Most recent entries from cvelistv5

CVE-2026-125612 — DIAEnergie - SQL Injection Vulnerability

Tue, 10 Nov 2026 02:59:53 +0000

Affected: Deltaww DIAEnergie

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Deltaww DIAEnergie allows SQL Injection.

This issue affects DIAEnergie: before 1.11.01.032.

CVE-2026-88708

Tue, 10 Nov 2026 02:00:37 +0000

Affected: ASUS Router firmware

An off-by-one error in certain ASUS Router firmware allows an unauthenticated nearby user to send a packet with a specific header length, potentially overwriting memory and causing the affected service to crash. Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.

CVE-2026-88707

Tue, 10 Nov 2026 02:00:26 +0000

Affected: ASUS Router firmware

An out-of-bounds write in certain ASUS Router firmware allows an unauthenticated nearby user to send an HTTP request containing parameters that exceed the buffer length, potentially overwriting other memory regions or causing the system to crash. Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.

CVE-2026-88710

Tue, 10 Nov 2026 02:00:17 +0000

Affected: ASUS Router firmware

Improper neutralization of special elements used in an OS command in certain ASUS Router firmware allows an unauthenticated nearby user to trigger a chain of actions—unauthenticated queries, identifier guessing, credential overwriting, and command injection—resulting in the execution of arbitrary commands with root privileges. Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.

CVE-2026-88709

Tue, 10 Nov 2026 02:00:09 +0000

Affected: ASUS Router firmware

Improper neutralization of special elements used in an OS command in certain ASUS Router firmware allows an user with physical access to insert a USB device containing a specially crafted directory name, potentially executing arbitrary commands with root privileges. Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.

CVE-2026-109799 — Improper verification of JWT signature in IASContextProvider leads to tenant/user identity spoofing ( sap-cloud-sdk (pi…

Tue, 10 Nov 2026 01:04:31 +0000

Affected: SAP_SE SAP Cloud SDK for Python

The SAP Cloud SDK for Python contains an improper cryptographic signature verification vulnerability (CWE-347) in IASContextProvider, the runtime-context provider registered by default via bootstrap(app).IASContextProvider extracted the app_tid, sap_gtid and user_uuid claims from the IAS JWT in the Authorization header using an unverified decoder and wrote them into the request-scoped RuntimeContext without validating the token signature. A remote caller could submit a self-signed JWT naming a victim tenant/user; the forged identity then propagated to every consumer of the runtime context:OTel span attributes (sap.tenancy.tenant_id, user.id) via RuntimeContextSpanProcessorlog records via IdentityLogFilteraudit events (tenant_id, user_initiator_id) via AuditClienttenant routing via CBCClientThis completes an earlier remediation that fixed the same unverified pattern in StarletteIASTelemetryMiddleware but did not cover IASContextProvider.

CVE-2026-109797 — Cross-tenant sandbox takeover in SAP/astonish

Tue, 10 Nov 2026 01:03:52 +0000

Affected: SAP_SE SAP/astonish

In SAP/astonish, an authenticated user could potentially identify and operate on another team�s sandbox containers because of improper tenant isolation in the legacy Incus sandbox-management API handlers. The affected handlers did not use the tenant-aware session lookup path, allowing cross-tenant container operations such as listing, exposing or proxying, and deleting containers.The issue affects only the legacy Incus backend. Kubernetes and OpenShell deployments are not affected because the relevant Incus-specific handlers are unavailable there.

CVE-2026-125087 — Michael-A-Kuykendall Shimmy Inference API server.rs missing authentication

Tue, 10 Nov 2026 01:00:27 +0000

Affected: Michael-A-Kuykendall Shimmy

A vulnerability was found in Michael-A-Kuykendall Shimmy up to 2.6.4. The affected element is an unknown function of the file src/server.rs of the component Inference API. Performing a manipulation results in missing authentication. The attack is possible to be carried out remotely. Upgrading to version 2.6.5 is sufficient to fix this issue. The patch is named 3f2ee748c02eeb229987913fe289a2ed9a24595d. You should upgrade the affected component.

CVE-2026-109805 — Weak Cryptography in SAP NetWeaver and ABAP Platform (Application Server ABAP)

Tue, 10 Nov 2026 00:49:24 +0000

Affected: SAP_SE SAP NetWeaver and ABAP Platform (Application Server ABAP)

Due to a weak HMAC cryptography calculation when receiving an RFC callback in SAP NetWeaver and ABAP Platform (Application Server ABAP), an authenticated attacker with high privileges and access to a network segment between application servers on an SAP system could intercept network communication between application servers and change the identity of the caller, enabling the execution of unauthorized function calls on the target server with escalated privileges leading to High impact on Confidentiality, Integrity, and Availability of the application.

CVE-2026-89125 — Insecure Storage of Sensitive Information in SAP Web Dispatcher and Internet Communication Manager

Tue, 10 Nov 2026 00:46:53 +0000

Affected: SAP_SE SAP Web Dispatcher and Internet Communication Manager

Due to Insecure Storage of Sensitive Information in SAP Web Dispatcher and Internet Communication Manager, an attacker with administrative privileges could obtain sensitive information from stored data. This may allow correlation of credentials across users and deployments, potentially leading to credential exposure and unauthorized access. Successful exploitation could expose credentials and facilitate unauthorized access to affected systems, resulting in a high impact on confidentiality and a low impact on integrity and availability.