critical · CVSS v3 9.9

CVE-2026-109795

SAP NetWeaver does not perform necessary authorization checks and lacks sufficient input validation in certain remote-en…

Description

SAP NetWeaver does not perform necessary authorization checks and lacks sufficient input validation in certain remote-enabled functionality. An attacker with low privileges could send specially crafted input through a remote interface to inject and execute arbitrary code within the affected system. Successful exploitation could extend the attacker's reach beyond the vulnerable component, resulting in a high impact on confidentiality, integrity and availability.

Scores

Severity
critical
CVSS v2
9
CVSS v3
9.9
CVSS v4
—
EPSS
—

← All CVEs

Related CVEs

critical

CVE-2026-125358

Universal-modder before commit e88f6876745427321eb755ebc98276063a962d8a contains a missing WebSocket Origin validation vulnerability in the HostLink class of its passthrough example mods that allows remote attackers to execute Minecraft commands. Any web page open in the player's browser can connect cross-site to the unauthenticated loopback WebSocket and send cmd messages that WorldBridge.command() runs with operator authority.

View analysis

critical

CVE-2026-125370

Kubero 3.0.0 through 3.1.1 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge administrative JWTs by using a hardcoded fallback signing secret when JWT_SECRET is unset. Attackers can sign tokens with arbitrary role, userGroups and permissions claims, which JwtStrategy.validate() trusts without a database lookup, to take control of pipelines, applications, users and API tokens.

View analysis

critical

CVE-2026-125383

INDOTALENT WHMS before 10.20261109 has an authentication bypass due to hard‑coded JWT signing key, issuer, and audience. Unauthenticated attackers can forge tokens and impersonate any user, including administrators. This flaw allows full control over the API.

View analysis

critical

CVE-2026-125384

INDOTALENT WHMS before 10.20261109 contains a default credentials vulnerability that allows unauthenticated attackers to gain administrator access because UserAdminSeeder creates [email protected] with password 123456. Attackers can log in with these credentials, which carry every admin role and no forced password change, to fully control deployments that kept them.

View analysis