SAP NetWeaver Application Server ABAP is a component of the SAP NetWeaver platform that serves as the runtime environment for ABAP-based applications in the SAP system landscape. It is specifically designed to host and execute applications developed using the ABAP programming language.

SAP NetWeaver Application Server ABAP

SAP NetWeaver Application Server Java is a component of the SAP NetWeaver platform that provides a runtime environment for Java-based applications and services in the SAP system landscape. It is specifically designed to host and execute applications developed using the Java programming language.

SAP NetWeaver Application Server Java

SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during registration. An unauthenticated attacker with network access to the affected service could exploit this weakness to register an unauthorized component and potentially perform unauthorized actions within the application environment, resulting in a high impact on the confidentiality, integrity, and availability of the affected system.

CVE-2026-58240

Linux

Linux Kernel

Windows

Windows Cumulative Update

A memory safety vulnerability exists in the Extended Passport Protocol (EPP) processing library. Under specific conditions, an unauthenticated attacker could exploit a crafted network request containing a malformed EPP header, potentially resulting in undefined behavior and abnormal program termination. Successful exploitation may have a high impact on the confidentiality, integrity, and availability of the application.

CVE-2026-44756

N-central is a remote monitoring and management (RMM) and unified endpoint management platform developed by N-able. It is primarily designed for managed service providers (MSPs) and IT departments to remotely monitor, manage, and secure complex networks and diverse endpoint devices. The platform streamlines IT operations by offering automated patch management, asset discovery, and integrated security tools to proactively protect environments.

N-central

N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14.

CVE-2026-86218

JFrog Artifactory is a universal repository manager that simplifies the management and distribution of software artifacts. It serves as a central hub for storing, versioning, and securing binaries, libraries, and dependencies. With seamless integration and robust features, Artifactory enhances automation, traceability, and DevOps practices for software development teams.

Artifactory

JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges.

CVE-2026-82329

Homebrew

VulnCheck NVD++

PaperCut NG is a print management software solution designed to help organizations monitor, control, and manage their printing resources. It provides various features and tools to optimize printing workflows, reduce waste, and enhance document security.

PaperCut NG

PaperCut MF is a low-cost, multi-platform software solution that enables schools, libraries, and businesses of any size to manage, account for, and recover print, copy, fax, and scan output via user login or card ID. Typical uses include student/patron charging, staff account billing, secure job release with "Find Me" pull printing, driverless web printing, and auto-enforced job routing based on administrator-defined attributes.

PaperCut MF

An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process.

CVE-2026-82078

Red Hat Enterprise Linux is a Linux distribution developed by Red Hat for the commercial market.

Linux Red Hat

Tesseract is an open source OCR engine. In version 5.5.3 and earlier, RecodedCharID::DeSerialize in src/ccutil/unicharcompress.h validates length_ but accepts negative code_ values from a crafted .traineddata recoder component. UnicharCompress::ComputeCodeRange in src/ccutil/unicharcompress.cpp can consequently produce code_range_ equal to zero, after which SetupDecoder indexes is_valid_start_ with the negative code on a size-zero vector. The resulting out-of-bounds bit write uses a large wrapped index and reliably causes a wild-address crash or allocation failure on the default LSTM engine. No fixed release is available as of this review.

CVE-2026-88050

Red Hat

Red Hat Errata

Tesseract is an open source OCR engine. In version 5.5.3 and earlier, prior .traineddata hardening added bounds checks to NetworkIO::CopyTimeStepGeneral and NetworkIO::Randomize in src/lstm/networkio.cpp but left NetworkIO::WriteTimeStepPart and NetworkIO::AddTimeStepPart unchecked. In LSTM::Forward in src/lstm/lstm.cpp, source_ is sized from the independently deserialized na_ field while the WriteTimeStepPart count is ns_, which comes from the CI gate WeightMatrix dim1() value. A crafted NT_LSTM layer can make ns_ much larger than na_, causing a heap out-of-bounds write during the first recognition step on the default LSTM engine and resulting in heap corruption, a crash, or potentially controlled corruption. No fixed release is available as of this review.

CVE-2026-88049

Tesseract is an open source OCR engine. In version 5.5.3 and earlier, FullyConnected::DeSerialize in src/lstm/fullyconnected.cpp does not validate the deserialized layer scalars ni_ and no_ against the weight-matrix dimensions. During FullyConnected::Forward, MatrixDotVector in src/lstm/weightmatrix.cpp writes w.dim1() results into temp_line, which is sized from no_, and reads w.dim2() minus one inputs from curr_input, which is sized from ni_. A crafted .traineddata NT_SOFTMAX layer can therefore use inconsistent dimensions to cause a heap out-of-bounds write and read on the default LSTM engine, resulting in heap corruption, a crash, information disclosure, or potentially controlled corruption. No fixed release is available as of this review.

CVE-2026-88048

Tesseract is an open source OCR engine. In version 5.5.3 and earlier, Classify::ReadNormProtos in src/classify/normmatch.cpp parses the NORMPROTO component of a .traineddata file and uses std::istream::operator>>(char*) to extract a whitespace-delimited token into a fixed 61-byte stack buffer without setting a stream width. The 100-byte line buffer can carry a token of up to 99 characters, so a token longer than 60 characters writes up to 39 attacker-controlled bytes past the buffer during TessBaseAPI::Init of the legacy engine, causing stack corruption, denial of service, and potentially control-flow hijacking on affected standard-library implementations. Builds using Apple's libc++ C++20 bounded array overload are incidentally protected, while typical libstdc++ builds remain affected. No fixed release is available as of this review.

CVE-2026-88047

Rclone is a command line program to sync files and directories to and from different cloud storage providers.

Rclone

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, when backend/local runs with --links, a source .rclonelink object can plant a symlink in the destination and later directory metadata is applied through that path. MkdirMetadata, writeMetadataToFile, and setTimes operate when Directory.translatedLink=false, so os.Chown, os.Chmod, os.Chtimes, and birth-time handling can bypass os.Root confinement and follow the symlink. An attacker controlling source contents can therefore apply selected ownership, permissions, modification times, or birth times to a file or directory outside the destination, with --metadata required for chmod and chown while modification time is applied by the normal directory workflow. This issue is fixed in version 1.75.1.

Identifiant CVE	Sévérité	Score	Technologies	Nom du composant	Exploit CISA KEV	A corrigé	Date de publication
CVE-2026-58240	CRITICAL	9.8	SAP NetWeaver Application Server ABAP	cpe:2.3:a:sap:netweaver_application_server_abap	Non	Non	Sep 08, 2026
CVE-2026-44756	CRITICAL	10	SAP NetWeaver Application Server ABAP	cpe:2.3:a:sap:netweaver_application_server_abap	Non	Oui	Sep 08, 2026
CVE-2026-86218	CRITICAL	10	N-central	cpe:2.3:a:n-able:n-central	Oui	Oui	Sep 06, 2026
CVE-2026-82329	CRITICAL	9.8	Artifactory	cpe:2.3:a:jfrog:artifactory	Oui	Oui	Aug 28, 2026
CVE-2026-82078	CRITICAL	9.4	PaperCut NG	cpe:2.3:a:papercut:papercut_mf	Oui	Oui	Aug 28, 2026

Identifiant CVE	Sévérité	Score	Technologies	Nom du composant	Exploit CISA KEV	A corrigé	Date de publication
CVE-2026-88050	MEDIUM	6.9	Linux Red Hat	script-ethiopic	Non	Non	Sep 10, 2026
CVE-2026-88049	HIGH	8.6	Linux Red Hat	script-bengali	Non	Non	Sep 10, 2026
CVE-2026-88048	HIGH	8.6	Linux Red Hat	script-greek	Non	Non	Sep 10, 2026
CVE-2026-88047	HIGH	8.6	Linux Red Hat	script-hant	Non	Non	Sep 10, 2026
CVE-2026-88016	HIGH	7.1	Rclone	cpe:2.3:a:rclone:rclone	Non	Oui	Sep 10, 2026

Base de données de vulnérabilités Wiz

Explorer par technologie

Filtres populaires

Profil élevé

Dernier

Les vulnérabilités en chiffres

Le bon, le mauvais et le vulnérable

Ressources Wiz supplémentaires

PEACH

Prêt(e) à voir Wiz en action ?