Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium4.9The Elementor plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.30.2 via the Import_Images::import() function due to insufficient coCheck if you run itEPSS 0.55%Aug 12, 2025
- High7.5The UiCore Elements – Free Elementor widgets and templates plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.3.0 via the prepare_temCheck if you run itEPSS 0.39%Aug 12, 2025
- High8.1SAP NetWeaver Application Server ABAP (BIC Document) allows an authenticated attacker to craft a request that, when submitted to a BIC Document application, could cause a memory coCheck if you run itEPSS 0.42%Aug 12, 2025
- Medium6.1SAP NetWeaver Application Server ABAP (BIC Document) allows an unauthenticated attacker to craft a URL link which, when accessed on the BIC Document application, embeds a maliciousCheck if you run itEPSS 0.26%Aug 12, 2025
- Critical9.9Improper Control of Generation of Code ('Code Injection')Patch nowKEVEPSS 1.65%Aug 12, 2025
- Low3.5Due to a missing authorization check in SAP Cloud Connector, an attacker on an adjacent network with low privileges could send a crafted request to the endpoint responsible for tesCheck if you run itEPSS 0.46%Aug 12, 2025
- High8.8Due to broken authorization, SAP Business One (SLD) allows an authenticated attacker to gain administrator privileges of a database by invoking the corresponding API.�As a result ,Check if you run itEPSS 0.49%Aug 12, 2025
- Critical9.9SAP Landscape Transformation (SLT) allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC.Check if you run itEPSS 0.70%Aug 12, 2025
- Medium4.9Due to a missing authorization check in the ABAP Platform, an authenticated user with elevated privileges could bypass authorization restrictions for common transactions by leveragCheck if you run itEPSS 0.32%Aug 12, 2025
- Medium6.1Due to a Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver ABAP Platform, an unauthenticated attacker could generate a malicious link and make it publicly accessible.Check if you run itEPSS 0.23%Aug 12, 2025
- Medium6.9Due to directory traversal vulnerability in SAP S/4HANA (Bank Communication Management), an attacker with high privileges and access to a specific transaction and method in Bank CoCheck if you run itEPSS 0.95%Aug 12, 2025
- Medium6.1SAP NetWeaver Application Server ABAP has HTML injection vulnerability.Check if you run itEPSS 0.21%Aug 12, 2025
- Medium6.1SAP NetWeaver Application Server for ABAP has cross-site scripting vulnerability.Check if you run itEPSS 0.23%Aug 12, 2025
- Low3.5SAP Fiori (Launchpad) is vulnerable to Reverse Tabnabbing vulnerability due to inadequate external navigation protections for its link ( ) elements.Check if you run itEPSS 0.21%Aug 12, 2025
- Medium5.4The SAP NetWeaver Application Server for ABAP does not enable an administrator to assign distinguished authorizations for different user roles, this issue allows authenticated userCheck if you run itEPSS 0.20%Aug 12, 2025
- Medium4.1The SAP NetWeaver Application Server ABAP and ABAP Platform Internet Communication Manager (ICM) permits authorized users with admin privileges and local access to log files to reaCheck if you run itEPSS 0.13%Aug 12, 2025
- Medium4.3SAP S/4HANA Supplier invoice is vulnerable to CRLF Injection.Check if you run itEPSS 0.26%Aug 12, 2025
- UnknownApache Superset Deserialization of Untrusted DataPatch nowKEVEPSS 35.45%Aug 12, 2025
- UnknownIBM data_risk_manager Use of Hard-coded CredentialsPatch nowKEVEPSS 71.95%Aug 12, 2025
- High8.6Server-Side Request Forgery (SSRF) in Omnissa Secure Email Gateway (SEG) in SEG prior to 2.32 running on Windows and SEG prior to 2503 running on UAG allows routing of network trafCheck if you run itEPSS 0.30%Aug 11, 2025
- High8.5Zed is a multiplayer code editor.Check if you run itEPSS 0.21%Aug 11, 2025
- Medium4.0Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the channel which allows attackers to create channel subscription without proper access to theCheck if you run itEPSS 0.20%Aug 11, 2025
- High7.5Mattermost Confluence Plugin version <1.5.0 fails to handle unexpected request body which allows attackers to crash the plugin via constant hit to create channel subscription endpoCheck if you run itEPSS 0.34%Aug 11, 2025
- High7.2Mattermost Confluence Plugin version <1.5.0 fails to enforce authentication of the user to the Mattermost instance which allows unauthenticated attackers to edit channel subscriptiCheck if you run itEPSS 0.24%Aug 11, 2025
- Medium5.9Mattermost Confluence Plugin version <1.5.0 fails to handle unexpected request body which allows attackers to crash the plugin via constant hit to server webhook endpoint with an iCheck if you run itEPSS 0.30%Aug 11, 2025
Sort