CVE-2026-40128
SAP NetWeaver Application Server Java (Web Container) allows an unauthenticated attacker to craft a malicious HTTP logon request that manipu
CVSS
9.0
Critical
EPSS
0.5%
p37
KEV
—
Exploit Today
11
0-100
Published: Jun 9, 2026 · Last modified: Jul 23, 2026 · CWE-35
0.5%EPSS · 30 days0.5%
2026-06-302026-07-26
SAP NetWeaver Application Server Java (Web Container) allows an unauthenticated attacker to craft a malicious HTTP logon request that manipulates file inclusion parameters, enabling path traversal and processing of the included file. Processing the included file could allow the attacker to view or modify sensitive information or render any part of the local system unavailable.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2025-59181——
———Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain a directory traversal vulnerability in Configuration Management that could allow an attacker to change directory permissions, denying access to legitimate users.6hCVE-2025-608357.8 HIG4.4%
——1An issue in the unrar.dll component of IZArc v4.6 allows attackers to execute a path traversal.3dCVE-2026-497796.5 MED26.9%
——8Customer Path Traversal in Tax Exempt for WooCommerce <= 1.9.3 versions.25dCVE-2026-243154.2 MED7.1%
——2SAP Fiori Launchpad allows attackers to craft malicious URLs that triggers arbitrary service calls on the Fiori domain, this when opened by the user could compromise accounts by stealing user credentials. Successful exploitation requires adversaries to possess advanced knowledge of the system causing low impact on Confidentiality and Integrity. Availability of the system is no impacted.5dCVE-2026-456619.9 CRI47.8%
——14Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.26.5 and earlier, a critical path traversal vulnerability exists in Dokploy v0.26.5 that allows authenticated users to write arbitrary files to the filesystem during application deployment. When combined with Dokploy's remote server deployment feature, this vulnerability enables arbitrary file write to remote server filesystems, automatic remote code execution via cron jobs, complete server compromise, data exfiltration without user interaction, and persistent backdoor installation. This vulnerability bypasses all container isolation on remote server deployments.6dCVE-2026-200348.8 HIG49.8%
——15A vulnerability in the web-based management interface of Cisco Unity Connection could allow an authenticated, remote attacker to execute arbitrary code on an affected device.
This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to execute arbitrary code as root, possibly resulting in the complete compromise of a targeted device. To exploit this vulnerability, the attacker must have valid user credentials on the affected device.26d