CVE-2026-0511
published 2026-01-13CVE-2026-0511: SAP Fiori App Intercompany Balance Reconciliation does not perform necessary authorization checks for an authenticated user, resulting in escalation of…
PriorityP351high8.1CVSS 3.1
AVNACLPRLUINSUCHIHAN
EPSS
0.30%
22.8th percentile
SAP Fiori App Intercompany Balance Reconciliation does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This has high impact on confidentiality and integrity of the application ,availability is not impacted.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| sap_se | sap_fiori_app | — | — |
| sap_se | sap_fiori_app | — | — |
| sap_se | sap_fiori_app | — | — |
| sap_se | sap_fiori_app | — | — |
| sap_se | sap_fiori_app | — | — |
| sap_se | sap_fiori_app | — | — |
| sap_se | sap_fiori_app | — | — |
| sap_se | sap_fiori_app | — | — |
| sap_se | sap_fiori_app | — | — |
| sap_se | sap_fiori_app | — | — |
| sap_se | sap_fiori_app | — | — |
| sap_se | sap_fiori_app | — | — |
| sap_se | sap_fiori_app | — | — |
| sap_se | sap_fiori_app | — | — |
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
vendor_redhat3.3LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-jjvw-w74f-45qh: SAP Fiori App Intercompany Balance Reconciliation does not perform necessary authorization checks for an authenticated user, resulting in escalation o
ghsa_unreviewed·2026-01-13
CVE-2026-0511 [HIGH] CWE-862 GHSA-jjvw-w74f-45qh: SAP Fiori App Intercompany Balance Reconciliation does not perform necessary authorization checks for an authenticated user, resulting in escalation o
SAP Fiori App Intercompany Balance Reconciliation does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This has high impact on confidentiality and integrity of the application ,availability is not impacted.
Red Hat
vim: Vim: Denial of Service via Use-After-Free in JSON Decoding
vendor_redhat·2026-08-11·CVSS 3.3
CVE-2026-73071 [LOW] CWE-416 vim: Vim: Denial of Service via Use-After-Free in JSON Decoding
vim: Vim: Denial of Service via Use-After-Free in JSON Decoding
Vim is an open source, command line text editor. From 9.2.0511 until 9.2.0844, json_decode_item() in src/json.c can retain a stale pointer after json_decode_string() invokes channel_fill() to refill and free the current buffer, causing the error path to read freed memory instead of reader->js_buf + reader->js_used when an invalid JSON string spans buffers. This issue is fixed in version 9.2.0844.
A flaw was found in Vim. When processing an invalid JSON string that spans multiple buffers, the json_decode_item() function can retain a stale pointer. This can lead to the program attempting to read freed memory, potentially resulting in a denial of service for a local user.
Statement: Red Hat's shipped vim versions across all su
No detection rules found.
No public exploits indexed.
2026-01-13
Published