https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-0513.htmlhttps://patchthecve.com/cve/CVE-2026-0513.htmlWed, 17 Jun 2026 10:10:52 +0000MEDIUM 4.7: Due to an Open Redirect Vulnerability in SAP Supplier Relationship Management (SICF Handler in SRM Catalog), an unauthenticated attacker could craft a malicious URL that, if accessed by a victim, redirects them to an attacker-controlled site.This causes low impact on integrity of the application. Cohttps://patchthecve.com/cve/CVE-2025-42920.htmlhttps://patchthecve.com/cve/CVE-2025-42920.htmlWed, 17 Jun 2026 09:23:14 +0000MEDIUM 6.1: Due to a Cross-Site Scripting (XSS) vulnerability in the SAP Supplier Relationship Management, an unauthenticated attacker could generate a malicious link and make it publicly accessible. If an authenticated victim clicks on the link, the injected input is processed during the page generation, resulhttps://patchthecve.com/cve/CVE-2025-30018.htmlhttps://patchthecve.com/cve/CVE-2025-30018.htmlWed, 17 Jun 2026 09:08:02 +0000HIGH 8.6: The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) allows an unauthenticated attacker to submit an application servlet request with a crafted XML file which when parsed, enables the attacker to access sensitive files and data. This vulnerability has a high impact on the applicatihttps://patchthecve.com/cve/CVE-2025-30012.htmlhttps://patchthecve.com/cve/CVE-2025-30012.htmlWed, 17 Jun 2026 09:08:02 +0000CRITICAL 10.0: The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) uses a deprecated java applet component, which allows an unauthenticated attacker to send malicious payload request in a specific encoding format. The servlet will then decode this malicious request which will result in deserialihttps://patchthecve.com/cve/CVE-2025-30011.htmlhttps://patchthecve.com/cve/CVE-2025-30011.htmlWed, 17 Jun 2026 09:08:02 +0000MEDIUM 5.3: The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) uses a deprecated java applet component within the affected SRM packages which allows an unauthenticated attacker to send an malicious request to the application, which could disclose the internal version details of the affected https://patchthecve.com/cve/CVE-2025-30010.htmlhttps://patchthecve.com/cve/CVE-2025-30010.htmlWed, 17 Jun 2026 09:08:01 +0000MEDIUM 6.1: The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) uses a deprecated java applet component within the affected SRM packages which allows an unauthenticated attacker to craft a malicious link, which when clicked by a victim, redirects the browser to a malicious site. On successfulhttps://patchthecve.com/cve/CVE-2025-30009.htmlhttps://patchthecve.com/cve/CVE-2025-30009.htmlWed, 17 Jun 2026 09:08:01 +0000MEDIUM 6.1: he Live Auction Cockpit in SAP Supplier Relationship Management (SRM) uses a deprecated java applet component within the affected SRM packages which allows an unauthenticated attacker to execute malicious script in the victim�s browser. This vulnerability has low impact on confidentiality and integr