Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-89112 | medium | 6.5 | No | The admin API endpoint used to retrieve CLA signature records does not consistently enforce the required authorization checks when the targe... | 2026-10-15 |
| CVE-2026-89110 | critical | 9.9 | No | SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality. An attacker with low privile... | 2026-10-15 |
| CVE-2026-89108 | critical | 9.1 | No | SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative function... | 2026-10-15 |
| CVE-2026-89107 | critical | 9.9 | No | SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validate input processed by rule definition functionality that util... | 2026-10-15 |
| CVE-2026-89106 | medium | 4.4 | No | SAP UI5 does not perform sufficient input validation under certain configurations. An attacker with low privileges could submit specially cr... | 2026-10-15 |
| CVE-2026-89105 | medium | 4.2 | No | The HybridTokenAuthenticator component of the SAP/cloud-security-services-integration-library accepts tokens from unintended ambient IAS/XSU... | 2026-10-15 |
| CVE-2026-76976 | medium | 5.4 | No | Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP do not sufficiently sanitize user-supplied content in certai... | 2026-10-15 |
| CVE-2026-76975 | medium | 6.1 | No | Due to a DOM-Based Cross-Site Scripting (XSS) vulnerability, an unauthenticated attacker could generate a malicious link and make it publicl... | 2026-10-15 |
| CVE-2026-76972 | medium | 6.5 | No | Due to a Cross-Site Scripting (XSS) vulnerability in SAP Manufacturing Integration and Intelligence, an attacker could store malicious conte... | 2026-10-15 |
| CVE-2026-58249 | high | 7.5 | No | SAP NetWeaver and SAP Web Dispatcher do not properly validate certain fields in specially crafted requests handled by an internal protocol c... | 2026-10-15 |
| CVE-2026-58242 | low | 3.5 | No | SAP Cloud Connector contains an improper authorization check, which could be exploited by a low-privileged attacker through specially crafte... | 2026-10-15 |
| CVE-2026-110857 | high | 7.5 | No | GitPython before 3.2.0 contains a remote code execution vulnerability that allows attackers to run commands because Git.ls_remote forwards U... | 2026-10-15 |
| CVE-2026-109357 | high | 8.1 | No | LibreNMS before 26.9.0 contains an LDAP filter injection in ldap-authorization and ad-authorization modes because usernames are inserted une... | 2026-10-15 |
| CVE-2026-109354 | medium | 4.3 | No | LibreNMS before 26.9.0 contains a path traversal vulnerability in nfsen_channel_common.inc.php that allows authenticated users to read unaut... | 2026-10-15 |
| CVE-2026-109353 | high | 7.1 | No | LibreNMS before 26.9.0 contains an SQL injection vulnerability that allows unprivileged users to inject SQL by supplying an array-valued not... | 2026-10-15 |
| CVE-2026-109352 | medium | 6.1 | No | LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in includes/html/pages/device/wireless.inc.php, which echoes wir... | 2026-10-15 |
| CVE-2026-109307 | medium | 4.7 | No | Craft CMS 5.0.0 before 5.10.14 contains a DOM-based cross-site scripting vulnerability in the control panel login and 2FA verification flow,... | 2026-10-15 |
| CVE-2026-109302 | low | 3.7 | No | Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 applies its GraphQL introspection control only to operation text sent dire... | 2026-10-15 |
| CVE-2026-109237 | high | 8.1 | No | Crawl4AI from 0.9.0 before 0.9.4 contains an untrusted-config gate bypass that allows non-admin API clients to construct forbidden config ob... | 2026-10-15 |
| CVE-2026-108715 | medium | 4.3 | No | LibreNMS through 26.9.1.1 contains an authorization bypass vulnerability in includes/html/graphs/smokeping/auth.inc.php that checks the src... | 2026-10-15 |