sap

Latest CVEs · RSS

• CVE-2026-89124 2026-10-13 · CVSS 4.3
  Display Product Catalog Based on Customs Declaration application does not perform sufficient authorization checks within certain functionality, allowing an auth
• CVE-2026-89122 2026-10-13 · CVSS 6.1
  SAP NetWeaver Enterprise Portal does not sufficiently validate input to a certain portal component. An unauthenticated attacker could craft a malicious link tha
• CVE-2026-89121 2026-10-13 · CVSS 4.7
  SAP S/4HANA does not perform sufficient instance-level authorization checks for certain modification operations on associated business object data. An attacker
• CVE-2026-89120 2026-10-13 · CVSS 7.1
  A regression caused by an API change in SAP ABAP Platform reintroduces a previously fixed authorization weakness. The session manager can be opened in single tr
• CVE-2026-89118 2026-10-13 · CVSS 5.3
  SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to access restricted resources and retrieve non-critical application information, which leads
• CVE-2026-89117 2026-10-13 · CVSS 6.1
  SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server res
• CVE-2026-89116 2026-10-13 · CVSS 5.9
  The affected code used child_process.execSync with a shell string for generator installation and uninstallation. This allowed an attacker to execute arbitrary O
• CVE-2026-89113 2026-10-13 · CVSS 8.8
  SAP Commerce Cloud does not sufficiently validate certain user-supplied input before it is incorporated into a database query. An authenticated user could send
• CVE-2026-89112 2026-10-13 · CVSS 6.5
  The admin API endpoint used to retrieve CLA signature records does not consistently enforce the required authorization checks when the target organisation is sp
• CVE-2026-89111 2026-10-13 · CVSS 10.0
  The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the tenant_subdomain parame
• CVE-2026-89110 2026-10-13 · CVSS 9.9
  SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality. An attacker with low privileges could invoke int
• CVE-2026-89108 2026-10-13 · CVSS 9.1
  SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative functionality. An attacker w
• CVE-2026-89107 2026-10-13 · CVSS 9.9
  SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validate input processed by rule definition functionality that utilizes a domain-specif
• CVE-2026-89106 2026-10-13 · CVSS 4.4
  SAP UI5 does not perform sufficient input validation under certain configurations. An attacker with low privileges could submit specially crafted content that i
• CVE-2026-89105 2026-10-13 · CVSS 4.2
  The HybridTokenAuthenticator component of the SAP/cloud-security-services-integration-library accepts tokens from unintended ambient IAS/XSUAA bindings, potenti
• CVE-2026-76976 2026-10-13 · CVSS 5.4
  Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP do not sufficiently sanitize user-supplied content in certain functionality, all
• CVE-2026-76975 2026-10-13 · CVSS 6.1
  Due to a DOM-Based Cross-Site Scripting (XSS) vulnerability, an unauthenticated attacker could generate a malicious link and make it publicly accessible. If an
• CVE-2026-76972 2026-10-13 · CVSS 6.5
  Due to a Cross-Site Scripting (XSS) vulnerability in SAP Manufacturing Integration and Intelligence, an attacker could store malicious content that is later ren
• CVE-2026-58249 2026-10-13 · CVSS 7.5
  SAP NetWeaver and SAP Web Dispatcher do not properly validate certain fields in specially crafted requests handled by an internal protocol component. An unauthe
• CVE-2026-58242 2026-10-13 · CVSS 3.5
  SAP Cloud Connector contains an improper authorization check, which could be exploited by a low-privileged attacker through specially crafted requests. Exploita
• CVE-2026-76974 2026-09-22 · CVSS 5.3
  SAP Fiori Launchpad does not sufficiently validate certain user-controlled input. An unauthenticated attacker could craft a malicious link that, when clicked by
• CVE-2026-76977 2026-09-08 · CVSS 4.3
  SAP UI5 does not sufficiently validate the parent frame's origin against the configured allowlist. An unauthenticated attacker could host a malicious page to by
• CVE-2026-76971 2026-09-08 · CVSS 6.5
  Due to a Server-Side Request Forgery (SSRF) vulnerability in SAP Manufacturing Integration and Intelligence, an attacker could cause the server to initiate arbi
• CVE-2026-76969 2026-09-08 · CVSS 9.4
  @sap/cds-mtxs NPM library does not perform sufficient checks on certain functionality used in multitenant CAP applications with extensibility enabled. An unauth
• CVE-2026-76968 2026-09-08 · CVSS 6.5
  SAP Web Dispatcher, Internet Communication Manager and SAP Content Server allows an authenticated low-privileged attacker to access certain administrative funct