CVE-2026-0504
Low · 3.8CVSS
3.8
EPSS
0.2%
Published
Jan 13, 2026
CISA due date
—
The record
Due to insufficient input handling, the SAP Identity Management REST interface allows an authenticated administrator to submit specially crafted malicious REST requests that are processed by JNDI operations without adequate input neutralization. This may lead to limited disclosure or modification of data, resulting in low impact on confidentiality and integrity, with no impact on application availability.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-106119 LangChain is a framework for building LLM-powered applications. CWE-943
- CVE-2026-105799 LangChain is a framework for building LLM-powered applications. CWE-943
- CVE-2026-88029 Improper neutralization of special elements in data query logic in the GridFS component… CWE-943
- CVE-2026-88030 Improper neutralization of special elements in data query logic in the GridFS component… CWE-943
- CVE-2026-85167 n8n before 2.35.4 and 2.36.x before 2.36.2 contain a query injection vulnerability in the… CWE-943
- CVE-2026-63138 Improper Neutralization of Special Elements in Data Query Logic (CWE-943) in Kibana can… CWE-943
- CVE-2026-79483 FastGPT Community Edition 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection in… CWE-943
- CVE-2026-78691 Improper Neutralization of Special Elements in Data Query Logic vulnerability in… CWE-943