https://vulnogram.org/ Most recent CVEs assigned by Security Risk Advisors (SRA) (sra). https://vulnogram.org/seaview/icons/sra.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-6881 https://vulnogram.org/CVE-2026-6881 A SQL Injection in the Giving Reports functionality in Ellucian Advance Web and Legacy Advance allows an authenticated attacker to extract sensitive information from databases via a crafted SQL query in the class credit field. This issue affects Adva… Critical Tue, 28 Jul 2026 20:03:11 GMT https://vulnogram.org/CVE-2026-13381 https://vulnogram.org/CVE-2026-13381 VSee Clinic 7.1.26 and API 1.3.0 contain an Insecure Direct Object Reference (IDOR) vulnerability in the /v1.3.0/api/files endpoint. An authenticated attacker can manipulate the 'remark' request parameter to enumerate, retrieve, and delete files belo… High Mon, 20 Jul 2026 20:12:55 GMT https://vulnogram.org/CVE-2026-13380 https://vulnogram.org/CVE-2026-13380 VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 exposes cleartext SFTP credentials in the HTTP responses of three unauthenticated endpoints. The credentials are present in these responses only when SFTP connections have been configured within the applic… Critical Network Exploitable Mon, 20 Jul 2026 20:11:46 GMT https://vulnogram.org/CVE-2026-9588 https://vulnogram.org/CVE-2026-9588 A stored cross-site scripting (XSS) vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997) within the voicemail notification template functionality. The submit_modify_voicemail_template endpoint fails to properly sanitize HTML content sup… High Fri, 17 Jul 2026 15:59:23 GMT https://vulnogram.org/CVE-2026-9587 https://vulnogram.org/CVE-2026-9587 An authenticated local file inclusion vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The play_file functionality accepts user-controlled input through the sound_path parameter and fails to properly validate file paths before acce… High Fri, 17 Jul 2026 15:58:25 GMT https://vulnogram.org/CVE-2026-9586 https://vulnogram.org/CVE-2026-9586 An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with <PolycomIPPhone> and directly concatenates the user-controlled PhoneIP value into PostgreSQL qu… Critical Known Exploited Network Exploitable Fri, 17 Jul 2026 15:57:42 GMT https://vulnogram.org/CVE-2026-9585 https://vulnogram.org/CVE-2026-9585 An unauthenticated reflected cross-site scripting (XSS) vulnerability exists in Sangoma Switchvox SMB Edition version 8.3 (104997). The application fails to properly sanitize the portal parameter supplied to the invalid_browser and invalid_browser_lo… High Network Exploitable Fri, 17 Jul 2026 15:56:32 GMT https://vulnogram.org/CVE-2025-58744 https://vulnogram.org/CVE-2025-58744 Use of Default Credentials, Hard-coded Credentials vulnerability in C2SGlobalSettings.dll in Milner ImageDirector Capture on Windows allows decryption of document archive files using credentials decrypted with hard-coded application encryption key. T… Medium Tue, 20 Jan 2026 21:38:02 GMT https://vulnogram.org/CVE-2025-58743 https://vulnogram.org/CVE-2025-58743 Use of a Broken or Risky Cryptographic Algorithm (DES) vulnerability in the Password class in C2SConnections.dll in Milner ImageDirector Capture on Windows allows Encryption Brute Forcing to obtain database credentials.This issue affects ImageDirecto… High Tue, 20 Jan 2026 21:37:25 GMT https://vulnogram.org/CVE-2025-58742 https://vulnogram.org/CVE-2025-58742 Insufficiently Protected Credentials, Improper Restriction of Communication Channel to Intended Endpoints vulnerability in the Connection Settings dialog in Milner ImageDirector Capture on Windows allows Adversary in the Middle (AiTM) by modifying th… High Tue, 20 Jan 2026 21:36:54 GMT https://vulnogram.org/CVE-2025-58741 https://vulnogram.org/CVE-2025-58741 Insufficiently Protected Credentials vulnerability in the Credential Field of Milner ImageDirector Capture allows retrieval of credential material and enables database access.This issue affects ImageDirector Capture: from 7.0.9 through 7.6.3.25808. High Tue, 20 Jan 2026 21:36:26 GMT https://vulnogram.org/CVE-2025-58740 https://vulnogram.org/CVE-2025-58740 The use of a hard-coded encryption key in calls to the Password function in C2SGlobalSettings.dll in Milner ImageDirector Capture on Windows allows a local attacker to decrypt database credentials by reading the cryptographic key from the executable.… High Tue, 20 Jan 2026 21:36:00 GMT https://vulnogram.org/CVE-2025-12874 https://vulnogram.org/CVE-2025-12874 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Quest Coexistence Manager for Notes (Free/Busy Connector modules) allows HTTP Request Smuggling via the Content-Length-Transfer-Encoding (CL.TE) attack… Medium Network Exploitable Fri, 19 Dec 2025 19:36:57 GMT https://vulnogram.org/CVE-2023-6260 https://vulnogram.org/CVE-2023-6260 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Brivo ACS100, ACS300 allows OS Command Injection, Bypassing Physical Security.This issue affects ACS100 (Network Adjacent Access), ACS300 (Phy… Critical Mon, 19 Feb 2024 21:30:20 GMT https://vulnogram.org/CVE-2023-6259 https://vulnogram.org/CVE-2023-6259 Insufficiently Protected Credentials, : Improper Access Control vulnerability in Brivo ACS100, ACS300 allows Password Recovery Exploitation, Bypassing Physical Security.This issue affects ACS100, ACS300: from 5.2.4 before 6.2.4.3. High Mon, 19 Feb 2024 21:28:01 GMT