EUVD-2026-55999

SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to certain functions lacking sufficient validation. Successful exploitation could enable arbitrary code execution and compromise internal components, resulting in high...

Broadstreet WordPress plugin - Reflected XSS

Broadstreet WordPress plugin 1.51.8 contains a reflected XSS caused by unsanitised and unescaped parameter output, letting attackers execute scripts against high privilege users such as admin, exploit requires victim interaction. id: CVE-2025-4652 info: name: Broadstreet WordPress plugin -...

Rukovoditel <= 3.2.1 - Cross Site Scripting

A stored cross-site scripting XSS vulnerability in the Users Alerts feature /index.php?module=usersalerts/usersalerts of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title parameter after clicking "Add". id:...

Leantime < 2.4 - Authenticated SQL Injection

Leantime is an open source project management system. A 'userId' variable in app/domain/files/repositories/class.files.php is not parameterized. An authenticated attacker can send a carefully crafted POST request to /api/jsonrpc to exploit an SQL injection vulnerability. Confidentiality is impact...

CVE-2026-34265

creationtimestamp| type| source ---|---|--- 2026-08-11 01:05:20+00:00| seen| https://bsky.app/profile/suriq.io/post/3msrgcbwz3e26 2026-08-11 01:24:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msrhdt46gj2o 2026-08-11 03:00:28+00:00| seen|...

EUVD-2026-55891

Due to a Cross-Site Scripting XSS vulnerability in SAP NetWeaver Application Server ABAP, an authenticated attacker could generate a malicious link and make it publicly accessible. If an authenticated victim accesses this link, the injected input is processed and reflected within the DOM on the...

CVE-2026-66778

CVE-2026-66778 affects SAP Approuter within SAP Business AI Platform. The vulnerability stems from insufficient sanitization of certain request headers forwarded to internal components, enabling an unauthenticated attacker to obtain limited unauthorized access to information (confidentiality impa...

CVE-2026-66777

SAP Approuter in SAP Business AI Platform is affected by vulnerabilities where incoming requests are not sufficiently validated before being forwarded to backend destinations. An attacker with low privileges could craft requests to bypass authorization and access protected resources beyond their ...

EUVD-2026-55889

SAP Approuter does not sufficiently validate certain incoming requests before forwarding them to backend destinations. Due to the complexity of the required conditions, an attacker with low privileges could send specially crafted requests to bypass authorization checks and reach protected resourc...

CVE-2026-66776

SAP Approuter (SAP Business AI Platform) contains vulnerabilities where integrity verification on certain session-related request headers can be bypassed under specific conditions, potentially exposing another user’s session context. Exploitation requires low privileges and previously observed ma...

EUVD-2026-55888

SAP Approuter does not consistently enforce integrity verification on certain session-related request headers under specific conditions. An attacker with low privileges could send a specially crafted request that bypasses the integrity check and loads another user's session context. Successful...

CVE-2026-66775

CVE-2026-66775 affects SAP Approuter (SAP Business AI Platform). The vulnerability is a CSRF flaw where cross-site request forgery protection is not enforced on the authentication flow by default. An unauthenticated attacker could craft a malicious link to lure a victim and bind the victim’s sess...

EUVD-2026-55887

SAP Approuter does not enforce cross-site request forgery protection on the authentication flow by default. An unauthenticated attacker could craft a malicious link and trick a victim into following it. Successful exploitation could allow the attacker to bind the victim's session to an...

CVE-2026-66774

SAP Approuter in SAP Business AI Platform contains multiple vulnerabilities related to error handling under non-default configurations. An attacker with low privileges could exploit conditions outside their control to affect availability , with no impact on confidentiality or integrity reported. ...

EUVD-2026-55885

A malicious or compromised OData service could disclose sensitive authentication information and inject untrusted data into the application, which may leads to a high impact on confidentiality and low impact on integrity and no impact on Availability...

CVE-2026-66772

CVE-2026-66772 concerns SAP BusinessObjects BI Platform (Admin Tools), where a missing authorization check on certain administrative functionality lets an authenticated non-administrative user bypass restrictions to glean limited information about the affected feature. The impact is described as ...

EUVD-2026-55883

SAPUI5 allows a key user with content adaptation privileges to inject malicious script content into persisted application changes. When another user subsequently opens the adapted application, the injected script executes in the victim's browser session. Successful exploitation could allow the...

CVE-2026-66770

Technical details about CVE-2026-66770 are not publicly available in the provided documents. Monitor for updates.

CVE-2026-66764

CVE-2026-66764 affects SAP S/4HANA, specifically the Reprocess Bank Statement Items functionality. The root cause is missing authorization checks for authenticated users, enabling them to use rules not shared with them. This results in privilege escalation with a low impact on confidentiality (C:...

EUVD-2026-55880

SAP BusinessObjects Business Intelligence Platform stores certain sensitive credentials associated with user objects using a hard-coded cryptographic key. An attacker with high privileges and local access to the server could retrieve these objects and decrypt the stored credentials. Successful...