CVE-2025-13648

An attacker with access to the web application ZeusWeb of the provider Microcom in this case, registration is required who has the vulnerable software could introduce arbitrary JavaScript by injecting an XSS payload into the ‘Name’ and “Surname” parameters within the ‘My Account’ section at the...

CVE-2026-0724

CVE-2026-0724 : WPlyr Media Block for WordPress is affected by a Stored Cross‑Site Scripting (XSS) vulnerability via the _wplyr_accent_color parameter, impacting all versions up to 1.3.0. The root cause is insufficient input sanitization and output escaping of user-supplied attributes. Exploitati...

CVE-2026-24320

Due to improper memory management in SAP NetWeaver and ABAP Platform Application Server ABAP, an authenticated attacker could exploit logical errors in memory management by supplying specially crafted input containing unique characters, which are improperly converted. This may result in memory...

CVE-2026-0488

An authenticated attacker in SAP CRM and SAP S/4HANA Scripting Editor could exploit a flaw in a generic function module call and execute unauthorized critical functionalities, which includes the ability to execute an arbitrary SQL statement. This leads to a full database compromise with high impa...

CVE-2026-25492

Craft CMS is a content management system. In Craft versions 3.5.0 through 4.16.17 and 5.0.0-RC1 through 5.8.21, the saveimagesAsset GraphQL mutation can be abused to fetch internal URLs by providing a domain name that resolves to an internal IP address, bypassing hostname validation. When a...

CVE-2026-0652

On TP-Link Tapo C260 v1, command injection vulnerability exists due to improper sanitization in certain POST parameters during configuration synchronization. An authenticated attacker can execute arbitrary system commands with high impact on confidentiality, integrity and availability. It may cau...

SSRF in MLflow via user-controlled webhook URL parameter

Description A Server-Side Request Forgery SSRF vulnerability exists in the webhook creation functionality of MLflow. The createwebhook handler accepts a user-controlled url parameter and stores it without any validation. When webhooks are tested or triggered, the sendwebhookrequest function sends...

CVE-2026-1602

Ivanti Endpoint Manager prior to 2024 SU5 is affected by an SQL injection vulnerability that allows a remote authenticated attacker to read arbitrary data from the database. The CVSSv3.1 base score is 6.5 (Medium) with Network attack vector, Low attack complexity, Privileges Required: Low, No use...

CVE-2026-2097

Agentflow developed by Flowring has an Arbitrary File Upload vulnerability, allowing authenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...

CVE-2026-24320

Due to improper memory management in SAP NetWeaver and ABAP Platform Application Server ABAP, an authenticated attacker could exploit logical errors in memory management by supplying specially crafted input containing unique characters, which are improperly converted. This may result in memory...

CVE-2026-24320

Due to improper memory management in SAP NetWeaver and ABAP Platform Application Server ABAP, an authenticated attacker could exploit logical errors in memory management by supplying specially crafted input containing unique characters, which are improperly converted. This may result in memory...

CVE-2026-0508

The SAP BusinessObjects Business Intelligence Platform allows an authenticated attacker with high privileges to insert malicious URL within the application. Upon successful exploitation, the victim may click on this malicious URL, resulting in an unvalidated redirect to the attacker-controlled...

CVE-2026-0508

The SAP BusinessObjects Business Intelligence Platform allows an authenticated attacker with high privileges to insert malicious URL within the application. Upon successful exploitation, the victim may click on this malicious URL, resulting in an unvalidated redirect to the attacker-controlled...

CVE-2026-24320 Memory Corruption vulnerability in SAP NetWeaver and ABAP Platform (Application Server ABAP)

Due to improper memory management in SAP NetWeaver and ABAP Platform Application Server ABAP, an authenticated attacker could exploit logical errors in memory management by supplying specially crafted input containing unique characters, which are improperly converted. This may result in memory...

CVE-2026-24320 Memory Corruption vulnerability in SAP NetWeaver and ABAP Platform (Application Server ABAP)

Due to improper memory management in SAP NetWeaver and ABAP Platform Application Server ABAP, an authenticated attacker could exploit logical errors in memory management by supplying specially crafted input containing unique characters, which are improperly converted. This may result in memory...

CVE-2026-24320

CVE-2026-24320 : In SAP NetWeaver and ABAP Platform (Application Server ABAP), improper memory management can be triggered by specially crafted input with unique characters, causing memory corruption and potential leakage of memory content. The vulnerability affects authenticated attackers via ne...

CVE-2026-23681 Missing Authorization check in a function module in SAP Support Tools Plug-In

Due to missing authorization check in a function module in SAP Support Tools Plug-In, an authenticated attacker could invoke specific function modules to retrieve information about the system and its configuration. This disclosure of the system information could assist the attacker to plan...

CVE-2026-23681 Missing Authorization check in a function module in SAP Support Tools Plug-In

Due to missing authorization check in a function module in SAP Support Tools Plug-In, an authenticated attacker could invoke specific function modules to retrieve information about the system and its configuration. This disclosure of the system information could assist the attacker to plan...

CVE-2026-0508

The CVE refers to SAP BusinessObjects Business Intelligence Platform where an authenticated, high-privileged attacker can insert a malicious URL in the app. When a victim clicks it, an unvalidated redirect to the attacker-controlled domain occurs, potentially downloading malicious content. The im...

CVE-2026-0508 Open Redirect vulnerability in SAP BusinessObjects Business Intelligence Platform

The SAP BusinessObjects Business Intelligence Platform allows an authenticated attacker with high privileges to insert malicious URL within the application. Upon successful exploitation, the victim may click on this malicious URL, resulting in an unvalidated redirect to the attacker-controlled...