SAP UI5 does not sufficiently validate the parent frame's origin against the configured allowlist...
CVE-2026-76977
SAP UI5 does not sufficiently validate the parent frame's origin against the configured allowlist. An unauthenticated at
#advisory
共收录 23717 条相关情报。
← 返回所有主题SAP S/4HANA (Manage Bank Chains app) does not perform sufficient authorization checks within...
CVE-2026-76962
SAP S/4HANA (Manage Bank Chains app) does not perform sufficient authorization checks within certain affected functional
SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cross-Site Request...
CVE-2026-76961
SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cross-Site Request Forgery protection on c
SAP NetWeaver Business Client does not perform sufficient validation when processing certain...
CVE-2026-76967
SAP NetWeaver Business Client does not perform sufficient validation when processing certain locally stored data during
SAP GUI for Java does not correctly enforce the trust level policy for certain functions invoked...
CVE-2026-66768
SAP GUI for Java does not correctly enforce the trust level policy for certain functions invoked from a connected backen
SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cross-Site Request...
CVE-2026-76959
SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cross-Site Request Forgery protection on c
SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cross-Site Request...
CVE-2026-76960
SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cross-Site Request Forgery protection on c
SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated user to...
CVE-2026-66767
SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated user to send a specially crafted p
SAP Integration Suite does not sufficiently validate XML documents accepted from untrusted...
CVE-2026-76958
SAP Integration Suite does not sufficiently validate XML documents accepted from untrusted sources in certain internal c
SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal...
CVE-2026-58240
SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components d
SAP Process Integration (SOAP Adapter) allows a privileged user to send specially crafted...
CVE-2026-58234
SAP Process Integration (SOAP Adapter) allows a privileged user to send specially crafted requests containing deeply nes
A memory safety vulnerability exists in the Extended Passport Protocol (EPP) processing library....
CVE-2026-44756
A memory safety vulnerability exists in the Extended Passport Protocol (EPP) processing library. Under specific conditio
SAP S/4HANA (Intercompany Matching and Reconciliation) allows a low-privileged authenticated user...
CVE-2026-44766
SAP S/4HANA (Intercompany Matching and Reconciliation) allows a low-privileged authenticated user to inject malicious in
knowns versions before 0.30.0 serve the management API without authentication on all network...
CVE-2026-86543
knowns versions before 0.30.0 serve the management API without authentication on all network interfaces by default, with
knowns through 0.33.0 contains a server-side request forgery vulnerability in the POST /api...
CVE-2026-86539
knowns through 0.33.0 contains a server-side request forgery vulnerability in the POST /api/embedding-models/test endpoi
knowns before 0.30.0 fails to validate import names in the import routes, allowing...
CVE-2026-86542
knowns before 0.30.0 fails to validate import names in the import routes, allowing unauthenticated attackers to write fi
knowns versions before 0.30.0 fail to validate filesystem paths in MCP tool arguments, allowing...
CVE-2026-86439
knowns versions before 0.30.0 fail to validate filesystem paths in MCP tool arguments, allowing attackers to read, creat
knowns versions before 0.30.0 contain an authorization bypass vulnerability where mutating code...
CVE-2026-86544
knowns versions before 0.30.0 contain an authorization bypass vulnerability where mutating code actions are incorrectly
knowns versions before 0.30.0 contain a path traversal vulnerability in the handleCodeReplace()...
CVE-2026-86541
knowns versions before 0.30.0 contain a path traversal vulnerability in the handleCodeReplace() function that allows att
knowns versions before 0.30.0 contain a path traversal vulnerability in the POST /api/templates...
CVE-2026-86538
knowns versions before 0.30.0 contain a path traversal vulnerability in the POST /api/templates/preview endpoint that al