SAP SE SAP NetWeaver Application Server Java

CVE-2026-23686 Low 3.4 CRLF Injection vulnerability in SAP NetWeaver Application Server Java 0.2%
CVE-2025-42919 Medium 5.3 Information Disclosure vulnerability in SAP NetWeaver Application Server Java 0.5%
CVE-2025-42926 Medium 5.3 Missing Authentication check in SAP NetWeaver Application Server Java 0.3%
CVE-2025-42978 Low 3.5 Insufficiently Secure Hostname Verification for Outbound TLS Connections in SAP NetWeaver Application Server Java 0.1%
CVE-2025-27431 Medium 5.4 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server Java 0.2%
CVE-2025-24869 Medium 4.3 Information Disclosure vulnerability in SAP NetWeaver Application Server Java 0.3%
CVE-2025-0054 Medium 5.4 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server Java 0.3%
CVE-2025-0067 Medium 6.3 Missing Authorization check in SAP NetWeaver Application Server Java 0.3%
CVE-2022-22533 Unrated Due to improper error handling in SAP NetWeaver Application Server Java - versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC, 7.22, 7.22EXT, 7.49, 7.53, KERNEL 7.22, 7.49, 7.53, an attacker could submit 1.5%
CVE-2022-22532 Unrated In SAP NetWeaver Application Server Java - versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC, 7.22, 7.22EXT, 7.49, 7.53, KERNEL 7.22, 7.49, 7.53, an unauthenticated attacker could submit a crafted HTTP 2.1%
CVE-2020-6365 Medium 4.7 SAP NetWeaver AS Java, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, Start Page allows an unauthenticated remote attacker to redirect users to a malicious site due to insufficient reverse tabna 1.1%
CVE-2020-6319 Medium 6.1 SAP NetWeaver Application Server Java, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, and 7.50 allows an unauthenticated attacker to include JavaScript blocks in any web page or URL with different sym 0.9%