# cve.now: SAP

The newest entries naming SAP as an affected vendor (up to 200), of 1,623 in all, 8 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-120013](https://cve.now/CVE-2026-120013.md): Path Traversal in Agent Memory Module of SAP Cloud SDK for Python (CVSS 7.5)
- [CVE-2026-120012](https://cve.now/CVE-2026-120012.md): Information Disclosure vulnerability in SAP Cloud SDK for AI(JavaScript) (CVSS 7.5)
- [CVE-2026-109799](https://cve.now/CVE-2026-109799.md): Improper verification of JWT signature in IASContextProvider leads to tenant/user identity spoofing ( sap-cloud-sdk (pip)) (CVSS 7.5)
- [CVE-2026-109797](https://cve.now/CVE-2026-109797.md): Cross-tenant sandbox takeover in SAP/astonish (CVSS 7.1)
- [CVE-2026-109805](https://cve.now/CVE-2026-109805.md): Weak Cryptography in SAP NetWeaver and ABAP Platform (Application Server ABAP) (CVSS 6.4)
- [CVE-2026-89125](https://cve.now/CVE-2026-89125.md): Insecure Storage of Sensitive Information in SAP Web Dispatcher and Internet Communication Manager (CVSS 6.0)
- [CVE-2026-120017](https://cve.now/CVE-2026-120017.md): Missing Authentication in SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider) (CVSS 10.0)
- [CVE-2026-120016](https://cve.now/CVE-2026-120016.md): Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Visual Composer (CVSS 6.1)
- [CVE-2026-120015](https://cve.now/CVE-2026-120015.md): Insufficient Input Validation in SAP Host Agent (CVSS 7.5)
- [CVE-2026-120014](https://cve.now/CVE-2026-120014.md): Cross-Site Request Forgery (CSRF) vulnerability in SAP Web Dispatcher and Internet Communication Manager (CVSS 7.6)
- [CVE-2026-120010](https://cve.now/CVE-2026-120010.md): Memory Corruption vulnerability in SAP NetWeaver Application Server (SAP Message Server) (CVSS 7.5)
- [CVE-2026-120009](https://cve.now/CVE-2026-120009.md): Code Injection vulnerability in SAP ABAP Developer Tools (AMDP Data Preview) (CVSS 7.2)
- [CVE-2026-120008](https://cve.now/CVE-2026-120008.md): Memory Corruption Vulnerability in SAP NetWeaver (Internet Graphics Service) (CVSS 8.2)
- [CVE-2026-109811](https://cve.now/CVE-2026-109811.md): Server-Side Request Forgery (SSRF) vulnerability in SAP NetWeaver and ABAP Platform (Application Server ABAP) (CVSS 6.5)
- [CVE-2026-109810](https://cve.now/CVE-2026-109810.md): CSS Injection vulnerability in SAP NetWeaver Application Server Java (Web Dynpro Java) (CVSS 6.1)
- [CVE-2026-109809](https://cve.now/CVE-2026-109809.md): Security Vulnerabilities SAP NetWeaver Application Server Java (NWDI Cockpit) (CVSS 6.5)
- [CVE-2026-109808](https://cve.now/CVE-2026-109808.md): Missing Authorisation Check in SAP Solution Tools Plug-In (ST-PI) (CVSS 3.1)
- [CVE-2026-109807](https://cve.now/CVE-2026-109807.md): Multiple Vulnerabilities in SAP NetWeaver (Internet Graphics Service) (CVSS 7.5)
- [CVE-2026-109806](https://cve.now/CVE-2026-109806.md): Multiple Vulnerabilities in SAP NetWeaver (Internet Graphics Service) (CVSS 7.5)
- [CVE-2026-109804](https://cve.now/CVE-2026-109804.md): Information Disclosure in SAP NetWeaver (SAP Message Server) (CVSS 7.5)
- [CVE-2026-109803](https://cve.now/CVE-2026-109803.md): Code Injection vulnerability in SAP NetWeaver Knowledge Management (XML Forms) (CVSS 9.9)
- [CVE-2026-109802](https://cve.now/CVE-2026-109802.md): Denial of Service (DoS) vulnerability in SAP NetWeaver Application Server for ABAP (CVSS 6.5)
- [CVE-2026-109801](https://cve.now/CVE-2026-109801.md): Security Vulnerabilities SAP NetWeaver Application Server Java (NWDI Cockpit) (CVSS 6.5)
- [CVE-2026-109800](https://cve.now/CVE-2026-109800.md): Memory Corruption vulnerability in SAP Web Dispatcher (CVSS 7.7)
- [CVE-2026-109798](https://cve.now/CVE-2026-109798.md): XML External Entity (XXE) Vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Intelligence) (CVSS 9.1)
- [CVE-2026-109796](https://cve.now/CVE-2026-109796.md): Multiple vulnerabilities in Application Server ABAP of SAP NetWeaver and ABAP Platform (CVSS 4.3)
- [CVE-2026-109795](https://cve.now/CVE-2026-109795.md): Missing authorization check in S4CRM (CVSS 9.9)
- [CVE-2026-109794](https://cve.now/CVE-2026-109794.md): Denial of Service vulnerability in SAP NetWeaver Application Server ABAP, ABAP Platform and SAP Web Dispatcher (CVSS 7.5)
- [CVE-2026-109793](https://cve.now/CVE-2026-109793.md): Denial of Service (DoS) vulnerability in SAP NetWeaver Application Server ABAP (Internet Communication Manager) and SAP Web Dispatcher (CVSS 7.5)
- [CVE-2026-89131](https://cve.now/CVE-2026-89131.md): Cross Site Request Forgery (CSRF) vulnerability in SAP NetWeaver Enterprise Portal (CVSS 4.3)
- [CVE-2026-89129](https://cve.now/CVE-2026-89129.md): Server-Side Request Forgery in SAP NetWeaver AS Java (Web Services) (CVSS 5.8)
- [CVE-2026-89128](https://cve.now/CVE-2026-89128.md): Broken Access Control in SAP NetWeaver AS Java (Process Integration Test Tool) (CVSS 5.3)
- [CVE-2026-89126](https://cve.now/CVE-2026-89126.md): Memory Corruption vulnerability in SAP Web Dispatcher (CVSS 10.0)
- [CVE-2026-89119](https://cve.now/CVE-2026-89119.md): Cross-Site Request Forgery (CSRF) vulnerability in SAP Web Dispatcher and Internet Communication Manager (CVSS 9.6)
- [CVE-2026-89115](https://cve.now/CVE-2026-89115.md): Information Disclosure vulnerability in SAP Start Service and SAP Microsoft Management Console (CVSS 4.4)
- [CVE-2026-89114](https://cve.now/CVE-2026-89114.md): Missing Authentication check in SAP NetWeaver AS Java EDM Application (CVSS 7.5)
- [CVE-2026-89103](https://cve.now/CVE-2026-89103.md): Broken Access Control in SAP Gateway (CVSS 10.0)
- [CVE-2026-76973](https://cve.now/CVE-2026-76973.md): Memory Corruption vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform (SAP Message Server) (CVSS 7.5)
- [CVE-2026-76970](https://cve.now/CVE-2026-76970.md): Memory Corruption vulnerability in Application Server ABAP for SAP NetWeaver and ABAP Platform (CVSS 7.5)
- [CVE-2026-76966](https://cve.now/CVE-2026-76966.md): Multiple vulnerabilities in Application Server ABAP of SAP NetWeaver and ABAP Platform (CVSS 8.9)
- [CVE-2026-76965](https://cve.now/CVE-2026-76965.md): OS Command Injection vulnerability in ABAP Application Server for SAP NetWeaver and ABAP Platform (CVSS 9.9)
- [CVE-2026-76964](https://cve.now/CVE-2026-76964.md): Memory Corruption Vulnerability in SAP NetWeaver AS ABAP (Internet Communication Manager) (CVSS 10.0)
- [CVE-2026-89124](https://cve.now/CVE-2026-89124.md): Missing Authorization Check in SAP Global Trade Services, edition for SAP HANA (Display Product Catalog Based on Customs Declaration) (CVSS 4.3)
- [CVE-2026-89122](https://cve.now/CVE-2026-89122.md): Open Redirect Vulnerability in SAP NetWeaver Enterprise Portal (CVSS 6.1)
- [CVE-2026-89121](https://cve.now/CVE-2026-89121.md): Missing Authorization Check in SAP S/4HANA (Linear Asset Management RAP Business Object) (CVSS 4.7)
- [CVE-2026-89120](https://cve.now/CVE-2026-89120.md): Missing authorization check in SAP ABAP Platform (CVSS 7.1)
- [CVE-2026-89118](https://cve.now/CVE-2026-89118.md): Information Disclosure vulnerability in SAP NetWeaver Enterprise Portal (CVSS 5.3)
- [CVE-2026-89117](https://cve.now/CVE-2026-89117.md): Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal (CVSS 6.1)
- [CVE-2026-89116](https://cve.now/CVE-2026-89116.md): OS Command Injection in Yeoman-UI / Application Wizard Extension for VS Code (CVSS 5.9)
- [CVE-2026-89113](https://cve.now/CVE-2026-89113.md): SQL Injection vulnerability in SAP Commerce Cloud (OOTB Code) (CVSS 8.8)
- [CVE-2026-89112](https://cve.now/CVE-2026-89112.md): Broken Access Control in CLA-Assistant � CLA Signature PII Disclosure (CVSS 6.5)
- [CVE-2026-89111](https://cve.now/CVE-2026-89111.md): OAuth2 SSRF vulnerability in SAP Cloud SDK for Python (CVSS 10.0)
- [CVE-2026-89110](https://cve.now/CVE-2026-89110.md): Broken Access Control in SAP NetWeaver Visual Composer (CVSS 9.9)
- [CVE-2026-89108](https://cve.now/CVE-2026-89108.md): Missing Authorization check in SAP Manufacturing Integration and Intelligence (Configuration Service) (CVSS 9.1)
- [CVE-2026-89107](https://cve.now/CVE-2026-89107.md): Code Injection vulnerability in SAP S/4HANA (Manage Substitution/Validation Rules) (CVSS 9.9)
- [CVE-2026-89106](https://cve.now/CVE-2026-89106.md): Cross Site Scripting (XSS) vulnerability in SAPUI5 (CVSS 4.4)
- [CVE-2026-89105](https://cve.now/CVE-2026-89105.md): Improper Authentication in HybridTokenAuthenticator of SAP/cloud-security-services-integration-library (CVSS 4.2)
- [CVE-2026-76976](https://cve.now/CVE-2026-76976.md): Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML) (CVSS 5.4)
- [CVE-2026-76975](https://cve.now/CVE-2026-76975.md): Cross-Site Scripting (XSS) vulnerability in SAPUI5 (Support Assistant Overlay) (CVSS 6.1)
- [CVE-2026-76972](https://cve.now/CVE-2026-76972.md): Cross-Site Scripting (XSS) vulnerability in SAP Manufacturing Integration and Intelligence (CVSS 6.5)
- [CVE-2026-58249](https://cve.now/CVE-2026-58249.md): Memory Corruption vulnerability in SAP NetWeaver and SAP Web Dispatcher (Internet Communication Manager) (CVSS 7.5)
- [CVE-2026-58242](https://cve.now/CVE-2026-58242.md): Improper Authorization check in SAP Cloud Connector (CVSS 3.5)
- [CVE-2026-76974](https://cve.now/CVE-2026-76974.md): Information Disclosure vulnerability in SAP Fiori Launchpad (CVSS 5.3)
- [CVE-2026-76977](https://cve.now/CVE-2026-76977.md): Clickjacking vulnerability in SAPUI5(Frame Options Allowlist) (CVSS 4.3)
- [CVE-2026-76971](https://cve.now/CVE-2026-76971.md): Server-Side Request Forgery in SAP Manufacturing Integration and Intelligence (CVSS 6.5)
- [CVE-2026-76969](https://cve.now/CVE-2026-76969.md): Credential disclosure in multitenant applications using SAP Cloud Application Programming Model (CAP) (CVSS 9.4)
- [CVE-2026-76968](https://cve.now/CVE-2026-76968.md): Information Disclosure vulnerability in SAP Web Dispatcher, Internet Communication Manager and SAP Content Server (CVSS 6.5)
- [CVE-2026-76967](https://cve.now/CVE-2026-76967.md): Insecure Deserialization in SAP NetWeaver Business Client (CVSS 7.8)
- [CVE-2026-76963](https://cve.now/CVE-2026-76963.md): Missing Authorization Check in Application Server ABAP of SAP NetWeaver and ABAP Platform (CVSS 4.3)
- [CVE-2026-76962](https://cve.now/CVE-2026-76962.md): Missing Authorization check in SAP S/4HANA (Manage Bank Chains app) (CVSS 4.3)
- [CVE-2026-76961](https://cve.now/CVE-2026-76961.md): Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4HANA (Finance for Advanced Payment Management) (CVSS 3.5)
- [CVE-2026-76960](https://cve.now/CVE-2026-76960.md): Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4HANA (Finance for Advanced Payment Management) (CVSS 3.5)
- [CVE-2026-76959](https://cve.now/CVE-2026-76959.md): Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4HANA (Finance for Advanced Payment Management) (CVSS 4.6)
- [CVE-2026-76958](https://cve.now/CVE-2026-76958.md): XML External Entity (XXE) Vulnerability in SAP Integration Suite (CVSS 8.5)
- [CVE-2026-66768](https://cve.now/CVE-2026-66768.md): Improper Access Control in SAP NetWeaver (SAP GUI for Java) (CVSS 9.0)
- [CVE-2026-66767](https://cve.now/CVE-2026-66767.md): Memory Corruption vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform (CVSS 7.7)
- [CVE-2026-58240](https://cve.now/CVE-2026-58240.md): Missing Authentication check in SAP NetWeaver (Message Server) (CVSS 9.8)
- [CVE-2026-58234](https://cve.now/CVE-2026-58234.md): Denial of Service vulnerability in SAP Process Integration (SOAP Adapter) (CVSS 2.2)
- [CVE-2026-44766](https://cve.now/CVE-2026-44766.md): SQL Injection vulnerability in SAP S/4HANA (Intercompany Matching and Reconciliation) (CVSS 6.5)
- [CVE-2026-44756](https://cve.now/CVE-2026-44756.md): Memory Corruption vulnerability in SAP Extended Passport (EPP) Processing (CVSS 10.0)
- [CVE-2026-66766](https://cve.now/CVE-2026-66766.md): Denial of Service (DoS) in SAP S/4HANA (Manage Supply Protection) (CVSS 7.5)
- [CVE-2026-58231](https://cve.now/CVE-2026-58231.md): Improper Authorization in SAP Commerce Cloud (Data Hub Adapter) (CVSS 10.0)
- [CVE-2026-66779](https://cve.now/CVE-2026-66779.md): Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (CVSS 6.3)
- [CVE-2026-66778](https://cve.now/CVE-2026-66778.md): Multiple vulnerabilities in SAP Business AI Platform (Approuter) (CVSS 5.3)
- [CVE-2026-66777](https://cve.now/CVE-2026-66777.md): Multiple vulnerabilities in SAP Business AI Platform (Approuter) (CVSS 5.9)
- [CVE-2026-66776](https://cve.now/CVE-2026-66776.md): Multiple vulnerabilities in SAP Business AI Platform (Approuter) (CVSS 5.9)
- [CVE-2026-66775](https://cve.now/CVE-2026-66775.md): Multiple vulnerabilities in SAP Business AI Platform (Approuter) (CVSS 4.3)
- [CVE-2026-66774](https://cve.now/CVE-2026-66774.md): Multiple vulnerabilities in SAP Business AI Platform (Approuter) (CVSS 3.7)
- [CVE-2026-66773](https://cve.now/CVE-2026-66773.md): Server-controlled \`\_\_next\` URL is not checking cross-origin (CVSS 5.9)
- [CVE-2026-66772](https://cve.now/CVE-2026-66772.md): Missing Authorization Check in SAP BusinessObjects Business Intelligence Platform (Admin Tools) (CVSS 4.3)
- [CVE-2026-66771](https://cve.now/CVE-2026-66771.md): Cross Site Scripting (XSS) vulnerability in SAPUI5 (CVSS 6.1)
- [CVE-2026-66770](https://cve.now/CVE-2026-66770.md): SQL Injection vulnerability in SAP Social Intelligence (CVSS 6.3)
- [CVE-2026-66764](https://cve.now/CVE-2026-66764.md): Missing Authorization check in SAP S/4 HANA (Reprocess Bank Statement Items) (CVSS 4.3)
- [CVE-2026-66763](https://cve.now/CVE-2026-66763.md): Credentials disclosure in SAP BusinessObjects Business Intelligence Platform (Central Management Server) (CVSS 7.9)
- [CVE-2026-66761](https://cve.now/CVE-2026-66761.md): Multiple vulnerabilities in SAP Business AI Platform (Approuter) (CVSS 4.3)
- [CVE-2026-66760](https://cve.now/CVE-2026-66760.md): Multiple vulnerabilities in SAP Business AI Platform (Approuter) (CVSS 6.4)
- [CVE-2026-58248](https://cve.now/CVE-2026-58248.md): XML External Entity Injection in SAP BusinessObjects Business Intelligence (CVSS 6.5)
- [CVE-2026-58247](https://cve.now/CVE-2026-58247.md): Memory Corruption vulnerability in SAP ABAP Platform (CVSS 5.3)
- [CVE-2026-58245](https://cve.now/CVE-2026-58245.md): Hard-coded Credentials in SAP Advanced Planning and Optimization (Model Mix Planning) (CVSS 3.8)
- [CVE-2026-58244](https://cve.now/CVE-2026-58244.md): Missing Authorization Check in SAP Manufacturing Integration and Intelligence (MII) (CVSS 4.3)
- [CVE-2026-58243](https://cve.now/CVE-2026-58243.md): Privilege Escalation vulnerability in SAP ABAP Developer Tools (CVSS 8.8)
- [CVE-2026-58241](https://cve.now/CVE-2026-58241.md): Missing Authorization Check in SAP NetWeaver and ABAP Platform (Change and Transport System - Customer Transport Integration Wizard) (CVSS 4.2)
- [CVE-2026-58239](https://cve.now/CVE-2026-58239.md): Multiple vulnerabilities in SAP Business AI Platform (Approuter) (CVSS 3.7)
- [CVE-2026-58238](https://cve.now/CVE-2026-58238.md): Multiple vulnerabilities in SAP Business AI Platform (Approuter) (CVSS 5.9)
- [CVE-2026-58237](https://cve.now/CVE-2026-58237.md): Multiple vulnerabilities in SAP Business AI Platform (Approuter) (CVSS 5.9)
- [CVE-2026-58236](https://cve.now/CVE-2026-58236.md): OS Command Injection vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform (CVSS 5.5)
- [CVE-2026-58235](https://cve.now/CVE-2026-58235.md): Use of Vulnerable Third-Party Component in SAP NetWeaver AS Java (Adobe Document Services) (CVSS 6.3)
- [CVE-2026-58230](https://cve.now/CVE-2026-58230.md): Multiple vulnerabilities in SAP Business AI Platform (Approuter) (CVSS 7.0)
- [CVE-2026-44765](https://cve.now/CVE-2026-44765.md): Missing Authorization Check in SAP Manufacturing Integration and Intelligence (CVSS 7.3)
- [CVE-2026-44764](https://cve.now/CVE-2026-44764.md): Missing Authorization Check in SAP Manufacturing Integration and Intelligence (CVSS 7.3)
- [CVE-2026-44763](https://cve.now/CVE-2026-44763.md): Directory Traversal vulnerability in SAP Manufacturing Integration and Intelligence (CVSS 7.6)
- [CVE-2026-44762](https://cve.now/CVE-2026-44762.md): Security Misconfiguration in SAP Data Services Management Console (CVSS 3.7)
- [CVE-2026-44758](https://cve.now/CVE-2026-44758.md): Code Injection vulnerability in Manufacturing Integration and Intelligence (CVSS 9.1)
- [CVE-2026-40130](https://cve.now/CVE-2026-40130.md): Memory Corruption vulnerability in SAPSPrint Service (CVSS 5.3)
- [CVE-2026-34265](https://cve.now/CVE-2026-34265.md): Memory Corruption vulnerability in Application Server ABAP for SAP NetWeaver and ABAP Platform (CVSS 9.8)
- [CVE-2026-58246](https://cve.now/CVE-2026-58246.md): Information Disclosure vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform (CVSS 4.3)
- [CVE-2026-44767](https://cve.now/CVE-2026-44767.md): Allowlist Bypass in setThemeRoot() Enables Cross-Origin CSS Injection (CVSS 6.1)
- [CVE-2026-58233](https://cve.now/CVE-2026-58233.md): Remote Code Execution vulnerability in SAP Change and Transport System Attach Tool (ctsattach) (CVSS 7.6)
- [CVE-2026-44771](https://cve.now/CVE-2026-44771.md): Missing Authorization check in SAP S/4HANA (Draft operation) (CVSS 4.3)
- [CVE-2026-44770](https://cve.now/CVE-2026-44770.md): Missing Authorization check in SAP S/4 HANA (Create Single Payment) (CVSS 4.3)
- [CVE-2026-44769](https://cve.now/CVE-2026-44769.md): SQL Injection vulnerability in SAP S/4HANA Project Management (PPM-PRO) (CVSS 5.5)
- [CVE-2026-44768](https://cve.now/CVE-2026-44768.md): Security misconfiguration in SAP WebClient UI (CVSS 4.1)
- [CVE-2026-44761](https://cve.now/CVE-2026-44761.md): Insecure Sample Credentials in SAP Commerce Cloud (CVSS 9.1)
- [CVE-2026-44760](https://cve.now/CVE-2026-44760.md): Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (applications based on Business Server Pages) (CVSS 4.7)
- [CVE-2026-44759](https://cve.now/CVE-2026-44759.md): Cross Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal (CVSS 6.1)
- [CVE-2026-44753](https://cve.now/CVE-2026-44753.md): Information Disclosure vulnerability in SAP HANA Extended Application Services classic model (User Self Service) (CVSS 3.7)
- [CVE-2026-44752](https://cve.now/CVE-2026-44752.md): Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server Java(Configuration Wizard) (CVSS 8.2)
- [CVE-2026-44747](https://cve.now/CVE-2026-44747.md): Memory Corruption vulnerability in SAP NetWeaver Application Server ABAP (CVSS 9.9)
- [CVE-2026-44745](https://cve.now/CVE-2026-44745.md): Open Redirect vulnerability in SAP Approuter (CVSS 8.1)
- [CVE-2026-27690](https://cve.now/CVE-2026-27690.md): HTTP Request Smuggling in SAP Approuter (CVSS 9.1)
- [CVE-2026-0487](https://cve.now/CVE-2026-0487.md): DLL Hijacking vulnerability in SAProuter on Microsoft Windows (CVSS 8.4)
- [CVE-2026-44757](https://cve.now/CVE-2026-44757.md): Cross-Site Scripting (XSS) vulnerability in SAP Wily Introscope Enterprise Manager (CVSS 4.7)
- [CVE-2026-44755](https://cve.now/CVE-2026-44755.md): Email Spoofing vulnerability in SAP Business Objects Business Intelligence Platform (CVSS 4.3)
- [CVE-2026-44754](https://cve.now/CVE-2026-44754.md): Missing caller identification check-in for ODP Data Replication APIs (CVSS 6.6)
- [CVE-2026-44751](https://cve.now/CVE-2026-44751.md): Missing Authorization check in Application Server ABAP of SAP NetWeaver and ABAP Platform (CVSS 7.1)
- [CVE-2026-44750](https://cve.now/CVE-2026-44750.md): Missing Authorization check in SAP MDG (Review Match Groups Application) (CVSS 4.3)
- [CVE-2026-44748](https://cve.now/CVE-2026-44748.md): XML Signature Wrapping in SAML Authentication in SAP NetWeaver AS ABAP and ABAP Platform (CVSS 9.9)
- [CVE-2026-44746](https://cve.now/CVE-2026-44746.md): Reflected Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS Java (JDBC Test Servlet) (CVSS 6.1)
- [CVE-2026-44744](https://cve.now/CVE-2026-44744.md): SQL Injection vulnerability in SAP S/4HANA (CVSS 6.5)
- [CVE-2026-44743](https://cve.now/CVE-2026-44743.md): Security Misconfiguration vulnerability in SAP Business Objects (CVSS 3.7)
- [CVE-2026-40128](https://cve.now/CVE-2026-40128.md): Directory Traversal vulnerability in SAP NetWeaver Application Server Java (Web Container) (CVSS 9.0)
- [CVE-2026-27671](https://cve.now/CVE-2026-27671.md): Memory Corruption vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform (CVSS 9.8)
- [CVE-2026-24315](https://cve.now/CVE-2026-24315.md): Path Traversal Vulnerability in SAP Fiori (launchpad) (CVSS 4.2)
- [CVE-2026-44749](https://cve.now/CVE-2026-44749.md): Information Disclosure vulnerability in SAP Gateway (CVSS 4.3)
- [CVE-2026-27680](https://cve.now/CVE-2026-27680.md): CSS Injection vulnerability in SAP NetWeaver Application Server ABAP (CVSS 3.1)
- [CVE-2026-40137](https://cve.now/CVE-2026-40137.md): Cross-Site Scripting (XSS) vulnerability in Business Server Pages Application (TAF\_APPLAUNCHER) (CVSS 6.1)
- [CVE-2026-40136](https://cve.now/CVE-2026-40136.md): Denial of service (DoS) in SAP Financial Consolidation (CVSS 4.3)
- [CVE-2026-40135](https://cve.now/CVE-2026-40135.md): OS Command Injection vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform (CVSS 6.5)
- [CVE-2026-40134](https://cve.now/CVE-2026-40134.md): Missing Authorization Check in SAP Incentive and Commission Management (CVSS 4.3)
- [CVE-2026-40133](https://cve.now/CVE-2026-40133.md): Missing Authorization check in SAP S/4HANA Condition Maintenance (CVSS 6.3)
- [CVE-2026-40132](https://cve.now/CVE-2026-40132.md): Missing Authorization Check in SAP Strategic Enterprise Management (BSP application Balanced Scorecard Wizard) (CVSS 5.4)
- [CVE-2026-40131](https://cve.now/CVE-2026-40131.md): SQL Injection vulnerability in SAP HANA Deployment Infrastructure (HDI) deploy library (CVSS 3.4)
- [CVE-2026-40129](https://cve.now/CVE-2026-40129.md): Code Injection vulnerability in SAP Application Server ABAP for SAP NetWeaver and ABAP Platform (CVSS 4.3)
- [CVE-2026-34263](https://cve.now/CVE-2026-34263.md): Missing authentication check in SAP Commerce cloud configuration (CVSS 9.6)
- [CVE-2026-34260](https://cve.now/CVE-2026-34260.md): SQL injection vulnerability in SAP S/4HANA (SAP Enterprise Search for ABAP) (CVSS 9.6)
- [CVE-2026-34259](https://cve.now/CVE-2026-34259.md): OS Command Injection Vulnerability in SAP Forecasting & Replenishment (CVSS 8.2)
- [CVE-2026-34258](https://cve.now/CVE-2026-34258.md): Content Spoofing vulnerability in SAPUI5 (Search UI) (CVSS 4.7)
- [CVE-2026-27682](https://cve.now/CVE-2026-27682.md): Reflected Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (Applications based on Business Server Pages) (CVSS 4.7)
- [CVE-2026-0502](https://cve.now/CVE-2026-0502.md): Cross Site Request Forgery (CSRF) in SAP BusinessObjects Business Intelligence Platform (CVSS 5.4)
- [CVE-2026-34264](https://cve.now/CVE-2026-34264.md): Information Disclosure vulnerability in SAP Human Capital Management for SAP S/4HANA (CVSS 6.5)
- [CVE-2026-34262](https://cve.now/CVE-2026-34262.md): Information Disclosure Vulnerability in SAP HANA Cockpit and HANA Database Explorer (CVSS 5.0)
- [CVE-2026-34261](https://cve.now/CVE-2026-34261.md): Missing Authorization check in SAP Business Analytics and SAP Content Management (CVSS 6.5)
- [CVE-2026-34257](https://cve.now/CVE-2026-34257.md): Open Redirect vulnerability in SAP NetWeaver Application Server ABAP (CVSS 6.1)
- [CVE-2026-34256](https://cve.now/CVE-2026-34256.md): Missing Authorization check in SAP ERP and SAP S/4 HANA (Private Cloud and On-Premise) (CVSS 7.1)
- [CVE-2026-27683](https://cve.now/CVE-2026-27683.md): Reflected cross site scripting vulnerability in SAP BusinessObjects Business Intelligence Platform (CVSS 4.1)
- [CVE-2026-27681](https://cve.now/CVE-2026-27681.md): SQL Injection vulnerability in SAP Business Planning and Consolidation and SAP Business Warehouse (CVSS 9.9)
- [CVE-2026-27679](https://cve.now/CVE-2026-27679.md): Missing Authorization check in SAP S/4HANA Frontend OData Service (Manage Reference Structures) (CVSS 6.5)
- [CVE-2026-27678](https://cve.now/CVE-2026-27678.md): Missing Authorization check in SAP S/4HANA Backend OData Service (Manage Reference Structures) (CVSS 6.5)
- [CVE-2026-27677](https://cve.now/CVE-2026-27677.md): Missing Authorization check in SAP S/4HANA OData Service (Manage Reference Equipment) (CVSS 6.5)
- [CVE-2026-27676](https://cve.now/CVE-2026-27676.md): Missing Authorization check in SAP S/4HANA OData Service (Manage Technical Object Structures) (CVSS 4.3)
- [CVE-2026-27675](https://cve.now/CVE-2026-27675.md): Code Injection vulnerability in SAP Landscape Transformation (CVSS 2.0)
- [CVE-2026-27674](https://cve.now/CVE-2026-27674.md): Code Injection vulnerability in SAP NetWeaver Application Server Java (Web Dynpro Java) (CVSS 6.1)
- [CVE-2026-27673](https://cve.now/CVE-2026-27673.md): Missing Authorization Check in SAP S/4HANA (Private Cloud and On-Premise) (CVSS 4.9)
- [CVE-2026-27672](https://cve.now/CVE-2026-27672.md): Missing Authorization check in Material Master Application (CVSS 4.3)
- [CVE-2026-24318](https://cve.now/CVE-2026-24318.md): Insecure Session Management vulnerability in SAP BusinessObjects Business Intelligence Platform (CVSS 4.2)
- [CVE-2026-0512](https://cve.now/CVE-2026-0512.md): Cross-Site Scripting (XSS) vulnerability in SAP Supplier Relationship Management (SICF Handler in SRM Catalog) (CVSS 6.1)
- [CVE-2026-27689](https://cve.now/CVE-2026-27689.md): Denial of service (DOS) in SAP Supply Chain Management (CVSS 7.7)
- [CVE-2026-27688](https://cve.now/CVE-2026-27688.md): Missing Authorization check in SAP NetWeaver Application Server for ABAP (CVSS 5.0)
- [CVE-2026-27687](https://cve.now/CVE-2026-27687.md): Missing Authorization check in SAP S/4HANA HCM Portugal and SAP ERP HCM Portugal (CVSS 5.8)
- [CVE-2026-27686](https://cve.now/CVE-2026-27686.md): Missing Authorization check in SAP Business Warehouse (Service API) (CVSS 5.9)
- [CVE-2026-27685](https://cve.now/CVE-2026-27685.md): Insecure Deserialization in SAP NetWeaver Enterprise Portal Administration (CVSS 9.1)
- [CVE-2026-27684](https://cve.now/CVE-2026-27684.md): SQL Injection Vulnerability in SAP NetWeaver (Feedback Notification) (CVSS 6.4)
- [CVE-2026-24317](https://cve.now/CVE-2026-24317.md): DLL Hijacking vulnerability in SAP GUI for Windows with active GuiXT (CVSS 5.0)
- [CVE-2026-24316](https://cve.now/CVE-2026-24316.md): Server-Side Request Forgery (SSRF) in SAP NetWeaver Application Server for ABAP (CVSS 6.4)
- [CVE-2026-24313](https://cve.now/CVE-2026-24313.md): Missing Authorization check in SAP Solution Tools Plug-In (ST-PI) (CVSS 5.0)
- [CVE-2026-24311](https://cve.now/CVE-2026-24311.md): Insecure Storage Protection vulnerability in SAP Customer Checkout 2.0 (CVSS 5.6)
- [CVE-2026-24310](https://cve.now/CVE-2026-24310.md): Missing Authorization check in SAP NetWeaver Application Server for ABAP (CVSS 3.5)
- [CVE-2026-24309](https://cve.now/CVE-2026-24309.md): Missing Authorization check in SAP NetWeaver Application Server for ABAP (CVSS 6.4)
- [CVE-2026-0489](https://cve.now/CVE-2026-0489.md): DOM-based Cross-Site Scripting (XSS) Vulnerability in SAP Business One (Job Service) (CVSS 6.1)
- [CVE-2026-24314](https://cve.now/CVE-2026-24314.md): Information Disclosure vulnerability in S/4HANA (Manage Payment Media) (CVSS 4.3)
- [CVE-2026-24328](https://cve.now/CVE-2026-24328.md): Open Redirection vulnerability in Business Server Pages Application (TAF\_APPLAUNCHER) (CVSS 6.1)
- [CVE-2026-24327](https://cve.now/CVE-2026-24327.md): Missing Authorization Check in SAP Strategic Enterprise Management (Balanced Scorecard in BSP Application) (CVSS 4.3)
- [CVE-2026-24326](https://cve.now/CVE-2026-24326.md): Missing authorization check in SAP S/4HANA Defense & Security (Disconnected Operations) (CVSS 4.3)
- [CVE-2026-24325](https://cve.now/CVE-2026-24325.md): Cross Site Scripting (XSS) vulnerability in SAP BusinessObjects Enterprise (Central Management Console) (CVSS 4.8)
- [CVE-2026-24324](https://cve.now/CVE-2026-24324.md): Denial of service (DOS) vulnerability in SAP BusinessObjects Business Intelligence Platform (AdminTools) (CVSS 6.5)
- [CVE-2026-24323](https://cve.now/CVE-2026-24323.md): Multiple vulnerabilities in BSP Applications of SAP Document Management System (CVSS 6.1)
- [CVE-2026-24322](https://cve.now/CVE-2026-24322.md): Missing Authorization check in SAP Solution Tools Plug-In (ST-PI) (CVSS 7.7)
- [CVE-2026-24321](https://cve.now/CVE-2026-24321.md): Information Disclosure vulnerability in SAP Commerce Cloud (CVSS 5.3)
- [CVE-2026-24320](https://cve.now/CVE-2026-24320.md): Memory Corruption vulnerability in SAP NetWeaver and ABAP Platform (Application Server ABAP) (CVSS 3.1)
- [CVE-2026-24319](https://cve.now/CVE-2026-24319.md): Information Disclosure Vulnerability in SAP Business One (B1 Client Memory Dump Files) (CVSS 5.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/sap
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.