SAP has released 15 new security notes, including two addressing critical code injection flaws in S/4HANA and Commerce.