CVE Watch10 de nov. de 2026

CVE-2026-76964

SAP NetWeaver Application Server ABAP does not sufficiently validate certain network input processed by an internal component. An unauthenti

CVSS

10.0

Crítica

EPSS

—

KEV

—

Exploit Today

—

0-100

Publicado: 10 de nov. de 2026 · Última mod.: 10 de nov. de 2026 · CWE-1287

EPSS · 30d

Ainda não há histórico EPSS suficiente.

Descrição técnica

SAP NetWeaver Application Server ABAP does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption condition in the affected functionality. Successful exploitation could allow the attacker to execute arbitrary code and fully compromise the system, resulting in a high impact on confidentiality, integrity and availability of the system.

Referências oficiais

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-632826.5 MÉD

—

———Improper shell quote escaping when processing user-controlled input, potentially allowing command injection, which could lead to privilege escalation.5h CVE-2026-145433.9 BAI

—

———The VAPIX Edge storage API, enabling the escalation of user privileges by circumventing filesystem isolation, granting unauthorized access to protected system resources. This flaw can only be exploited after authenticating with an admin-privileged service account.5h CVE-2026-145426.7 MÉD

—

———The VAPIX SIP configuration API lacked sufficient input validation, which could potentially lead to privilege escalation. This flaw can only be exploited after authenticating with an admin-privileged service account.5h CVE-2026-133129.9 CRÍ

—

———A vulnerability that could allow an attacker to compromise a system.5h CVE-2025-360755.3 MÉD

16.3%

——5IBM Safer Payments 6.4.0.00 through 6.4.2.11, 6.5.0.00 through 6.5.0.09, 6.6.0.00 through 6.6.0.07, 6.7.0.00 through 6.7.0.03, and 6.8.0.00 could allow an authenticated user to obtain sensitive information, caused by improper user input validation. By using a set of API requests the user could exploit this vulnerability to decrypt sensitive information.18h CVE-2026-123776—

15.2%

——5RRD::CGI::Image versions through 0.01 for Perl pass CGI query parameters containting "tz" to tzset(), , so a FIFO or device path blocks the CGI process. The normalize_params method sends any query key matching /tz/i to tz(), which sets $ENV{TZ} to that value, with no validation. It then calls tzset(). glibc treats a TZ value starting with / or : as a file path and opens it, so a value naming a FIFO or a blocking device stalls the process inside tzset().3d