SAP vulnerabilities
Filtered catalog for this technology stack. Use KEV and EPSS sorting to prioritize — then open each CVE for remediation and version matching.
181 matching records
- Medium4.3Due to a missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker with basic privileges could execute a specific function module in ABAPCheck if you run itEPSS 0.24%Nov 11, 2025
- High7.3A flaw was identified in the X.Org X server’s X Keyboard (Xkb) extension where improper bounds checking in the XkbSetCompatMap() function can cause an unsigned short overflow.Check if you run itEPSS 0.30%Oct 30, 2025
- Medium4.3SAP S/4HANA (Manage Processing Rules - For Bank Statements) allows an authenticated attacker with basic privileges to delete conditions from any shared rule of any user by tamperinCheck if you run itEPSS 0.23%Oct 14, 2025
- Low3.0SAP Cloud Appliance Library Appliances allows an attacker with high privileges to leverage an insecure S/4HANA default profile setting in an existing SAP CAL appliances to gain accCheck if you run itEPSS 0.24%Oct 14, 2025
- Medium5.4Due to a Cross-Site Request Forgery (CSRF) vulnerability in SAP NetWeaver Application Server for ABAP, an authenticated attacker could initiate transactions directly via the sessioCheck if you run itEPSS 0.16%Oct 14, 2025
- Medium5.3SAP Commerce Cloud contains a path traversal vulnerability that may allow users to access web applications such as the Administration Console from addresses where the AdministratioCheck if you run itEPSS 0.43%Oct 14, 2025
- Medium4.3A vulnerability in SAP Financial Service Claims Management RFC function ICL_USER_GET_NAME_AND_ADDRESS allows user enumeration and potential disclosure of personal data through respCheck if you run itEPSS 0.34%Oct 14, 2025
- Medium5.3Due to the memory corruption vulnerability in SAP NetWeaver AS ABAP and ABAP Platform, an unauthenticated attacker can send a corrupted SAP Logon Ticket or SAP Assertion Ticket toCheck if you run itEPSS 0.37%Oct 14, 2025
- Medium5.4SAP Application Server for ABAP allows an authenticated attacker to store malicious JavaScript payloads which could be executed in victim user's browser when accessing the affectedCheck if you run itEPSS 0.23%Oct 14, 2025
- High7.5A flaw was found in QEMU.Check if you run itEPSS 0.86%Oct 3, 2025
- High7.5A flaw was found in the cookie date handling logic of the libsoup HTTP library, widely used by GNOME and other applications for web communication.Check if you run itEPSS 0.64%Sep 26, 2025
- Medium5.5A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and application crash.Check if you run itEPSS 0.17%Sep 25, 2025
- Medium4.3SAP BI Platform allows an attacker to modify the IP address of the LogonToken for the OpenDoc.Check if you run itEPSS 0.22%Sep 23, 2025
- Medium6.1Due to a Cross-Site Scripting (XSS) vulnerability in the SAP NetWeaver ABAP Platform, an unauthenticated attacker could generate a malicious link and make it publicly accessible.Check if you run itEPSS 0.23%Sep 9, 2025
- High8.5A flaw was found in the Udisks daemon, where it allows unprivileged users to create loop devices using the D-BUS system.Check if you run itEPSS 0.65%Aug 28, 2025
- High8.1SAP NetWeaver Application Server ABAP (BIC Document) allows an authenticated attacker to craft a request that, when submitted to a BIC Document application, could cause a memory coCheck if you run itEPSS 0.42%Aug 12, 2025
- Medium6.1SAP NetWeaver Application Server ABAP (BIC Document) allows an unauthenticated attacker to craft a URL link which, when accessed on the BIC Document application, embeds a maliciousCheck if you run itEPSS 0.26%Aug 12, 2025
- Critical9.9Improper Control of Generation of Code ('Code Injection')Patch nowKEVEPSS 1.65%Aug 12, 2025
- Low3.5Due to a missing authorization check in SAP Cloud Connector, an attacker on an adjacent network with low privileges could send a crafted request to the endpoint responsible for tesCheck if you run itEPSS 0.46%Aug 12, 2025
- High8.8Due to broken authorization, SAP Business One (SLD) allows an authenticated attacker to gain administrator privileges of a database by invoking the corresponding API.�As a result ,Check if you run itEPSS 0.49%Aug 12, 2025
- Critical9.9SAP Landscape Transformation (SLT) allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC.Check if you run itEPSS 0.70%Aug 12, 2025
- Medium4.9Due to a missing authorization check in the ABAP Platform, an authenticated user with elevated privileges could bypass authorization restrictions for common transactions by leveragCheck if you run itEPSS 0.32%Aug 12, 2025
- Medium6.1Due to a Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver ABAP Platform, an unauthenticated attacker could generate a malicious link and make it publicly accessible.Check if you run itEPSS 0.23%Aug 12, 2025
- Medium6.9Due to directory traversal vulnerability in SAP S/4HANA (Bank Communication Management), an attacker with high privileges and access to a specific transaction and method in Bank CoCheck if you run itEPSS 0.95%Aug 12, 2025
- Medium6.1SAP NetWeaver Application Server ABAP has HTML injection vulnerability.Check if you run itEPSS 0.21%Aug 12, 2025