Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.4MaxKB is an open-source AI assistant for enterprise.Check if you run itEPSS 0.49%Apr 14, 2026
- Medium6.5During authorization checks in SAP Human Capital Management for SAP S/4HANA, the system returns specific messages.Check if you run itEPSS 0.27%Apr 14, 2026
- Medium6.5Due to a missing authorization check in SAP Business Analytics and SAP Content Management, an authenticated user could make unauthorized calls to certain remote function modules, pCheck if you run itEPSS 0.22%Apr 14, 2026
- Medium6.1Due to an Open Redirect vulnerability in SAP NetWeaver Application Server ABAP, an unauthenticated attacker could craft malicious URL that, if accessed by a victim, they could be rCheck if you run itEPSS 0.16%Apr 14, 2026
- High7.1Due to a missing authorization check in SAP ERP and SAP S/4HANA (Private Cloud and On-Premise), an authenticated attacker could execute a particular ABAP report to overwrite any exCheck if you run itEPSS 0.23%Apr 14, 2026
- Medium4.1SAP BusinessObjects Business Intelligence application allows an authenticated attacker to inject malicious JavaScript payloads through crafted URLs.Check if you run itEPSS 0.19%Apr 14, 2026
- Critical9.9Due to insufficient authorization checks in SAP Business Planning and Consolidation and SAP Business Warehouse, an authenticated user can execute crafted SQL statements to read, moCheck if you run itEPSS 0.51%Apr 14, 2026
- Medium6.5Due to missing authorization checks in the SAP S/4HANA frontend OData Service (Manage Reference Structures), an attacker could update and delete child entities via exposed OData seCheck if you run itEPSS 0.19%Apr 14, 2026
- Medium6.5Due to missing authorization checks in the SAP S/4HANA backend OData Service (Manage Reference Structures), an attacker could update and delete child entities via exposed OData serCheck if you run itEPSS 0.19%Apr 14, 2026
- Medium6.5Due to missing authorization checks in the SAP S/4HANA OData Service (Manage Reference Equipment), an attacker could update and delete child entities via OData services without proCheck if you run itEPSS 0.19%Apr 14, 2026
- Medium4.3Due to missing authorization checks in the SAP S/4HANA OData Service (Manage Technical Object Structures), an attacker could update and delete child entities via exposed OData servCheck if you run itEPSS 0.16%Apr 14, 2026
- Low2.0SAP Landscape Transformation contains a vulnerability in an RFC-exposed function module that could allow a high privileged adversary to inject arbitrary ABAP code and operating sysCheck if you run itEPSS 0.18%Apr 14, 2026
- Medium4.9Due to a missing authorization check, SAP S/4HANA (Private Cloud and On-Premise) allows an authenticated user to delete files on the operating system and gain unauthorized controlCheck if you run itEPSS 0.16%Apr 14, 2026
- Medium4.3The Material Master application does not enforce authorization checks for authenticated users when executing reports, resulting in the disclosure of sensitive information.Check if you run itEPSS 0.18%Apr 14, 2026
- Medium4.2Due to an Insecure session management vulnerability in SAP Business Objects Business Intelligence Platform, an unauthenticated attacker could obtain valid session tokens and reuseCheck if you run itEPSS 0.17%Apr 14, 2026
- Medium6.1Due to a Cross-Site Scripting (XSS) vulnerability in the SAP Supplier Relationship Management (SICF Handler in SRM Catalog), an unauthenticated attacker could craft a malicious URLCheck if you run itEPSS 0.24%Apr 14, 2026
- Medium5.5MaxKB is an open-source AI assistant for enterprise.Check if you run itEPSS 0.25%Apr 14, 2026
- Medium6.5An improper authorization vulnerability in the /api/v1/users/{id} endpoint of Snipe-IT v8.4.0 allows authenticated attackers with the users.edit permission to modify sensitive authCheck if you run itEPSS 0.32%Apr 14, 2026
- Low2.7SourceCodester Patient Appointment Scheduler System v1.0 is vulnerable to SQL Injection in the file /scheduler/admin/user/manage_user.php.Check if you run itEPSS 0.19%Apr 14, 2026
- Low2.7SourceCodester Patient Appointment Scheduler System v1.0 is vulnerable to SQL Injection in the file /scheduler/admin/appointments/manage_appointment.php.Check if you run itEPSS 0.19%Apr 14, 2026
- Low2.7SourceCodester Patient Appointment Scheduler System v1.0 is vulnerable to SQL Injection in the file /scheduler/admin/appointments/view_details.php.Check if you run itEPSS 0.19%Apr 14, 2026
- Low2.7SourceCodester Patient Appointment Scheduler System v1.0 is vulnerable to arbitrary code execution (RCE) via /scheduler/classes/SystemSettings.php?f=update_settings.Check if you run itEPSS 0.24%Apr 14, 2026
- Low2.7SourceCodester Online Employees Work From Home Attendance System v1.0 is vulnerable to SQL Injection in the file /wfh_attendance/admin/attendance_list.php.Check if you run itEPSS 0.19%Apr 14, 2026
- Low2.7SourceCodester Online Employees Work From Home Attendance System v1.0 is vulnerable to SQL Injection in the file /wfh_attendance/admin/manage_department.php.Check if you run itEPSS 0.19%Apr 14, 2026
- Low2.7SourceCodester Online Employees Work From Home Attendance System v1.0 is vulnerable to SQL Injection in the file /wfh_attendance/admin/manage_employee.php.Check if you run itEPSS 0.19%Apr 14, 2026
Sort