CrocoTime SSRF

The vulnerability in CrocoTime’s employee working hours tracking system is related to insufficient validation of requests on the server side. Exploiting this vulnerability allows a remote attacker to execute an SSRF attack...

SAP NetWeaver Multiple Vulnerabilities (3804858)

The version of the SAP NetWeaver kernel detected on the remote host is affected by multiple vulnerabilities as referenced in SAP Security Note 3804858: - SAP Web Dispatcher and SAP NetWeaver Application Server ABAP Internet Communication Manager do not perform sufficient request validation in...

CVE-2026-89119

SAP Web Dispatcher and SAP NetWeaver Application Server ABAP Internet Communication Manager do not perform sufficient request validation in certain administrative functionality. In the context of Application Server ABAP and SAP Web Dispatcher, an unauthenticated attacker could trick a logged-on...

CVE-2026-120014

SAP HANA XSA Web Dispatcher does not perform sufficient request validation in certain administrative functionality. In the context of SAP HANA XSA Web Dispatcher, an unauthenticated attacker could trick a logged-on administrator into visiting a malicious link. Visiting the link could cause...

CVE-2026-120014

The SAP HANA XSA Web Dispatcher is vulnerable to a Cross-Site Request Forgery (CSRF) flaw due to insufficient request validation in certain administrative functionalities. An unauthenticated attacker can trick a logged-on administrator into visiting a malicious link, causing unintended actions wi...

CVE-2026-89119

SAP Web Dispatcher and SAP NetWeaver Application Server ABAP (Internet Communication Manager) are affected by a Cross-Site Request Forgery (CSRF) vulnerability (CWE-352) due to insufficient request validation in specific administrative functionalities. An unauthenticated attacker can trick a logg...

EUVD-2026-120665

SAP Web Dispatcher and SAP NetWeaver Application Server ABAP Internet Communication Manager do not perform sufficient request validation in certain administrative functionality. In the context of Application Server ABAP and SAP Web Dispatcher, an unauthenticated attacker could trick a logged-on...

PT-2026-141262

SAP HANA XSA Web Dispatcher does not perform sufficient request validation in certain administrative functionality. In the context of SAP HANA XSA Web Dispatcher, an unauthenticated attacker could trick a logged-on administrator into visiting a malicious link. Visiting the link could cause...

CVE-2026-89119: SAP_SE SAP Web Dispatcher and Internet Communication Manager: SAP Web Dispatcher and SAP NetWeaver Application Server ABAP (Internet Communication Manager) do not perform sufficient…

SAP Web Dispatcher and SAP NetWeaver Application Server ABAP Internet Communication Manager do not perform sufficient request validation in certain administrative functionality. In the context of Application Server ABAP and SAP Web Dispatcher, an unauthenticated attacker could trick a logged-on...

PT-2026-141283

Name of the Vulnerable Software and Affected Versions SAP Web Dispatcher affected versions not specified SAP NetWeaver Application Server ABAP Internet Communication Manager affected versions not specified Description Insufficient request validation in certain administrative functionality allows ...

CVE-2026-120014: SAP_SE SAP Web Dispatcher and Internet Communication Manager: SAP HANA XSA Web Dispatcher does not perform sufficient request validation in certain administrative functionality

SAP HANA XSA Web Dispatcher does not perform sufficient request validation in certain administrative functionality. In the context of SAP HANA XSA Web Dispatcher, an unauthenticated attacker could trick a logged-on administrator into visiting a malicious link. Visiting the link could cause...

CVE-2026-111768

The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. From 1.3.0 until 1.32.0 in @modelcontextprotocol/sdk and from 2.0.0 until 2.3.0 in @modelcontextprotocol/server, HTTP servers did not enforce a limit on the number of arr...

CVE-2026-111768 Model Context Protocol TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation

The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. From 1.3.0 until 1.32.0 in @modelcontextprotocol/sdk and from 2.0.0 until 2.3.0 in @modelcontextprotocol/server, HTTP servers did not enforce a limit on the number of arr...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference due to improper handling of array schemas that omit the items keyword in request validation. An attacker can cause the application to panic and potentially crash by submitting crafted requests that trigger...

kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter

Summary The fix for GHSA-p6wj-qrr4-pgh5 addressed a nil-pointer dereference that occurs when an OpenAPI 3.1 array schema omits the items keyword which is legal under JSON Schema 2020-12. That fix patched three decoder paths: the standalone parseArray function, the top-level array check in...

GHSA-VRCC-3CH7-HPPW kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter

Summary The fix for GHSA-p6wj-qrr4-pgh5 addressed a nil-pointer dereference that occurs when an OpenAPI 3.1 array schema omits the items keyword which is legal under JSON Schema 2020-12. That fix patched three decoder paths: the standalone parseArray function, the top-level array check in...

CVE-2026-19622

IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to bypass authentication and escalate privileges due to improper validation of sub-requests...

PT-2026-111092

Name of the Vulnerable Software and Affected Versions IBM Planning Analytics versions 2.0 through 2.1 Description Improper validation of sub-requests allows a remote attacker to bypass authentication and escalate privileges. Recommendations At the moment, there is no information about a newer...

EUVD-2026-96123

The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization or request-validation checks on one of its AJAX actions, allowing unauthenticated attackers to forge the stored transaction status of records and to write the Accept PayPal Payments...

CVE-2026-105242

A flaw was found in log4net. A remote attacker can exploit this issue by sending a crafted request containing content such as markup that triggers ASP.NET request validation. When log4net attempts to parse the request parameters, an unhandled exception occurs, causing the logging system to discar...