CVE-2026-14297

The Continuous Glucose Monitoring Service's Record Access Control Point (RACP) write handler `memcpy`s the entire attacker-supplied ATT write value into a fixed 20-byte BSS buffer.

A buffer overflow in the Bluetooth Continuous Glucose Monitoring Service (CGMS) Record Access Control Point (RACP) write handler allows an authenticated BLE peer to overflow a 20-byte static buffer into adjacent BSS memory. The exploitable impact cannot be predetermined - it is entirely dependent on the linker-assigned BSS layout of the specific firmware build, which may vary.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Nordic Semiconductor Asa

Products

Nrf Connect Sdk

CVE-2026-18796

QSPI flash encryption side-channel leakage

Any application that uses external QSPI flash for encrypted XIP on nRF5340 and relies on that encryption for confidentiality and/or integrity of the externally stored code. No specific nRF Connect SDK version is the root cause; the weakness is in the on-the-fly decryption scheme.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Nordic Semiconductor Asa

Products

Nrf5340

CVE-2026-84173

Authorization Flaw Enabling Unauthorized Cluster State Access in Eclipse Ankaios

In Eclipse Ankaios versions v0.5.1 through v1.0.1, the agent-side Control Interface authorizer incorrectly evaluates multi-segment allow rules whose first path segment is a wildcard. An authenticated workload with access restricted by such a rule can submit a CompleteStateRequest or UpdateStateRequest with an empty field mask. The request may then be incorrectly authorized as matching the scoped rule, allowing the workload to read the complete cluster state or replace state outside its authorized subtree. This may result in unauthorized disclosure or modification of other workloads and cluster configuration. Only a rule consisting solely of * is intended to authorize an empty mask. Mitigation: Until an update containing the fix is installed, avoid multi-segment Control Interface allow-rule filter masks that begin with a wildcard, such as *.workloads.some_workload. Replace them with explicit paths such as desiredState.workloads.some_workload, where applicable. A filter mask consisting solely of * has different, intentionally unrestricted semantics and should only be used when full-state access is intended.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Eclipse

Products

Ankaios

CVE-2026-85201

Unbounded Memory Allocation via Control Interface FIFO

In Eclipse Ankaios versions 0.1.0 through 1.0.1, the agent does not limit the length declared by a workload in a length-delimited protobuf message received through the Control Interface FIFO. A workload granted Control Interface access can specify an excessive message length, causing an unbounded memory allocation that may abort the Ankaios agent process. This results in loss of orchestration services for workloads managed by the affected agent.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Eclipse

Products

Ankaios

CVE-2025-52651

HCL MyXalytics is affected by multiple security vulnerabilities.

HCL MyXalytics was affected by Improper Input validation Vulnerability. It allow malicious or unexpected data to cause unintended system behaviour or security issues.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Myxalytics

CVE-2025-52652

HCL MyXalytics is affected by multiple security vulnerabilities.

HCL MyXalytics was affected by Content Spoofing Vulnerability. It may allow an attacker to manipulate displayed content, making it appear as though it originates from a trusted source, potentially leading to phishing or data theft.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Myxalytics

CVE-2025-52657

HCL MyXalytics is affected by multiple security vulnerabilities.

HCL MyXalytics was affected by Potential DOS Vulnerability. It allows users to input data without any restriction on the number of characters which can impact system performance or availability.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Myxalytics

CVE-2026-78325

XSS in Standard Notes on Android via Malicious Google Keep and Evernote HTML Import

Cross-site scripting in the Evernote and Google Keep note importers in Standard Notes for Android through 3.201.24 allows an attacker to execute arbitrary JavaScript in the application context when a victim imports a crafted .enex or Google Keep HTML file, leading to theft of encryption keys and note data, and arbitrary invocation of native device APIs.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Standard Notes

Products

Standard Notes

CVE-2026-77901

Microsoft Office Word Remote Code Execution Vulnerability

Null pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Microsoft 365 Office 2019 and 7 more

CVE-2026-12853

Flamingo <= 2.6.2 - Authenticated (Contributor+) Missing Authorization to Unauthorized Tag Information Disclosure via wp.getTerms and ajax-tag-search

The Flamingo plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to enumerate taxonomy terms including channel names derived from Contact Form 7 form titles that may reveal internal form purposes, department names, or workflow identifiers, as well as submission counts per channel and contact tag names. The plugin's flamingo_map_meta_cap() filter restricts access to Flamingo's admin UI but does not extend to WordPress core APIs such as XML-RPC wp.getTerms and admin-ajax ajax-tag-search.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Rocklobsterinc Wordpress

Products

Flamingo Wordpress

CVE-2026-6377

Path Traversal in Next4Biz's CSM (Customer Service Management)

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Next4Biz Information Technologies Inc. CSM (Customer Service Management) allows Path Traversal. This issue affects CSM (Customer Service Management): from 6.8.9 before 8.0.3.

CVSS 3.1 · 7.5 High EPSS 1.8% KEV · Not listed

Vendors

Next4biz

Products

Csm (customer Service Management)

CVE-2026-86321

java-json-tools jackson-coreutils URL Validation JsonLoader.java JsonLoader.fromURL server-side request forgery

A vulnerability was found in java-json-tools jackson-coreutils 2.0. Affected by this issue is the function JsonLoader.fromURL of the file src/main/java/com/github/fge/jackson/JsonLoader.java of the component URL Validation. The manipulation results in server-side request forgery. It is possible to launch the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Java-json-tools

Products

Jackson-coreutils

CVE-2026-72976

Microsoft Office Word Information Disclosure Vulnerability

Out-of-bounds read in Microsoft Office Word allows an authorized attacker to disclose information locally.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Microsoft 365 Office 2019 and 7 more

CVE-2026-44766

SQL Injection vulnerability in SAP S/4HANA (Intercompany Matching and Reconciliation)

SAP S/4HANA (Intercompany Matching and Reconciliation) allows a low-privileged authenticated user to inject malicious input into certain functions, which may be processed by the database without proper validation. This could allow the user to access sensitive information, resulting in high impact on confidentiality, with no impact on integrity and availability of the application.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Sap Se

Products

Sap S/4hana (intercompany Matching And Reconciliation)

CVE-2026-58234

Denial of Service vulnerability in SAP Process Integration (SOAP Adapter)

SAP Process Integration (SOAP Adapter) allows a privileged user to send specially crafted requests containing deeply nested entity definitions, which under certain conditions could temporarily increase processor load and degrade system responsiveness. Successful exploitation results in low impact on availability with no impact on confidentiality and integrity.

CVSS 3.1 · 2.2 Low EPSS < 1% KEV · Not listed

Vendors

Sap Se

Products

Sap Process Integration (soap Adapter)

CVE-2026-58240

Missing Authentication check in SAP NetWeaver (Message Server)

SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during registration. An unauthenticated attacker with network access to the affected service could exploit this weakness to register an unauthorized component and potentially perform unauthorized actions within the application environment, resulting in a high impact on the confidentiality, integrity, and availability of the affected system.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Sap Se

Products

Sap Netweaver (message Server)

CVE-2026-66768

Improper Access Control in SAP NetWeaver (SAP GUI for Java)

SAP GUI for Java does not correctly enforce the trust level policy for certain functions invoked from a connected backend system. A low-privileged attacker could exploit this weakness by manipulating a connected backend system to trigger affected functionality. This could allow arbitrary command execution on the victim's machine, leading to a high impact on the confidentiality, integrity, and availability of the affected system.

CVSS 3.1 · 9 Critical EPSS < 1% KEV · Not listed

Vendors

Sap Se

Products

Sap Netweaver (sap Gui For Java)

CVE-2026-76958

XML External Entity (XXE) Vulnerability in SAP Integration Suite

SAP Integration Suite does not sufficiently validate XML documents accepted from untrusted sources in certain internal components. An attacker with low privileges could submit specially crafted XML payloads containing malicious external entity declarations. Successful exploitation could allow the attacker to read sensitive file contents from the server and expose them through monitoring or logging output, resulting in a high impact on confidentiality. It could also lead to resource exhaustion, causing a low impact on availability. There is no impact on integrity.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Sap Se

Products

Sap Integration Suite

CVE-2026-76959

Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4HANA (Finance for Advanced Payment Management)

SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cross-Site Request Forgery protection on certain requests due to this an attacker with low privileges could craft a malicious link or page. If an authenticated victim interacts with it, unintended actions could be triggered on the web server on their behalf. This results in a low impact on confidentiality and integrity. There is no impact on availability.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Sap Se

Products

Sap S/4hana (finance For Advanced Payment Management)

CVE-2026-76960

Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4HANA (Finance for Advanced Payment Management)

SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cross-Site Request Forgery protection on certain requests, due to this an attacker with low privileges could craft a malicious link or page. If an authenticated victim interacts with it, unintended actions could be triggered on the web server on their behalf. This results in a low impact on confidentiality and integrity. There is no impact on availability.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Sap Se

Products

Sap S/4hana (finance For Advanced Payment Management)