Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Unknownwebreinvent vaahcms Embedded Malicious CodePatch nowKEVEPSS 0.76%Jul 29, 2026
- UnknownSAP netweaver_application_server_java Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Patch nowKEVEPSS 28.31%Jun 12, 2026
- Medium6.4The Animation Addons for Elementor – GSAP Powered Elementor Addons & Website Templates plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via…Check if you run itEPSS 0.15%Jun 10, 2026
- Low2.0A vulnerability was determined in lharries whatsapp-mcp 0.0.1.Check if you run itEPSS 0.27%Jun 1, 2026
- Medium4.3The SAP Gateway allows attackers to inject content into error messages, potentially leading to disclosure of request artefacts (e.g., regex patterns) and revealing und…Check if you run itEPSS 0.32%May 26, 2026
- Medium6.5TypeBot is a chatbot builder tool.Check if you run itEPSS 0.16%May 22, 2026
- Medium4.3Due to improper input handling under certain conditions, SAP NetWeaver Application Server ABAP allows an attacker to inject custom Cascading Style Sheets (CSS) data in…Check if you run itEPSS 0.29%May 14, 2026
- Medium6.1SAP TAF_APPLAUNCHER within Business Server Pages allows an unauthenticated attacker to craft malicious links that, when clicked by a victim, redirects them to attacker…Check if you run itEPSS 0.29%May 12, 2026
- Medium4.3SAP Financial Consolidation allows an authenticated attacker to disconnect other users by terminating their sessions temporarily preventing access.Check if you run itEPSS 0.37%May 12, 2026
- Medium6.5An OS Command Injection vulnerability exists in the SAP NetWeaver Application Server for ABAP and ABAP Platform that allows an authenticated attacker with administrati…Check if you run itEPSS 1.88%May 12, 2026
- Medium4.3Due to insufficient authorization checks in the SAP Incentive and Commission Management application, authenticated users could invoke a remote-enabled function module…Check if you run itEPSS 0.26%May 12, 2026
- Medium6.3Due to missing authorization check in SAP S/4HANA Condition Maintenance, an authenticated attacker could gain unauthorized access to view and modify condition table re…Check if you run itEPSS 0.27%May 12, 2026
- Medium5.4Due to missing authorization check in SAP Strategic Enterprise Management (Scorecard Wizard in Business Server Pages), an authenticated attacker could access informati…Check if you run itEPSS 0.24%May 12, 2026
- Low3.4SQL injection vulnerability exists in @sap/hdi-deploy package, where SQL queries are dynamically constructed using user input without proper parameterization or prepar…Check if you run itEPSS 0.18%May 12, 2026
- Medium4.3Due to a Code Injection vulnerability in SAP Application Server ABAP for SAP NetWeaver and ABAP Platform, an authenticated attacker could send specially crafted inputs…Check if you run itEPSS 0.34%May 12, 2026
- Critical9.6Due to improper Spring Security configuration, SAP Commerce Cloud allows an unauthenticated user to perform malicious input injection, resulting in arbitrary server-si…Check if you run itEPSS 0.62%May 12, 2026
- Critical9.6SAP S/4HANA (SAP Enterprise Search for ABAP) contains a SQL injection vulnerability that allows an authenticated attacker to inject malicious SQL statements through us…Check if you run itEPSS 0.43%May 12, 2026
- High8.2Due to an OS Command Execution vulnerability in SAP Forecasting & Replenishment, an authenticated attacker with administrative authorizations could abuse a non-remote-…Check if you run itEPSS 0.24%May 12, 2026
- Medium4.7SAPUI5 (Search UI) allows an unauthenticated attacker to manipulate specific URL parameters on the Search UI to include malicious content.Check if you run itEPSS 0.32%May 12, 2026
- Medium6.1Due to a reflected cross-site scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (Applications based on Business Server Pages), an unauthenticated…Check if you run itEPSS 0.30%May 12, 2026
- Medium5.4Due to insufficient CSRF protection in SAP BusinessObjects Business Intelligence Platform ,an authenticated user could be tricked by an attacker to send unintended req…Check if you run itEPSS 0.12%May 12, 2026
- High8.8WordPress Plugin Survey & Poll 1.5.7.3 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting mali…Check if you run itEPSS 0.28%May 10, 2026
- Medium5.3ZEBRA is a Zcash node written entirely in Rust.Check if you run itEPSS 0.41%May 8, 2026
- High8.6The MongoDB C Driver's Cyrus SASL integration performs unsafe string copying during username canonicalization, enabling a heap buffer overflow before any authenticatio…Check if you run itEPSS 0.18%May 6, 2026
- High7.8In the Linux kernel, the following vulnerability has been resolved: alpha: fix user-space corruption during memory compaction Alpha systems can suffer sporadic user-sp…Check if you run itEPSS 0.18%May 6, 2026