https://vulnogram.org/ Most recent CVEs assigned by SEC Consult Vulnerability Lab (sec-vlab). https://vulnogram.org/seaview/icons/sec-vlab.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:06 GMT https://vulnogram.org/CVE-2026-4638 https://vulnogram.org/CVE-2026-4638 PRTG Network Monitor before version 26.2.120.1449 ships a demo EXE/Script sensor that multiplies two integer parameters using cscript.exe. If a non-numeric value is passed instead, cscript.exe raises a 'Type mismatch' runtime error that includes the… High Thu, 24 Sep 2026 10:57:54 GMT https://vulnogram.org/CVE-2026-4637 https://vulnogram.org/CVE-2026-4637 Paessler PRTG Network Monitor before version 26.2.120.1449 is affected by a reflected Cross-Site Scripting (XSS) vulnerability. When a request is made for a non-existent resource ending in \".htm\", the web interface returns an HTTP 403 \"Forbidden P… Medium Network Exploitable Thu, 24 Sep 2026 10:05:06 GMT https://vulnogram.org/CVE-2025-10560 https://vulnogram.org/CVE-2025-10560 Worksnaps before version 1.6.20260201 contains hardcoded cloud credentials and related secret material in the Worksnaps client application binaries. The exposed credentials included AWS access keys, S3 bucket names, and related cloud access informati… Critical Network Exploitable Thu, 18 Jun 2026 08:32:14 GMT https://vulnogram.org/CVE-2026-11858 https://vulnogram.org/CVE-2026-11858 Quanos SCHEMA ST4 on-premises contains a local privilege escalation vulnerability in the Client Update Service. The update service runs as NT AUTHORITY\SYSTEM and exposes a .NET Remoting interface over a named pipe without sufficient access controls… High Wed, 17 Jun 2026 11:50:47 GMT https://vulnogram.org/CVE-2026-11857 https://vulnogram.org/CVE-2026-11857 Quanos SCHEMA ST4 on-premises contains a local privilege escalation vulnerability in the Client Update Service due to insecure deserialization in the .NET Remoting service. The service is configured with TypeFilterLevel.Full and is bound to local int… High Wed, 17 Jun 2026 11:42:02 GMT https://vulnogram.org/CVE-2026-12225 https://vulnogram.org/CVE-2026-12225 syracom AG Secure Login (2FA) for Atlassian Jira, Confluence, and Bitbucket 3.4.0.x contains an authentication bypass vulnerability. An attacker with valid credentials for a user account can bypass the two-factor authentication flow by sending HTTP r… High Tue, 16 Jun 2026 11:20:37 GMT https://vulnogram.org/CVE-2026-34030 https://vulnogram.org/CVE-2026-34030 The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, does not sufficiently validate the branch code when a new branch is created. The branch code is later used in multiple application functions, including filesystem path generation… Medium Mon, 15 Jun 2026 10:05:36 GMT https://vulnogram.org/CVE-2026-34029 https://vulnogram.org/CVE-2026-34029 The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains a hard-coded cryptographic key in the SafeSystem.Infrastructure.Security.dll component. An attacker with access to the application files can reverse engineer the DLL and… Medium Mon, 15 Jun 2026 10:05:13 GMT https://vulnogram.org/CVE-2026-34028 https://vulnogram.org/CVE-2026-34028 The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, exposes web-accessible file paths that are not protected by an authorization scheme. An unauthenticated attacker can directly access HTTP endpoints to download files from location… Medium Network Exploitable Mon, 15 Jun 2026 10:04:56 GMT https://vulnogram.org/CVE-2026-34027 https://vulnogram.org/CVE-2026-34027 The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains insufficient server-side file type validation in the /safe/contract/uploadcustomdocuments endpoint. The application validates uploaded files based on the user-controlled… Medium Mon, 15 Jun 2026 10:04:35 GMT https://vulnogram.org/CVE-2026-34026 https://vulnogram.org/CVE-2026-34026 Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains a path traversal vulnerability in the documentName parameter of the /safe/selfservice/openselfservicedocument endpoint. The application constructs a file path using attacker-… High Mon, 15 Jun 2026 10:04:13 GMT https://vulnogram.org/CVE-2026-34025 https://vulnogram.org/CVE-2026-34025 The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains an IP restriction bypass vulnerability in the login process. The application restricts user logins based on the IP address associated with a branch location, but the clie… Medium Mon, 15 Jun 2026 10:03:53 GMT https://vulnogram.org/CVE-2026-34024 https://vulnogram.org/CVE-2026-34024 The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains missing authorization checks on multiple web application endpoints. An authenticated attacker with minimal privileges can access endpoints that are not visible in the fro… High Mon, 15 Jun 2026 10:03:33 GMT https://vulnogram.org/CVE-2026-34023 https://vulnogram.org/CVE-2026-34023 The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains an incorrect authorization vulnerability in the WebSocket communication used by the SafeController WebMessageBroker. An authenticated attacker with valid low-privileged b… High Mon, 15 Jun 2026 10:03:11 GMT https://vulnogram.org/CVE-2026-34022 https://vulnogram.org/CVE-2026-34022 The Wertheim SafeController Family 65000, Controller 65000 - AssemblyVersion 6.11.8130.22319, uses weak custom cryptographic algorithms with hard-coded cryptographic keys to protect communication. An attacker in an adversary-in-the-middle position ca… High Mon, 15 Jun 2026 10:02:33 GMT https://vulnogram.org/CVE-2026-34021 https://vulnogram.org/CVE-2026-34021 The Wertheim SafeController 5400, Controller 5400 - AssemblyVersion 6.11.8130.22320, uses RS-485 communication between the server and the microcontroller without cryptographic protection. An attacker with access to the communication path between the… High Mon, 15 Jun 2026 10:02:09 GMT https://vulnogram.org/CVE-2026-24067 https://vulnogram.org/CVE-2026-24067 Slate Digital Connect 1.37.0 for macOS installs a privileged helper tool, com.slatedigital.connect.privileged.helper.tool, which exposes the XPC service com.slatedigital.connect.privileged.helper.tool2. The helper validates connecting XPC clients by… High Wed, 10 Jun 2026 11:49:10 GMT https://vulnogram.org/CVE-2026-24066 https://vulnogram.org/CVE-2026-24066 Slate Digital Connect 1.37.0 for macOS installs a privileged helper tool, com.slatedigital.connect.privileged.helper.tool, which exposes the XPC service com.slatedigital.connect.privileged.helper.tool2. The helper validates connecting XPC clients by… High Wed, 10 Jun 2026 11:43:53 GMT https://vulnogram.org/CVE-2026-24065 https://vulnogram.org/CVE-2026-24065 Waves Central for macOS versions 13.0.9 through 16.5.5 contain a local privilege escalation vulnerability in the privileged helper service. The helper validates connecting XPC clients using the client process identifier (PID) to verify code-signing i… High Network Exploitable Tue, 09 Jun 2026 14:50:15 GMT https://vulnogram.org/CVE-2026-24064 https://vulnogram.org/CVE-2026-24064 Waves Central for macOS versions 13.0.9 through 16.5.5 contain a local privilege escalation vulnerability. A trusted XPC client component included with the product is signed with hardened runtime entitlements that permit dynamic library injection. A… High Tue, 09 Jun 2026 14:47:16 GMT https://vulnogram.org/CVE-2025-10539 https://vulnogram.org/CVE-2025-10539 Due to improper TLS certificate validation in the DeskTime Time Tracking App before version 1.3.674, attackers who can position themselves in the network path between the client and the DeskTime update servers can return a malicious executable in res… Medium Network Exploitable Tue, 28 Apr 2026 07:52:23 GMT https://vulnogram.org/CVE-2025-10549 https://vulnogram.org/CVE-2025-10549 EfficientLab Controlio before v1.3.95 contains a DLL hijacking vulnerability caused by weak folder permissions in the installation directory. A local attacker can place a specially crafted DLL in this directory and achieve arbitrary code execution wi… Medium Thu, 23 Apr 2026 06:57:27 GMT https://vulnogram.org/CVE-2026-24069 https://vulnogram.org/CVE-2026-24069 Kiuwan SAST improperly authorizes SSO logins for locally disabled mapped user accounts, allowing disabled users to continue accessing the application. Kiuwan Cloud was affected, and Kiuwan SAST on-premise (KOP) was affected before 2.8.2509.4. Medium Tue, 14 Apr 2026 11:26:55 GMT https://vulnogram.org/CVE-2026-24068 https://vulnogram.org/CVE-2026-24068 The VSL privileged helper does utilize NSXPC for IPC. The implementation of the "shouldAcceptNewConnection" function, which is used by the NSXPC framework to validate if a client should be allowed to connect to the XPC listener, does not validate cli… High Thu, 26 Mar 2026 10:55:54 GMT https://vulnogram.org/CVE-2026-24063 https://vulnogram.org/CVE-2026-24063 When a plugin is installed using the Arturia Software Center (MacOS), it also installs an uninstall.sh bash script in a root owned path. This script is written to disk with the file permissions 777, meaning it is writable by any user. When uninstalli… High Wed, 18 Mar 2026 15:33:35 GMT https://vulnogram.org/CVE-2026-24062 https://vulnogram.org/CVE-2026-24062 The "Privileged Helper" component of the Arturia Software Center (MacOS) does not perform sufficient client code signature validation when a client connects. This leads to an attacker being able to connect to the helper and execute privileged actions… High Wed, 18 Mar 2026 15:24:07 GMT https://vulnogram.org/CVE-2025-10010 https://vulnogram.org/CVE-2025-10010 The CPSD CryptoPro Secure Disk application boots a small Linux operating system to perform user authentication before using BitLocker to decrypt the Windows partition. The system is located on a separate unencrypted partition which can be reached by… Medium Tue, 24 Feb 2026 14:13:29 GMT https://vulnogram.org/CVE-2025-15563 https://vulnogram.org/CVE-2025-15563 Any unauthenticated user can reset the WorkTime on-prem database configuration by sending a specific HTTP request to the WorkTime server. No authorization check is applied here. Medium Network Exploitable Thu, 19 Feb 2026 11:01:56 GMT https://vulnogram.org/CVE-2025-15562 https://vulnogram.org/CVE-2025-15562 The server API endpoint /report/internet/urls reflects received data into the HTML response without applying proper encoding or filtering. This allows an attacker to execute arbitrary JavaScript in the victim's browser if the victim opens a URL prepa… Medium Network Exploitable Thu, 19 Feb 2026 10:54:52 GMT https://vulnogram.org/CVE-2025-15561 https://vulnogram.org/CVE-2025-15561 An attacker can exploit the update behavior of the WorkTime monitoring daemon to elevate privileges on the local system to NT Authority\SYSTEM. A malicious executable must be named WTWatch.exe and dropped in the C:\ProgramData\wta\ClientExe directory… High Thu, 19 Feb 2026 10:53:18 GMT https://vulnogram.org/CVE-2025-15560 https://vulnogram.org/CVE-2025-15560 An authenticated attacker with minimal permissions can exploit a SQL injection in the WorkTime server "widget" API endpoint to inject SQL queries. If the Firebird backend is used, attackers are able to retrieve all data from the database backend. If… High Thu, 19 Feb 2026 10:48:43 GMT https://vulnogram.org/CVE-2025-15559 https://vulnogram.org/CVE-2025-15559 An unauthenticated attacker can inject OS commands when calling a server API endpoint in NesterSoft WorkTime. The server API call to generate and download the WorkTime client from the WorkTime server is vulnerable in the “guid” parameter. This allows… Critical Network Exploitable Thu, 19 Feb 2026 10:45:34 GMT https://vulnogram.org/CVE-2025-15574 https://vulnogram.org/CVE-2025-15574 When connecting to the Solax Cloud MQTT server the username is the "registration number", which is the 10 character string printed on the SolaX Power Pocket device / the QR code on the device. The password is derived from the "registration number" us… Medium Network Exploitable Thu, 12 Feb 2026 10:58:29 GMT https://vulnogram.org/CVE-2025-15575 https://vulnogram.org/CVE-2025-15575 The firmware update functionality does not verify the authenticity of the supplied firmware update files. This allows attackers to flash malicious firmware update files on the device. Initial analysis of the firmware update functionality does not sho… Medium Network Exploitable Thu, 12 Feb 2026 10:51:44 GMT https://vulnogram.org/CVE-2025-15573 https://vulnogram.org/CVE-2025-15573 The affected devices do not validate the server certificate when connecting to the SolaX Cloud MQTTS server hosted in the Alibaba Cloud (mqtt001.solaxcloud.com, TCP 8883). This allows attackers in a man-in-the-middle position to act as the legitimate… Critical Network Exploitable Thu, 12 Feb 2026 10:39:35 GMT https://vulnogram.org/CVE-2026-24071 https://vulnogram.org/CVE-2026-24071 It was found that the XPC service offered by the privileged helper of Native Access uses the PID of the connecting client to verify its code signature. This is considered insecure and can be exploited by PID reuse attacks. The connection handler func… High Mon, 02 Feb 2026 13:23:51 GMT https://vulnogram.org/CVE-2026-24070 https://vulnogram.org/CVE-2026-24070 During the installation of the Native Access application, a privileged helper `com.native-instruments.NativeAccess.Helper2`, which is used by Native Access to trigger functions via XPC communication like copy-file, remove or set-permissions, is deplo… High Mon, 02 Feb 2026 13:15:37 GMT https://vulnogram.org/CVE-2025-59109 https://vulnogram.org/CVE-2025-59109 The dormakaba registration units 9002 (PIN Pad Units) have an exposed UART header on the backside. The PIN pad is sending every button press to the UART interface. An attacker can use the interface to exfiltrate PINs. As the devices are explicitly bu… Medium Mon, 26 Jan 2026 10:06:45 GMT https://vulnogram.org/CVE-2025-59108 https://vulnogram.org/CVE-2025-59108 By default, the password for the Access Manager's web interface, is set to 'admin'. In the tested version changing the password was not enforced. Critical Network Exploitable Mon, 26 Jan 2026 10:06:31 GMT https://vulnogram.org/CVE-2025-59107 https://vulnogram.org/CVE-2025-59107 Dormakaba provides the software FWServiceTool to update the firmware version of the Access Managers via the network. The firmware in some instances is provided in an encrypted ZIP file. Within this tool, the password used to decrypt the ZIP and extra… High Mon, 26 Jan 2026 10:06:22 GMT https://vulnogram.org/CVE-2025-59106 https://vulnogram.org/CVE-2025-59106 The binary serving the web server and executing basically all actions launched from the Web UI is running with root privileges. This is against the least privilege principle. If an attacker is able to execute code on the system via other vulnerabilit… High Mon, 26 Jan 2026 10:06:13 GMT https://vulnogram.org/CVE-2025-59105 https://vulnogram.org/CVE-2025-59105 With physical access to the device and enough time an attacker can desolder the flash memory, modify it and then reinstall it because of missing encryption. Thus, essential files, such as "/etc/passwd", as well as stored certificates, cryptographic k… High Mon, 26 Jan 2026 10:06:02 GMT https://vulnogram.org/CVE-2025-59104 https://vulnogram.org/CVE-2025-59104 With physical access to the device and enough time an attacker is able to solder test leads to the debug footprint (or use the 6-Pin tag-connect cable). Thus, the attacker gains access to the bootloader, where the kernel command line can be changed.… High Mon, 26 Jan 2026 10:05:54 GMT https://vulnogram.org/CVE-2025-59103 https://vulnogram.org/CVE-2025-59103 The Access Manager 92xx in hardware revision K7 is based on Linux instead of Windows CE embedded in older hardware revisions. In this new hardware revision it was noticed that an SSH service is exposed on port 22. By analyzing the firmware of the dev… Critical Network Exploitable Mon, 26 Jan 2026 10:05:45 GMT https://vulnogram.org/CVE-2025-59102 https://vulnogram.org/CVE-2025-59102 The web server of the Access Manager offers a functionality to download a backup of the local database stored on the device. This database contains the whole configuration. This includes encrypted MIFARE keys, card data, user PINs and much more. The… Medium Mon, 26 Jan 2026 10:05:31 GMT https://vulnogram.org/CVE-2025-59101 https://vulnogram.org/CVE-2025-59101 Instead of typical session tokens or cookies, it is verified on a per-request basis if the originating IP address has once successfully logged in. As soon as an authentication request from a certain source IP is successful, the IP address is handled… High Network Exploitable Mon, 26 Jan 2026 10:05:20 GMT https://vulnogram.org/CVE-2025-59100 https://vulnogram.org/CVE-2025-59100 The web interface offers a functionality to export the internal SQLite database. After executing the database export, an automatic download is started and the device reboots. After rebooting, the exported database is deleted and cannot be accessed an… Medium Network Exploitable Mon, 26 Jan 2026 10:05:11 GMT https://vulnogram.org/CVE-2025-59099 https://vulnogram.org/CVE-2025-59099 The Access Manager is using the open source web server CompactWebServer written in C#. This web server is affected by a path traversal vulnerability, which allows an attacker to directly access files via simple GET requests without prior authenticati… High Network Exploitable Mon, 26 Jan 2026 10:05:02 GMT https://vulnogram.org/CVE-2025-59098 https://vulnogram.org/CVE-2025-59098 The Access Manager is offering a trace functionality to debug errors and issues with the device. The trace functionality is implemented as a simple TCP socket. A tool called TraceClient.exe, provided by dormakaba via the Access Manager web interface,… High Network Exploitable Mon, 26 Jan 2026 10:04:51 GMT https://vulnogram.org/CVE-2025-59097 https://vulnogram.org/CVE-2025-59097 The exos 9300 application can be used to configure Access Managers (e.g. 92xx, 9230 and 9290). The configuration is done in a graphical user interface on the dormakaba exos server. As soon as the save button is clicked in exos 9300, the whole configu… Critical Network Exploitable Mon, 26 Jan 2026 10:04:38 GMT