| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-25976 | — | 0.00 | — | — | Feb 10, 2026 | Rejected reason: Not used | ||
| CVE-2026-25975 | — | 0.00 | — | — | Feb 10, 2026 | Rejected reason: Not used | ||
| CVE-2026-25974 | — | 0.00 | — | — | Feb 10, 2026 | Rejected reason: Not used | ||
| CVE-2026-25973 | — | 0.00 | — | — | Feb 10, 2026 | Rejected reason: Not used | ||
| CVE-2026-2260 | Hig | 0.47 | 7.2 | 0.06 | Feb 10, 2026 | A vulnerability was found in D-Link DCS-931L up to 1.13.0. This affects an unknown part of the file /goform/setSysAdmin. The manipulation of the argument AdminID results in os command injection. The attack can be executed remotely. The exploit has been made public and could be… | ||
| CVE-2026-2259 | Low | 0.14 | 3.3 | 0.00 | Feb 10, 2026 | A vulnerability has been found in aardappel lobster up to 2025.4. Affected by this issue is the function lobster::Parser::ParseStatements in the library dev/src/lobster/parser.h of the component Parsing. The manipulation leads to memory corruption. The attack can only be… | ||
| CVE-2026-24328 | Med | 0.40 | 6.1 | 0.00 | Feb 10, 2026 | SAP TAF_APPLAUNCHER within Business Server Pages allows unauthenticated attacker to craft malicious links that, when clicked by a victim, redirect them to attacker?controlled sites, potentially exposing or altering sensitive information in the victim�s browser. This results in… | ||
| CVE-2026-24327 | Med | 0.28 | 4.3 | 0.00 | Feb 10, 2026 | Due to missing authorization check in SAP Strategic Enterprise Management (Balanced Scorecard in Business Server Pages), an authenticated attacker could access information that they are otherwise unauthorized to view. This leads to low impact on confidentiality and no effect on… | ||
| CVE-2026-24326 | Med | 0.28 | 4.3 | 0.00 | Feb 10, 2026 | Due to a missing authorization check in the Disconnected Operations of the SAP S/4HANA Defense & Security, an attacker with user privileges could call remote-enabled function modules to do direct update on standard SAP database table . This results in low impact on integrity,… | ||
| CVE-2026-24325 | Med | 0.31 | 4.8 | 0.00 | Feb 10, 2026 | SAP BusinessObjects Enterprise does not sufficiently encode user-controlled inputs, leading to Stored Cross-Site Scripting (XSS) vulnerability. This enables an admin user to inject malicious JavaScript into a website and the injected script gets executed when the user visits the… | ||
| CVE-2026-24324 | Med | 0.42 | 6.5 | 0.00 | Feb 10, 2026 | SAP BusinessObjects Business Intelligence Platform (AdminTools) allows an authenticated attacker with user privileges to execute a specific query in AdminTools that could cause the Content Management Server (CMS) to crash, rendering the CMS partially or completely unavailable… | ||
| CVE-2026-24323 | Med | 0.40 | 6.1 | 0.00 | Feb 10, 2026 | The BSP applications allow an unauthenticated user to inject malicious script content via user-controlled URL parameters that are not sufficiently sanitized. When a victim accesses a crafted URL, the injected script is executed in the victim�s browser, leading to a low impact… | ||
| CVE-2026-24322 | Hig | 0.50 | 7.7 | 0.00 | Feb 10, 2026 | SAP Solution Tools Plug-In (ST-PI) contains a function module that does not perform the necessary authorization checks for authenticated users, allowing sensitive information to be disclosed. This vulnerability has a high impact on confidentiality and does not affect integrity… | ||
| CVE-2026-24321 | Med | 0.34 | 5.3 | 0.00 | Feb 10, 2026 | SAP Commerce Cloud exposes multiple API endpoints to unauthenticated users, allowing them to submit requests to these open endpoints to retrieve sensitive information that is not intended to be publicly accessible via the front-end. This vulnerability has a low impact on… | ||
| CVE-2026-24320 | Low | 0.20 | 3.1 | 0.00 | Feb 10, 2026 | Due to improper memory management in SAP NetWeaver and ABAP Platform (Application Server ABAP), an authenticated attacker could exploit logical errors in memory management by supplying specially crafted input containing unique characters, which are improperly converted. This may… | ||
| CVE-2026-24319 | Med | 0.38 | 5.8 | 0.00 | Feb 10, 2026 | In SAP Business One, sensitive information is written to the application�s memory dump files without obfuscation. Gaining access to this information could potentially lead to unauthorized operations within the B1 environment, including modification of company data. This issue… | ||
| CVE-2026-24312 | Med | 0.34 | 5.2 | 0.00 | Feb 10, 2026 | An erroneous authorization check in SAP Business Workflow leads to privilege escalation. An authenticated administrative user can bypass role restrictions by leveraging permissions from a less sensitive function to execute unauthorized, high-privilege actions. This has a high… | ||
| CVE-2026-23689 | Hig | 0.50 | 7.7 | 0.00 | Feb 10, 2026 | Due to an uncontrolled resource consumption (Denial of Service) vulnerability, an authenticated attacker with regular user privileges and network access can repeatedly invoke a remote-enabled function module with an excessively large loop-control parameter. This triggers… | ||
| CVE-2026-23688 | Med | 0.28 | 4.3 | 0.00 | Feb 10, 2026 | SAP Fiori App Manage Service Entry Sheets does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This has low impact on integrity, confidentiality and availability are not impacted. | ||
| CVE-2026-23687 | Hig | 0.57 | 8.8 | 0.01 | Feb 10, 2026 | SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated attacker with normal privileges to obtain a valid signed message and send modified signed XML documents to the verifier. This may result in acceptance of tampered identity information, unauthorized… | ||
| CVE-2026-23686 | Low | 0.22 | 3.4 | 0.00 | Feb 10, 2026 | Due to a CRLF Injection vulnerability in SAP NetWeaver Application Server Java, an authenticated attacker with administrative access could submit specially crafted content to the application. If processed by the application, this content enables injection of untrusted entries… | ||
| CVE-2026-23685 | Med | 0.29 | 4.4 | 0.00 | Feb 10, 2026 | Due to a Deserialization vulnerability in SAP NetWeaver (JMS service), an attacker authenticated as an administrator with local access could submit specially crafted content to the server. If processed by the application, this content could trigger unintended behavior during… | ||
| CVE-2026-23684 | Med | 0.38 | 5.9 | 0.00 | Feb 10, 2026 | A race condition vulnerability exists in the SAP Commerce cloud. Because of this when an attacker adds products to a cart, it may result in a cart entry being created with erroneous product value which could be checked out. This leads to high impact on data integrity, with no… | ||
| CVE-2026-23681 | Med | 0.28 | 4.3 | 0.00 | Feb 10, 2026 | Due to missing authorization check in a function module in SAP Support Tools Plug-In, an authenticated attacker could invoke specific function modules to retrieve information about the system and its configuration. This disclosure of the system information could assist the… | ||
| CVE-2026-0509 | Cri | 0.62 | 9.6 | 0.00 | Feb 10, 2026 | SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated, low-privileged user to perform background Remote Function Calls without the required S_RFC authorization in certain cases. This can result in a high impact on integrity and availability, and no… | ||
| CVE-2026-0508 | Hig | 0.47 | 7.3 | 0.00 | Feb 10, 2026 | The SAP BusinessObjects Business Intelligence Platform allows an authenticated attacker with high privileges to insert malicious URL within the application. Upon successful exploitation, the victim may click on this malicious URL, resulting in an unvalidated redirect to the… | ||
| CVE-2026-0505 | Med | 0.40 | 6.1 | 0.00 | Feb 10, 2026 | The BSP applications allow an unauthenticated user to manipulate user-controlled URL parameters that are not sufficiently validated. This could result in unvalidated redirection to attacker-controlled websites, leading to a low impact on confidentiality and integrity, and no… | ||
| CVE-2026-0490 | Hig | 0.49 | 7.5 | 0.00 | Feb 10, 2026 | SAP BusinessObjects BI Platform allows an unauthenticated attacker to craft a specific network request to the trusted endpoint that breaks the authentication, which prevents the legitimate users from accessing the platform. As a result, it has a high impact on the availability… | ||
| CVE-2026-0488 | Cri | 0.64 | 9.9 | 0.01 | Feb 10, 2026 | An authenticated attacker in SAP CRM and SAP S/4HANA (Scripting Editor) could exploit a flaw in a generic function module call and execute unauthorized critical functionalities, which includes the ability to execute an arbitrary SQL statement. This leads to a full database… | ||
| CVE-2026-0486 | Med | 0.33 | 5.0 | 0.00 | Feb 10, 2026 | In ABAP based SAP systems a remote enabled function module does not perform necessary authorization checks for an authenticated user resulting in disclosure of system information.This has low impact on confidentiality. Integrity and availability are not impacted. | ||
| CVE-2026-0485 | Hig | 0.49 | 7.5 | 0.00 | Feb 10, 2026 | SAP BusinessObjects BI Platform allows an unauthenticated attacker to send specially crafted requests that could cause the Content Management Server (CMS) to crash and automatically restart. By repeatedly submitting these requests, the attacker could induce a persistent service… | ||
| CVE-2026-0484 | Med | 0.42 | 6.5 | 0.00 | Feb 10, 2026 | Due to missing authorization check in SAP NetWeaver Application Server ABAP and SAP S/4HANA, an authenticated attacker could access a specific transaction code and modify the text data in the system. This vulnerability has a high impact on integrity of the application with no… | ||
| CVE-2026-2258 | Low | 0.14 | 3.3 | 0.00 | Feb 10, 2026 | A flaw has been found in aardappel lobster up to 2025.4. Affected by this vulnerability is the function WaveFunctionCollapse in the library dev/src/lobster/wfc.h. Executing a manipulation can lead to memory corruption. The attack can only be executed locally. The exploit has… | ||
| CVE-2026-0845 | Hig | 0.40 | 7.2 | 0.00 | Feb 10, 2026 | The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the… | ||
| CVE-2025-15314 | Med | 0.36 | 5.5 | 0.00 | Feb 10, 2026 | Tanium addressed an arbitrary file deletion vulnerability in end-user-cx. | ||
| CVE-2025-15313 | Med | 0.36 | 5.5 | 0.00 | Feb 10, 2026 | Tanium addressed an arbitrary file deletion vulnerability in Tanium EUSS. | ||
| CVE-2025-15310 | Hig | 0.51 | 7.8 | 0.00 | Feb 10, 2026 | Tanium addressed a local privilege escalation vulnerability in Patch Endpoint Tools. | ||
| CVE-2025-15147 | Med | 0.21 | 4.3 | 0.00 | Feb 10, 2026 | The WCFM Membership – WooCommerce Memberships for Multivendor Marketplace plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.11.8 via the 'WCFMvm_Memberships_Payment_Controller::processing' due to missing validation… | ||
| CVE-2026-25958 | Hig | 0.43 | 7.7 | 0.00 | Feb 9, 2026 | Cube is a semantic layer for building data applications. From 0.27.19 to before 1.5.13, 1.4.2, and 1.0.14, it is possible to make a specially crafted request with a valid API token that leads to privilege escalation. This vulnerability is fixed in 1.5.13, 1.4.2, and 1.0.14. | ||
| CVE-2026-25957 | Med | 0.35 | 6.5 | 0.00 | Feb 9, 2026 | Cube is a semantic layer for building data applications. From 1.1.17 to before 1.5.13 and 1.4.2, it is possible to make the entire Cube API unavailable by submitting a specially crafted request to a Cube API endpoint. This vulnerability is fixed in 1.5.13 and 1.4.2. | ||
| CVE-2026-25951 | Hig | 0.40 | 7.2 | 0.01 | Feb 9, 2026 | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.2.11, there is a flaw in the path sanitization logic allows an authenticated attacker with administrative privileges to bypass directory traversal protections. By using nested traversal… | ||
| CVE-2026-25939 | Cri | 0.53 | 9.1 | 0.13 | Feb 9, 2026 | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. From 1.2.8 through version 1.2.10, an authorization bypass vulnerability in the FUXA allows an unauthenticated, remote attacker to create and modify arbitrary schedulers, exposing connected ICS/SCADA… | ||
| CVE-2026-25938 | Cri | 0.57 | 9.8 | 0.01 | Feb 9, 2026 | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. From 1.2.8 through 1.2.10, an authentication bypass vulnerability in FUXA allows an unauthenticated, remote attacker to execute arbitrary code on the server when the Node-RED plugin is enabled. This has… | ||
| CVE-2026-25934 | Med | 0.21 | 4.3 | 0.00 | Feb 9, 2026 | go-git is a highly extensible git implementation library written in pure Go. Prior to 5.16.5, a vulnerability was discovered in go-git whereby data integrity values for .pack and .idx files were not properly verified. This resulted in go-git potentially consuming corrupted… | ||
| CVE-2026-25931 | Hig | 0.51 | 7.8 | 0.00 | Feb 9, 2026 | vscode-spell-checker is a basic spell checker that works well with code and documents. Prior to v4.5.4, DocumentSettings._determineIsTrusted treats the configuration value cSpell.trustedWorkspace as the authoritative trust flag. The value defaults to true (package.json) and is… | ||
| CVE-2026-25895 | Cri | 0.61 | 9.8 | 0.13 | Feb 9, 2026 | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. A path traversal vulnerability in FUXA allows an unauthenticated, remote attacker to write arbitrary files to arbitrary locations on the server filesystem. This affects FUXA through version 1.2.9. This… | ||
| CVE-2026-25894 | Cri | 0.57 | 9.8 | 0.01 | Feb 9, 2026 | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An insecure default configuration in FUXA allows an unauthenticated, remote attacker to gain administrative access and execute arbitrary code on the server. This affects FUXA through version 1.2.9 when… | ||
| CVE-2026-25893 | Cri | 0.57 | 9.8 | 0.01 | Feb 9, 2026 | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.2.10, an authentication bypass vulnerability in FUXA allows an unauthenticated, remote attacker to gain administrative access via the heartbeat refresh API and execute arbitrary code on the… | ||
| CVE-2025-15319 | Hig | 0.51 | 7.8 | 0.00 | Feb 9, 2026 | Tanium addressed a local privilege escalation vulnerability in Patch Endpoint Tools. | ||
| CVE-2025-15318 | Med | 0.36 | 5.5 | 0.00 | Feb 9, 2026 | Tanium addressed an arbitrary file deletion vulnerability in End-User Notifications Endpoint Tools. |
- CVE-2026-25976Feb 10, 2026risk 0.00cvss —epss —
Rejected reason: Not used
- CVE-2026-25975Feb 10, 2026risk 0.00cvss —epss —
Rejected reason: Not used
- CVE-2026-25974Feb 10, 2026risk 0.00cvss —epss —
Rejected reason: Not used
- CVE-2026-25973Feb 10, 2026risk 0.00cvss —epss —
Rejected reason: Not used
- risk 0.47cvss 7.2epss 0.06
A vulnerability was found in D-Link DCS-931L up to 1.13.0. This affects an unknown part of the file /goform/setSysAdmin. The manipulation of the argument AdminID results in os command injection. The attack can be executed remotely. The exploit has been made public and could be…
- risk 0.14cvss 3.3epss 0.00
A vulnerability has been found in aardappel lobster up to 2025.4. Affected by this issue is the function lobster::Parser::ParseStatements in the library dev/src/lobster/parser.h of the component Parsing. The manipulation leads to memory corruption. The attack can only be…
- risk 0.40cvss 6.1epss 0.00
SAP TAF_APPLAUNCHER within Business Server Pages allows unauthenticated attacker to craft malicious links that, when clicked by a victim, redirect them to attacker?controlled sites, potentially exposing or altering sensitive information in the victim�s browser. This results in…
- risk 0.28cvss 4.3epss 0.00
Due to missing authorization check in SAP Strategic Enterprise Management (Balanced Scorecard in Business Server Pages), an authenticated attacker could access information that they are otherwise unauthorized to view. This leads to low impact on confidentiality and no effect on…
- risk 0.28cvss 4.3epss 0.00
Due to a missing authorization check in the Disconnected Operations of the SAP S/4HANA Defense & Security, an attacker with user privileges could call remote-enabled function modules to do direct update on standard SAP database table . This results in low impact on integrity,…
- risk 0.31cvss 4.8epss 0.00
SAP BusinessObjects Enterprise does not sufficiently encode user-controlled inputs, leading to Stored Cross-Site Scripting (XSS) vulnerability. This enables an admin user to inject malicious JavaScript into a website and the injected script gets executed when the user visits the…
- risk 0.42cvss 6.5epss 0.00
SAP BusinessObjects Business Intelligence Platform (AdminTools) allows an authenticated attacker with user privileges to execute a specific query in AdminTools that could cause the Content Management Server (CMS) to crash, rendering the CMS partially or completely unavailable…
- risk 0.40cvss 6.1epss 0.00
The BSP applications allow an unauthenticated user to inject malicious script content via user-controlled URL parameters that are not sufficiently sanitized. When a victim accesses a crafted URL, the injected script is executed in the victim�s browser, leading to a low impact…
- risk 0.50cvss 7.7epss 0.00
SAP Solution Tools Plug-In (ST-PI) contains a function module that does not perform the necessary authorization checks for authenticated users, allowing sensitive information to be disclosed. This vulnerability has a high impact on confidentiality and does not affect integrity…
- risk 0.34cvss 5.3epss 0.00
SAP Commerce Cloud exposes multiple API endpoints to unauthenticated users, allowing them to submit requests to these open endpoints to retrieve sensitive information that is not intended to be publicly accessible via the front-end. This vulnerability has a low impact on…
- risk 0.20cvss 3.1epss 0.00
Due to improper memory management in SAP NetWeaver and ABAP Platform (Application Server ABAP), an authenticated attacker could exploit logical errors in memory management by supplying specially crafted input containing unique characters, which are improperly converted. This may…
- risk 0.38cvss 5.8epss 0.00
In SAP Business One, sensitive information is written to the application�s memory dump files without obfuscation. Gaining access to this information could potentially lead to unauthorized operations within the B1 environment, including modification of company data. This issue…
- risk 0.34cvss 5.2epss 0.00
An erroneous authorization check in SAP Business Workflow leads to privilege escalation. An authenticated administrative user can bypass role restrictions by leveraging permissions from a less sensitive function to execute unauthorized, high-privilege actions. This has a high…
- risk 0.50cvss 7.7epss 0.00
Due to an uncontrolled resource consumption (Denial of Service) vulnerability, an authenticated attacker with regular user privileges and network access can repeatedly invoke a remote-enabled function module with an excessively large loop-control parameter. This triggers…
- risk 0.28cvss 4.3epss 0.00
SAP Fiori App Manage Service Entry Sheets does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This has low impact on integrity, confidentiality and availability are not impacted.
- risk 0.57cvss 8.8epss 0.01
SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated attacker with normal privileges to obtain a valid signed message and send modified signed XML documents to the verifier. This may result in acceptance of tampered identity information, unauthorized…
- risk 0.22cvss 3.4epss 0.00
Due to a CRLF Injection vulnerability in SAP NetWeaver Application Server Java, an authenticated attacker with administrative access could submit specially crafted content to the application. If processed by the application, this content enables injection of untrusted entries…
- risk 0.29cvss 4.4epss 0.00
Due to a Deserialization vulnerability in SAP NetWeaver (JMS service), an attacker authenticated as an administrator with local access could submit specially crafted content to the server. If processed by the application, this content could trigger unintended behavior during…
- risk 0.38cvss 5.9epss 0.00
A race condition vulnerability exists in the SAP Commerce cloud. Because of this when an attacker adds products to a cart, it may result in a cart entry being created with erroneous product value which could be checked out. This leads to high impact on data integrity, with no…
- risk 0.28cvss 4.3epss 0.00
Due to missing authorization check in a function module in SAP Support Tools Plug-In, an authenticated attacker could invoke specific function modules to retrieve information about the system and its configuration. This disclosure of the system information could assist the…
- risk 0.62cvss 9.6epss 0.00
SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated, low-privileged user to perform background Remote Function Calls without the required S_RFC authorization in certain cases. This can result in a high impact on integrity and availability, and no…
- risk 0.47cvss 7.3epss 0.00
The SAP BusinessObjects Business Intelligence Platform allows an authenticated attacker with high privileges to insert malicious URL within the application. Upon successful exploitation, the victim may click on this malicious URL, resulting in an unvalidated redirect to the…
- risk 0.40cvss 6.1epss 0.00
The BSP applications allow an unauthenticated user to manipulate user-controlled URL parameters that are not sufficiently validated. This could result in unvalidated redirection to attacker-controlled websites, leading to a low impact on confidentiality and integrity, and no…
- risk 0.49cvss 7.5epss 0.00
SAP BusinessObjects BI Platform allows an unauthenticated attacker to craft a specific network request to the trusted endpoint that breaks the authentication, which prevents the legitimate users from accessing the platform. As a result, it has a high impact on the availability…
- risk 0.64cvss 9.9epss 0.01
An authenticated attacker in SAP CRM and SAP S/4HANA (Scripting Editor) could exploit a flaw in a generic function module call and execute unauthorized critical functionalities, which includes the ability to execute an arbitrary SQL statement. This leads to a full database…
- risk 0.33cvss 5.0epss 0.00
In ABAP based SAP systems a remote enabled function module does not perform necessary authorization checks for an authenticated user resulting in disclosure of system information.This has low impact on confidentiality. Integrity and availability are not impacted.
- risk 0.49cvss 7.5epss 0.00
SAP BusinessObjects BI Platform allows an unauthenticated attacker to send specially crafted requests that could cause the Content Management Server (CMS) to crash and automatically restart. By repeatedly submitting these requests, the attacker could induce a persistent service…
- risk 0.42cvss 6.5epss 0.00
Due to missing authorization check in SAP NetWeaver Application Server ABAP and SAP S/4HANA, an authenticated attacker could access a specific transaction code and modify the text data in the system. This vulnerability has a high impact on integrity of the application with no…
- risk 0.14cvss 3.3epss 0.00
A flaw has been found in aardappel lobster up to 2025.4. Affected by this vulnerability is the function WaveFunctionCollapse in the library dev/src/lobster/wfc.h. Executing a manipulation can lead to memory corruption. The attack can only be executed locally. The exploit has…
- risk 0.40cvss 7.2epss 0.00
The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the…
- risk 0.36cvss 5.5epss 0.00
Tanium addressed an arbitrary file deletion vulnerability in end-user-cx.
- risk 0.36cvss 5.5epss 0.00
Tanium addressed an arbitrary file deletion vulnerability in Tanium EUSS.
- risk 0.51cvss 7.8epss 0.00
Tanium addressed a local privilege escalation vulnerability in Patch Endpoint Tools.
- risk 0.21cvss 4.3epss 0.00
The WCFM Membership – WooCommerce Memberships for Multivendor Marketplace plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.11.8 via the 'WCFMvm_Memberships_Payment_Controller::processing' due to missing validation…
- risk 0.43cvss 7.7epss 0.00
Cube is a semantic layer for building data applications. From 0.27.19 to before 1.5.13, 1.4.2, and 1.0.14, it is possible to make a specially crafted request with a valid API token that leads to privilege escalation. This vulnerability is fixed in 1.5.13, 1.4.2, and 1.0.14.
- risk 0.35cvss 6.5epss 0.00
Cube is a semantic layer for building data applications. From 1.1.17 to before 1.5.13 and 1.4.2, it is possible to make the entire Cube API unavailable by submitting a specially crafted request to a Cube API endpoint. This vulnerability is fixed in 1.5.13 and 1.4.2.
- risk 0.40cvss 7.2epss 0.01
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.2.11, there is a flaw in the path sanitization logic allows an authenticated attacker with administrative privileges to bypass directory traversal protections. By using nested traversal…
- risk 0.53cvss 9.1epss 0.13
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. From 1.2.8 through version 1.2.10, an authorization bypass vulnerability in the FUXA allows an unauthenticated, remote attacker to create and modify arbitrary schedulers, exposing connected ICS/SCADA…
- risk 0.57cvss 9.8epss 0.01
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. From 1.2.8 through 1.2.10, an authentication bypass vulnerability in FUXA allows an unauthenticated, remote attacker to execute arbitrary code on the server when the Node-RED plugin is enabled. This has…
- risk 0.21cvss 4.3epss 0.00
go-git is a highly extensible git implementation library written in pure Go. Prior to 5.16.5, a vulnerability was discovered in go-git whereby data integrity values for .pack and .idx files were not properly verified. This resulted in go-git potentially consuming corrupted…
- risk 0.51cvss 7.8epss 0.00
vscode-spell-checker is a basic spell checker that works well with code and documents. Prior to v4.5.4, DocumentSettings._determineIsTrusted treats the configuration value cSpell.trustedWorkspace as the authoritative trust flag. The value defaults to true (package.json) and is…
- risk 0.61cvss 9.8epss 0.13
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. A path traversal vulnerability in FUXA allows an unauthenticated, remote attacker to write arbitrary files to arbitrary locations on the server filesystem. This affects FUXA through version 1.2.9. This…
- risk 0.57cvss 9.8epss 0.01
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An insecure default configuration in FUXA allows an unauthenticated, remote attacker to gain administrative access and execute arbitrary code on the server. This affects FUXA through version 1.2.9 when…
- risk 0.57cvss 9.8epss 0.01
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.2.10, an authentication bypass vulnerability in FUXA allows an unauthenticated, remote attacker to gain administrative access via the heartbeat refresh API and execute arbitrary code on the…
- risk 0.51cvss 7.8epss 0.00
Tanium addressed a local privilege escalation vulnerability in Patch Endpoint Tools.
- risk 0.36cvss 5.5epss 0.00
Tanium addressed an arbitrary file deletion vulnerability in End-User Notifications Endpoint Tools.