Vulnerability intelligence / live index
A working index of published vulnerability records, ordered by latest update. Open a record to inspect its score, vector, and impact metrics.
CVE Program / CVE List®
Updated continuously
Nov 10, 2026 UTC
A flaw was found in D-Bus. With a privileged Monitoring client attached (for example dbus-monitor or busctl monitor), an unprivileged local user can cause dbus-daemon to abort if a driver-originated broadcast such as NameOwnerChanged or ActivatableServicesChanged cannot be delive…
Inspect record →Nov 10, 2026 UTC
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Deltaww DIAEnergie allows SQL Injection. This issue affects DIAEnergie: before 1.11.01.032.
Inspect record →Nov 10, 2026 UTC
In IMS, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed.
Inspect record →Nov 10, 2026 UTC
An off-by-one error in certain ASUS Router firmware allows an unauthenticated nearby user to send a packet with a specific header length, potentially overwriting memory and causing the affected service to crash. Refer to the ' Security Update for ASUS Router Firmware ' section on…
Inspect record →Nov 10, 2026 UTC
An out-of-bounds write in certain ASUS Router firmware allows an unauthenticated nearby user to send an HTTP request containing parameters that exceed the buffer length, potentially overwriting other memory regions or causing the system to crash. Refer to the ' Security Update fo…
Inspect record →Nov 10, 2026 UTC
Improper neutralization of special elements used in an OS command in certain ASUS Router firmware allows an unauthenticated nearby user to trigger a chain of actions—unauthenticated queries, identifier guessing, credential overwriting, and command injection—resulting in the execu…
Inspect record →Nov 10, 2026 UTC
Improper neutralization of special elements used in an OS command in certain ASUS Router firmware allows an user with physical access to insert a USB device containing a specially crafted directory name, potentially executing arbitrary commands with root privileges. Refer to the …
Inspect record →Nov 10, 2026 UTC
The SAP Cloud SDK for Python contains an improper cryptographic signature verification vulnerability (CWE-347) in IASContextProvider, the runtime-context provider registered by default via bootstrap(app).IASContextProvider extracted the app_tid, sap_gtid and user_uuid claims from…
Inspect record →Nov 10, 2026 UTC
In SAP/astonish, an authenticated user could potentially identify and operate on another team�s sandbox containers because of improper tenant isolation in the legacy Incus sandbox-management API handlers. The affected handlers did not use the tenant-aware session lookup path, all…
Inspect record →Nov 10, 2026 UTC
A vulnerability was found in Michael-A-Kuykendall Shimmy up to 2.6.4. The affected element is an unknown function of the file src/server.rs of the component Inference API. Performing a manipulation results in missing authentication. The attack is possible to be carried out remote…
Inspect record →Nov 10, 2026 UTC
Due to a weak HMAC cryptography calculation when receiving an RFC callback in SAP NetWeaver and ABAP Platform (Application Server ABAP), an authenticated attacker with high privileges and access to a network segment between application servers on an SAP system could intercept net…
Inspect record →Nov 10, 2026 UTC
Due to Insecure Storage of Sensitive Information in SAP Web Dispatcher and Internet Communication Manager, an attacker with administrative privileges could obtain sensitive information from stored data. This may allow correlation of credentials across users and deployments, poten…
Inspect record →Nov 10, 2026 UTC
A vulnerability has been found in D-Link M60 1.12.B01. Impacted is the function system of the file /etc/emDaemon/mosquitto.conf of the component emDaemon MQTT Broker. Such manipulation leads to hard-coded credentials. The attack can be executed remotely. The exploit has been disc…
Inspect record →Nov 10, 2026 UTC
SAP Start Service and SAP Management Console store sensitive credential information in process memory without protection. An attacker with high privileges and local access could inspect the memory to recover credentials and reuse them for authentication. This results in a high im…
Inspect record →Nov 10, 2026 UTC
SAP NetWeaver AS ABAP and ABAP Platform does not perform sufficient verification of incoming authentication assertions under certain configurations. An unauthenticated attacker could submit specially crafted data to bypass authentication and impersonate arbitrary users, including…
Inspect record →
