CVE Vulnerability Catalog

A vulnerability in SAP S/4HANA Project Management (PPM-PRO) allows an attacker with high privileges to execute crafted database queries, exposing the backend database. This results in low impact on confidentiality, with no impact on integrity and availability.

The SAP CRM WebClient UI lacks a Content Security Policy (CSP) configuration for certain restrictive directives, allowing an attacker to inject and execute malicious scripts within the application context. This vulnerability has a low impact on integrity, while confidentiality and availability are not affected.

The setThemeRoot() function fails to enforce the sap-allowed-theme-origins allowlist. An attacker can store and use a controlled absolute cross-origin URL to construct a <link rel=stylesheet> element, even without the <meta name=sap-allowed-theme-origins> tag. The bypass is also reachable via the ?sap-themeRoot URL parameter.

A Cross-Site Scripting (XSS) vulnerability in the Business Server Pages framework of SAP NetWeaver Application Server ABAP reflects unsanitized input into HTTP responses, allowing an attacker to inject and execute arbitrary JavaScript code. Successful exploitation could lead to session theft and unauthorized actions on behalf of the victim.

A vulnerability in SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server response and executed in a user's browser when the crafted URL is visited.

A vulnerability was found in the File Tools component of mosaxiv clawlet up to version 0.2.10, involving symbolic link following in the read_file, write_file, and edit_file functions within tools/fs_ops.go. The attack requires local access.

A server-side request forgery (SSRF) vulnerability was found in the mosaxiv clawlet library up to version 0.2.10 in the tools.webFetch function of tools/tool_web_fetch.go. The attack can be launched remotely, and the exploit has been publicly disclosed.

A server-side request forgery (SSRF) vulnerability has been identified in the IPv4 Handler component of mosaxiv clawlet up to version 0.2.10. The issue is in the web_fetch function in tools/tool_web_fetch.go, where manipulation of the url argument allows an attacker to send requests to internal resources. The attack can be performed remotely and the exploit has been made public.

A security flaw in mosaxiv clawlet up to version 0.2.10 affects the exec Safety Guard component. The guardExecCommand function in tools/tool_exec.go fails to provide effective protection, allowing remote bypass of security mechanisms. An exploit has been publicly released, and the GitHub issue was closed with the label 'not planned'.

In HedgeDoc prior to version 1.11.0, the GitHub Gist export flow had an OAuth2 state validation flaw. The state parameter was only checked for presence, not validated against the user's session, allowing an attacker to forge a callback URL. A logged-in victim clicking a crafted link could export their private note to an attacker-controlled Gist.

A vulnerability was found in tanstack db up to version 0.6.8 in the select function of the Alias Path Handler component. Manipulation leads to improperly controlled modification of object prototype attributes, exploitable remotely. The exploit is public.

A symlink attack vulnerability in FlashAttention through version 2.8.3.post1 (fixed in commit 0816ef1) exists in the download_and_copy() function within hopper/setup.py, which extracts NVIDIA toolchain archives without validating symlinks or filtering tar members. A local attacker can pre-plant a symlink in the predictable cache directory to redirect extracted binaries to an attacker-chosen location, enabling arbitrary file write with victim privileges during build time.

OpenClaw versions 2026.5.28 through 2026.6.5 contain an authorization bypass vulnerability in native web search. This allows lower-trust callers to perform actions requiring stronger policy checks.

OpenClaw versions 2026.6.5 through 2026.6.8 contain a vulnerability in the plugin installation wrappers that can bypass the install policy (authorization) check. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could execute or persist actions beyond the caller's intended authorization.

HedgeDoc versions prior to 1.11.0 allowed attackers to bypass rate-limiting on /login and /register routes by spoofing the cf-connecting-ip header. The application trusted this header even when the request did not originate from Cloudflare, enabling login spam or mass account creation.

HedgeDoc before version 1.11.0 was vulnerable to stored HTML Injection due to unsafe handling of the local-part of registered email addresses. An attacker could register a specially crafted email address and inject arbitrary HTML into pages viewed by other users.

The SCORM lab launch endpoint in Skillable (formerly Learn on Demand Systems) does not validate the client-supplied userId parameter against the authenticated SCORM session token. An authenticated user can substitute arbitrary userId values to bypass per-user lab launch rate limits and consume other users' lab allocations.

A vulnerability in AnyDesk allows a local attacker to cause a denial-of-service (DoS) condition by abusing the 'Send Support Information' feature. The attack requires prior low-privileged code execution on the target system.

A vulnerability in AnyDesk allows a local attacker to cause a denial-of-service (DoS) condition by manipulating screen recording files. The attacker must first obtain the ability to execute low-privileged code on the target system.

A vulnerability has been identified in antv layout version 2.0.0, involving uncontrolled modification of object prototype attributes. The issue is in the setNestedValue function in lib/util/object.js, where manipulation of the path argument can lead to prototype pollution. The attack can be launched remotely.