Csaf
by Cisagov
Source repositories
CVEs (180)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-90457 | Med | 0.33 | 6.2 | 0.00 | Sep 11, 2026 | The administrative password is hashed using a comparatively weak, fast algorithm for the credential store backing one authentication path, and the file containing that hash is written with permissions allowing it to be read by any local user. This is inconsistent with a… | ||
| CVE-2025-53471 | Med | 0.33 | 5.1 | 0.00 | Jul 11, 2025 | Emerson ValveLink products receive input or data, but does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. | ||
| CVE-2026-33272 | Med | 0.32 | 4.9 | 0.00 | Oct 9, 2026 | A malicious user with physical access to the device can boot the switch from factory settings without authentication, use the default administrative credentials to obtain administrative access, and save changes to the configuration file so that they persist next time the switch… | ||
| CVE-2026-90451 | Med | 0.31 | 5.9 | 0.00 | Sep 11, 2026 | An example environment-configuration file ships with a fixed, publicly-known secret value used to sign authentication cookies for a bundled packet-analysis component. A deployment that copies this example file into active configuration without running the setup routine that… | ||
| CVE-2026-81824 | Med | 0.31 | 4.7 | 0.00 | Sep 8, 2026 | The vulnerability, if exploited, could allow a miscreant to run arbitrary JavaScript code in a browser session of a PIMBoards user who was socially engineered to click on a malicious link. | ||
| CVE-2026-50099 | Med | 0.30 | 4.6 | 0.00 | Jun 12, 2026 | During WiFi association, Naxclow device firmware prints the host network’s SSID, PSK, and negotiated WPA keys in cleartext to an exposed UART console on production hardware. The UART pads are labeled, run with default serial settings, and drop to an interactive RT-Thread shell… | ||
| CVE-2025-67634 | Med | 0.29 | 4.4 | 0.00 | Dec 12, 2025 | The CISA Software Acquisition Guide Supplier Response Web Tool before 2025-12-11 was vulnerable to cross-site scripting via text fields. If an attacker could convince a user to import a specially-crafted JSON file, the Tool would load JavaScript from the file into the page. The… | ||
| CVE-2026-90443 | Med | 0.28 | 5.4 | 0.00 | Sep 11, 2026 | A web interface reflects a portion of the request URL into a script context and a hyperlink attribute without adequate encoding, and does not require authentication to reach. This allows an unauthenticated network attacker to craft a link that, when visited by a user, executes… | ||
| CVE-2026-17264 | Med | 0.28 | 4.3 | 0.00 | Aug 7, 2026 | Opening a crafted DICOM file containing malicious JPEG-compressed pixel data triggers an attacker-controlled heap out-of-bounds write, which may allow an attacker to remotely execute arbitrary code. | ||
| CVE-2026-107361 | Med | 0.27 | 4.2 | 0.00 | Oct 8, 2026 | The Arkime live capture service (arkime-live) in Malcolm runs with network_mode: host, exposing port 8005 on all network interfaces (viewHost=0.0.0.0). Arkime trusts the X-Forwarded-User header from any IP address (userAuthIps=::,0.0.0.0/0) and auto-creates users with full… | ||
| CVE-2026-102137 | Med | 0.27 | 4.1 | 0.00 | Sep 30, 2026 | An authenticated administrator could bypass the content validation applied to an administrative file upload and store a file containing dangerous content on the appliance. This did not by itself result in code execution, which would require a separate vulnerability to run the… | ||
| CVE-2026-90452 | Med | 0.27 | 5.3 | 0.00 | Sep 11, 2026 | Requests from the reverse proxy to the identity-provider service for token discovery, introspection, and credential exchange do not verify the identity provider's server certificate. An attacker positioned on the network path between the proxy and the identity provider could… | ||
| CVE-2026-69662 | Low | 0.24 | 3.7 | 0.00 | Sep 29, 2026 | The application uses unsafe functions that allow execution of inline scripts and string evaluation functions. | ||
| CVE-2026-71189 | Low | 0.23 | 3.5 | 0.00 | Sep 29, 2026 | An attacker can construct a request that, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application. | ||
| CVE-2026-85478 | Low | 0.23 | 3.5 | 0.00 | Sep 18, 2026 | A CM2507 IP camera running firmware version HMT.CM2507 v251211.1507 exposes an interactive bootloader through a physical debug interface without requiring authentication. An attacker with physical access could interrupt the normal boot process and access functionality that… | ||
| CVE-2026-90454 | Med | 0.21 | 4.3 | 0.00 | Sep 11, 2026 | A deployment mode intended to expose only read access to a bundled packet-analysis component's interface denies a list of write-capable routes by pattern, but the pattern omits routes that modify tags attached to stored session records, and the proxy configuration otherwise… | ||
| CVE-2026-90450 | Med | 0.21 | 4.3 | 0.00 | Sep 11, 2026 | The application's role-authorization lookup defaults to granting access when a request handler's name is not present in its table of role requirements, rather than defaulting to deny. Any request handler that is not explicitly registered in this table is reachable by any… | ||
| CVE-2026-90446 | Med | 0.21 | 4.3 | 0.00 | Sep 11, 2026 | An application programming interface endpoint accepts a user-supplied value and interpolates it directly into the path of a backend request to the underlying search and analytics data store, without restricting its contents. This allows an authenticated attacker to substitute an… | ||
| CVE-2026-90455 | Low | 0.17 | 3.7 | 0.00 | Sep 11, 2026 | A prior update that raised a bundled HTTP client library to a version remediating known vulnerabilities was later reverted, reintroducing the earlier, vulnerable version into a log-processing component. The only code path in that component using the library issues a request to a… | ||
| CVE-2026-90453 | Low | 0.16 | 3.5 | 0.00 | Sep 11, 2026 | A file-upload handler redirects the authenticated client's browser to a URL taken directly from that same request's Referer header, without validating it against the application's own origin. This allows an authenticated attacker to craft a request that causes another user's… |
- risk 0.33cvss 6.2epss 0.00
The administrative password is hashed using a comparatively weak, fast algorithm for the credential store backing one authentication path, and the file containing that hash is written with permissions allowing it to be read by any local user. This is inconsistent with a…
- risk 0.33cvss 5.1epss 0.00
Emerson ValveLink products receive input or data, but does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- risk 0.32cvss 4.9epss 0.00
A malicious user with physical access to the device can boot the switch from factory settings without authentication, use the default administrative credentials to obtain administrative access, and save changes to the configuration file so that they persist next time the switch…
- risk 0.31cvss 5.9epss 0.00
An example environment-configuration file ships with a fixed, publicly-known secret value used to sign authentication cookies for a bundled packet-analysis component. A deployment that copies this example file into active configuration without running the setup routine that…
- risk 0.31cvss 4.7epss 0.00
The vulnerability, if exploited, could allow a miscreant to run arbitrary JavaScript code in a browser session of a PIMBoards user who was socially engineered to click on a malicious link.
- risk 0.30cvss 4.6epss 0.00
During WiFi association, Naxclow device firmware prints the host network’s SSID, PSK, and negotiated WPA keys in cleartext to an exposed UART console on production hardware. The UART pads are labeled, run with default serial settings, and drop to an interactive RT-Thread shell…
- risk 0.29cvss 4.4epss 0.00
The CISA Software Acquisition Guide Supplier Response Web Tool before 2025-12-11 was vulnerable to cross-site scripting via text fields. If an attacker could convince a user to import a specially-crafted JSON file, the Tool would load JavaScript from the file into the page. The…
- risk 0.28cvss 5.4epss 0.00
A web interface reflects a portion of the request URL into a script context and a hyperlink attribute without adequate encoding, and does not require authentication to reach. This allows an unauthenticated network attacker to craft a link that, when visited by a user, executes…
- risk 0.28cvss 4.3epss 0.00
Opening a crafted DICOM file containing malicious JPEG-compressed pixel data triggers an attacker-controlled heap out-of-bounds write, which may allow an attacker to remotely execute arbitrary code.
- risk 0.27cvss 4.2epss 0.00
The Arkime live capture service (arkime-live) in Malcolm runs with network_mode: host, exposing port 8005 on all network interfaces (viewHost=0.0.0.0). Arkime trusts the X-Forwarded-User header from any IP address (userAuthIps=::,0.0.0.0/0) and auto-creates users with full…
- risk 0.27cvss 4.1epss 0.00
An authenticated administrator could bypass the content validation applied to an administrative file upload and store a file containing dangerous content on the appliance. This did not by itself result in code execution, which would require a separate vulnerability to run the…
- risk 0.27cvss 5.3epss 0.00
Requests from the reverse proxy to the identity-provider service for token discovery, introspection, and credential exchange do not verify the identity provider's server certificate. An attacker positioned on the network path between the proxy and the identity provider could…
- risk 0.24cvss 3.7epss 0.00
The application uses unsafe functions that allow execution of inline scripts and string evaluation functions.
- risk 0.23cvss 3.5epss 0.00
An attacker can construct a request that, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application.
- risk 0.23cvss 3.5epss 0.00
A CM2507 IP camera running firmware version HMT.CM2507 v251211.1507 exposes an interactive bootloader through a physical debug interface without requiring authentication. An attacker with physical access could interrupt the normal boot process and access functionality that…
- risk 0.21cvss 4.3epss 0.00
A deployment mode intended to expose only read access to a bundled packet-analysis component's interface denies a list of write-capable routes by pattern, but the pattern omits routes that modify tags attached to stored session records, and the proxy configuration otherwise…
- risk 0.21cvss 4.3epss 0.00
The application's role-authorization lookup defaults to granting access when a request handler's name is not present in its table of role requirements, rather than defaulting to deny. Any request handler that is not explicitly registered in this table is reachable by any…
- risk 0.21cvss 4.3epss 0.00
An application programming interface endpoint accepts a user-supplied value and interpolates it directly into the path of a backend request to the underlying search and analytics data store, without restricting its contents. This allows an authenticated attacker to substitute an…
- risk 0.17cvss 3.7epss 0.00
A prior update that raised a bundled HTTP client library to a version remediating known vulnerabilities was later reverted, reintroducing the earlier, vulnerable version into a log-processing component. The only code path in that component using the library issues a request to a…
- risk 0.16cvss 3.5epss 0.00
A file-upload handler redirects the authenticated client's browser to a URL taken directly from that same request's Referer header, without validating it against the application's own origin. This allows an authenticated attacker to craft a request that causes another user's…
Page 9 of 9