: Missing CSRF enforcement for file creation and share-link creation

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.14.0, FileRise authenticates requests to the file creation and share-link creation handlers but does not enforce the server-side CSRF token check used by adjacent state-changing operations. The POST endpoints /api/file/createFile.php and /api/file/createShareLink.php invoke FileController::createFile and FileController::createShareLink without rejecting a missing or invalid X-CSRF-Token header. A request issued with a logged-in user's session can create an empty file or create a share link with that user's permissions, although the default SameSite=Lax session cookie reduces ordinary cross-site POST reachability. This issue is fixed in version 3.14.0.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Error311

Products

Filerise

CVE-2026-53922

odhcpd: pre-auth remote DoS via size_t underflow in dhcpv6_ia_handle_IAs (stack BOF, canary-terminated)

odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In commit cfddd56 and earlier, an unauthenticated host on the same link can first obtain two bindings through normal DHCPv6 SOLICIT and REQUEST exchanges and then send a crafted RENEW containing multiple IA_NA options. An earlier matched IA consumes most of the response buffer, an unmatched IA causes the build_ia() status branch to write and return a NOBINDING response larger than the remaining space, and a subsequent matched IA is processed after dhcpv6_ia_handle_IAs() subtracts that over-return from an unsigned size_t. The resulting underflow disables subsequent length checks and permits attacker-controlled IA_ADDR serialization beyond the 512-byte stack buffer pdbuf in handle_client_request(). The stack canary terminates odhcpd, and sustained packets can repeatedly disrupt DHCPv6 service while procd respawns the process. The observed configuration does not establish code execution.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Openwrt

Products

Odhcpd Openwrt

CVE-2026-22314

Improper Control of Code Generation in Mesalvo Meona Components Enables Remote Code Execution

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority based on the reported functionality projecting intended administrative functionality.

CVSS n/a EPSS n/a KEV · Not listed

Vendors

Mesalvo

Products

Meona Client Launcher Component Meona Server Component

CVE-2026-19627

IBM Planning Analytics Local is affected by security vulnerabilities

IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to read arbitrary host files and overwrite certain application files due to improper validation of file paths.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Planning Analytics

CVE-2026-19622

IBM Planning Analytics Local is affected by security vulnerabilities

IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to bypass authentication and escalate privileges due to improper validation of sub-requests.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Planning Analytics

CVE-2026-19620

IBM Planning Analytics Local is affected by security vulnerabilities

IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to gain unauthorized administrative access due to improper authentication.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Planning Analytics

CVE-2026-18541

IBM Planning Analytics Local is affected by security vulnerabilities

IBM Planning Analytics 2.0, and 2.1 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Planning Analytics

CVE-2026-18537

IBM Maximo Application Suite - Location Service for Esri Component Code Execution

IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper input validation due to an unsanitised container image reference in a Kubernetes operator template.

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Maximo Application Suite Location Service For Esri Component

CVE-2026-18533

IBM Maximo Application Suite - Location Service for Esri Component Code Execution

IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper input validation due to an unsanitised container image configuration in a Kubernetes operator template.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Maximo Application Suite Location Service For Esri Component

CVE-2026-18529

IBM Maximo Application Suite - Location Service for Esri Component Code Execution

IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to command injection due to improper sanitisation of a user-controlled value passed to a shell command in a Kubernetes operator task.

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Maximo Application Suite Location Service For Esri Component