Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
25 results
Sep 7, 2026SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated user to send a specially crafted packet that triggers reprocessing of a prCVE-2026-66767 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 7.7
SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated user to send a specially crafted packet that triggers reprocessing of a previously buffered user request, potentially hijacking another user's session under narrow timing conditions. Successful exploitation could result in high impact on confidentiality and integrity, with low impact on availability of the application.
- Product
- SAP NetWeaver Application Server for ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2026SAP NetWeaver Application Server for ABAP and ABAP Platform writes sensitive session identifier information into a diagnostic trace when the trace is activated CVE-2026-58246 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
SAP NetWeaver Application Server for ABAP and ABAP Platform writes sensitive session identifier information into a diagnostic trace when the trace is activated by a privileged user. An attacker with access to the resulting trace data could obtain identifiers that allow impersonation of legitimate users during their validity period. This leads to high impact on confidentiality. Integrity and availability are not impacted.
- Product
- SAP NetWeaver Application Server for ABAP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2026An OS Command Injection vulnerability exists in the SAP NetWeaver Application Server for ABAP and ABAP Platform that allows an authenticated attacker with adminCVE-2026-40135 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.5
An OS Command Injection vulnerability exists in the SAP NetWeaver Application Server for ABAP and ABAP Platform that allows an authenticated attacker with administrative access to execute specially crafted shell commands on the server, bypassing the logging mechanism. This allows the execution of unintended OS commands without detection, potentially impacting the integrity and availability of the application, with no impact on confidentiality.
- Product
- SAP NetWeaver Application Server for ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025SAP NetWeaver Application Server for ABAP and ABAP Platform allows an authenticated attacker to obtain illegitimate access to the system by exploiting improper CVE-2025-0070 · Network & remote access · SAP_SE · reported by cna@sap.comCritical 9.9
SAP NetWeaver Application Server for ABAP and ABAP Platform allows an authenticated attacker to obtain illegitimate access to the system by exploiting improper authentication checks, resulting in privilege escalation. On successful exploitation, this can result in potential security concerns. This results in a high impact on confidentiality, integrity, and availability.
- Product
- SAP NetWeaver Application Server for ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker to gain unauthorized access to system information.CVE-2025-0053 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.3
SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker to gain unauthorized access to system information. By using a specific URL parameter, an unauthenticated attacker could retrieve details such as system configuration. This has a limited impact on the confidentiality of the application and may be leveraged to facilitate further attacks or exploits.
- Product
- SAP NetWeaver Application Server for ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2024SAP NetWeaver Application Server for ABAP and ABAP Platform allows an authenticated attacker to gain higher access levels than they should have by exploiting imCVE-2024-47585 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
SAP NetWeaver Application Server for ABAP and ABAP Platform allows an authenticated attacker to gain higher access levels than they should have by exploiting improper authorization checks, resulting in privilege escalation. While authorizations for import and export are distinguished, a single authorization is applied for both, which may contribute to these risks. On successful exploitation, this can result in potential security concerns. However, it has no impact on the integrity and availability of the application and may have only a low impact on data confidentiality.
- Product
- SAP NetWeaver Application Server for ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2024SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated attacker to send a maliciously crafted http request which could cause a nuCVE-2024-47586 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.3
SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated attacker to send a maliciously crafted http request which could cause a null pointer dereference in the kernel. This dereference will result in the system crashing and rebooting, causing the system to be temporarily unavailable. There is no impact on Confidentiality or Integrity.
- Product
- SAP NetWeaver Application Server for ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024The RFC enabled function module allows a low privileged user to perform denial of service on any user and also change or delete favourite nodes.CVE-2024-45285 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.4
The RFC enabled function module allows a low privileged user to perform denial of service on any user and also change or delete favourite nodes. By sending a crafted packet in the function module targeting specific parameters, the specific targeted user will no longer have access to any functionality of SAP GUI. There is low impact on integrity and availability of the application.
- Product
- SAP NetWeaver Application Server for ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024The RFC enabled function module allows a low privileged user to perform various actions, such as modifying the URLs of any user's favourite nodes and workbook ICVE-2024-44117 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.4
The RFC enabled function module allows a low privileged user to perform various actions, such as modifying the URLs of any user's favourite nodes and workbook ID. There is low impact on integrity and availability of the application.
- Product
- SAP NetWeaver Application Server for ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024Due to missing authorization check, SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker logged in as a developer to read objects contCVE-2024-41728 · Network & remote access · SAP_SE · reported by cna@sap.comLow 2.7
Due to missing authorization check, SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker logged in as a developer to read objects contained in a package. This causes an impact on confidentiality, as this attacker would otherwise not have access to view these objects.
- Product
- SAP NetWeaver Application Server for ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2024The RFC enabled function module allows a low privileged user to add any workbook to any user's workplace favourites.CVE-2024-44116 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
The RFC enabled function module allows a low privileged user to add any workbook to any user's workplace favourites. This vulnerability could be utilized to identify usernames and access information about targeted user's workplaces. There is low impact on integrity of the application.
- Product
- SAP NetWeaver Application Server for ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2024The RFC enabled function module allows a low privileged user to add URLs to any user's workplace favourites.CVE-2024-44115 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
The RFC enabled function module allows a low privileged user to add URLs to any user's workplace favourites. This vulnerability could be utilized to identify usernames and access information about targeted user's workplaces, and nodes. There is low impact on integrity of the application
- Product
- SAP NetWeaver Application Server for ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2024SAP NetWeaver Application Server for ABAP and ABAP Platform allow users with high privileges to execute a program that reveals data over the network.CVE-2024-44114 · Network & remote access · SAP_SE · reported by cna@sap.comLow 2
SAP NetWeaver Application Server for ABAP and ABAP Platform allow users with high privileges to execute a program that reveals data over the network. This results in a minimal impact on confidentiality of the application.
- Product
- SAP NetWeaver Application Server for ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2024The RFC enabled function module allows a low privileged user to read any user's workplace favourites and user menu along with all the specific data of each nodeCVE-2024-42380 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
The RFC enabled function module allows a low privileged user to read any user's workplace favourites and user menu along with all the specific data of each node. Usernames can be enumerated by exploiting vulnerability. There is low impact on confidentiality of the application.
- Product
- SAP NetWeaver Application Server for ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2024The RFC enabled function module allows a low privileged user to delete the workplace favourites of any user.CVE-2024-42371 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.4
The RFC enabled function module allows a low privileged user to delete the workplace favourites of any user. This vulnerability could be utilized to identify usernames and access information about targeted user's workplaces and nodes. There is low impact on integrity and availability of the application.
- Product
- SAP NetWeaver Application Server for ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2024Due to a Protection Mechanism Failure in SAP NetWeaver Application Server for ABAP and ABAP Platform, a developer can bypass the configured malware scanner API CVE-2024-39599 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.7
Due to a Protection Mechanism Failure in SAP NetWeaver Application Server for ABAP and ABAP Platform, a developer can bypass the configured malware scanner API because of a programming error. This leads to a low impact on the application's confidentiality, integrity, and availability.
- Product
- SAP NetWeaver Application Server for ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2024Under certain conditions SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker to access remote-enabled function module with no furtherCVE-2024-37180 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.1
Under certain conditions SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker to access remote-enabled function module with no further authorization which would otherwise be restricted, the function can be used to read non-sensitive information with low impact on confidentiality of the application.
- Product
- SAP NetWeaver Application Server for ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024SAP NetWeaver Application Server for ABAP and ABAP Platform do not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerabiCVE-2024-34687 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.5
SAP NetWeaver Application Server for ABAP and ABAP Platform do not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. An attacker can control code that is executed within a user’s browser, which could result in modification, deletion of data, including accessing or deleting files, or stealing session cookies which an attacker could use to hijack a user’s session. Hence, this could have impact on Confidentiality, Integrity and Availability of the system.
- Product
- SAP NetWeaver Application server for ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordme.sap.comsupport.sap.com
Mar 14, 2023SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, has multiple vulnerCVE-2023-27270 · Network & remote access · SAP · reported by cna@sap.comMedium 6.5
SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, has multiple vulnerabilities in a class for test purposes in which an attacker authenticated as a non-administrative user can craft a request with certain parameters, which will consume the server's resources sufficiently to make it unavailable. There is no ability to view or modify any information.
- Product
- NetWeaver Application Server for ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
Mar 14, 2023SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, allows an attacker CVE-2023-27269 · Network & remote access · SAP · reported by cna@sap.comCritical 9.6
SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, allows an attacker with non-administrative authorizations to exploit a directory traversal flaw in an available service to overwrite the system files. In this attack, no data can be read but potentially critical OS files can be overwritten making the system unavailable.
- Product
- NetWeaver Application Server for ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
Mar 14, 2023SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, has multiple vulnerCVE-2023-25618 · Network & remote access · SAP · reported by cna@sap.comMedium 6.5
SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, has multiple vulnerabilities in an unused class for error handling in which an attacker authenticated as a non-administrative user can craft a request with certain parameters which will consume the server's resources sufficiently to make it unavailable. There is no ability to view or modify any information.
- Product
- NetWeaver AS for ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
Feb 13, 2023SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, does not perform necessary authorization checks fCVE-2023-23854 · Network & remote access · SAP · reported by cna@sap.comLow 3.8
SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.
- Product
- NetWeaver AS ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
May 11, 2022SAP NetWeaver Application Server for ABAP and ABAP Platform do not perform necessary authorization checks for an authenticated user, resulting in escalation of CVE-2022-29611 · Network & remote access · SAP SE · reported by cna@sap.comHigh 8.8
SAP NetWeaver Application Server for ABAP and ABAP Platform do not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.
- Product
- SAP NetWeaver Application Server for ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
Nov 10, 2021A certain template role in SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 75CVE-2021-40504 · Network & remote access · SAP SE · reported by cna@sap.comMedium 4.9
A certain template role in SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, contains transport authorizations, which exceed expected display only permissions.
- Product
- SAP NetWeaver AS for ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comwiki.scn.sap.com
Oct 12, 2021There are multiple Denial-of Service vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 740, 750, 751, 752, 753, 754, 755CVE-2021-40495 · Network & remote access · SAP SE · reported by cna@sap.comMedium 5.3
There are multiple Denial-of Service vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 740, 750, 751, 752, 753, 754, 755. An unauthorized attacker can use the public SICF service /sap/public/bc/abap to reduce the performance of SAP NetWeaver Application Server ABAP and ABAP Platform.
- Product
- SAP NetWeaver AS ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comwiki.scn.sap.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.