2026

A vulnerability was found in java-json-tools jackson-coreutils 2.0. Affected by this vulnerability is the function BigDe

Improper Restriction of Software Interfaces to Hardware Features in ASUS Armoury Crate allows a local user to modify har

Exposed Dangerous Method or Function in ASUS Armoury Crate allow a local user to cause a brief system stall by bypassing

Exposed IOCTL with insufficient access control in ASUS Armoury Crate allows a local user to disclosure information and d

Allocation of Resources Without Limits or Throttling in ASUS Armoury Crate allows a local user to cause a denial-of-serv

Missing authentication for a critical function in ASUS Control Center Express Agent allows an unauthenticated nearby use

Sensitive Information in Resource Not Removed Before Reuse in ASUS Armoury Crate driver allows a local user to disclose

Exposure of Sensitive System Information to an Unauthorized Control Sphere in Armoury Crate driver allows a local user t

Release of Invalid Pointer or Reference in Armoury Crate driver allows a local user to free arbitrary memory via a craft

Exposed IOCTL with Insufficient Access Control in Armoury Crate driver allows a local user to read and write arbitrary P

Exposed IOCTL with Insufficient Access Control in Armoury Crate driver allows a local user to add an arbitrary process i

A Permissive Cross-domain Security Policy with Untrusted Domains in Armoury Crate allows a remote user to obtain a local

A vulnerability has been found in D-Link DIR-822A A_101. Affected is the function tunnel_set_params of the component L2T

A flaw has been found in D-Link DIR-895L A1_102b07. This impacts the function sendOffer/sendACK of the file udhcpcd/serv

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project usage_rules allows a maliciou

SAP UI5 does not sufficiently validate the parent frame's origin against the configured allowlist. An unauthenticated at

Due to a Server-Side Request Forgery (SSRF) vulnerability in SAP Manufacturing Integration and Intelligence, an attacker

@sap/cds-mtxs NPM library does not perform sufficient checks on certain functionality used in multitenant CAP applicatio

SAP Web Dispatcher, Internet Communication Manager and SAP Content Server allows an authenticated low-privileged attacke

SAP NetWeaver Business Client does not perform sufficient validation when processing certain locally stored data during

Due to a missing authorization check in Application Server ABAP of SAP NetWeaver and ABAP Platform, an authenticated att

SAP S/4HANA (Manage Bank Chains app) does not perform sufficient authorization checks within certain affected functional

SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cross-Site Request Forgery protection on c

SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cross-Site Request Forgery protection on c

SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cross-Site Request Forgery protection on c

SAP Integration Suite does not sufficiently validate XML documents accepted from untrusted sources in certain internal c

SAP GUI for Java does not correctly enforce the trust level policy for certain functions invoked from a connected backen

SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated user to send a specially crafted p

SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components d

SAP Process Integration (SOAP Adapter) allows a privileged user to send specially crafted requests containing deeply nes

SAP S/4HANA (Intercompany Matching and Reconciliation) allows a low-privileged authenticated user to inject malicious in

A memory safety vulnerability exists in the Extended Passport Protocol (EPP) processing library. Under specific conditio

knowns versions before 0.30.0 contain an authorization bypass vulnerability where mutating code actions are incorrectly

knowns versions before 0.30.0 serve the management API without authentication on all network interfaces by default, with

knowns before 0.30.0 fails to validate import names in the import routes, allowing unauthenticated attackers to write fi

knowns versions before 0.30.0 contain a path traversal vulnerability in the handleCodeReplace() function that allows att

knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, a

knowns through 0.33.0 contains a server-side request forgery vulnerability in the POST /api/embedding-models/test endpoi

knowns versions before 0.30.0 contain a path traversal vulnerability in the POST /api/templates/preview endpoint that al

knowns versions before 0.30.0 fail to validate filesystem paths in MCP tool arguments, allowing attackers to read, creat

Improper Authentication vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker

Server-Side Request Forgery (SSRF) vulnerability in ash-project ash_authentication_oauth2_server allows an attacker who

Improper Encoding or Escaping of Output vulnerability in ash-project ash_authentication_oauth2_server allows an unauthen

Use of Cache Containing Sensitive Information vulnerability in ash-project ash_authentication_oauth2_server allows a sha

Improper Protection of Alternate Path vulnerability in ash-project ash_authentication_oauth2_server exposes the state-ch

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_authentication_oauth2_server allow

Improper Protection of Alternate Path vulnerability in ash-project ash_lua allows a user-supplied Lua script to read att

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project igniter allows a malicious pa

Improper Handling of Alternate Encoding vulnerability in ash-project ash_double_entry allows an attacker to submit sever

Lara Dashboard before 1.3.2 fails to authorize the MarketplaceModuleBrowser installModule Livewire action, allowing non-