https://vulnogram.org/ Most recent CVEs assigned by Switzerland National Cyber Security Centre (NCSC) (ncsc.ch). https://vulnogram.org/seaview/icons/ncsc.ch.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:06 GMT https://vulnogram.org/CVE-2026-14933 https://vulnogram.org/CVE-2026-14933 Cross-site scripting in the embedded co-browsing feature in Unblu inc. Unblu Spark 7.0 through 7.57.7 and 8.0 through 8.39.2, on on-premises and cloud deployments, allows an unauthenticated remote attacker in the visitor role to execute arbitrary Jav… High Network Exploitable Tue, 20 Oct 2026 11:08:43 GMT https://vulnogram.org/CVE-2026-9589 https://vulnogram.org/CVE-2026-9589 Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc. Unblu Spark 7.0 through 8.36.1-hotfix.0, on on-premises and cloud deployments, allows an authenticated remote attacker to read and change configur… Critical Tue, 20 Oct 2026 11:01:14 GMT https://vulnogram.org/CVE-2026-108120 https://vulnogram.org/CVE-2026-108120 Brian Mariani from DigitalCanion SA has discovered a path traversal vulnerability in the View Logs functionality of koozali's SME Server version 11.0rc1-215 allowing an unauthenticated attacker to access files outside of the intended directory, leadi… High Network Exploitable Mon, 19 Oct 2026 05:12:00 GMT https://vulnogram.org/CVE-2026-108121 https://vulnogram.org/CVE-2026-108121 Brian Mariani from DigitalCanion SA has discovered a vulnerability in the domain creation functionality of koozali's SME Server version 11.0rc1-215, allowing an attacker with high privileges to inject reserved Apache configuration directives, corrupt… Medium Mon, 19 Oct 2026 05:07:58 GMT https://vulnogram.org/CVE-2026-104811 https://vulnogram.org/CVE-2026-104811 DigitalCanion SA has discovered a vulnerability that allows remote attackers to execute arbitrary code on affected installations of the product. Authentication may be required to exploit this vulnerability. The specific flaw exists within the Configu… High Mon, 05 Oct 2026 08:34:38 GMT https://vulnogram.org/CVE-2026-104810 https://vulnogram.org/CVE-2026-104810 This vulnerability allows remote attackers to delete sensitive files on vulnerable installations of Mitel MiVoice Office 400. Authentication is required to exploit this vulnerability. The specific flaw exists within the web portal listening on TCP po… High Mon, 05 Oct 2026 08:33:36 GMT https://vulnogram.org/CVE-2026-104809 https://vulnogram.org/CVE-2026-104809 DigitalCanion has discovered a vulnerability that allows an attacker to cause the system to load an attacker-controlled .so file instead of the expected legitimate module. The loading mechanism relies on a predictable module name without adequately v… High Mon, 05 Oct 2026 08:32:14 GMT https://vulnogram.org/CVE-2026-104808 https://vulnogram.org/CVE-2026-104808 DigitalCanion has discovered a stored Cross-Site Scripting (XSS) vulnerability that allows an authenticated malicious user to inject persistent JavaScript or HTML content, resulting in a denial-of-service condition within the web application. The spe… Low Mon, 05 Oct 2026 08:30:54 GMT https://vulnogram.org/CVE-2026-104807 https://vulnogram.org/CVE-2026-104807 DigitalCanion has discovered a stored Cross-Site Scripting (XSS) vulnerability that allows an authenticated malicious user to inject persistent JavaScript or HTML content into the web application. The specific flaw exists within the web portal listen… Low Mon, 05 Oct 2026 08:28:58 GMT https://vulnogram.org/CVE-2026-104806 https://vulnogram.org/CVE-2026-104806 DigitalCanion has discovered a path traversal vulnerability that allows an attacker to access files outside of the intended directory. The specific flaw exists within the Maintenance → System Logs functionality of the web management portal listening… Medium Mon, 05 Oct 2026 08:24:22 GMT https://vulnogram.org/CVE-2026-104805 https://vulnogram.org/CVE-2026-104805 DigitalCanion has discovered a vulnerability in the backup restoration functionality that allows an attacker with access to the configured backup repository to introduce arbitrary files into the system during restoration. The specific flaw exists wit… High Mon, 05 Oct 2026 08:22:08 GMT https://vulnogram.org/CVE-2026-104706 https://vulnogram.org/CVE-2026-104706 DigitalCanion has discovered a path traversal vulnerability that allows to view or download sensitive system files over the portal https://<ip>:8443 via menus Administration -> View Logs High Mon, 05 Oct 2026 08:17:15 GMT https://vulnogram.org/CVE-2026-104721 https://vulnogram.org/CVE-2026-104721 Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attack… Medium Network Exploitable Fri, 02 Oct 2026 13:21:59 GMT https://vulnogram.org/CVE-2026-104733 https://vulnogram.org/CVE-2026-104733 User Impersonation in ProcessOnes XMMP Server ejabberd <= 26.04 allows an attacker to impersonate arbitrary users via unvalidated authzid parameter in SASL-PLAIN mechanism. High Fri, 02 Oct 2026 12:19:10 GMT https://vulnogram.org/CVE-2026-84830 https://vulnogram.org/CVE-2026-84830 SEPPmail Secure Email Gateway before 15.0.7 contains a command injection vulnerability that allows authenticated administrators to execute commands with elevated privileges. High Thu, 03 Sep 2026 08:45:42 GMT https://vulnogram.org/CVE-2026-84832 https://vulnogram.org/CVE-2026-84832 SEPPmail Secure Email Gateway before 15.0.6 deserializes attacker-controlled data in a privileged REST import workflow without adequate validation. An attacker with a privileged API token can execute arbitrary commands with "nobody" privileges. High Thu, 03 Sep 2026 08:45:08 GMT https://vulnogram.org/CVE-2026-84831 https://vulnogram.org/CVE-2026-84831 SEPPmail Secure Email Gateway before 15.0.7 creates a fully privileged session before required multi-factor authentication enrollment is completed. An attacker with the password for an MFA-required but unenrolled account can access protected function… High Thu, 03 Sep 2026 08:43:46 GMT https://vulnogram.org/CVE-2026-14208 https://vulnogram.org/CVE-2026-14208 Remote Utilities Host <=7.7.3.0 sets insecure ACLs on all DLL files in the installation directory (C:\Program Files (x86)\Remote Utilities - Host\), granting FULL CONTROL (F) to the built-in Everyone group (BUILTIN\Everyone, S-1-1-0). A Windows servi… High Fri, 21 Aug 2026 10:51:07 GMT https://vulnogram.org/CVE-2026-19880 https://vulnogram.org/CVE-2026-19880 Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attack… Medium Network Exploitable Fri, 14 Aug 2026 14:31:02 GMT https://vulnogram.org/CVE-2026-16458 https://vulnogram.org/CVE-2026-16458 Padding oracle attack vulnerability in Oberon microsystem AG’s ocrypto library in all versions since 3.0.0 and prior to 4.0.1 allows an attacker to recover plaintexts via timing measurements of RSA PKCS#1 v1.5 decrypt operations. Medium Thu, 13 Aug 2026 08:31:39 GMT https://vulnogram.org/CVE-2026-16459 https://vulnogram.org/CVE-2026-16459 Padding oracle attack vulnerability in Oberon microsystem AG’s Oberon PSA Crypto library in all versions since 1.0.0 and prior to 2.1.1 allows an attacker to recover plaintexts via timing measurements of RSA PKCS#1 v1.5 decrypt operations. Medium Thu, 13 Aug 2026 08:29:07 GMT https://vulnogram.org/CVE-2026-54205 https://vulnogram.org/CVE-2026-54205 Tobit Laboratories AG TeamDavid's Webbox 's link storing functionality (//ServerClient_celink.htm) accepts a “pathname” parameter, which can be set to network locations using UNC paths (e.g., “\\Server\Share”). The server processes these paths withou… Medium Fri, 07 Aug 2026 10:02:28 GMT https://vulnogram.org/CVE-2026-54218 https://vulnogram.org/CVE-2026-54218 Use of hard-coded cryptographic key vulnerability in Tobit Laboratories AG TeamDavid's Webbox. For users created locally in David, passwords are stored in various files using only obfuscation. Any user with access to the server’s file system, or who… High Network Exploitable Fri, 07 Aug 2026 09:49:24 GMT https://vulnogram.org/CVE-2026-54217 https://vulnogram.org/CVE-2026-54217 Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to a stored XSS vulnerability. An attacker can send an email containing malicious JavaScript code. When a user accesses the email, the stored cross-site scripting is triggered. This i… Medium Network Exploitable Fri, 07 Aug 2026 09:49:02 GMT https://vulnogram.org/CVE-2026-54216 https://vulnogram.org/CVE-2026-54216 Tobit Laboratories AG TeamDavid's Webbox application contains a reflected cross-site scripting (XSS) vulnerability. By sending a specially crafted link including an arbitrary path, an XSS payload or the parameter “EntryInfo”, and the parameter “!temp… Medium Network Exploitable Fri, 07 Aug 2026 09:48:46 GMT https://vulnogram.org/CVE-2026-54215 https://vulnogram.org/CVE-2026-54215 Tobit Laboratories AG TeamDavid's Webbox contains an open redirect vulnerability via the “replyUrl” parameter. An attacker can exploit this vulnerability to craft a URL within the application that, when visited, redirects the user’s browser to an arb… Medium Network Exploitable Fri, 07 Aug 2026 09:48:16 GMT https://vulnogram.org/CVE-2026-54214 https://vulnogram.org/CVE-2026-54214 Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to HTTP header injection through the “cType” URL parameter, which allows arbitrary modification of the Content-Type header in HTTP responses. Because the parameter does not properly r… Medium Network Exploitable Fri, 07 Aug 2026 09:47:55 GMT https://vulnogram.org/CVE-2026-54213 https://vulnogram.org/CVE-2026-54213 Tobit Laboratories AG TeamDavid's Webbox application exposes a functionality that allows the server to be shut down when a specific endpoint (/internalRestart) is accessed. This endpoint is accessible to unauthenticated users over the public Internet… Critical Network Exploitable Fri, 07 Aug 2026 09:47:34 GMT https://vulnogram.org/CVE-2026-54212 https://vulnogram.org/CVE-2026-54212 Tobit Laboratories AG TeamDavid's Webbox application implements an API endpoint that is vulnerable to a buffer overflow condition. By submitting a specially crafted JSON body, such as one that is at least 8 characters long and begins with a number, a… Critical Network Exploitable Fri, 07 Aug 2026 09:47:12 GMT https://vulnogram.org/CVE-2026-54211 https://vulnogram.org/CVE-2026-54211 Tobit Laboratories AG TeamDavid's Webbox application’s endpoint “//serverClient_close.html” is vulnerable to a buffer overflow vulnerability in multiple form data parameters. By submitting excessively long values in these parameters, an authenticated… Critical Network Exploitable Fri, 07 Aug 2026 09:46:50 GMT https://vulnogram.org/CVE-2026-54210 https://vulnogram.org/CVE-2026-54210 Tobit Laboratories AG TeamDavid's Webbox application implements various file upload functionalities that are vulnerable to a buffer overflow condition. By specifying an excessively long filename in a file upload request, an unauthenticated attacker c… Critical Network Exploitable Fri, 07 Aug 2026 09:46:23 GMT https://vulnogram.org/CVE-2026-54209 https://vulnogram.org/CVE-2026-54209 Tobit Laboratories AG TeamDavid's Webbox application handles password changes using a function triggered by including the string "(editini)" in the file path, writing the new password to the specified "Archive.ini" file. However, the application does… High Network Exploitable Fri, 07 Aug 2026 09:45:53 GMT https://vulnogram.org/CVE-2026-54208 https://vulnogram.org/CVE-2026-54208 Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to arbitrary file write, allowing an unauthenticated attacker to create or write into existing files on the server with attacker-controlled content. This is possible because user inpu… High Network Exploitable Fri, 07 Aug 2026 09:45:40 GMT https://vulnogram.org/CVE-2026-54207 https://vulnogram.org/CVE-2026-54207 Tobit Laboratories AG TeamDavid's Webbox 's move archive functionality (“!ArcEntryMove”) accepts an arbitrary path, which can be set to network locations using UNC paths (e.g., “\\Server\Share”). The server processes these paths without validation, r… Medium Fri, 07 Aug 2026 09:45:18 GMT https://vulnogram.org/CVE-2026-54206 https://vulnogram.org/CVE-2026-54206 Tobit Laboratories AG TeamDavid's Webbox 's sending email, fax, SMS, etc. functionality accepts a @@INCLUDE command, which can be set to network locations using UNC paths (e.g., “\\Server\Share”). The server processes these paths without validation,… Medium Fri, 07 Aug 2026 09:44:58 GMT https://vulnogram.org/CVE-2026-54204 https://vulnogram.org/CVE-2026-54204 Tobit Laboratories AG TeamDavid's Webbox 's search functionality accepts a “pathnameroot” parameter, which can be set to network locations using UNC paths (e.g., “\\Server\Share”). The server processes these paths without validation, resulting in out… High Network Exploitable Fri, 07 Aug 2026 09:44:38 GMT https://vulnogram.org/CVE-2026-54203 https://vulnogram.org/CVE-2026-54203 Memory Leak to an Unauthorized Actor vulnerability in Tobit Laboratories AG TeamDavid's Webbox allows reading of sensitive information. When accessing the URL “/.well-known/mta-sts.”, the application responds with memory. By repeatedly requesting thi… Critical Network Exploitable Fri, 07 Aug 2026 09:44:13 GMT https://vulnogram.org/CVE-2026-54202 https://vulnogram.org/CVE-2026-54202 Tobit Laboratories AG TeamDavid's Webbox is vulnerable to a path traversal vulnerability in the archive creation functionality. Because the archive path is user-controlled and insufficiently validated, an attacker can manipulate the input to traverse… High Fri, 07 Aug 2026 09:43:41 GMT https://vulnogram.org/CVE-2026-54201 https://vulnogram.org/CVE-2026-54201 Tobit Laboratories AG TeamDavid's Webbox does not enforce authentication or authorization checks when serving these log files. As a result, attackers can obtain sensitive error information or internal application details, potentially aiding in furthe… Medium Network Exploitable Fri, 07 Aug 2026 09:43:18 GMT https://vulnogram.org/CVE-2026-54200 https://vulnogram.org/CVE-2026-54200 Tobit Laboratories AG TeamDavid's Webbox is vulnerable to a local file inclusion vulnerability in the send email, fax, SMS, etc. functionality. By specifying an '@@attach' command in the form field 'scjob', files can be attached to a message, which c… High Fri, 07 Aug 2026 09:41:49 GMT https://vulnogram.org/CVE-2026-54199 https://vulnogram.org/CVE-2026-54199 Tobit Laboratories AG TeamDavid's Webbox is vulnerable to HTTP header injection through the request body in the application's link storing functionality (//ServerClient_celink.htm), which is appended to the redirect target in the 302 HTTP response. I… Medium Network Exploitable Fri, 07 Aug 2026 09:41:22 GMT https://vulnogram.org/CVE-2026-12071 https://vulnogram.org/CVE-2026-12071 The Webbox of TeamDavid by Tobit Laboratories AG constructs redirect URLs using user-supplied input, which is appended to the redirect target in a 302 HTTP response. By using URL-encoded characters such as “%2e” (representing a dot), an attacker can… Medium Network Exploitable Fri, 07 Aug 2026 09:40:52 GMT https://vulnogram.org/CVE-2026-12070 https://vulnogram.org/CVE-2026-12070 Tobit Laboratories AG TeamDavid's Webbox is vulnerable to an arbitrary file deletion vulnerability in the send email, fax, SMS, etc. functionality. By specifying an @@COMMENTFILE command in the form field scjob, any file on the system can be deleted.… High Fri, 07 Aug 2026 09:40:02 GMT https://vulnogram.org/CVE-2026-9169 https://vulnogram.org/CVE-2026-9169 DLL Search Order Hijacking in LUCID Vision Labs Arena SDK 1.0.80.49 on Windows allows a local attacker to execute arbitrary code with the privileges of the application by placing a malicious DLL in a user-controlled directory listed in the PATH envir… High Fri, 07 Aug 2026 08:47:13 GMT https://vulnogram.org/CVE-2026-16022 https://vulnogram.org/CVE-2026-16022 @oblique/cli 15.4.0 contains an OS command injection vulnerability in the project creation functionality. The CLI constructs shell commands through string concatenation and executes them with execSync(). A user-controlled project-name argument is ins… High Wed, 05 Aug 2026 12:06:19 GMT https://vulnogram.org/CVE-2026-55732 https://vulnogram.org/CVE-2026-55732 Out-of-bounds Read (CWE-125) in BACnet packet parsing (`bacdt_datetime_to_tod`) in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.18 on LINX-A64 allows an unauthenticated remote attacker to crash `linx_a64.exe` an… High Network Exploitable Fri, 24 Jul 2026 14:00:48 GMT https://vulnogram.org/CVE-2026-55731 https://vulnogram.org/CVE-2026-55731 Unchecked input for loop condition (CWE-606) in the SNMP agent in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to cause persistent denial of service (CPU… Medium Network Exploitable Fri, 24 Jul 2026 14:00:30 GMT https://vulnogram.org/CVE-2026-55730 https://vulnogram.org/CVE-2026-55730 Reflected Cross-Site Scripting (CWE-79) in LWEB802 in Loytec LWEB-802 before 5.0.8 on all platforms allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's browser and perform actions with the victim's privileges via a… High Network Exploitable Fri, 24 Jul 2026 14:00:04 GMT https://vulnogram.org/CVE-2026-55729 https://vulnogram.org/CVE-2026-55729 Exposure of Sensitive Information (CWE-200) in LWEB802 browser `localStorage` in Loytec LWEB-802 before 5.0.8 on all platforms allows an unauthenticated remote attacker to leak stored management credentials via a crafted link. High Network Exploitable Fri, 24 Jul 2026 13:59:43 GMT https://vulnogram.org/CVE-2026-55728 https://vulnogram.org/CVE-2026-55728 Stack-based Buffer Overflow (CWE-121) in `/usr/bin/ltsudo` `cmd_ipaddr_conflict` in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a `superadmin`-group attacker to trigger a SUID-root process… Low Fri, 24 Jul 2026 13:58:35 GMT