cve.bz

New CVEs this week, the last 7 days, newest first, page 77

Filter

The new CVEs published in the last 7 days, newest first, with CVSS, EPSS, CISA KEV and public exploits for each. Refreshed every few minutes. Narrow it: in CISA KEV · critical. Other lists: CISA KEV list, CVE exploit search, Latest critical CVEs, Ransomware CVEs, New CVEs today, Patch Tuesday

  1. 7.8CVE-2026-91759EPSS 0.1%

    Out-of-Bounds Write Vulnerability in Hitachi Dynamic Link Manager for Linux. This issue affects Hitachi Dynamic Link Manager for Linux: from 7.5.0-00 before 9.0.5-00.

  2. 7.8CVE-2026-91758EPSS 0.1%

    Out-of-bounds Read and Write Vulnerability in Hitachi Dynamic Link Manager for Linux. This issue affects Hitachi Dynamic Link Manager for Linux: from 7.5.0-00 before 9.0.5-00.

  3. 7.1CVE-2026-91757EPSS 0.7%

    OS Command Injection Vulnerability in Hitachi Dynamic Link Manager for VMware. This issue affects Hitachi Dynamic Link Manager for VMware: from 7.3.0-00 before 9.0.4-01.

  4. 8.1CVE-2026-91756EPSS 0.9%

    OS Command Injection Vulnerability in Hitachi Dynamic Link Manager for VMware. This issue affects Hitachi Dynamic Link Manager for VMware: from 8.7.3-00 before 9.0.4-01.

  5. 8.1CVE-2026-91755EPSS 0.3%

    Integer Overflow Vulnerability in Hitachi Dynamic Link Manager for VMware. This issue affects Hitachi Dynamic Link Manager for VMware: from 8.7.3-00 before 9.0.4-01.

  6. 8.1CVE-2026-91754EPSS 0.3%

    Stack-based Buffer Overflow Vulnerability in Hitachi Dynamic Link Manager for VMware. This issue affects Hitachi Dynamic Link Manager for VMware: from 8.7.3-00 before 9.0.4-01.

  7. 8.2CVE-2026-86579EPSS 0.1%

    Binary Planting Vulnerability in Hitachi Dynamic Link Manager for Windows. This issue affects Hitachi Dynamic Link Manager for Windows: from 5.9.5-00 before 9.0.4-01.

  8. 7.3CVE-2026-86578EPSS 0.2%

    Link Following Vulnerability in Hitachi Dynamic Link Manager for Windows. This issue affects Hitachi Dynamic Link Manager for Windows: from 5.0.0-03 before 9.0.4-01.

  9. 9.8CVE-2026-115646EPSS 0.4%

    Partial String Comparison Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-50-06 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-50…

  10. 7.4CVE-2026-115640EPSS 0.3%

    LimeSurvey Community Edition 7.7.0 contains a stored cross-site scripting vulnerability in the Central Participants Database blocklist control. An authenticated user with only global participantpanel:import permission can import a CSV part…

  11. 7.3CVE-2026-112125EPSS 0.1%

    Incorrect Permission Assignment for Critical Resource Vulnerability in HA Monitor. This issue affects HA Monitor: from 01-00 before 01-83-01.

  12. 8.8CVE-2026-125612EPSS 0.2%

    Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Deltaww DIAEnergie allows SQL Injection. This issue affects DIAEnergie: before 1.11.01.032.

  13. 8.7CVE-2026-88710EPSS 1.2%

    Improper neutralization of special elements used in an OS command in certain ASUS Router firmware allows an unauthenticated nearby user to trigger a chain of actions—unauthenticated queries, identifier guessing, credential overwriting, and…

  14. 7.0CVE-2026-88709EPSS 0.4%

    Improper neutralization of special elements used in an OS command in certain ASUS Router firmware allows an user with physical access to insert a USB device containing a specially crafted directory name, potentially executing arbitrary com…

  15. 5.3CVE-2026-88708EPSS 0.2%

    An off-by-one error in certain ASUS Router firmware allows an unauthenticated nearby user to send a packet with a specific header length, potentially overwriting memory and causing the affected service to crash. Refer to the ' Security Upd…

  16. 7.1CVE-2026-88707EPSS 0.2%

    An out-of-bounds write in certain ASUS Router firmware allows an unauthenticated nearby user to send an HTTP request containing parameters that exceed the buffer length, potentially overwriting other memory regions or causing the system to…

  17. 4.3CVE-2026-89131EPSS 0.1%

    SAP NetWeaver Enterprise Portal does not sufficiently protect certain server-side actions against cross-site request forgery. An unauthenticated attacker could craft a malicious link that, when clicked by an authenticated user, triggers an…

  18. 5.8CVE-2026-89129EPSS 0.3%

    Due to a Server-Side Request Forgery (SSRF) vulnerability in SAP NetWeaver AS Java (Web Services), an unauthenticated attacker could craft a SOAP request that causes the server to return a SOAP fault to a URL under the attacker�s control. …

  19. 5.3CVE-2026-89128EPSS 0.2%

    Due to Broken Access Control in SAP NetWeaver AS Java, an unauthenticated attacker could invoke affected SOAP operations exposed over HTTP without proper access control. Successful exploitation could allow disclosure of information accessi…

  20. 10.0CVE-2026-89126EPSS 0.4%

    SAP Web Dispatcher does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption condition in the affected f…

  21. 6.0CVE-2026-89125EPSS 0.3%

    Due to Insecure Storage of Sensitive Information in SAP Web Dispatcher and Internet Communication Manager, an attacker with administrative privileges could obtain sensitive information from stored data. This may allow correlation of creden…

  22. 9.6CVE-2026-89119EPSS 0.1%

    SAP Web Dispatcher and SAP NetWeaver Application Server ABAP (Internet Communication Manager) do not perform sufficient request validation in certain administrative functionality. In the context of Application Server ABAP and SAP Web Dispa…

  23. 4.4CVE-2026-89115EPSS 0.2%

    SAP Start Service and SAP Management Console store sensitive credential information in process memory without protection. An attacker with high privileges and local access could inspect the memory to recover credentials and reuse them for …

  24. 7.5CVE-2026-89114EPSS 0.3%

    SAP NetWeaver AS Java EDM Application does not perform an authentication check for certain web service requests. An unauthenticated attacker could send a specially crafted request to retrieve sensitive business information. This results in…

  25. 10.0CVE-2026-89103EPSS 0.3%

    SAP Gateway activates the default Access Control List with high privileges allowing categorization of external attacker as internal application server. As a result an unauthenticated attacker with network access to the SAP Gateway could ex…

  26. 7.5CVE-2026-76973EPSS 0.3%

    Due to a Memory Corruption vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform, an unauthenticated attacker could send specially crafted network requests to the affected service. By triggering the vulnerability, the…

  27. 7.5CVE-2026-76970EPSS 0.3%

    Due to a Memory Corruption vulnerability in Application Server ABAP for SAP NetWeaver and ABAP Platform, an unauthenticated attacker could send specially crafted requests to the application. If processed by the application, these requests …

  28. 8.9CVE-2026-76966EPSS 0.2%

    Due to improper RFC protocol validation in the SAP Kernel used by the Application Server ABAP of SAP NetWeaver and ABAP Platform, an unauthenticated attacker can send a crafted RFC request that exploits logical errors in memory management,…

  29. 9.9CVE-2026-76965EPSS 0.3%

    SAP NetWeaver Application Server ABAP and ABAP Platform does not perform necessary authorization checks for certain internal functionality. An attacker with low privileges could invoke affected functionality to execute arbitrary operating …

  30. 10.0CVE-2026-76964EPSS 0.4%

    SAP NetWeaver Application Server ABAP does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption conditio…

  31. 5.5CVE-2026-125087EPSS 0.4%

    A vulnerability was found in Michael-A-Kuykendall Shimmy up to 2.6.4. The affected element is an unknown function of the file src/server.rs of the component Inference API. Performing a manipulation results in missing authentication. The at…

  32. 9.3CVE-2026-125086EPSS 0.6%

    A vulnerability has been found in D-Link M60 1.12.B01. Impacted is the function system of the file /etc/emDaemon/mosquitto.conf of the component emDaemon MQTT Broker. Such manipulation leads to hard-coded credentials. The attack can be exe…

  33. 2.0CVE-2026-125082EPSS 0.2%

    A security flaw has been discovered in sunkaifei FlyCMS up to e71738e0cfb7ffd48c2ce74242a2dbb43f84f25a. Affected by this vulnerability is the function ModelDataService.insertData of the file articles/detail.html of the component Content Re…

  34. 5.5CVE-2026-125079EPSS 0.4%

    A vulnerability was determined in D-Link DCS-6501LH 3.03.02. This impacts the function pf_get_onvif_user_pwd/mydlink_default_sys_info of the file /mnt/conf/SystemConfig.ini of the component Media Service. This manipulation of the argument …

  35. 6.2CVE-2026-124604EPSS 0.1%

    The RSA cryptographic key material, including a private key and public key, is embedded within the GV-Cloud application package. Because Android applications can be extracted and reverse engineered, storing private cryptographic keys direc…

  36. 6.2CVE-2026-124603EPSS 0.1%

    An API key is hardcoded and retrievable from the GV-Cloud application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to ext…

  37. 6.2CVE-2026-124602EPSS 0.1%

    The RSA cryptographic key material, including a private key and public key, is embedded within the GV-Access application package. Because Android applications can be extracted and reverse engineered, storing private cryptographic keys dire…

  38. 6.2CVE-2026-124601EPSS 0.1%

    An API key is hardcoded and retrievable from the GV-Access package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and mi…

  39. 10.0CVE-2026-124600EPSS 0.2%

    GV-Face transmits sensitive user credentials and related authentication data over unencrypted HTTP connections. The HTTP traffic is not encrypted, an attacker with the ability to intercept network traffic.

  40. 6.2CVE-2026-124599EPSS 0.1%

    The RSA cryptographic key material, including a private key and public key, is embedded within the application package. Because Android applications can be extracted and reverse engineered, storing private cryptographic keys directly insid…

  41. 7.5CVE-2026-124598EPSS 0.2%

    An API key is hardcoded and retrievable from the GV-Face package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misu…

  42. 10.0CVE-2026-120017EPSS 0.3%

    SAP NetWeaver AS ABAP and ABAP Platform does not perform sufficient verification of incoming authentication assertions under certain configurations. An unauthenticated attacker could submit specially crafted data to bypass authentication a…

  43. 6.1CVE-2026-120016EPSS 0.2%

    SAP NetWeaver Visual Composer does not perform sufficient input validation and output encoding on certain request data. An unauthenticated attacker could craft a malicious link containing specially crafted input. If a victim clicks the lin…

  44. 7.5CVE-2026-120015EPSS 0.4%

    SAP Host Agent does not sufficiently validate certain inputs. Under certain condition, an attacker with low privileges could abuse the affected functionality to influence an internal component into loading a malicious file under a privileg…

  45. 7.6CVE-2026-120014EPSS 0.1%

    SAP HANA XSA Web Dispatcher does not perform sufficient request validation in certain administrative functionality. In the context of SAP HANA XSA Web Dispatcher, an unauthenticated attacker could trick a logged-on administrator into visit…

  46. 7.5CVE-2026-120010EPSS 0.4%

    SAP NetWeaver Application Server (SAP Message Server) does not properly size memory allocations when handling certain HTTP requests. An unauthenticated attacker could send a specially crafted request to trigger a heap buffer overflow in af…

  47. 7.2CVE-2026-120009EPSS 0.5%

    SAP ABAP Developer Tools (AMDP Data Preview) does not perform sufficient validation and authorization checks within certain affected functionality. An attacker with high privileges could submit specially crafted input to inject and execute…

  48. 8.2CVE-2026-120008EPSS 0.3%

    SAP NetWeaver (Internet Graphics Service) does not sufficiently validate certain input values within incoming requests. An unauthenticated user could send a specially crafted request to trigger an out-of-bounds memory write in a worker pro…

  49. 6.5CVE-2026-109811EPSS 0.2%

    An internal ABAP HTTP component in SAP NetWeaver and ABAP Platform (Application Server ABAP) has SSRF vulnerability due to insecure default settings. An authenticated attacker with low privileges could trick the victim to interact with a m…

  50. 6.1CVE-2026-109810EPSS 0.2%

    SAP NetWeaver Application Server Java (Web Dynpro Java) does not sufficiently validate certain request parameters used to resolve styling resources in the application. An unauthenticated attacker could craft a malicious link that, when cli…