Search vulnerabilities

Expected end of text, found ':' (at char 6), (line:1, col:7)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,959

CVE-2026-66778

Multiple vulnerabilities in SAP Business AI Platform (Approuter)

SAP Approuter does not sufficiently sanitize certain request headers before forwarding traffic to internal components. An unauthenticated attacker could send a specially crafted request to obtain limited unauthorized access to information. This results in a low impact on confidentiality. There is no impact on integrity and availability.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Sap Sap Se
Products
Approuter Sap Business Ai Platform (approuter)
CVE-2026-44745

Open Redirect vulnerability in SAP Approuter

SAP Approuter does not properly validate incoming request headers during the OAuth2 login flow under certain configurations. This allows an unauthenticated remote attacker to craft a malicious link which, when clicked by a victim, could lead to unauthorized access. Successful exploitation results in a high impact to the confidentiality and integrity with no impact on the availability of the application.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Sap Sap Se
Products
Approuter Sap Approuter
CVE-2026-58237

Multiple vulnerabilities in SAP Business AI Platform (Approuter)

WebSocket of SAP Approuter does not perform sufficient authorization checks in certain functionality. An attacker with low privileges could exploit this to access restricted functionality. Successful exploitation could allow the attacker to read sensitive information and perform limited modifications, resulting in a high impact on confidentiality and a low impact on integrity. There is no impact on availability.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Sap Sap Se
Products
Approuter Sap Business Ai Platform (approuter)
CVE-2026-58239

Multiple vulnerabilities in SAP Business AI Platform (Approuter)

SAP Approuter does not sufficiently validate tenant context in inbound requests. An unauthenticated attacker could send specially crafted requests to spoof the tenant context under conditions not fully within their control. Successful exploitation could allow limited access to another tenant's information, resulting in a low impact on confidentiality. There is no impact on integrity and availability.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Sap Sap Se
Products
Approuter Sap Business Ai Platform (approuter)
CVE-2026-66761

Multiple vulnerabilities in SAP Business AI Platform (Approuter)

SAP Approuter does not enforce sufficient flow control in certain functionality. An attacker with low privileges could send high volumes of data without consuming responses, causing unbounded memory growth. This results in a low impact on availability. There is no impact on confidentiality and integrity.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Sap Sap Se
Products
Approuter Sap Business Ai Platform (approuter)
CVE-2026-66775

Multiple vulnerabilities in SAP Business AI Platform (Approuter)

SAP Approuter does not enforce cross-site request forgery protection on the authentication flow by default. An unauthenticated attacker could craft a malicious link and trick a victim into following it. Successful exploitation could allow the attacker to bind the victim's session to an attacker-controlled identity, resulting in a low impact on integrity. There is no impact on confidentiality and availability.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Sap Sap Se
Products
Approuter Sap Business Ai Platform (approuter)
CVE-2026-66777

Multiple vulnerabilities in SAP Business AI Platform (Approuter)

SAP Approuter does not sufficiently validate certain incoming requests before forwarding them to backend destinations. Due to the complexity of the required conditions, an attacker with low privileges could send specially crafted requests to bypass authorization checks and reach protected resources beyond their assigned scope. Successful exploitation could allow the attacker to read sensitive data and perform limited modifications on protected resources, resulting in a high impact on confidentiality and a low impact on integrity. There is no impact on availability.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Sap Sap Se
Products
Approuter Sap Business Ai Platform (approuter)
CVE-2026-86806

opengeos GeoLibre _is_within_roots server-side request forgery

A weakness has been identified in opengeos GeoLibre up to 2.3.0. Impacted is the function _is_within_roots. This manipulation causes server-side request forgery. The attack can be initiated remotely. Upgrading to version 2.4.0 is recommended to address this issue. Patch name: b745f62e29fa37364686525a21eee5e5c0f8a369. It is recommended to upgrade the affected component.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Opengeos
Products
Geolibre
CVE-2026-86716

Cesanta mJS mjs_tok.c skip_spaces_and_comments heap-based overflow

A vulnerability was determined in Cesanta mJS up to 1.26. Affected is the function skip_spaces_and_comments of the file src/mjs_tok.c. Executing a manipulation can lead to heap-based buffer overflow. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Cesanta
Products
Mjs
CVE-2026-77907

Visual Studio Remote Code Execution Vulnerability

Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Visual Studio 2026
CVE-2026-69904

Microsoft Office SharePoint Information Disclosure Vulnerability

Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Sharepoint Server
CVE-2026-69559

Microsoft Teams for Android Information Disclosure Vulnerability

Origin validation error in Microsoft Teams for Android allows an authorized attacker to disclose information over a network.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Teams
CVE-2026-69282

Microsoft Office SharePoint Remote Code Execution Vulnerability

Improper access control in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Sharepoint Server
CVE-2026-65812

Microsoft Teams for Android Information Disclosure Vulnerability

Insertion of sensitive information into sent data in Microsoft Teams for Android allows an authorized attacker to disclose information over a network.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Teams
CVE-2026-27258

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Adobe
Products
Dng Sdk Dng Software Development Kit
CVE-2026-27222

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Adobe Apple Microsoft
Products
Bridge Macos Windows
CVE-2026-21269

ColdFusion | Cross-site Scripting (Stored XSS) (CWE-79)

ColdFusion is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Adobe
Products
Coldfusion Coldfusion 2023 Coldfusion 2025
CVE-2025-34115

OP5 Monitor <= 7.1.9 Authenticated Command Execution via command_test.php

An authenticated command injection vulnerability exists in OP5 Monitor through version 7.1.9 via the 'cmd_str' parameter in the command_test.php endpoint. A user with access to the web interface can exploit the 'Test this command' feature to execute arbitrary shell commands as the unprivileged web application user. The vulnerability resides in the configuration section of the application and requires valid login credentials with access to the command testing functionality. This issue is fixed in version 7.2.0.

CVSS 4.0 · 8.7 High EPSS 3.5% KEV · Not listed
Vendors
Op5
Products
Monitor