https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-10T17:17:15.499887+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/certfr-2026-avi-1497 certfr-2026-avi-1497 — De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquan… 2026-11-10T17:17:15.501530+00:00 certfr-2026-avi-1497 https://db.gcve.eu/vuln/fkie_cve-2026-109799 fkie_cve-2026-109799 2026-11-10T17:17:15.501570+00:00

The SAP Cloud SDK for Python contains an improper cryptographic signature verification vulnerability (CWE-347) in IASContextProvider, the runtime-context provider registered by default via bootstrap(app).IASContextProvider extracted the app_tid, sap_gtid and user_uuid claims from the IAS JWT in the Authorization header using an unverified decoder and wrote them into the request-scoped RuntimeContext without validating the token signature. A remote caller could submit a self-signed JWT naming a victim tenant/user; the forged identity then propagated to every consumer of the runtime context:OTel span attributes (sap.tenancy.tenant_id, user.id) via RuntimeContextSpanProcessorlog records via IdentityLogFilteraudit events (tenant_id, user_initiator_id) via AuditClienttenant routing via CBCClientThis completes an earlier remediation that fixed the same unverified pattern in StarletteIASTelemetryMiddleware but did not cover IASContextProvider.

 https://db.gcve.eu/vuln/wid-sec-w-2026-4420 WID-SEC-W-2026-4420 — SAP Patch Day November 2026: Mehrere Schwachstellen 2026-11-10T17:17:15.501607+00:00

Ein Angreifer kann mehrere Schwachstellen in SAP Software ausnutzen, um Daten zu manipulieren, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um einen Cross-Site Scripting Angriff durchzuführen, um Sicherheitsvorkehrungen zu umgehen und um beliebigen Programmcode auszuführen.