CVE Explorer

Exact snapshot results

353,537 CVE records

CVE ID descending · no relevance ranking

CVE-2026-44811

Heap-based buffer overflow in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.

PUBLISHED

Vendor: Microsoft
Product: Windows 11 version 26H1
Provider severity: HIGH
Conflicts: 1

CVE-2026-44810

Improper authentication in Windows Cryptographic Services allows an unauthorized attacker to elevate privileges locally.

PUBLISHED

Vendor: Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product: Windows 11 version 26H1, Windows 11 version 23H2, Windows Server 2025 (Server Core installation), Windows 11 Version 23H2, Windows 11 Version 24H2, Windows Server 2025, Windows Server 2022, Windows 11 Version 25H2
Provider severity: HIGH
Conflicts: 1

CVE-2026-44809

Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

PUBLISHED

Vendor: Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product: Windows Server 2025, Windows Server 2025 (Server Core installation), Windows 11 Version 24H2, Windows 11 Version 25H2, Windows 11 version 26H1
Provider severity: HIGH
Conflicts: 1

CVE-2026-44808

Heap-based buffer overflow in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.

PUBLISHED

Vendor: Microsoft
Product: Windows 11 version 26H1
Provider severity: HIGH
Conflicts: 1

CVE-2026-44807

Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.

PUBLISHED

Vendor: Microsoft
Product: Windows 11 version 26H1
Provider severity: HIGH
Conflicts: 0

CVE-2026-44806

Missing release of memory after effective lifetime in Windows Cryptographic Services allows an unauthorized attacker to deny service over a network.

PUBLISHED

Vendor: Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product: Windows Server 2025, Windows Server 2016, Windows 10 Version 1607, Windows Server 2016 (Server Core installation), Windows Server 2019, Windows 10 Version 1809, Windows Server 2012 (Server Core installation), Windows Server 2025 (Server Core installation), Windows 10 Version 22H2, Windows Server 2012 R2 (Server Core installation), Windows Server 2012 R2, Windows 11 Version 24H2, Windows Server 2012, Windows 11 Version 25H2, Windows Server 2019 (Server Core installation), Windows 11 version 26H1, Windows Server 2022, Windows 10 Version 21H2
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-44805

Use after free in Windows Network Controller (NC) Host Agent allows an authorized attacker to deny service locally.

PUBLISHED

Vendor: Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product: Windows Server 2025, Windows Server 2022, Windows Server 2019 (Server Core installation), Windows Server 2019, Windows Server 2025 (Server Core installation)
Provider severity: MEDIUM
Conflicts: 2

CVE-2026-44804

Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.

PUBLISHED

Vendor: Microsoft
Product: Windows 11 version 26H1
Provider severity: HIGH
Conflicts: 0

CVE-2026-44803

Integer overflow or wraparound in Windows Win32K - GRFX allows an unauthorized attacker to execute code locally.

PUBLISHED

Vendor: Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product: Microsoft Excel for Android, Windows 10 Version 22H2, Windows 11 Version 23H2, Windows Server 2012, Windows 11 version 23H2, Microsoft PowerPoint for Android, Windows Server 2019, Windows Server 2012 R2, Windows Server 2012 (Server Core installation), Windows 11 version 26H1, Windows Server 2025 (Server Core installation), Windows 10 Version 1809, Windows Server 2019 (Server Core installation), Windows 10 Version 21H2, Windows Server 2016 (Server Core installation), Windows Server 2016, Windows 10 Version 1607, Windows Server 2012 R2 (Server Core installation), Windows Server 2025, Microsoft Word for Android, Windows 11 Version 25H2, Windows Server 2022, Windows 11 Version 24H2
Provider severity: HIGH
Conflicts: 1

CVE-2026-44802

Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.

PUBLISHED

Vendor: Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product: Windows Server 2019, Windows Server 2019 (Server Core installation), Windows 10 Version 1809, Windows 11 Version 25H2, Windows 10 Version 21H2, Windows 11 Version 23H2, Windows 11 Version 24H2, Windows Server 2025, Windows Server 2025 (Server Core installation), Windows 11 version 26H1, Windows 11 version 23H2, Windows Server 2022, Windows 10 Version 22H2
Provider severity: HIGH
Conflicts: 1

CVE-2026-44801

Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

PUBLISHED

Vendor: Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product: Windows Server 2016, Windows 10 Version 1809, Windows 11 Version 25H2, Windows Server 2019, Windows 10 Version 22H2, Windows Server 2022, Windows Server 2019 (Server Core installation), Windows 11 version 23H2, Windows 11 Version 23H2, Windows 11 version 26H1, Windows Server 2025 (Server Core installation), Windows 11 Version 24H2, Windows 10 Version 21H2, Windows Server 2016 (Server Core installation), Windows App Client for Windows Desktop, Windows Server 2012 (Server Core installation), Windows Server 2012, Windows 10 Version 1607, Windows Server 2012 R2 (Server Core installation), Windows Server 2012 R2, Remote Desktop client for Windows Desktop, Windows Server 2025
Provider severity: HIGH
Conflicts: 1

CVE-2026-44800

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elevate privileges locally.

PUBLISHED

Vendor: Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product: Windows Server 2025, Windows 11 Version 23H2, Windows 11 Version 25H2, Windows 11 Version 24H2, Windows 11 version 23H2, Windows 11 version 26H1, Windows Server 2025 (Server Core installation)
Provider severity: HIGH
Conflicts: 2

A flaw was found in the Samba printing subsystem. Samba passes the client-controlled job description string to the command configured with the "print command" setting via the "%J" substitution character without escaping shell meta characters. A remote attacker could exploit this vulnerability by sending a specially crafted print job description that contains unescaped shell characters. This could lead to remote code execution on the affected system.

PUBLISHED

Vendor: Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat
Product: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat OpenShift Container Platform 4, Red Hat Enterprise Linux 8.8 Telecommunications Update Service, Red Hat Enterprise Linux 9.6 Extended Update Support, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On, Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions, Red Hat Enterprise Linux 7 Extended Lifecycle Support, Red Hat OpenShift Container Platform 4, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 7 Extended Lifecycle Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.8 Telecommunications Update Service, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 9.6 Extended Update Support, Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions, Red Hat Enterprise Linux 7 Extended Lifecycle Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On, Red Hat Enterprise Linux 10
Provider severity: CRITICAL
Conflicts: 1

CVE-2026-44799

Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

PUBLISHED

Vendor: Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product: Windows 11 Version 24H2, Windows Server 2019, Windows App Client for Windows Desktop, Windows Server 2025 (Server Core installation), Windows 10 Version 1607, Windows 11 version 26H1, Windows Server 2016 (Server Core installation), Windows Server 2012 R2 (Server Core installation), Windows Server 2019 (Server Core installation), Windows 10 Version 1809, Windows 11 version 23H2, Windows 10 Version 22H2, Windows 11 Version 25H2, Windows Server 2012 R2, Windows Server 2012 (Server Core installation), Windows Server 2025, Windows Server 2016, Windows Server 2022, Remote Desktop client for Windows Desktop, Windows Server 2012, Windows 10 Version 21H2, Windows 11 Version 23H2
Provider severity: HIGH
Conflicts: 1

CVE-2026-44798

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, a user with access to add/change a GitRepository record could use the REST API to directly set the current_head field on the record, which was not intended to be user-editable. Doing so could cause Nautobot's local clone(s) of the relevant repository to checkout a commit other than the latest commit on the specified branch (resulting in misleading state), or potentially to be unable to make use of t

PUBLISHED

Vendor: nautobot
Product: nautobot
Provider severity: HIGH
Conflicts: 1

CVE-2026-44797

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, Nautobot's Webhook data model and associated feature set could be configured by users with sufficient access to perform requests to various hosts and IP addresses that should not be permitted, allowing for various behaviors similar to server-side request forgery (SSRF). This vulnerability is fixed in 2.4.33 and 3.1.2.

PUBLISHED

Vendor: nautobot
Product: nautobot
Provider severity: HIGH
Conflicts: 0

CVE-2026-44796

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, Nautobot UI object-bulk-rename endpoints (for example, /dcim/interfaces/rename/) were vulnerable to application-wide denial of service via maliciously crafted regular expressions in the find field in combination with the use_regex flag. This vulnerability is fixed in 2.4.33 and 3.1.2.

PUBLISHED

Vendor: nautobot
Product: nautobot
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-44795

Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to 2026.1.0, 2026.0.3, 2025.4.4, and 2025.3.3, unsafe YAML processing bypasses safe deserialization when using CloudFormation deployments or CloudFoundry baking. The use of a non-safe constructor allows arbitrary loading of Java classes, leading to remote code execution. This issue is fixed in versions 2026.1.0, 2026.0.3, 2025.4.4, and 2025.3.3.

PUBLISHED

Vendor: spinnaker
Product: spinnaker
Provider severity: HIGH
Conflicts: 1

CVE-2026-44794

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, in the case of inter-object references via GenericForeignKey (a pattern allowing an object to reference another object that may belong to one of several different "content types" or database tables), when creating or updating an object containing a GenericForeignKey, Nautobot's REST API failed to enforce user "view" permissions when determining whether a given reference to another object would be va

PUBLISHED

Vendor: nautobot
Product: nautobot
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-44792

n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, an attacker with write access to the git repository connected to an n8n Source Control configuration could commit a malicious Data Table JSON file containing a crafted column name. When an administrator performed a Source Control Pull, n8n imported the file and could lead to SQL injection on the internal PostgreSQL instance. Exploitation requires the n8n instance uses PostgreSQL as its database backend, th

PUBLISHED

Vendor: n8n-io
Product: n8n
Provider severity: HIGH
Conflicts: 0

CVE-2026-44791

n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, an authenticated user with permission to create or modify workflows could bypass the patch for CVE-2026-42232 in the XML node. When combined with other nodes, this could lead to RCE on the n8n host. This vulnerability is fixed in 1.123.43, 2.22.1, and 2.20.7.

PUBLISHED

Vendor: n8n-io
Product: n8n
Provider severity: CRITICAL
Conflicts: 0

CVE-2026-44790

n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, an authenticated user with permission to create or modify workflows could inject CLI flags on the Git node's Push operation allowing an attacker to read arbitrary files from the n8n server potentially leading to full compromise. This vulnerability is fixed in 1.123.43, 2.22.1, and 2.20.7.

PUBLISHED

Vendor: n8n-io
Product: n8n
Provider severity: CRITICAL
Conflicts: 0

CVE-2026-4479

The WholeSale Products Dynamic Pricing Management WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and in

PUBLISHED

Vendor: wpcodefactory
Product: WholeSale Products Dynamic Pricing Management WooCommerce
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-44789

n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, an authenticated user with permission to create or modify workflows could achieve global prototype pollution via an unvalidated pagination parameter in the HTTP Request node. Combined with other techniques this could lead to RCE on the instance. This vulnerability is fixed in 1.123.43, 2.22.1, and 2.20.7.

PUBLISHED

Vendor: n8n-io
Product: n8n
Provider severity: CRITICAL
Conflicts: 0

CVE-2026-44788

SharpCompress is a fully managed C# library to deal with many compression types and formats. In 0.47.4 and earlier, a path traversal vulnerability in IArchive.WriteToDirectory() allows a malicious archive to create directories outside the intended extraction root. For TAR archives, this can be escalated to arbitrary file writes by chaining with a symlink entry, giving a full write primitive on the target filesystem subject to the permissions of the running process.

PUBLISHED

Vendor: adamhathcock
Product: sharpcompress
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-44787

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, the signup flow could allow newly registered users to set primary_group_id and gain whisper-group privileges without legitimate group membership on sites with whispers_allowed_groups configured. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.

PUBLISHED

Vendor: discourse
Product: discourse
Provider severity: HIGH
Conflicts: 0

CVE-2026-44786

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, chat events for public category channels are published to MessageBus without permission scoping, so any MessageBus subscriber without chat enabled could receive chat message payloads in real time. This issue has been patched in versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1.

PUBLISHED

Vendor: discourse
Product: discourse
Provider severity: HIGH
Conflicts: 0

CVE-2026-44785

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, the AI "explain" helper only checks can_see? on the post being explained, not its reply_to_post, so any authenticated user with access to the AI helper could read the raw contents of a hidden parent post by invoking "Explain" on a reply to it. This issue has been patched in versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.

PUBLISHED

Vendor: discourse
Product: discourse
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-44784

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, group owners who are not necessarily admins or moderators can view a group's outgoing email/SMTP credentials in plaintext via the group history log (/groups/:name/logs.json). Affected fields: email_password, email_username, smtp_server, smtp_port, smtp_ssl_mode. The most sensitive item is the SMTP password, which an owner c

PUBLISHED

Vendor: discourse
Product: discourse
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-44783

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, a flaw in how replies to whisper posts are handled allows authenticated users outside the groups configured in whispers_allowed_groups to post into a topic's staff-only whisper channel. The injected content is visible to whisperers (typically staff) alongside legitimate whispers. Only sites that have whispers enabled are af

PUBLISHED

Vendor: discourse
Product: discourse
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-44782

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, GroupPostSerializer declared include_user_long_name? as the predicate for its :name attribute, but AMS looks for include_name?. The misnamed predicate was never called, so object.user.name was always serialized regardless of SiteSetting.enable_names. This issue has been patched in versions 2026.1.4, 2026.3.1, 2026.4.1, and

PUBLISHED

Vendor: discourse
Product: discourse
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-44780

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, ReviewableQueuedPostSerializer unconditionally included payload["raw_email"] for posts that arrived via incoming email. Category moderation group members reaching the review queue could therefore read the full inbound email source (headers, sender trace, MUA, body) without being in view_raw_email_allowed_groups — the trust

PUBLISHED

Vendor: discourse
Product: discourse
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-4478

A vulnerability was identified in Yi Technology YI Home Camera 2 2.1.1_20171024151200. This impacts an unknown function of the file home/web/ipc of the component HTTP Firmware Update Handler. The manipulation leads to improper verification of cryptographic signature. The attack is possible to be carried out remotely. The complexity of an attack is rather high. The exploitability is said to be difficult. The exploit is publicly available and might be used. The vendor was contacted early about thi

PUBLISHED

Vendor: Yi Technology
Product: YI Home Camera
Provider severity: CRITICAL, HIGH
Conflicts: 2

CVE-2026-44779

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, bot debug endpoints disclose whisper translation audit logs. This issue has been patched in versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1.

PUBLISHED

Vendor: discourse
Product: discourse
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-44777

jq is a command-line JSON processor. In 1.8.2rc1 and earlier, the ordinary module loader recurses without cycle detection when two otherwise valid modules include each other.

PUBLISHED

Vendor: jqlang
Product: jq
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-44776

Kavita is a cross platform reading server. Prior to 0.9.0, the download, size-check, and chapter metadata endpoints do not enforce library-level authorization. A low-privileged user who knows or guesses a chapterId, volumeId, or seriesId belonging to a library they are not assigned to can download the full file contents, query file sizes, and read metadata for that content. This affects /api/Download/volume-size, /api/Download/chapter-size, /api/Download/series-size, /api/Download/volume, /api/D

PUBLISHED

Vendor: Kareadita
Product: Kavita
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-44775

Kavita is a cross platform reading server. Prior to 0.9.0, the ReaderController.GetImage endpoint is decorated with [AllowAnonymous], allowing completely unauthenticated access to page images from any chapter in any library. While the endpoint accepts an apiKey parameter, it is never validated. Since entity IDs are sequential integers, an unauthenticated attacker can trivially enumerate all content on the server. This vulnerability is fixed in 0.9.0.

PUBLISHED

Vendor: Kareadita
Product: Kavita
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-44774

A flaw was found in Traefik. A low-privileged tenant with HTTPRoute creation permissions in Traefik's Kubernetes Gateway API provider can bypass security settings. This allows the tenant to expose the REST provider handler and gain live dynamic configuration write access to Traefik. This vulnerability enables unauthorized reconfiguration of routers and services, potentially leading to privilege escalation within the system.

PUBLISHED

Vendor: Red Hat, traefik, Red Hat, Red Hat
Product: Red Hat OpenShift GitOps, traefik, Red Hat OpenShift GitOps, Red Hat OpenShift Dev Spaces 3.29
Provider severity: HIGH, MEDIUM
Conflicts: 3

CVE-2026-44771

SAP S/4HANA Draft operation does not perform necessary authorization checks for an authenticated user, a restricted user could access information within the entity resulting in escalation of privileges. This results in low impact on confidentiality, with no impact on integrity and availability of the application.

PUBLISHED

Vendor: SAP_SE
Product: SAP S/4HANA (Draft operation)
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-44770

SAP Create Single Payment does not perform necessary authorization checks for an authenticated user, a restricted user could access specific entity set keys resulting in disclosure of information. This has low impact on confidentiality, with no impact on integrity and availability of the application.

PUBLISHED

Vendor: SAP_SE
Product: SAP S/4 HANA (Create Single Payment)
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-4477

A vulnerability was determined in Yi Technology YI Home Camera 2 2.1.1_20171024151200. This affects an unknown function of the component WPA/WPS. Executing a manipulation can lead to use of hard-coded cryptographic key . The attack can only be done within the local network. This attack is characterized by high complexity. The exploitability is reported as difficult. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not resp

PUBLISHED

Vendor: Yi Technology
Product: YI Home Camera
Provider severity: LOW
Conflicts: 2

CVE-2026-44769

SAP S/4HANA application Project Management (PPM-PRO) allows an attacker with high privileges to execute crafted database queries, exposing the backend database. This results in low impact on confidentiality, with no impact on integrity and availability of the application.

PUBLISHED

Vendor: SAP_SE
Product: SAP S/4HANA Project Management (PPM-PRO)
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-44768

SAP CRM WebClient UI allows an attacker to inject and execute malicious scripts in the context of the application due to the absence of a Content Security Policy (CSP) configuration for certain restrictive directives. This vulnerability has a low impact on the integrity of the application. Confidentiality and availability are not impacted.

PUBLISHED

Vendor: SAP_SE
Product: SAP CRM (WebClient UI)
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-44767

setThemeRoot() failed to enforce the sap-allowed-theme-origins allowlist. An attacker-controlled absolute cross-origin URL could be stored and used directly to construct a <link rel=stylesheet> element, even when no <meta name=sap-allowed-theme-origins> tag was present in the document. The same bypass was reachable via the ?sap-themeRoot URL parameter.Exploitation requires attacker-influenced input (e.g., a URL query parameter, tenant configuration, or user-supplied setting) to reach setThemeRoo

PUBLISHED

Vendor: SAP_SE
Product: @ui5/webcomponents-base
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-44761

SAP Commerce Cloud could retain a sample OAuth2 client with publicly documented sample credentials originating from sample configuration provided in SAP Help Portal documentation. If left unchanged, an unauthenticated attacker could use these well-known credentials to obtain a valid access token and invoke certain APIs to read and modify data. Successful exploitation results in high impact on confidentiality and integrity, with no impact on availability.

PUBLISHED

Vendor: SAP_SE
Product: SAP Commerce Cloud
Provider severity: CRITICAL
Conflicts: 0

CVE-2026-44760

Due to a Cross-Site Scripting (XSS) vulnerability, applications based on Business Server Pages framework in SAP NetWeaver Application Server ABAP reflects unsanitized input into the HTTP response which allows an attacker to inject and execute arbitrary JavaScript code under certain conditions. Successful exploitation could allow the attacker to steal session information, perform authenticated actions on behalf of the victim user etc. This vulnerability has low impact on confidentiality and integ

PUBLISHED

Vendor: SAP_SE
Product: SAP NetWeaver Application Server ABAP (applications based on Business Server Pages)
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-4476

A vulnerability was found in Yi Technology YI Home Camera 2 2.1.1_20171024151200. The impacted element is an unknown function of the file home/web/ipc of the component CGI Endpoint. Performing a manipulation results in missing authentication. Access to the local network is required for this attack. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

PUBLISHED

Vendor: Yi Technology
Product: YI Home Camera
Provider severity: MEDIUM
Conflicts: 2

CVE-2026-44759

SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server response and executed in a user's browser when the crafted URL is visited, leading to theft of session information, manipulation of portal content, or user redirection, resulting in a low impact on the application's confidentiality and integrity, with no impact on availability.

PUBLISHED

Vendor: SAP_SE
Product: SAP NetWeaver Enterprise Portal
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-44757

SAP Wily Introscope Enterprise Manager allows an unauthenticated attacker to craft a specially crafted URL. Under certain conditions, when accessed by a victim, the injected script could execute in the user�s browser within the context of the application. This issue has a low impact on the confidentiality and integrity of the application with no impact on availability.

PUBLISHED

Vendor: SAP_SE
Product: SAP Wily Introscope Enterprise Manager
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-44755

SAP Business Objects Business Intelligence Platform does not sufficiently validate email sending parameters supplied by authenticated users, resulting in an email spoofing vulnerability.This vulnerability has a low impact on integrity and does not affect the confidentiality and availability of the application.

PUBLISHED

Vendor: SAP_SE
Product: SAP Business Objects Business Intelligence Platform
Provider severity: MEDIUM
Conflicts: 0