SAP vulnerabilities
Filtered catalog for this technology stack. Use KEV and EPSS sorting to prioritize — then open each CVE for remediation and version matching.
181 matching records
- High8.8SAP Commerce Cloud does not sufficiently validate certain user-supplied input before it is incorporated into a database query.Check if you run itEPSS 0.45%Oct 13, 2026
- Critical10.0The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications.Check if you run itEPSS 0.37%Oct 13, 2026
- Critical9.9SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality.Check if you run itEPSS 0.40%Oct 13, 2026
- UnknownImproper Control of Generation of Code ('Code Injection')Patch nowKEVEPSS 0.85%Aug 14, 2026
- High7.6SAP Manufacturing Integration and Intelligence allows a privileged attacker to exploit insufficient file path validation in certain functions using specially crafted input.Check if you run itEPSS 0.40%Aug 11, 2026
- Medium5.3SAP SAPSPrint Service has memory corruption vulnerabilities in the handling of certain commands.Check if you run itEPSS 0.47%Aug 11, 2026
- Critical9.8SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to exploit logical errors in DIAG protocol parsing, resulting in memory corruption.Check if you run itEPSS 0.64%Aug 11, 2026
- Medium4.3Due to improper input handling under certain conditions, SAP NetWeaver Application Server ABAP allows an attacker to inject custom Cascading Style Sheets (CSS) data in…Check if you run itEPSS 0.17%May 14, 2026
- Medium4.3SAP Financial Consolidation allows an authenticated attacker to disconnect other users by terminating their sessions temporarily preventing access.Check if you run itEPSS 0.29%May 12, 2026
- Medium6.5An OS Command Injection vulnerability exists in the SAP NetWeaver Application Server for ABAP and ABAP Platform that allows an authenticated attacker with administrati…Check if you run itEPSS 1.40%May 12, 2026
- Medium6.1Due to a reflected cross-site scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (Applications based on Business Server Pages), an unauthenticated…Check if you run itEPSS 0.22%May 12, 2026
- Medium6.5During authorization checks in SAP Human Capital Management for SAP S/4HANA, the system returns specific messages.Check if you run itEPSS 0.27%Apr 14, 2026
- Medium4.3Information Disclosure Vulnerability in SAP HANA Cockpit and HANA Database ExplorerCheck if you run itEPSS 0.30%Apr 14, 2026
- Medium6.1Due to an Open Redirect vulnerability in SAP NetWeaver Application Server ABAP, an unauthenticated attacker could craft malicious URL that, if accessed by a victim, th…Check if you run itEPSS 0.15%Apr 14, 2026
- Medium4.1SAP BusinessObjects Business Intelligence application allows an authenticated attacker to inject malicious JavaScript payloads through crafted URLs.Check if you run itEPSS 0.18%Apr 14, 2026
- Medium6.5Due to missing authorization checks in the SAP S/4HANA frontend OData Service (Manage Reference Structures), an attacker could update and delete child entities via exp…Check if you run itEPSS 0.18%Apr 14, 2026
- Medium6.1Due to a Code Injection vulnerability in SAP NetWeaver Application Server Java (Web Dynpro Java), an unauthenticated attacker could supply crafted input that is interp…Check if you run itEPSS 0.19%Apr 14, 2026
- Medium5.0Due to a missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker with user privileges could read Database Analyzer Log File…Check if you run itEPSS 0.24%Mar 10, 2026
- Medium5.8Due to missing authorization check in SAP S/4HANA HCM Portugal and SAP ERP HCM Portugal, a user with high privileges could access sensitive data belonging to another company.Check if you run itEPSS 0.27%Mar 10, 2026
- Medium5.9Due to a Missing Authorization Check in SAP Business Warehouse (Service API), an authenticated attacker could perform unauthorized actions via an affected RFC function module.Check if you run itEPSS 0.23%Mar 10, 2026
- Medium5.0SAP GUI for Windows allows DLL files to be loaded from arbitrary directories within the application.Check if you run itEPSS 0.18%Mar 10, 2026
- Medium6.4SAP NetWeaver Application Server for ABAP provides an ABAP Report for testing purposes, which allows to send HTTP requests to arbitrary internal or external endpoints.Check if you run itEPSS 0.17%Mar 10, 2026
- Medium5.6The SAP Customer Checkout application exhibits certain design characteristics that involve locally storing operational data using reversible protection mechanisms.Check if you run itEPSS 0.09%Mar 10, 2026
- Medium4.3Due to missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker could execute specific ABAP function module and read the sen…Check if you run itEPSS 0.20%Mar 10, 2026
- Medium6.4Due to missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker could execute specific ABAP function module to read, modify…Check if you run itEPSS 0.21%Mar 10, 2026