CVE Vulnerability Catalog

A deserialization of untrusted data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execute arbitrary code on the server.

A deserialization of untrusted data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.

A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.

A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.

A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.

Private Metrics Server contained an SQL injection condition affecting database operations. Software customers should upgrade to the resolved maintenance release. Update Private Metrics Server.

Content Extractor has a deserialization of untrusted data issue affecting privilege management. Software customers should upgrade to the resolved maintenance release.

Command Center API contained an authentication bypass issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update Command Center.

A flaw was found in hawtio-operator. The operator reads the OpenShift Service CA private signing key from the openshift-service-ca namespace and uses it to mint client certificates with a Subject Common Name (CN) supplied by the author of a namespaced Hawtio custom resource. Because the operator ships a ClusterRole that aggregates Hawtio CR permissions into the edit and admin roles, any user with edit access in any namespace can obtain a Service-CA-signed certificate with an arbitrary subject. This certificate can be used to impersonate any in-cluster service identity to peers that trust the Service CA for client authentication, including Jolokia agents and other Service-CA-trusting components.

Command argument injection vulnerability in Cosminexus Component Container. Allows an attacker to execute unauthorized system commands.

OS command injection vulnerability in Cosminexus Component Container. Allows an attacker to execute arbitrary commands on the server.

Vulnerability in Reyrolle 7SR5 exposes information through the web interface that can be used to calculate current and past session ID numbers. An attacker could bypass authentication and gain unauthorized access to the device.

Vulnerability in the OIS web module of Siveillance Control allows an attacker to upload arbitrary files to the server. Successful exploitation could allow an attacker to gain root access on the host system, potentially leading to full compromise of the OIS environment.

Deserialization of untrusted data vulnerability in Cosminexus Component Container. Could allow an attacker to execute arbitrary code or cause a crash.

The D-Link DIR-822A router version A_101 has a vulnerability in the tunnel_set_params function of the L2TP Control Message Parser component, leading to an out-of-bounds write. The attack can be launched remotely, and the exploit has been publicly disclosed.

The D-Link DIR-895L router version A1_102b07 has a vulnerability in the sendOffer/sendACK functions of the file udhcpcd/serverpacket.c in the udhcpcd component, causing a stack-based buffer overflow. The attack can only be performed within the local network, and the exploit has been published.

The @sap/cds-mtxs NPM library does not perform sufficient checks on certain functionality used in multitenant CAP applications with extensibility enabled. An unauthenticated attacker could send specially crafted requests to obtain sensitive credentials and abuse them to replace or delete tenant data. Successful exploitation can result in a high impact on availability and integrity of the application, and partial impact on confidentiality of business data.

SAP GUI for Java does not correctly enforce the trust level policy for certain functions invoked from a connected backend system. A low-privileged attacker could exploit this weakness by manipulating a connected backend system to trigger affected functionality. This could allow arbitrary command execution on the victim's machine, leading to a high impact on confidentiality, integrity, and availability.

SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during registration. An unauthenticated attacker with network access could register an unauthorized component and potentially perform unauthorized actions, resulting in high impact on confidentiality, integrity, and availability.

A memory safety vulnerability exists in the Extended Passport Protocol (EPP) processing library. Under specific conditions, an unauthenticated attacker could exploit a crafted network request with a malformed EPP header, potentially resulting in undefined behavior and abnormal program termination. Successful exploitation may have high impact on confidentiality, integrity, and availability.