2026 CVE Vulnerabilities
85,180 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-24327 | MEDIUM | 4.3 | 0.2% | Feb 10, 2026 | Due to missing authorization check in SAP Strategic Enterprise Management (Balanced Scorecard in Business Server Pages),... |
| CVE-2026-24326 | MEDIUM | 4.3 | 0.2% | Feb 10, 2026 | Due to a missing authorization check in the Disconnected Operations of the SAP S/4HANA Defense & Security, an attacker w... |
| CVE-2026-24325 | MEDIUM | 4.8 | 0.2% | Feb 10, 2026 | SAP BusinessObjects Enterprise does not sufficiently encode user-controlled inputs, leading to Stored Cross-Site Scripti... |
| CVE-2026-24324 | MEDIUM | 6.5 | 0.3% | Feb 10, 2026 | SAP BusinessObjects Business Intelligence Platform (AdminTools) allows an authenticated attacker with user privileges to... |
| CVE-2026-24323 | MEDIUM | 6.1 | 0.2% | Feb 10, 2026 | The BSP applications allow an unauthenticated user to inject malicious script content via user-controlled URL parameters... |
| CVE-2026-24322 | HIGH | 7.7 | 0.2% | Feb 10, 2026 | SAP Solution Tools Plug-In (ST-PI) contains a function module that does not perform the necessary authorization checks f... |
| CVE-2026-24321 | MEDIUM | 5.3 | 0.2% | Feb 10, 2026 | SAP Commerce Cloud exposes multiple API endpoints to unauthenticated users, allowing them to submit requests to these op... |
| CVE-2026-24320 | LOW | 3.1 | 0.2% | Feb 10, 2026 | Due to improper memory management in SAP NetWeaver and ABAP Platform (Application Server ABAP), an authenticated attacke... |
| CVE-2026-24319 | MEDIUM | 5.8 | 0.1% | Feb 10, 2026 | In SAP Business One, sensitive information is written to the application�s memory dump files without obfuscation. Gainin... |
| CVE-2026-24312 | MEDIUM | 5.2 | 0.2% | Feb 10, 2026 | An erroneous authorization check in SAP Business Workflow leads to privilege escalation. An authenticated administrative... |
| CVE-2026-23689 | HIGH | 7.7 | 0.4% | Feb 10, 2026 | Due to an uncontrolled resource consumption (Denial of Service) vulnerability, an authenticated attacker with regular us... |
| CVE-2026-23688 | MEDIUM | 4.3 | 0.2% | Feb 10, 2026 | SAP Fiori App Manage Service Entry Sheets does not perform necessary authorization checks for an authenticated user, res... |
| CVE-2026-23687 | HIGH | 8.8 | 0.5% | Feb 10, 2026 | SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated attacker with normal privileges to obtai... |
| CVE-2026-23686 | LOW | 3.4 | 0.2% | Feb 10, 2026 | Due to a CRLF Injection vulnerability in SAP NetWeaver Application Server Java, an authenticated attacker with administr... |
| CVE-2026-23685 | MEDIUM | 4.4 | 0.1% | Feb 10, 2026 | Due to a Deserialization vulnerability in SAP NetWeaver (JMS service), an attacker authenticated as an administrator wit... |
| CVE-2026-23684 | MEDIUM | 5.9 | 0.2% | Feb 10, 2026 | A race condition vulnerability exists in the SAP Commerce cloud. Because of this when an attacker adds products to a car... |
| CVE-2026-23681 | MEDIUM | 4.3 | 0.2% | Feb 10, 2026 | Due to missing authorization check in a function module in SAP Support Tools Plug-In, an authenticated attacker could in... |
| CVE-2026-0509 | CRITICAL | 9.6 | 0.3% | Feb 10, 2026 | SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated, low-privileged user to perform backgrou... |
| CVE-2026-0508 | HIGH | 8.1 | 0.3% | Feb 10, 2026 | The SAP BusinessObjects Business Intelligence Platform allows an authenticated attacker with high privileges to insert m... |
| CVE-2026-0505 | MEDIUM | 6.1 | 0.2% | Feb 10, 2026 | The BSP applications allow an unauthenticated user to manipulate user-controlled URL parameters that are not sufficientl... |
| CVE-2026-0490 | HIGH | 7.5 | 0.4% | Feb 10, 2026 | SAP BusinessObjects BI Platform allows an unauthenticated attacker to craft a specific network request to the trusted en... |
| CVE-2026-0488 | CRITICAL | 9.9 | 0.5% | Feb 10, 2026 | An authenticated attacker in SAP CRM and SAP S/4HANA (Scripting Editor) could exploit a flaw in a generic function modul... |
| CVE-2026-0486 | MEDIUM | 4.3 | 0.2% | Feb 10, 2026 | In ABAP based SAP systems a remote enabled function module does not perform necessary authorization checks for an authen... |
| CVE-2026-0485 | HIGH | 7.5 | 0.4% | Feb 10, 2026 | SAP BusinessObjects BI Platform allows an unauthenticated attacker to send specially crafted requests that could cause t... |
| CVE-2026-0484 | MEDIUM | 6.5 | 0.3% | Feb 10, 2026 | Due to missing authorization check in SAP NetWeaver Application Server ABAP and SAP S/4HANA, an authenticated attacker c... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now