https://vulnogram.org/ Most recent CVEs assigned by Altium (altium). https://vulnogram.org/seaview/icons/altium.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-92808 https://vulnogram.org/CVE-2026-92808 A server-side request forgery (SSRF) vulnerability exists in the UnifiedLogin service of Altium Enterprise Server. An unauthenticated network attacker can cause the server to issue outbound HTTP requests to a destination of the attacker's choosing, i… Critical Network Exploitable Wed, 16 Sep 2026 20:06:28 GMT https://vulnogram.org/CVE-2026-14439 https://vulnogram.org/CVE-2026-14439 A path traversal vulnerability exists in the Git Service component shared by Altium Enterprise Server and Altium 365. The service accepts a sequence of post-clone file-manipulation operations that use user-supplied paths without validation, allowing… Critical Wed, 01 Jul 2026 23:05:30 GMT https://vulnogram.org/CVE-2026-11431 https://vulnogram.org/CVE-2026-11431 A path traversal vulnerability exists in the Projects Service download endpoint shared by Altium Enterprise Server and Altium 365. An authenticated user can supply a crafted path parameter that bypasses validation, allowing arbitrary files (including… High Fri, 05 Jun 2026 21:08:05 GMT https://vulnogram.org/CVE-2026-11429 https://vulnogram.org/CVE-2026-11429 Two endpoints in the Vault Service ScriptsController, shared by Altium Enterprise Server and Altium 365, accept file uploads where a user-supplied filename component is used to construct the destination path without validation, allowing arbitrary fil… Critical Network Exploitable Fri, 05 Jun 2026 21:01:37 GMT https://vulnogram.org/CVE-2026-11424 https://vulnogram.org/CVE-2026-11424 A server-side request forgery (SSRF) vulnerability exists in a GraphQL service component shared by Altium Enterprise Server and Altium 365. An authenticated user can submit a request whose input is treated as a URL by the server and used to issue an… High Fri, 05 Jun 2026 20:51:28 GMT https://vulnogram.org/CVE-2026-11423 https://vulnogram.org/CVE-2026-11423 A path traversal vulnerability exists in the Altium Enterprise Server Collaboration Service due to improper handling of user-supplied filenames in the MCAD and Simulation file download flows. A regular authenticated user can submit a collaboration me… Critical Fri, 05 Jun 2026 20:12:50 GMT https://vulnogram.org/CVE-2026-11420 https://vulnogram.org/CVE-2026-11420 Two path traversal vulnerabilities in the Network Installation Service (NIS) of Altium Enterprise Server allow an unauthenticated network attacker to write arbitrary files to any writable location on the server filesystem and to read package archive… Critical Network Exploitable Fri, 05 Jun 2026 20:03:12 GMT https://vulnogram.org/CVE-2026-11419 https://vulnogram.org/CVE-2026-11419 A path traversal vulnerability exists in the Altium Enterprise Server Vault Service UploadController due to improper validation of a user-controlled path component in image upload requests. An authenticated user can supply a crafted absolute path so… Critical Fri, 05 Jun 2026 19:54:56 GMT https://vulnogram.org/CVE-2026-11414 https://vulnogram.org/CVE-2026-11414 A hard-coded cryptographic key is used by Altium Enterprise Server to sign file download URLs in the Vault service. Because the key is identical across all installations, an unauthenticated network attacker who can reach the server can forge valid do… Critical Network Exploitable Fri, 05 Jun 2026 19:01:12 GMT https://vulnogram.org/CVE-2026-9152 https://vulnogram.org/CVE-2026-9152 A missing authentication vulnerability exists in the Altium 365 SearchService. A legacy SOAP endpoint exposes search index operations without requiring authentication, session tokens, or any form of identity verification. An unauthenticated network a… Critical Network Exploitable Cloud Hosted Thu, 21 May 2026 00:47:24 GMT https://vulnogram.org/CVE-2026-9129 https://vulnogram.org/CVE-2026-9129 A path traversal vulnerability exists in the Altium Enterprise Server Viewer StorageController due to improper handling of file path route parameters. On on-premise deployments that use local filesystem storage, a regular authenticated user can suppl… Critical Wed, 20 May 2026 18:05:29 GMT https://vulnogram.org/CVE-2026-9102 https://vulnogram.org/CVE-2026-9102 A path traversal vulnerability exists in the Altium Enterprise Server ComparisonService due to missing filename sanitization in the Gerber file upload APIs. A regular authenticated workspace user can supply a crafted filename in the multipart Content… Critical Wed, 20 May 2026 17:48:31 GMT https://vulnogram.org/CVE-2025-27380 https://vulnogram.org/CVE-2025-27380 HTML injection in Project Release in Altium Enterprise Server (AES) 7.0.3 on all platforms allows an authenticated attacker to execute arbitrary JavaScript in the victim’s browser via crafted HTML content. High Thu, 22 Jan 2026 01:28:24 GMT https://vulnogram.org/CVE-2025-27379 https://vulnogram.org/CVE-2025-27379 A stored cross-site scripting (XSS) vulnerability in the BOM Viewer in Altium AES 7.0.3 allows an authenticated attacker to inject arbitrary JavaScript into the Description field of a schematic, which is executed when the BOM Viewer renders the affec… Medium Thu, 22 Jan 2026 01:17:54 GMT https://vulnogram.org/CVE-2025-27378 https://vulnogram.org/CVE-2025-27378 AES contains a SQL injection vulnerability due to an inactive configuration that prevents the latest SQL parsing logic from being applied. When this configuration is not enabled, crafted input may be improperly handled, allowing attackers to inject a… High Network Exploitable Thu, 22 Jan 2026 01:06:19 GMT https://vulnogram.org/CVE-2025-27377 https://vulnogram.org/CVE-2025-27377 Altium Designer version 24.9.0 does not validate self-signed server certificates for cloud connections. An attacker capable of performing a man-in-the-middle (MITM) attack could exploit this issue to intercept or manipulate network traffic, potential… Medium Network Exploitable Thu, 22 Jan 2026 00:16:04 GMT https://vulnogram.org/CVE-2026-1181 https://vulnogram.org/CVE-2026-1181 Altium 365 workspace endpoints were configured with an overly permissive Cross-Origin Resource Sharing (CORS) policy that allowed credentialed cross-origin requests from other Altium-controlled subdomains, including forum.live.altium.com. As a result… Critical Mon, 19 Jan 2026 12:00:10 GMT https://vulnogram.org/CVE-2026-1011 https://vulnogram.org/CVE-2026-1011 A stored cross-site scripting (XSS) vulnerability exists in the Altium Support Center AddComment endpoint due to missing server-side input sanitization. Although the client interface applies HTML escaping, the backend accepts and stores arbitrary HTM… Medium Network Exploitable Thu, 15 Jan 2026 23:08:01 GMT https://vulnogram.org/CVE-2026-1010 https://vulnogram.org/CVE-2026-1010 A stored cross-site scripting (XSS) vulnerability exists in the Altium Workflow Engine due to missing server-side input sanitization in workflow form submission APIs. A regular authenticated user can inject arbitrary JavaScript into workflow data. Wh… High Thu, 15 Jan 2026 23:00:18 GMT https://vulnogram.org/CVE-2026-1009 https://vulnogram.org/CVE-2026-1009 A stored cross-site scripting (XSS) vulnerability exists in the Altium Forum due to missing server-side input sanitization in forum post content. An authenticated attacker can inject arbitrary JavaScript into forum posts, which is stored and executed… Critical Thu, 15 Jan 2026 22:51:32 GMT https://vulnogram.org/CVE-2026-1008 https://vulnogram.org/CVE-2026-1008 A stored cross-site scripting (XSS) vulnerability exists in the user profile text fields of Altium 365. Insufficient server-side input sanitization allows authenticated users to inject arbitrary HTML and JavaScript payloads using whitespace-based att… High Thu, 15 Jan 2026 22:24:16 GMT