CISA CSAF IT advisories
feedUScisa_csaf_it
CISA's machine-readable CSAF 2.0 advisories for information technology (VA series).
01
betrieben von
Wer diese Quelle betreibt oder veröffentlicht.
02
Advisories (102)
Hersteller- und Ökosystem-Meldungen dazu.
03
Produkt-Aussagen (612)
Betroffene Produkte und Versionsbereiche.
- ANGEET ES3 KVM <*
- ASUS AURA SYNC <1.07.84
- Adminer (all versions)
- AdminerEvo 4.8.2
- AdminerEvo 4.8.3
- AdminerEvo 4.8.4
- Agiloft Agiloft <Release 30
- Agiloft Agiloft <Release 31
- Agiloft Agiloft Release 30
- Agiloft Agiloft Release 31
- Airship AI Acropolis 10.2.35
- Airship AI Acropolis 11.0.21
- Airship AI Acropolis 11.1.9
- Airship AI Acropolis <10.2.35
- Airship AI Acropolis <11.0.21
- Airship AI Acropolis <11.1.9
- Allwinner H616 <*
- Appriss Insights Victim Information Notification Exchange (VINE) 2026-05-07
- Appriss Insights Victim Information Notification Exchange (VINE) <2026-05-07
- Araxis Merge 2026.1
20 von 612 angezeigt
04
CVE-Verknüpfungen (296)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-113876US | —OT erhöht | — | ||
SmileCDR HAPI FHIR does not correctly check authorization for conditional create actions. A user with CREATE but not READ permissions could submit a conditional create whose predic… | ||||
| CVE-2026-113875US | —OT erhöht | — | ||
On a SmileCDR HAPI FHIR server with REST-hook subscriptions enabled, if a user is granted subscription-creation permissions, they may be able to query and read resources that they… | ||||
| CVE-2026-97635US | — | — | ||
The Agent Zero Web UI before 1.15 does not correctly sanitize user-provided input in chat messages or file uploads. When Agent Zero reproduces content in the chat interface, any in… | ||||
| CVE-2026-113874US | —OT erhöht | — | ||
SmileCDR HAPI FHIR allows an untrusted bundle body to replace a partition identity previously established by a trusted source, and does not enforce storage partition entitlement by… | ||||
| CVE-2026-113873US | — | — | ||
SmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an unauthenticated attacker to send compressed payloads that exhaust server heap or crash certain servi… | ||||
| CVE-2026-109619US | high8.1 | Exploit | ||
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The g… | ||||
| CVE-2026-109618US | critical9.8 | Exploit | ||
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave… | ||||
| CVE-2026-105773US | — | — | ||
Canimaan Software ClamXAV versions 3.3 - 3.11 contains a local privilege escalation vulnerability in the Privileged Helper Tool caused by a race condition and insufficient file val… | ||||
| CVE-2026-102262US | — | Exploit | ||
Newell Brands DYMO ID 1.5.1.71 resolves its plugin Modules directory relative to the process working directory. An attacker could store a job file alongside malicious modules / DLL… | ||||
| CVE-2026-101893US | — | — | ||
Newell Brands DYMO ID 1.5.1.71 parses job files using XmlDocument.Load() without disabling DTD processing. The PC Job Files view automatically parses every recognized job file exte… | ||||
| CVE-2026-82358US | —OT erhöht | — | ||
RT-Labs AB C-Open CANopen contains a write protection bypass in the SDO (Service Data Object) server implementation 'src/co_sdo_server.c' that fails to properly validate write perm… | ||||
| CVE-2026-82357US | — | — | ||
RT-Labs AB C-Open CANopen contains a NULL pointer dereference if the LSS protocol is used to configure the device. An object defined by the user application may not have all requir… | ||||
| CVE-2026-102628US | —OT erhöht | — | ||
The Cadmos LTI application hosted at cadmos.eummena.io had Laravel debug mode enabled (APP_DEBUG=true, APP_ENV=local) in a publicly accessible environment. An unauthenticated attac… | ||||
| CVE-2026-100251US | — | — | ||
Wormhole.app as deployed before 2026-08-22 misconfigures the coturn TURN server and does not properly restrict TCP relay peers, allowing an unauthenticated attacker to access insta… | ||||
| CVE-2026-102150US | —OT erhöht | — | ||
A function in the Kiteworks Advanced Forms component was reachable without authentication. An unauthenticated attacker could potentially use it to carry out a limited set of intern… | ||||
| CVE-2026-102149US | —OT erhöht | — | ||
Kiteworks Email Protection Gateway did not sufficiently restrict which account a certificate could be assigned to. This could allow an attacker to associate a certificate with anot… | ||||
| CVE-2026-102147US | — | — | ||
A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an unauthenticated attacker to store crafted content that later executes arbitrary JavaScript in the auth… | ||||
| CVE-2026-102146US | — | — | ||
An authenticated Email Protection Gateway administrator holding only limited, delegated permissions could write files with attacker-controlled content to arbitrary locations access… | ||||
| CVE-2026-102145US | — | — | ||
An authenticated administrator could cause the server to issue requests to, and interact with, internal network services that are not meant to be reachable through this interface.… | ||||
| CVE-2026-102144US | —OT erhöht | — | ||
A resource exhaustion vulnerability in Kiteworks Email Protection Gateway allowed an unauthenticated remote attacker to repeatedly trigger a comparatively expensive server-side ope… | ||||
20 von 296 angezeigt