https://vulnogram.org/ Most recent CVEs assigned by TCS-CERT (Thales Cyber Solutions Customer’s CERT) (tcs-cert). https://vulnogram.org/seaview/icons/tcs-cert.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-18825 https://vulnogram.org/CVE-2026-18825 An Origin Validation Error in the middleware of the connect-xcors npm package allows an attacker to bypass origin verification and perform a cross domain authenticated request. Medium Network Exploitable Mon, 28 Sep 2026 12:32:17 GMT https://vulnogram.org/CVE-2026-19614 https://vulnogram.org/CVE-2026-19614 The API is prone to XML external entity (XXE) injection. By default, XML external entity support is enabled. This issue affects NanoXML: 2.2.3. Medium Tue, 08 Sep 2026 10:28:10 GMT https://vulnogram.org/CVE-2026-9007 https://vulnogram.org/CVE-2026-9007 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in HCL Notes from HCL Software allows reflected Cross-Site Scripting (XSS). Successful exploitation allows an attacker to execute arbitrary JavaScript… Medium Network Exploitable Wed, 15 Jul 2026 15:41:34 GMT https://vulnogram.org/CVE-2026-6501 https://vulnogram.org/CVE-2026-6501 Improper restriction of XML external entity reference vulnerability in ILM Informatique jOpenDocument allows Data Serialization External Entities Blowup. This issue affects jOpenDocument: 1.5. Medium Mon, 04 May 2026 14:26:50 GMT https://vulnogram.org/CVE-2026-6500 https://vulnogram.org/CVE-2026-6500 Plaintext storage of a password vulnerability in ILM Informatique OpenConcerto allows Retrieve Embedded Sensitive Data. This issue affects OpenConcerto: 1.7.5. Medium Mon, 04 May 2026 14:16:41 GMT https://vulnogram.org/CVE-2026-6499 https://vulnogram.org/CVE-2026-6499 Incorrect Permission Assignment for Critical Resource vulnerability in ILM Informatique OpenConcerto allows Replace Binaries. This issue affects OpenConcerto: 1.7.5. Low Mon, 04 May 2026 14:08:03 GMT https://vulnogram.org/CVE-2026-2344 https://vulnogram.org/CVE-2026-2344 A vulnerability in Plunet Plunet BusinessManager allows unauthorized actions being performed on behalf of privileged users.This issue affects Plunet BusinessManager: 10.15.1 High Wed, 11 Feb 2026 14:53:20 GMT https://vulnogram.org/CVE-2026-2337 https://vulnogram.org/CVE-2026-2337 A vulnerability in Plunet Plunet BusinessManager allows session hijacking, data theft, unauthorized actions on behalf of the user.This issue affects Plunet BusinessManager: 10.15.1. High Network Exploitable Wed, 11 Feb 2026 13:28:30 GMT https://vulnogram.org/CVE-2025-15479 https://vulnogram.org/CVE-2025-15479 Stored cross-site scripting (XSS, CWE-79) in the survey content and administration functionality in Data Illusion Zumbrunn NGSurvey Enterprise Edition 3.6.4 on all supported platforms ( on Windows and Linux servers ) allows authenticated remote users… Medium Wed, 07 Jan 2026 13:23:09 GMT https://vulnogram.org/CVE-2025-13873 https://vulnogram.org/CVE-2025-13873 Stored Cross-Site Scripting (XSS) in the survey-import feature of ObjectPlanet Opinio 7.26 rev12562 on web application allows an attacker to inject arbitrary JavaScript code, which executes in the browsing context of any visitor accessing the comprom… Medium Tue, 02 Dec 2025 09:56:16 GMT https://vulnogram.org/CVE-2025-13872 https://vulnogram.org/CVE-2025-13872 Blind Server-Side Request Forgery (SSRF) in the survey-import feature of ObjectPlanet Opinio 7.26 rev12562 on Web-based platforms allows an attacker to force the server to perform HTTP GET requests via crafted import requests to an arbitrary destinat… Low Tue, 02 Dec 2025 09:51:59 GMT https://vulnogram.org/CVE-2025-13871 https://vulnogram.org/CVE-2025-13871 Cross-Site Request Forgery (CSRF) in the resource-management feature of ObjectPlanet Opinio 7.26 rev12562 allows to upload files on behalf of the connected users and then access such files without authentication. Low Network Exploitable Tue, 02 Dec 2025 09:42:51 GMT https://vulnogram.org/CVE-2025-13829 https://vulnogram.org/CVE-2025-13829 Incorrect Authorization vulnerability in Data Illusion Zumbrunn NGSurvey allows any logged-in user to obtain the private information of any other user. Critical information retrieved: * APIKEY (1 year user Session) * RefreshToken (10 minutes user Ses… High Mon, 01 Dec 2025 15:47:10 GMT