CVE-2026-44765

Missing Authorization Check in SAP Manufacturing Integration and Intelligence

Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated remote attacker could access scheduling-related application functions without proper authorization validation. Successful exploitation could allow the attacker to retrieve, create, modify, or delete application-managed scheduling data, causing a low impact on confidentiality, integrity, and availability.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Sap

Products

Manufacturing Integration And Intelligence

CVE-2026-58235

Use of Vulnerable Third-Party Component in SAP NetWeaver AS Java (Adobe Document Services)

SAP NetWeaver Application Server Java (Adobe Document Service) uses outdated open source cryptographic and data transfer libraries that contain known vulnerabilities addressed in later versions. A low-privileged authenticated attacker could potentially leverage these weaknesses against the affected component, though no specific exploit is currently known. Successful exploitation could result in low impact on confidentiality, integrity, and availability of the system.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Sap Se

Products

Sap Netweaver As Java (adobe Document Services)

CVE-2026-58236

OS Command Injection vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform

SAP NetWeaver Application Server ABAP and ABAP Platform allow an attacker with high privileges to bypass missing security controls on an internal code path leading to operating system command execution. Successful exploitation could allow the attacker to execute OS-level commands that write to the operating system or stop the SAP system, resulting in no impact on confidentiality, low impact on integrity, and high impact on availability.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Sap Se

Products

Sap Netweaver Application Server Abap And Abap Platform

CVE-2026-11809

UpdateHub probe: uninitialized-heap out-of-bounds read of network-supplied metadata

The UpdateHub OTA client in subsys/mgmt/updatehub/updatehub.c contains an out-of-bounds / uninitialized-memory read in z_impl_updatehub_probe(). The probe response from the UpdateHub server is copied into a heap buffer (metadata) that is correctly NUL-terminated, but a second buffer (metadata_copy) is allocated with k_malloc (unzeroed) and filled with memcpy(metadata_copy, metadata, strlen(metadata)), which omits the terminating NUL. Everything after the copied content remains uninitialized heap. When the first json_obj_parse() over the array descriptor fails, the code falls back to json_obj_parse(metadata_copy, strlen(metadata_copy), ...). The strlen() call scans past the copied bytes through uninitialized heap and, if no zero byte is found before the end of the allocation, reads beyond the buffer; the resulting over-long length is then parsed as JSON. The probe payload is fully controlled by the (malicious, compromised, or — without the optional CONFIG_UPDATEHUB_DTLS — on-path) UpdateHub server, which can craft a large payload that fails the first parse to drive this path. The consequence is a read of uninitialized heap, with a worst case of an out-of-bounds read past the metadata_copy allocation that can fault and crash the update thread/device, producing a network-triggerable denial of service. The over-read data is consumed only internally to evaluate the update and is not returned to the attacker, so there is no direct information disclosure and no out-of-bounds write. The fix zeroes metadata_copy with memset before the copy, guaranteeing NUL termination and bounding strlen() within the allocation.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Zephyrproject

Products

Zephyr

CVE-2026-66763

Credentials disclosure in SAP BusinessObjects Business Intelligence Platform (Central Management Server)

SAP BusinessObjects Business Intelligence Platform stores certain sensitive credentials associated with user objects using a hard-coded cryptographic key. An attacker with high privileges and local access to the server could retrieve these objects and decrypt the stored credentials. Successful exploitation could allow the attacker to obtain sensitive authentication data and modify protected information, resulting in a high impact on confidentiality and integrity. There is no impact on availability.

CVSS 3.1 · 7.9 High EPSS < 1% KEV · Not listed

Vendors

Sap Se

Products

Sap Business Objects Business Intelligence Platform

CVE-2026-66764

Missing Authorization check in SAP S/4 HANA (Reprocess Bank Statement Items)

Reprocess Bank Statement Items in SAP S/4HANA does not perform the necessary authorization checks for authenticated users, allowing them to use rules that have not been shared with them, resulting in privilege escalation.This vulnerability has a low impact on confidentiality, with no impact on integrity and availability of the application

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Sap Se

Products

Sap S/4 Hana (reprocess Bank Statement Items)

CVE-2026-66770

SQL Injection vulnerability in SAP Social Intelligence

Due to an SQL Injection vulnerability in SAP Social intelligence, an authenticated attacker could directly inject an SQL DDL (Data Definition Language) string into the underlying database without further authorization. Successful exploitation could allow the attacker to make malicious changes to the database structure, resulting in a low impact to the confidentiality, integrity, and availability of the system.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Sap Se

Products

Sap Social Intelligence

CVE-2026-67553

Apache Qpid Proton Dotnet: Incoming session flow control window can be exceeded

An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. This issue affects Apache Qpid Proton-Dotnet: through 1.0.0. Users are recommended to upgrade to version 1.1.0, which fixes the issue.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Qpid Proton-dotnet Qpid Proton Dotnet

CVE-2026-67554

Apache Qpid Proton Dotnet: Unbounded disposition range handling can lead to denial of service

An authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usage due to naive range handling, leading to denial of service. This issue affects Apache Qpid Proton-Dotnet: through 1.0.0. Users are recommended to upgrade to version 1.1.0, which fixes the issue.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Qpid Proton-dotnet Qpid Proton Dotnet

CVE-2026-67555

Apache Qpid Proton Dotnet: Unable to govern the maximum number of transfer frames per incoming delivery

It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage and potential denial of service This issue affects Apache Qpid Proton-Dotnet: through 1.0.0. Users are recommended to upgrade to version 1.1.0, which fixes the issue.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Qpid Proton-dotnet Qpid Proton Dotnet

CVE-2026-66771

Cross Site Scripting (XSS) vulnerability in SAPUI5

SAPUI5 allows a key user with content adaptation privileges to inject malicious script content into persisted application changes. When another user subsequently opens the adapted application, the injected script executes in the victim's browser session. Successful exploitation could allow the attacker to access sensitive session data and perform unauthorized actions on behalf of the victim, resulting in a high impact on confidentiality and integrity. There is no impact on availability.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Sap Se

Products

Sapui5

CVE-2026-71983

MSI Radix AXE6600 v781521 Command Injection via wps.cgi

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the wps.cgi interface that allows remote attackers to execute arbitrary commands by injecting malicious input through the pin2g, pin5g, or pin6g parameters. Attackers can exploit these unsanitized parameters to execute arbitrary commands on the affected device and obtain root privileges.

CVSS 4.0 · 9.3 Critical EPSS 2.5% KEV · Not listed

Vendors

Msi

Products

Radix Axe6600

CVE-2026-71984

MSI Radix AXE6600 v781521 Command Injection via urlfilter

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the urlfilter function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit the urlfilter function to inject malicious commands and obtain root privileges on the underlying system.

CVSS 4.0 · 9.3 Critical EPSS 2.5% KEV · Not listed

Vendors

Msi

Products

Radix Axe6600

CVE-2026-71987

MSI Radix AXE6600 v781521 Command Injection via alg function

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the alg function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the alg function to execute malicious commands and obtain root privileges on the underlying system.

CVSS 4.0 · 9.3 Critical EPSS 2.5% KEV · Not listed

Vendors

Msi

Products

Radix Axe6600

CVE-2026-66772

Missing Authorization Check in SAP BusinessObjects Business Intelligence Platform (Admin Tools)

SAP BusinessObjects Business Intelligence Platform (Admin Tools) does not perform sufficient authorization check on certain administrative functionality. An attacker authenticated as a non-administrative user could bypass this restriction to gain limited information about affected functionality. This results in a low impact on confidentiality. There is no impact on integrity and availability.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Sap Se

Products

Sap Business Objects Business Intelligence Platform

CVE-2026-71988

MSI Radix AXE6600 v781521 Command Injection via portFw function

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the portFw function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the alg function to execute malicious commands and obtain root privileges on the underlying system.

CVSS 4.0 · 9.3 Critical EPSS 2.5% KEV · Not listed

Vendors

Msi

Products

Radix Axe6600

CVE-2026-71989

MSI Radix AXE6600 v781521 Command Injection via porTrigger function

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the porTrigger function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the alg function to execute malicious commands and obtain root privileges on the underlying system.

CVSS 4.0 · 9.3 Critical EPSS 2.5% KEV · Not listed

Vendors

Msi

Products

Radix Axe6600

CVE-2026-72904

Firecrawl: Arbitrary file read via JSON Schema $ref expansion

Firecrawl turns entire websites into LLM-ready markdown or structured data. Prior to 2.11.32, a critical arbitrary file read vulnerability exists in Firecrawl's extraction functionality due to unsafe schema dereferencing of user-supplied JSON schemas in apps/api/src/lib/extract/helpers/dereference-schema.ts. The affected code invokes the json-schema-ref-parser dependency with default resolver settings, allowing external and local file references to be resolved during schema processing. An authenticated attacker can supply a malicious schema containing a $ref within default, const, or enum fields that are not traversed by AJV validation. By triggering a dereference error, file contents from the extract worker filesystem may be included in persisted error messages returned through the extraction API, enabling arbitrary file reads and SSRF against internal or external HTTP endpoints. This issue is fixed in version 2.11.32.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Firecrawl

Products

Firecrawl

CVE-2026-66773

Server-controlled `__next` URL is not checking cross-origin

A malicious or compromised OData service could disclose sensitive authentication information and inject untrusted data into the application, which may leads to a high impact on confidentiality and low impact on integrity and no impact on Availability.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Sap Se

Products

Odata

CVE-2026-71993

MSI Radix AXE6600 v781521 Command Injection via openvpn function

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the openvpn function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit the macfilter function to inject malicious commands and obtain root privileges on the underlying system.

CVSS 4.0 · 9.3 Critical EPSS 2.5% KEV · Not listed

Vendors

Msi

Products

Radix Axe6600