@openui5/sap.f (>=1.72.0, <=1.84.57), @openui5/sap.m (>=1.72.0, <=1.84.57) +18 more potentially affected by CVE-2026-76977 via @openui5/sap.ui.core (>=1.72.0, <=1.84.57)

@openui5/sap.ui.core NPM version =1.72.0, =1.72.0, =1.72.0, =1.72.0, =1.72.0, =1.72.0, =1.72.0, =1.72.0, =1.72.0, =1.72.0, =1.72.0, =1.72.0, =1.80.0, =1.72.0, =1.72.0, =1.72.0, =1.84.57 and more Source cves: CVE-2026-76977 Source advisory: MEND:CVE-2026-76977...

@openui5/sap.f (>=1.52.5, <=1.71.80), @openui5/sap.m (>=1.52.5, <=1.71.80) +16 more potentially affected by CVE-2026-76977 via @openui5/sap.ui.core (>=1.52.5, <=1.71.80)

@openui5/sap.ui.core NPM version =1.52.5, =1.52.5, =1.52.5, =1.52.5, =1.52.5, =1.52.5, =1.52.5, =1.52.5, =1.52.5, =1.52.5, =1.62.0, =1.52.5, =1.52.5, =1.52.5, =1.52.5, =1.52.5, =1.71.80 and more Source cves: CVE-2026-76977 Source advisory: MEND:CVE-2026-76977...

@openui5/sap.f (>=1.138.0, <=1.148.3), @openui5/sap.m (>=1.138.0, <=1.148.3) +20 more potentially affected by CVE-2026-76977 via @openui5/sap.ui.core (>=1.138.0, <=1.148.3)

@openui5/sap.ui.core NPM version =1.138.0, =1.138.0, =1.138.0, =1.138.0, =1.138.0, =1.138.0, =1.138.0, =1.138.0, =1.138.0, =1.138.0, =1.138.0, =1.138.0, =1.138.0, =1.138.0, =1.138.0, =1.138.0, =1.148.3 and more Source cves: CVE-2026-76977 Source advisory: MEND:CVE-2026-76977...

@gsmlg/ui5-webcomponents-tools (>=0.0.0-58d0063af, <=1.3.2), @openui5/sap.f (>=1.85.0, <=1.96.47) +22 more potentially affected by CVE-2026-76977 via @openui5/sap.ui.core (>=1.85.0, <=1.96.47)

@openui5/sap.ui.core NPM version =1.85.0, =0.0.0-58d0063af, =1.85.0, =1.85.0, =1.85.0, =1.85.0, =1.85.0, =1.85.0, =1.85.0, =1.85.0, =1.85.0, =1.85.0, =1.85.0, =1.85.0, =1.85.0, =1.85.0, =1.96.47 and more Source cves: CVE-2026-76977 Source advisory: MEND:CVE-2026-76977...

@openui5/sap.f (>=1.121.0, <=1.136.18), @openui5/sap.m (>=1.121.0, <=1.136.18) +21 more potentially affected by CVE-2026-76977 via @openui5/sap.ui.core (>=1.121.0, <=1.136.18)

@openui5/sap.ui.core NPM version =1.121.0, =1.121.0, =1.121.0, =1.121.0, =1.121.0, =1.121.0, =1.121.0, =1.121.0, =1.121.0, =1.121.0, =1.121.0, =1.121.0, =1.121.0, =1.121.0, =1.121.0, =1.121.0, =1.136.18 and more Source cves: CVE-2026-76977 Source advisory: MEND:CVE-2026-76977...

@openui5/sap.f (>=1.97.0, <=1.108.52), @openui5/sap.m (>=1.97.0, <=1.108.52) +20 more potentially affected by CVE-2026-76977 via @openui5/sap.ui.core (>=1.97.0, <=1.108.52)

@openui5/sap.ui.core NPM version =1.97.0, =1.97.0, =1.97.0, =1.97.0, =1.97.0, =1.97.0, =1.97.0, =1.97.0, =1.97.0, =1.97.0, =1.97.0, =1.97.0, =1.97.0, =1.97.0, =1.97.0, =1.97.0, =1.108.52 and more Source cves: CVE-2026-76977 Source advisory: MEND:CVE-2026-76977...

@openui5/sap.f (>=1.149.0, <=1.150.0), @openui5/sap.m (>=1.149.0, <=1.150.0) +17 more potentially affected by CVE-2026-76977 via @openui5/sap.ui.core (>=1.149.0, <=1.150.0)

@openui5/sap.ui.core NPM version =1.149.0, =1.149.0, =1.149.0, =1.149.0, =1.149.0, =1.149.0, =1.149.0, =1.149.0, =1.149.0, =1.149.0, =1.149.0, =1.149.0, =1.149.0, =1.149.0, =1.149.0, =1.149.0, =1.150.0 and more Source cves: CVE-2026-76977 Source advisory: MEND:CVE-2026-76977...

@openui5/sap.f (>=1.109.0, <=1.120.47), @openui5/sap.m (>=1.109.0, <=1.120.47) +20 more potentially affected by CVE-2026-76977 via @openui5/sap.ui.core (>=1.109.0, <=1.120.47)

@openui5/sap.ui.core NPM version =1.109.0, =1.109.0, =1.109.0, =1.109.0, =1.109.0, =1.109.0, =1.109.0, =1.109.0, =1.109.0, =1.109.0, =1.109.0, =1.109.0, =1.109.0, =1.109.0, =1.109.0, =1.109.0, =1.120.47 and more Source cves: CVE-2026-76977 Source advisory: MEND:CVE-2026-76977...

CVE-2025-42873

SAPUI5 and OpenUI5 packages use outdated 3rd party libraries with known security vulnerabilities. When markdown-it encounters special malformed input, it fails to terminate properly, resulting in an infinite loop. This Denial of Service via infinite loop causes high CPU usage and system...

CVE-2025-42873: Asymmetric Resource Consumption (Amplification)

SAPUI5 and OpenUI5 packages use outdated 3rd party libraries with known security vulnerabilities. When markdown-it encounters special malformed input, it fails to terminate properly, resulting in an infinite loop. This Denial of Service via infinite loop causes high CPU usage and system...

EUVD-2021-0483

Malware in sbrugna...

EUVD-2019-1054

Malware in sbrugna...

CVE-2021-21316

less-openui5 is an npm package which enables building OpenUI5 themes with Less.js. In less-openui5 before version 0.10., when processing theming resources i.e. .less files with less-openui5 that originate from an untrusted source, those resources might contain JavaScript code which will be execut...

CVE-2019-0281

SAPUI5 and OpenUI5, before versions 1.38.39, 1.44.39, 1.52.25, 1.60.6 and 1.63.0, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability...

Arbitrary JavaScript Execution

Overview In affected versions of less-openui5 processing untrusted theming resources might execute arbitrary code. Impact When processing theming resources i.e. .less files with less-openui5 that originate from an untrusted source, those resources might contain JavaScript code which will be...

CVE-2021-21316

less-openui5 is an npm package which enables building OpenUI5 themes with Less.js. In less-openui5 before version 0.10., when processing theming resources i.e. .less files with less-openui5 that originate from an untrusted source, those resources might contain JavaScript code which will be execut...

CVE-2021-21316

less-openui5 is an npm package which enables building OpenUI5 themes with Less.js. In less-openui5 before version 0.10., when processing theming resources i.e. .less files with less-openui5 that originate from an untrusted source, those resources might contain JavaScript code which will be execut...

Privilege escalation

less-openui5 is an npm package which enables building OpenUI5 themes with Less.js. In less-openui5 before version 0.10., when processing theming resources i.e. .less files with less-openui5 that originate from an untrusted source, those resources might contain JavaScript code which will be execut...

CVE-2021-21316 Arbitrary code execution in less-openui5

less-openui5 is an npm package which enables building OpenUI5 themes with Less.js. In less-openui5 before version 0.10., when processing theming resources i.e. .less files with less-openui5 that originate from an untrusted source, those resources might contain JavaScript code which will be execut...

@sap/grunt-sapui5-bestpractice-build (>=1.3.17, <=1.4.11), @sap/grunt-sapui5-bestpractice-test (>=0.0.1, <=2.0.3) +19 more potentially affected by CVE-2021-21316 via less-openui5 (>=0.1.0, <=0.9.0)

less-openui5 NPM version =0.1.0, =1.3.17, =0.0.1, =1.0.2, =0.0.12, =0.0.8, =0.0.1, =0.1.0, =0.0.1, =0.1.1, =0.1.0, =1.0.42, =0.1.0, =0.1.0, =1.0.0-beta.1, =1.2.0 and more Source cves: CVE-2021-21316 Source advisory: MEND:CVE-2021-21316...