Export limit exceeded: 425694 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (425694 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-89131 | 2026-11-10 | 4.3 Medium | ||
| SAP NetWeaver Enterprise Portal does not sufficiently protect certain server-side actions against cross-site request forgery. An unauthenticated attacker could craft a malicious link that, when clicked by an authenticated user, triggers an unintended action on the server. Successful exploitation could allow the attacker to modify non-sensitive information, resulting in a low impact on integrity. There is no impact on confidentiality and availability. | ||||
| CVE-2026-120016 | 2026-11-10 | 6.1 Medium | ||
| SAP NetWeaver Visual Composer does not perform sufficient input validation and output encoding on certain request data. An unauthenticated attacker could craft a malicious link containing specially crafted input. If a victim clicks the link, the injected script executes in the victim's browser within the context of the affected application. This results in a low impact on confidentiality and integrity. There is no impact on availability. | ||||
| CVE-2026-120015 | 2026-11-10 | 7.5 High | ||
| SAP Host Agent does not sufficiently validate certain inputs. Under certain condition, an attacker with low privileges could abuse the affected functionality to influence an internal component into loading a malicious file under a privileged account. Successful exploitation could lead to persistent code execution, resulting in a high impact on confidentiality, integrity and availability. | ||||
| CVE-2026-120014 | 2026-11-10 | 7.6 High | ||
| SAP HANA XSA Web Dispatcher does not perform sufficient request validation in certain administrative functionality. In the context of SAP HANA XSA Web Dispatcher, an unauthenticated attacker could trick a logged-on administrator into visiting a malicious link. Visiting the link could cause unintended actions in the administrator's session. Successful exploitation could lead to a temporary compromise of the SAP HANA XSA Web Dispatcher, resulting in a high impact on confidentiality, and partial impact on integrity, and availability. | ||||
| CVE-2026-120010 | 2026-11-10 | 7.5 High | ||
| SAP NetWeaver Application Server (SAP Message Server) does not properly size memory allocations when handling certain HTTP requests. An unauthenticated attacker could send a specially crafted request to trigger a heap buffer overflow in affected functionality. Successful exploitation causes the component to abort and remain unavailable until it is restarted by the framework, resulting in a high impact on availability of the system. There is no impact on confidentiality and integrity of the application. | ||||
| CVE-2026-120008 | 2026-11-10 | 8.2 High | ||
| SAP NetWeaver (Internet Graphics Service) does not sufficiently validate certain input values within incoming requests. An unauthenticated user could send a specially crafted request to trigger an out-of-bounds memory write in a worker process. Successful exploitation could result in memory corruption or repeated termination of the affected process, resulting in a high impact on availability and a low impact on integrity with no impact on confidentiality. | ||||
| CVE-2026-109811 | 2026-11-10 | 6.5 Medium | ||
| An internal ABAP HTTP component in SAP NetWeaver and ABAP Platform (Application Server ABAP) has SSRF vulnerability due to insecure default settings. An authenticated attacker with low privileges could trick the victim to interact with a malicious server which allows the attacker to access sensitive information belonging to the victim and modify limited non-sensitive information. This results in a high impact on confidentiality and low impact on integrity. Availability is not impacted. | ||||
| CVE-2026-109810 | 2026-11-10 | 6.1 Medium | ||
| SAP NetWeaver Application Server Java (Web Dynpro Java) does not sufficiently validate certain request parameters used to resolve styling resources in the application. An unauthenticated attacker could craft a malicious link that, when clicked by an authenticated victim, causes the victim's browser to load attacker-controlled styling content within the trusted application context. Successful exploitation could allow the attacker to redress the trusted user interface for phishing purposes and exfiltrate limited web page content, resulting in a low impact on confidentiality and integrity. There is no impact on availability. | ||||
| CVE-2026-109809 | 2026-11-10 | 6.5 Medium | ||
| SAP NetWeaver Application Server Java (NWDI Cockpit) does not perform sufficient authorization checks for certain functionality before processing the requests. An attacker with low privileges could exploit this to perform unauthorized modifications. Successful exploitation results in high impact on integrity, with no impact on confidentiality and availability of the application. | ||||
| CVE-2026-4897 | 2 Freedesktop, Redhat | 6 Polkit, Enterprise Linux, Hummingbird and 3 more | 2026-11-10 | 5.5 Medium |
| A flaw was found in polkit. A local user can exploit this by providing a specially crafted, excessively long input to the `polkit-agent-helper-1` setuid binary via standard input (stdin). This unbounded input can lead to an out-of-memory (OOM) condition, resulting in a Denial of Service (DoS) for the system. | ||||
| CVE-2026-69555 | 1 Microsoft | 1 Azure Arc | 2026-11-10 | 10 Critical |
| Incorrect authorization in Azure Arc allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-66798 | 1 Microsoft | 2 Edge, Edge Chromium | 2026-11-10 | 4.3 Medium |
| Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-68798 | 1 Microsoft | 7 365 Apps, Microsoft 365, Office 2021 and 4 more | 2026-11-10 | 7.8 High |
| Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-66805 | 2 Microsoft, Redhat | 4 Sharepoint Server, Sharepoint Server 2016, Sharepoint Server 2019 and 1 more | 2026-11-10 | 8.8 High |
| Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | ||||
| CVE-2026-67177 | 2026-11-10 | 5.4 Medium | ||
| Chargemap contains a stored cross site scripting vulnerability. A remote, unauthenticated attacker could craft a payload in the username field of the account registration page and associate the new account with a victim's email. The attacker could send a forgotten password request to the victim, and the payload would execute when a victim opens the link. Fixed 2026-07-17. | ||||
| CVE-2026-62757 | 1 Microsoft | 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more | 2026-11-10 | 5.3 Medium |
| Improper verification of cryptographic signature in Windows Schannel allows an unauthorized attacker to bypass a security feature over a network. | ||||
| CVE-2026-67176 | 2026-11-10 | 5.4 Medium | ||
| Chargemap contains an open redirect vulnerability in the authentication login endpoint. A remote, unauthenticated attacker could send a crafted URL to a victim and redirect them to an attacker controlled domain. Fixed 2026-07-17. | ||||
| CVE-2026-68820 | 1 Microsoft | 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more | 2026-11-10 | 7 High |
| Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-68807 | 1 Microsoft | 17 365 Apps, Excel, Excel 2016 and 14 more | 2026-11-10 | 7.8 High |
| Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-68800 | 1 Microsoft | 17 365 Apps, Excel, Excel 2016 and 14 more | 2026-11-10 | 7.8 High |
| Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | ||||