https://vulnogram.org/ Most recent CVEs assigned by National Cyber Security Centre Finland (NCSC-FI) (ncsc-fi). https://vulnogram.org/seaview/icons/ncsc-fi.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:06 GMT https://vulnogram.org/CVE-2026-82819 https://vulnogram.org/CVE-2026-82819 A vulnerability in Cerberus FTP Server allows an authenticated remote attacker to perform UNC path injection via a manipulated parameter. By supplying a malicious SMB share path, an attacker can execute authentication coercion against the underlying… High Wed, 21 Oct 2026 04:30:40 GMT https://vulnogram.org/CVE-2026-80275 https://vulnogram.org/CVE-2026-80275 Comelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1 and 2.10.0 fail to enforce server-side authorization on an administrative password-change function. An authenticated user level can invoke this function to overwrite the… High Thu, 01 Oct 2026 05:51:37 GMT https://vulnogram.org/CVE-2026-80276 https://vulnogram.org/CVE-2026-80276 Comelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1 and 2.10.0 expose a network-accessible management interface that does not require authentication. Through this interface, sensitive device configuration data - including… High Network Exploitable Thu, 01 Oct 2026 05:51:21 GMT https://vulnogram.org/CVE-2026-85104 https://vulnogram.org/CVE-2026-85104 In Sooma 2GEN brain stimulator, an attacker within Bluetooth range can make unauthenticated changes to brain stimulation parameters. Medium Wed, 16 Sep 2026 13:38:30 GMT https://vulnogram.org/CVE-2026-6265 https://vulnogram.org/CVE-2026-6265 Insecure preserved inherited permissions vulnerability in Cerberus FTP Server on Windows allows Privilege Escalation.This issue has been resolved in Cerberus FTP Server: 2026.1 High Mon, 27 Apr 2026 13:00:10 GMT https://vulnogram.org/CVE-2025-15626 https://vulnogram.org/CVE-2025-15626 Authenticated user can bypass authorization in Ribblr - Crochet & Knitting iOS application Medium Mon, 27 Apr 2026 12:47:43 GMT https://vulnogram.org/CVE-2025-15625 https://vulnogram.org/CVE-2025-15625 Unauthenticated user is able to execute arbitrary SQL commands in Sparx Pro Cloud Server database in certain cases. Critical Network Exploitable Fri, 17 Apr 2026 08:38:59 GMT https://vulnogram.org/CVE-2025-15624 https://vulnogram.org/CVE-2025-15624 Plaintext Storage of a Password vulnerability in Sparx Systems Pty Ltd. Sparx Pro Cloud Server. In a setup where OpenID is used as the primary method of authentication to authenticate to Sparx EA, Pro Cloud Server creates local passwords to the users… Critical Network Exploitable Fri, 17 Apr 2026 08:38:36 GMT https://vulnogram.org/CVE-2025-15623 https://vulnogram.org/CVE-2025-15623 Exposure of Private Personal Information to an Unauthorized Actor, : Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Sparx Systems Pty Ltd. Sparx Pro Cloud Server. Unauthenticated user can retrieve database… Critical Network Exploitable Fri, 17 Apr 2026 08:37:27 GMT https://vulnogram.org/CVE-2025-15622 https://vulnogram.org/CVE-2025-15622 Insufficiently Protected Credentials vulnerability in Sparx Systems Pty Ltd. Sparx Enterprise Architect. Client reveals plaintext OAuth2 client secretDesktop client decodes the secret and uses the plaintext secret to exchange it into an access and id… Medium Fri, 17 Apr 2026 08:35:05 GMT https://vulnogram.org/CVE-2025-15621 https://vulnogram.org/CVE-2025-15621 Insufficiently Protected Credentials in Sparx Systems Pty Ltd. Sparx Enterprise Architect. Client does not verify the receiver of OAuth2 credentials during OpenID authentication Medium Thu, 16 Apr 2026 12:40:08 GMT https://vulnogram.org/CVE-2025-15554 https://vulnogram.org/CVE-2025-15554 Browser caching of LAPS passwords in Truesec’s LAPSWebUI before version 2.4 allows an attacker with access to a workstation to escalate their privileges via disclosure of local admin passwords. Medium Mon, 16 Mar 2026 10:46:09 GMT https://vulnogram.org/CVE-2025-15553 https://vulnogram.org/CVE-2025-15553 Non-working logout functionality in Truesec’s LAPSWebUI before version 2.4 allows an attacker with access to a workstation to escalate their privileges via disclosure of local admin password. Medium Mon, 16 Mar 2026 10:45:04 GMT https://vulnogram.org/CVE-2025-15552 https://vulnogram.org/CVE-2025-15552 Insufficient Session Expiration in Truesec’s LAPSWebUI before version 2.4 allows an attacker with access to a workstation to escalate their privileges via disclosure of local admin password. Medium Mon, 16 Mar 2026 10:44:02 GMT https://vulnogram.org/CVE-2026-3315 https://vulnogram.org/CVE-2026-3315 Incorrect Default Permissions, : Execution with Unnecessary Privileges, : Incorrect Permission Assignment for Critical Resource vulnerability in ASSA ABLOY Visionline on Windows allows Configuration/Environment Manipulation.This issue affects Visionl… Medium Tue, 10 Mar 2026 09:35:42 GMT https://vulnogram.org/CVE-2025-15595 https://vulnogram.org/CVE-2025-15595 Privilege escalation via dll hijacking in Inno Setup 6.2.1 and ealier versions. Medium Tue, 03 Mar 2026 06:13:07 GMT https://vulnogram.org/CVE-2026-2731 https://vulnogram.org/CVE-2026-2731 Path traversal and content injection in JobRunnerBackground.aspx in DynamicWeb 8 (all) and 9 (<9.19.7 and <9.20.3) allows unauthenticated attackers to execute code via simple web requests Critical Network Exploitable Thu, 19 Feb 2026 06:46:52 GMT https://vulnogram.org/CVE-2025-15577 https://vulnogram.org/CVE-2025-15577 An unauthenticated attacker can exploit this vulnerability by manipulating URL to achieve arbitrary file read access.This issue affects Valmet DNA Web Tools: C2022 and older. High Network Exploitable Thu, 12 Feb 2026 06:04:56 GMT https://vulnogram.org/CVE-2026-1680 https://vulnogram.org/CVE-2026-1680 Improper access control in the WCF endpoint in Edgemo (now owned by Danoffice IT) Local Admin Service 1.2.7.23180 on Windows allows a local user to escalate their privileges to local administrator via direct communication with the LocalAdminService.e… High Fri, 30 Jan 2026 06:00:31 GMT https://vulnogram.org/CVE-2025-9427 https://vulnogram.org/CVE-2025-9427 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Lemonsoft WordPress add on allows Cross-Site Scripting (XSS).This issue affects WordPress add on: 2025.7.1. High Tue, 13 Jan 2026 13:39:02 GMT https://vulnogram.org/CVE-2025-10009 https://vulnogram.org/CVE-2025-10009 Incorrect handling of uploaded files in the admin "Restore" function in Invoice Ninja <= 5.11.72 allows attackers with admin credentials to execute arbitrary code on the server via uploaded .php files. High Mon, 22 Sep 2025 09:20:03 GMT https://vulnogram.org/CVE-2025-4377 https://vulnogram.org/CVE-2025-4377 Improper Limitation of a Pathname caused a Path Traversal vulnerability in Sparx Systems Pro Cloud Server. This vulnerability is present in logview.php and it allows reading arbitrary files on the filesystem. Logview is accessible on Pro Cloud Server… High Fri, 09 May 2025 05:12:59 GMT https://vulnogram.org/CVE-2025-4376 https://vulnogram.org/CVE-2025-4376 Improper Input Validation vulnerability in Sparx Systems Pro Cloud Server's WebEA model search field allows Cross-Site Scripting (XSS). This issue affects Pro Cloud Server: earlier than 6.0.165. Medium Network Exploitable Fri, 09 May 2025 05:12:54 GMT https://vulnogram.org/CVE-2025-4375 https://vulnogram.org/CVE-2025-4375 Cross-Site Request Forgery (CSRF) vulnerability in Sparx Systems Pro Cloud Server allows Cross-Site Request Forgery to perform Session Hijacking. Cross-Site Request Forgery is present at the whole application but it can be used to change the Pro Clou… Medium Fri, 09 May 2025 05:12:48 GMT https://vulnogram.org/CVE-2025-0416 https://vulnogram.org/CVE-2025-0416 Local privilege escalation through insecure DCOM configuration in Valmet DNA versions prior to C2023. The DCOM object Valmet DNA Engineering has permissions that allow it to run commands as a user with the SeImpersonatePrivilege privilege. The SeImpe… High Tue, 01 Apr 2025 04:05:14 GMT https://vulnogram.org/CVE-2025-0417 https://vulnogram.org/CVE-2025-0417 Lack of protection against brute force attacks in Valmet DNA visualization in DNA Operate. The possibility to make an arbitrary number of login attempts without any rate limit gives an attacker an increased chance of guessing passwords and then perfo… High Tue, 01 Apr 2025 04:02:54 GMT https://vulnogram.org/CVE-2025-0418 https://vulnogram.org/CVE-2025-0418 Valmet DNA user passwords in plain text. This practice poses a security risk as attackers who gain access to local project data can read the passwords. Medium Tue, 01 Apr 2025 03:59:40 GMT https://vulnogram.org/CVE-2024-12867 https://vulnogram.org/CVE-2024-12867 Server-Side Request Forgery in URL Mapper in Arctic Security's Arctic Hub versions 3.0.1764-5.6.1877 allows an unauthenticated remote attacker to exfiltrate and modify configurations and data. High Network Exploitable Fri, 20 Dec 2024 19:19:43 GMT