boxscore/security
VENDOR · referenceVendors · latest edition

Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

Sap

Vendor reference — Sap · sector: Enterprise Applications. Cumulative disclosure record across the archive.

Follow Sap — Atom feed

Career totals

Disclosures & known-exploited
All-timeYTD
CVEs120
KEV entries120
Rate & severity
KEV/100Med CVSSMed EPSSCHML
100.0—.49080000

KEV/100 = KEV entries ÷ CVEs × 100. Med CVSS / Med EPSS are medians over all disclosures. C/H/M/L = disclosures by CVSS severity band.

Monthly disclosures

Trend (by first-seen month, full archive): █▁▁▁▁▁▁▅▁▂▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▂▁▁▁▁▁▂▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁

Last 12 months (new CVEs by first-seen day)
MonthNew CVEs
2025-090
2025-100
2025-110
2025-120
2026-010
2026-020
2026-030
2026-040
2026-050
2026-060
2026-070
2026-080

Notable CVEs

Ranked by the published formula: KEV → EPSS → CVSS → CVE ID.

Notable (ranked)
CVECVSSEPSS %ileSeverityKEVFirst seen
CVE-2020-6207—99.9—YES2021-11-03
CVE-2022-22536—99.9—YES2022-08-18
CVE-2017-12637—99.9—YES2025-03-19
CVE-2020-6287—99.9—YES2021-11-03
CVE-2016-2386—99.4—YES2022-06-09
CVE-2016-2388—98.9—YES2022-06-09
CVE-2016-3976—98.7—YES2021-11-03
CVE-2021-38163—98.3—YES2022-06-09
CVE-2018-2380—98.0—YES2021-11-03
CVE-2016-9563—97.6—YES2021-11-03
CVE-2010-5326—96.9—YES2021-11-03
CVE-2019-0344—93.7—YES2024-09-30

Recent CVEs

Most recently seen
CVECVSSEPSS %ileSeverityKEVFirst seen
CVE-2017-12637—99.9—YES2025-03-19
CVE-2019-0344—93.7—YES2024-09-30
CVE-2022-22536—99.9—YES2022-08-18
CVE-2016-2388—98.9—YES2022-06-09
CVE-2016-2386—99.4—YES2022-06-09
CVE-2021-38163—98.3—YES2022-06-09
CVE-2016-3976—98.7—YES2021-11-03
CVE-2020-6207—99.9—YES2021-11-03
CVE-2020-6287—99.9—YES2021-11-03
CVE-2016-9563—97.6—YES2021-11-03
CVE-2010-5326—96.9—YES2021-11-03
CVE-2018-2380—98.0—YES2021-11-03

Products

This vendor's products with a reference page (≥2 disclosures), by CVE count. A monolithic vendor total dilutes signal; product pages sharpen it.

Products (by CVE count)
ProductCVEsKEV
NetWeaver88

KEV entries

CISA Known Exploited Vulnerabilities (newest addition first)
CVEKEV addedCVSSEPSS %ileSeverity
CVE-2017-126372025-03-19—99.9—
CVE-2019-03442024-09-30—93.7—
CVE-2022-225362022-08-18—99.9—
CVE-2016-23882022-06-09—98.9—
CVE-2016-23862022-06-09—99.4—
CVE-2021-381632022-06-09—98.3—
CVE-2016-39762021-11-03—98.7—
CVE-2020-62072021-11-03—99.9—
CVE-2020-62872021-11-03—99.9—
CVE-2016-95632021-11-03—97.6—
CVE-2010-53262021-11-03—96.9—
CVE-2018-23802021-11-03—98.0—

KEV timing

Fastest to KEV
CVEDays
CVE-2010-53260
CVE-2016-23860
CVE-2016-23880
CVE-2016-39760
CVE-2016-95630
CVE-2017-126370
CVE-2018-23800
CVE-2019-03440
CVE-2020-62070
CVE-2020-62870
Longest unpatched (KEV due date passed)
CVEDueDays over
CVE-2018-23802022-05-031569
CVE-2010-53262022-05-031569
CVE-2016-95632022-05-031569
CVE-2020-62872022-05-031569
CVE-2020-62072022-05-031569
CVE-2016-39762022-05-031569
CVE-2021-381632022-06-301511
CVE-2016-23862022-06-301511
CVE-2016-23882022-06-301511
CVE-2022-225362022-09-081441

Methodology

Rate statistics are arithmetic over published figures: KEV/100 = KEV entries ÷ CVEs × 100; medians are taken over this vendor's disclosures. Vendor names are normalized (case, punctuation, common aliases) before aggregation; monthly counts are keyed to first-seen day, the day this archive first observed the record, not the upstream publication date.

Raw counts are not comparable across vendors: disclosure practices, product breadth, and CNA conventions differ widely, so a larger number here does not mean less secure software. This is a reference page assembled from the public record — not a record of its own, and not a ranking of vendors by our judgment.

Sources. CVE records from the CVE Program (cvelistV5); enrichment from NVD (NIST); known-exploited status from the CISA KEV catalog; exploit probability from FIRST EPSS.