Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2026-89111

OAuth2 SSRF vulnerability in SAP Cloud SDK for Python

The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated. This vulnerability was originally fixed in 0.45.2. It was reintroduced in 0.53.0 when the HTTP client was refactored into a shared core module, and the tenant subdomain validation was not carried over to the new location. The validation was restored in 0.55.1.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Sap Se
Products
Sap Cloud
CVE-2026-76969

Credential disclosure in multitenant applications using SAP Cloud Application Programming Model (CAP)

@sap/cds-mtxs NPM library does not perform sufficient checks on certain functionality used in multitenant CAP applications with extensibility enabled. An unauthenticated attacker could send specially crafted requests to obtain sensitive credentials and abuse them to replace or delete tenant data. Successful exploitation can result in a high impact on availability and integrity of the application. There may also be partial impact to the confidentiality of business data.

CVSS 3.1 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Sap Se
Products
Sap Cloud Application Programming Model (cap)