CVE-2026-50093

Command argument injection vulnerability in Cosminexus Component Container. Allows an attacker to execute unauthorized system commands.

OS command injection vulnerability in Cosminexus Component Container. Allows an attacker to execute arbitrary commands on the server.

Vulnerability in Reyrolle 7SR5 exposes information through the web interface that can be used to calculate current and past session ID numbers. An attacker could bypass authentication and gain unauthorized access to the device.

Deserialization of untrusted data vulnerability in Cosminexus Component Container. Could allow an attacker to execute arbitrary code or cause a crash.

The D-Link DIR-822A router version A_101 has a vulnerability in the tunnel_set_params function of the L2TP Control Message Parser component, leading to an out-of-bounds write. The attack can be launched remotely, and the exploit has been publicly disclosed.

The D-Link DIR-895L router version A1_102b07 has a vulnerability in the sendOffer/sendACK functions of the file udhcpcd/serverpacket.c in the udhcpcd component, causing a stack-based buffer overflow. The attack can only be performed within the local network, and the exploit has been published.

The @sap/cds-mtxs NPM library does not perform sufficient checks on certain functionality used in multitenant CAP applications with extensibility enabled. An unauthenticated attacker could send specially crafted requests to obtain sensitive credentials and abuse them to replace or delete tenant data. Successful exploitation can result in a high impact on availability and integrity of the application, and partial impact on confidentiality of business data.

SAP GUI for Java does not correctly enforce the trust level policy for certain functions invoked from a connected backend system. A low-privileged attacker could exploit this weakness by manipulating a connected backend system to trigger affected functionality. This could allow arbitrary command execution on the victim's machine, leading to a high impact on confidentiality, integrity, and availability.

SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during registration. An unauthenticated attacker with network access could register an unauthorized component and potentially perform unauthorized actions, resulting in high impact on confidentiality, integrity, and availability.

A memory safety vulnerability exists in the Extended Passport Protocol (EPP) processing library. Under specific conditions, an unauthenticated attacker could exploit a crafted network request with a malformed EPP header, potentially resulting in undefined behavior and abnormal program termination. Successful exploitation may have high impact on confidentiality, integrity, and availability.