CVE Vulnerability Database
Search and browse 389,967 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-58233 | HIGH | 7.6 | 0.3% | Jul 14, 2026 | SAP Change and Transport System Attach Tool (ctsattach) allows an authenticated attacker to supply a specially crafted a... |
| CVE-2026-44771 | MEDIUM | 4.3 | 0.2% | Jul 14, 2026 | SAP S/4HANA Draft operation does not perform necessary authorization checks for an authenticated user, a restricted user... |
| CVE-2026-44770 | MEDIUM | 4.3 | 0.2% | Jul 14, 2026 | SAP Create Single Payment does not perform necessary authorization checks for an authenticated user, a restricted user c... |
| CVE-2026-44769 | MEDIUM | 5.5 | 0.2% | Jul 14, 2026 | SAP S/4HANA application Project Management (PPM-PRO) allows an attacker with high privileges to execute crafted database... |
| CVE-2026-44768 | MEDIUM | 4.1 | 0.2% | Jul 14, 2026 | SAP CRM WebClient UI allows an attacker to inject and execute malicious scripts in the context of the application due to... |
| CVE-2026-44767 | MEDIUM | 6.1 | 0.2% | Jul 14, 2026 | setThemeRoot() failed to enforce the sap-allowed-theme-origins allowlist. An attacker-controlled absolute cross-origin U... |
| CVE-2026-44761 | CRITICAL | 9.1 | 0.4% | Jul 14, 2026 | SAP Commerce Cloud could retain a sample OAuth2 client with publicly documented sample credentials originating from samp... |
| CVE-2026-44760 | MEDIUM | 4.7 | 0.1% | Jul 14, 2026 | Due to a Cross-Site Scripting (XSS) vulnerability, applications based on Business Server Pages framework in SAP NetWeave... |
| CVE-2026-44759 | MEDIUM | 6.1 | 0.2% | Jul 14, 2026 | SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The... |
| CVE-2026-44753 | LOW | 3.7 | 0.2% | Jul 14, 2026 | SAP HANA Database (user self service tools) allows an unauthenticated user to send specially crafted requests that produ... |
| CVE-2026-44752 | HIGH | 8.2 | 0.3% | Jul 14, 2026 | SAP NetWeaver Application Server Java allows an unauthenticated attacker to inject malicious JavaScript through crafted ... |
| CVE-2026-44747 | CRITICAL | 9.9 | 0.5% | Jul 14, 2026 | SAP NetWeaver Application Server ABAP allows an authenticated attacker to leverage logical errors in memory management t... |
| CVE-2026-44745 | HIGH | 8.1 | 0.5% | Jul 14, 2026 | SAP Approuter does not properly validate incoming request headers during the OAuth2 login flow under certain configurati... |
| CVE-2026-27690 | CRITICAL | 9.1 | 0.7% | Jul 14, 2026 | Due to an HTTP Request Smuggling vulnerability in SAP Approuter, an unauthenticated attacker could send a specially craf... |
| CVE-2026-15621 | MEDIUM | 5.3 | 0.1% | Jul 14, 2026 | A vulnerability was detected in mosaxiv clawlet up to 0.2.10. This impacts the function read_file/write_file/edit_file o... |
| CVE-2026-15620 | MEDIUM | 6.3 | 0.2% | Jul 14, 2026 | A security vulnerability has been detected in mosaxiv clawlet up to 0.2.10. This affects the function tools.webFetch of ... |
| CVE-2026-0487 | HIGH | 8.4 | 0.1% | Jul 14, 2026 | SAProuter on Microsoft Windows allows an unauthenticated attacker to load library (DLL) files from an untrusted location... |
| CVE-2026-15619 | MEDIUM | 6.3 | 0.3% | Jul 14, 2026 | A weakness has been identified in mosaxiv clawlet up to 0.2.10. The impacted element is the function web_fetch of the fi... |
| CVE-2026-15618 | MEDIUM | 6.3 | 0.2% | Jul 14, 2026 | A security flaw has been discovered in mosaxiv clawlet up to 0.2.10. The affected element is the function guardExecComma... |
| CVE-2026-58489 | MEDIUM | 6.8 | 0.1% | Jul 13, 2026 | HedgeDoc is an open source, real-time collaborative markdown notes application. Prior to 1.11.0, the GitHub Gist export ... |
| CVE-2026-58486 | HIGH | 8.3 | 0.2% | Jul 13, 2026 | HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to version 1.11.0, HedgeDoc was ... |
| CVE-2026-58102 | CRITICAL | 9.1 | 0.2% | Jul 13, 2026 | Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow a heap out-of-bounds read via a long certificate extension OID... |
| CVE-2026-58101 | HIGH | 7.5 | 0.2% | Jul 13, 2026 | Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow denial of service via NULL pointer dereference. X509V3_EXT_d2... |
| CVE-2026-57856 | HIGH | 8.8 | 0.4% | Jul 13, 2026 | Cockpit CMS contains a path traversal vulnerability in the Bucket file storage API (/system/buckets/api). The api() meth... |
| CVE-2026-57855 | HIGH | 8.8 | 0.3% | Jul 13, 2026 | Cockpit CMS contains a missing authorization vulnerability in the Bucket file storage API (/system/buckets/api). The api... |