Total
6987 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-0488 | 1 Sap | 3 Netweaver Application Server Abap, S\/4hana, Webclient Ui Framework | 2026-02-17 | N/A | 9.9 CRITICAL |
| An authenticated attacker in SAP CRM and SAP S/4HANA (Scripting Editor) could exploit a flaw in a generic function module call and execute unauthorized critical functionalities, which includes the ability to execute an arbitrary SQL statement. This leads to a full database compromise with high impact on confidentiality, integrity, and availability. | |||||
| CVE-2026-0490 | 1 Sap | 1 Businessobjects Business Intelligence Platform | 2026-02-17 | N/A | 7.5 HIGH |
| SAP BusinessObjects BI Platform allows an unauthenticated attacker to craft a specific network request to the trusted endpoint that breaks the authentication, which prevents the legitimate users from accessing the platform. As a result, it has a high impact on the availability but no impact on the confidentiality and integrity. | |||||
| CVE-2026-0509 | 1 Sap | 3 Netweaver As Abap Kernel, Netweaver As Abap Krnl64nuc, Netweaver As Abap Krnl64uc | 2026-02-17 | N/A | 9.6 CRITICAL |
| SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated, low-privileged user to perform background Remote Function Calls without the required S_RFC authorization in certain cases. This can result in a high impact on integrity and availability, and no impact on the confidentiality of the application. | |||||
| CVE-2026-23681 | 1 Sap | 1 Solution Tools Plug-in | 2026-02-17 | N/A | 4.3 MEDIUM |
| Due to missing authorization check in a function module in SAP Support Tools Plug-In, an authenticated attacker could invoke specific function modules to retrieve information about the system and its configuration. This disclosure of the system information could assist the attacker to plan subsequent attacks. This vulnerability has a low impact on the confidentiality of the application, with no effect on its integrity or availability. | |||||
| CVE-2026-23688 | 1 Sap | 1 S4core | 2026-02-17 | N/A | 4.3 MEDIUM |
| SAP Fiori App Manage Service Entry Sheets does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This has low impact on integrity, confidentiality and availability are not impacted. | |||||
| CVE-2026-24312 | 1 Sap | 1 Sap Basis | 2026-02-17 | N/A | 5.2 MEDIUM |
| An erroneous authorization check in SAP Business Workflow leads to privilege escalation. An authenticated administrative user can bypass role restrictions by leveraging permissions from a less sensitive function to execute unauthorized, high-privilege actions. This has a high impact on data integrity, with low impact on confidentiality and no impact on availability of the application. | |||||
| CVE-2026-24322 | 1 Sap | 1 Solution Tools Plug-in | 2026-02-17 | N/A | 7.7 HIGH |
| SAP Solution Tools Plug-In (ST-PI) contains a function module that does not perform the necessary authorization checks for authenticated users, allowing sensitive information to be disclosed. This vulnerability has a high impact on confidentiality and does not affect integrity or availability. | |||||
| CVE-2026-24326 | 1 Sap | 1 S\/4hana Defense \& Security | 2026-02-17 | N/A | 4.3 MEDIUM |
| Due to a missing authorization check in the Disconnected Operations of the SAP S/4HANA Defense & Security, an attacker with user privileges could call remote-enabled function modules to do direct update on standard SAP database table . This results in low impact on integrity, with no impact on confidentiality or availability of the application. | |||||
| CVE-2026-24327 | 1 Sap | 1 Strategic Enterprise Management | 2026-02-17 | N/A | 4.3 MEDIUM |
| Due to missing authorization check in SAP Strategic Enterprise Management (Balanced Scorecard in Business Server Pages), an authenticated attacker could access information that they are otherwise unauthorized to view. This leads to low impact on confidentiality and no effect on integrity or availability. | |||||
| CVE-2025-67737 | 1 Azuracast | 1 Azuracast | 2026-02-17 | N/A | 3.1 LOW |
| AzuraCast is a self-hosted, all-in-one web radio management suite. Versions 0.23.1 mistakenly include an API endpoint that is intended for internal use by the SFTP software sftpgo, exposing it to the public-facing HTTP API for AzuraCast installations. A user with specific internal knowledge of a station's operations can craft a custom HTTP request that would affect the contents of a station's database, without revealing any internal information about the station. In order to carry out an attack, a malicious user would need to know a valid SFTP station username and the coordinating internal filesystem structure. This issue is fixed in version 0.23.2. | |||||
| CVE-2026-24532 | 2026-02-17 | N/A | 4.3 MEDIUM | ||
| Missing Authorization vulnerability in SiteLock SiteLock Security – WP Hardening, Login Security & Malware Scans allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SiteLock Security – WP Hardening, Login Security & Malware Scans: from n/a through 5.0.2. | |||||
| CVE-2023-1333 | 1 Rapidload | 1 Rapidload Power-up For Autoptimize | 2026-02-13 | N/A | 4.3 MEDIUM |
| The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the clear_page_cache function in versions up to, and including, 1.7.1. This makes it possible for authenticated attackers with subscriber-level access to delete the plugin's cache. | |||||
| CVE-2026-25531 | 1 Kanboard | 1 Kanboard | 2026-02-13 | N/A | 4.3 MEDIUM |
| Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, The fix for CVE-2023-33968 is incomplete. The TaskCreationController::duplicateProjects() endpoint does not validate user permissions for target projects, allowing authenticated users to duplicate tasks into projects they cannot access. This vulnerability is fixed in 1.2.50. | |||||
| CVE-2026-25939 | 1 Frangoteam | 1 Fuxa | 2026-02-13 | N/A | 9.1 CRITICAL |
| FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. From 1.2.8 through version 1.2.10, an authorization bypass vulnerability in the FUXA allows an unauthenticated, remote attacker to create and modify arbitrary schedulers, exposing connected ICS/SCADA environments to follow-on actions. This has been patched in FUXA version 1.2.11. | |||||
| CVE-2025-14592 | 1 Gitlab | 1 Gitlab | 2026-02-13 | N/A | 3.7 LOW |
| GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain conditions could have allowed an authenticated user to perform unauthorized operations by submitting GraphQL mutations through the GLQL API endpoint. | |||||
| CVE-2026-1104 | 2026-02-13 | N/A | 8.8 HIGH | ||
| The FastDup – Fastest WordPress Migration & Duplicator plugin for WordPress is vulnerable to unauthorized backup creation and download due to a missing capability check on REST API endpoints in all versions up to, and including, 2.7.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to create and download full-site backup archives containing the entire WordPress installation, including database exports and configuration files. | |||||
| CVE-2026-20626 | 1 Apple | 4 Ipados, Iphone Os, Macos and 1 more | 2026-02-12 | N/A | 7.8 HIGH |
| This issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.4, iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, visionOS 26.3. A malicious app may be able to gain root privileges. | |||||
| CVE-2025-30398 | 1 Microsoft | 1 Nuance Powerscribe One | 2026-02-12 | N/A | 8.1 HIGH |
| Missing authorization in Nuance PowerScribe allows an unauthorized attacker to disclose information over a network. | |||||
| CVE-2026-21743 | 1 Fortinet | 1 Fortiauthenticator | 2026-02-12 | N/A | 7.2 HIGH |
| A missing authorization vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, FortiAuthenticator 6.4 all versions, FortiAuthenticator 6.3 all versions may allow a read-only user to make modification to local users via a file upload to an unprotected endpoint. | |||||
| CVE-2026-25036 | 2026-02-12 | N/A | 6.5 MEDIUM | ||
| Missing Authorization vulnerability in WP Chill Passster content-protector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Passster: from n/a through <= 4.2.25. | |||||