Tag: cvss
-
CVSS 10 im SAP-Kernel: OVERPASS öffnet Angreifern den Weg zu kritischen Geschäftssystemen
SAP OVERPASS (CVE-2026-44756) erreicht CVSS 10,0 und betrifft zahlreiche SAP-Systeme. Qualys warnt vor Angriffen über HTTP, SAP GUI und RFC. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/cvss-10-im-sap-kernel-overpass-oeffnet-angreifern-den-weg-zu-kritischen-geschaeftssystemen/a46377/
-
CVSS 10 im SAP-Kernel: OVERPASS öffnet Angreifern den Weg zu kritischen Geschäftssystemen
SAP OVERPASS (CVE-2026-44756) erreicht CVSS 10,0 und betrifft zahlreiche SAP-Systeme. Qualys warnt vor Angriffen über HTTP, SAP GUI und RFC. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/cvss-10-im-sap-kernel-overpass-oeffnet-angreifern-den-weg-zu-kritischen-geschaeftssystemen/a46377/
-
CVSS 10 im SAP-Kernel: OVERPASS öffnet Angreifern den Weg zu kritischen Geschäftssystemen
SAP OVERPASS (CVE-2026-44756) erreicht CVSS 10,0 und betrifft zahlreiche SAP-Systeme. Qualys warnt vor Angriffen über HTTP, SAP GUI und RFC. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/cvss-10-im-sap-kernel-overpass-oeffnet-angreifern-den-weg-zu-kritischen-geschaeftssystemen/a46377/
-
CVSS 10 im SAP-Kernel: OVERPASS öffnet Angreifern den Weg zu kritischen Geschäftssystemen
SAP OVERPASS (CVE-2026-44756) erreicht CVSS 10,0 und betrifft zahlreiche SAP-Systeme. Qualys warnt vor Angriffen über HTTP, SAP GUI und RFC. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/cvss-10-im-sap-kernel-overpass-oeffnet-angreifern-den-weg-zu-kritischen-geschaeftssystemen/a46377/
-
Extended-Passport-Daten im SAP-Kernel gefährdet
SAP hat insgesamt 22 Security-Notes veröffentlicht, darunter fünf Hot-News-Einträge. Die schwerwiegendste Schwachstelle intern <> genannt, geführt als CVE-2026-44756 betrifft die Verarbeitung von Extended-Passport-Daten im SAP-Kernel und erreicht mit CVSS 10,0 den höchstmöglichen Wert. Ein nicht authentifizierter Angreifer kann über eine präparierte Netzwerkanfrage mit fehlerhaftem EPP-Header eine Speicherbeschädigung auslösen. Die Schwachstelle ist über mehrere […] First…
-
Extended-Passport-Daten im SAP-Kernel gefährdet
SAP hat insgesamt 22 Security-Notes veröffentlicht, darunter fünf Hot-News-Einträge. Die schwerwiegendste Schwachstelle intern <> genannt, geführt als CVE-2026-44756 betrifft die Verarbeitung von Extended-Passport-Daten im SAP-Kernel und erreicht mit CVSS 10,0 den höchstmöglichen Wert. Ein nicht authentifizierter Angreifer kann über eine präparierte Netzwerkanfrage mit fehlerhaftem EPP-Header eine Speicherbeschädigung auslösen. Die Schwachstelle ist über mehrere […] First…
-
Extended-Passport-Daten im SAP-Kernel gefährdet
SAP hat insgesamt 22 Security-Notes veröffentlicht, darunter fünf Hot-News-Einträge. Die schwerwiegendste Schwachstelle intern <> genannt, geführt als CVE-2026-44756 betrifft die Verarbeitung von Extended-Passport-Daten im SAP-Kernel und erreicht mit CVSS 10,0 den höchstmöglichen Wert. Ein nicht authentifizierter Angreifer kann über eine präparierte Netzwerkanfrage mit fehlerhaftem EPP-Header eine Speicherbeschädigung auslösen. Die Schwachstelle ist über mehrere […] First…
-
Extended-Passport-Daten im SAP-Kernel gefährdet
SAP hat insgesamt 22 Security-Notes veröffentlicht, darunter fünf Hot-News-Einträge. Die schwerwiegendste Schwachstelle intern <> genannt, geführt als CVE-2026-44756 betrifft die Verarbeitung von Extended-Passport-Daten im SAP-Kernel und erreicht mit CVSS 10,0 den höchstmöglichen Wert. Ein nicht authentifizierter Angreifer kann über eine präparierte Netzwerkanfrage mit fehlerhaftem EPP-Header eine Speicherbeschädigung auslösen. Die Schwachstelle ist über mehrere […] First…
-
Extended-Passport-Daten im SAP-Kernel gefährdet
SAP hat insgesamt 22 Security-Notes veröffentlicht, darunter fünf Hot-News-Einträge. Die schwerwiegendste Schwachstelle intern <> genannt, geführt als CVE-2026-44756 betrifft die Verarbeitung von Extended-Passport-Daten im SAP-Kernel und erreicht mit CVSS 10,0 den höchstmöglichen Wert. Ein nicht authentifizierter Angreifer kann über eine präparierte Netzwerkanfrage mit fehlerhaftem EPP-Header eine Speicherbeschädigung auslösen. Die Schwachstelle ist über mehrere […] First…
-
SAP September 2026 Security Update Fixes 4 Critical Vulnerabilities and 15 Other Flaws
SAP released 19 new Security Notes addressing four critical vulnerabilities and 15 additional flaws throughout its enterprise portfolio. The vendor also updated one note from August. The most urgent issue is CVE-2026-44756, a memory-corruption vulnerability in Extended Passport (EPP) Processing with a CVSS score of 10.0. This flaw affects numerous SAP Kernel and Web Dispatcher…
-
Why Vulnerability Management Must Move Beyond CVSS
Learn why vulnerability management must move beyond CVSS to prioritize real risk using exploitability, asset context, attack paths, and AI-driven analysis. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/news-why-vulnerability-management-moves-past-cvss/
-
Microsoft Exchange Vulnerability CVE-2026-62911: What Administrators Should Do and How Zscaler Can Help
Microsoft’s August 2026 Patch Tuesday included a fix for CVE-2026-62911, a high-severity authentication bypass vulnerability affecting Exchange Server 2016, 2019, and Subscription Edition. The severity has a CVSS score of 8.0 from Microsoft. As of September 1, threat intelligence group Shadowserver has… First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/microsoft-exchange-vulnerability-cve-2026-62911-what-administrators-should-do-and-how-zscaler-can-help/
-
Critical Cisco Nexus 9000 Flaw Lets Remote Attackers Execute Code as Root Without Authentication
Cisco has released security updates addressing a critical vulnerability in Nexus 9000 Series switches that could allow unauthenticated remote attackers to execute arbitrary code with root privileges. This vulnerability, tracked as CVE-2026-20212, has a CVSS score of 9.8 and affects Nexus 9000 platforms that are equipped with Cisco Silicon One ASICs. Cisco Nexus 9000 Flaw…
-
SonicWall Patches Two New Actively Exploited Zero-Days in SMA 1000 VPNs
SonicWall patched two zero-days in SMA 1000 VPNs, including a CVSS 10 pre-auth SSRF flaw, after confirming active exploitation. SonicWall has released security updates for two vulnerabilities in its SMA 1000 VPN appliances that are actively exploited in attacks in the wild. SonicWall’s researchers William Perry and Adam Babis discovered the vulnerabilities. SonicWall confirmed that…
-
SonicWall Patches Two New Actively Exploited Zero-Days in SMA 1000 VPNs
SonicWall patched two zero-days in SMA 1000 VPNs, including a CVSS 10 pre-auth SSRF flaw, after confirming active exploitation. SonicWall has released security updates for two vulnerabilities in its SMA 1000 VPN appliances that are actively exploited in attacks in the wild. SonicWall’s researchers William Perry and Adam Babis discovered the vulnerabilities. SonicWall confirmed that…
-
What vulnerability prioritization looks like when KEV, EPSS, and CVSS disagree
In this Help Net Security interview, Dr. Joye Purser, Global Field CISO at Cohesity, explains how to rank vulnerabilities when KEV, EPSS, and CVSS point in different … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/08/31/joye-purser-cohesity-kev-epss-cvss-conflicts/
-
Critical Microsoft UFO MCP Flaw Lets Attackers Remotely Control Android Devices Without Authentication
Tags: access, android, authentication, control, cve, cvss, cyber, flaw, microsoft, mobile, open-source, vulnerabilityA critical vulnerability in Microsoft’s open-source UFO Desktop AgentOS could allow remote attackers to access and control Android devices connected via the platform’s Mobile Model Context Protocol (MCP) servers without requiring authentication. This vulnerability is tracked as CVE-2026-73296 and GHSA-24fq-m9rr-g3mm, carrying a CVSS v3.1 score of 9.4. It affects UFO versions up to and including…
-
Critical WordPress Plugin Flaw Allows Unauthenticated Administrator Account Takeover
A critical authentication bypass vulnerability has been identified in the WPMU DEV Dashboard WordPress plugin, which could allow unauthenticated attackers to gain administrator-level access to vulnerable sites configured with Hub Single Sign-On (SSO). This vulnerability, tracked as CVE-2026-76581, has a CVSS score of 9.8 and affects WPMU DEV Dashboard versions 5.0.1 and earlier. The plugin…
-
Three CVSS 10.0 ServiceNow Flaws Could Let Unauthenticated Attackers Execute Code and SQL
ServiceNow has released patches for four security flaws impacting the ServiceNow AI Platform, three of them rated 10.0 on the CVSS scoring system and exploitable, in certain circumstances, by an unauthenticated attacker.The company said it deployed a security update to hosted instances and provided the update to its partners and self-hosted customers, which leaves organizations…
-
CVE vs CWE vs CAPEC vs MITRE ATTCK: What They Are and Why Your Content Needs Them
CVE, CWE, CAPEC, ATT&CK, CVSS, KEV, ATLAS. The security taxonomy acronyms get used interchangeably and they should not be. Here is what each one actually does, how they chain together, and why they matter more for your content strategy than most security marketers realize. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/08/cve-vs-cwe-vs-capec-vs-mitre-attck-what-they-are-and-why-your-content-needs-them/
-
Critical Veeam ONE Flaw Lets Unauthenticated Attackers Coerce SMB Authentication From Service Accounts
Veeam has released security updates for a critical vulnerability in Veeam ONE that could allow an unauthenticated network attacker to coerce SMB authentication from the account running an affected service. Tracked as CVE-2026-65641, the vulnerability received a CVSS v4.0 severity score of 9.3. Veeam disclosed the issue through Knowledge Base article 4905, published on August…
-
Critical WatchGuard Agent Flaws Let Unauthenticated Attackers Execute Remote Code
WatchGuard has revealed two critical vulnerabilities in its Windows WatchGuard Agent, which could allow unauthenticated attackers to execute arbitrary code on affected endpoints. These vulnerabilities, tracked as CVE-2026-57910 and CVE-2026-57909, have CVSS v4.0 scores of 9.3 and 9.4, respectively. Both issues impact WatchGuard Agent versions earlier than 1.25.13.0000. If exploited, these vulnerabilities could give an…
-
SonicWall NetExtender Flaw Lets Attackers Write Arbitrary Files as Root
SonicWall has released security updates for two high-severity vulnerabilities in its NetExtender Linux Client. One of these is a path traversal flaw that could allow attackers to write arbitrary files with root privileges. The most severe issue, tracked as CVE-2026-66152, has a CVSS score of 8.8/10 and affects NetExtender Linux Client versions 10.3.5 and earlier.…
-
Critical WordPress TranslatePress Flaw Lets Attackers Take Over Admin Accounts
A critical vulnerability in the TranslatePress multilingual WordPress plugin could enable unauthenticated attackers to take control of administrator accounts and fully compromise affected websites. This vulnerability, tracked as CVE-2026-19632, has a CVSS score of 9.8 and affects all TranslatePress versions up to 3.3.1. The flaw affects a plugin installed on over 400,000 WordPress sites. Security…
-
Two CVSS 9.8 Auth Bypasses in miniOrange SAML WordPress Plugin Were Exploited Before Any Database Even Listed the Paid Editions as Vulnerable
Two CVSS 9.8 miniOrange SAML WordPress plugin auth bypasses were exploited while paid editions never appeared in any vulnerability database. Manual patch required. Two critical authentication bypass vulnerabilities in the miniOrange SAML 2.0 Single Sign On WordPress plugin, both rated CVSS 9.8, are under active exploitation. Both CVE-2026-61979 and CVE-2026-15981 allow an unauthenticated attacker to…
-
Multiple Zscaler Client Connector Flaws Enable Remote Code Execution
Zscaler has addressed several vulnerabilities in its Client Connector endpoint application that could allow an unauthenticated, unprivileged attacker to execute arbitrary code within the product’s context. This vulnerability, tracked as CVE-2026-59568, is rated as Critical, with a CVSS v3.1 score of 9.1. The attack vector is network-accessible and requires no privileges or user interaction. Multiple…
-
Critical miniOrange SAML SSO Flaws Let Attackers Take Over WordPress Admin Accounts
Two critical vulnerabilities have been identified in the miniOrange SAML 2.0 Single Sign-On WordPress plugin, which could allow unauthenticated attackers to forge SAML assertions and log in as any existing user, including site administrators. These vulnerabilities, tracked as CVE-2026-61979 and CVE-2026-15981, carry a CVSS score of 9.8. Research conducted by DigitalOcean’s security team and later…
-
Critical Keycloak Password Reset Flaw Could Let Unauthenticated Attackers Take Over Any Account
Red Hat and the Keycloak project have released patches to address a critical security flaw in the open-source identity and access management server that could allow an unauthenticated remote attacker to take over any user account by forcing a password reset.The vulnerability, assigned the CVE identifier CVE-2026-18963, is rated 9.1 on the CVSS scoring system…
-
Critical WordPress Pods Flaw Lets Unauthenticated Attackers Gain Admin Access
A critical vulnerability has been identified in the widely used Pods WordPress plugin, which could allow unauthenticated attackers to take complete control of affected websites by escalating privileges to the administrator level. This vulnerability, tracked as CVE-2026-19598, carries a CVSS score of 9.8 and affects Pods Custom Content Types and Fields versions up to […]…
-
91 Spring CVEs: The AI Vulnerability Consumption Problem
Tags: access, advisory, ai, attack, cloud, cve, cvss, data, data-breach, framework, guide, injection, intelligence, open-source, risk, service, software, tool, update, vulnerability<div cla TL;DR Broadcom released a large batch of Spring security advisories on August 20, 2026, with Sonatype tracking 91 CVEs across Spring Framework and related projects. At the time of publishing, Sonatype Guide currently identifies 209,569 software components affected by the security event. The disclosure comes amid a dramatic rise in AI-assisted vulnerability discovery. Broadcom…