CVE-2026-48537

GFI Archiver

EUVD-2026-48296

GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the File Archive Assistant configuration that allows authenticated attackers to inject arbitrary web script or HTML via the excluded extensions parameter to /Archiver/FileArchiveAssistantWizard.aspx. The injected...

CVE-2026-48536 GFI Archiver < 15.13 Stored XSS via GeneralSettingsWizard.aspx

GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the General Settings SMTP configuration that allows authenticated attackers to inject arbitrary web script or HTML via the SMTP server address parameter to /Archiver/GeneralSettingsWizard.aspx. The injected payload ...

CVE-2026-48536

GFI Archiver

CVE-2026-48535

GFI Archiver Additional Settings page. Exploitation requires authenticated access; CVSS 4.0/3.1 base scores are 5.1 (medium) and 5.4 (medium) respectively. Remediation: upgrade to version 15.13 or later. If upgrading is not possible, apply the documented workaround as per vendor guidance.

EUVD-2026-48294

GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Call Home proxy server configuration that allows authenticated attackers to inject arbitrary web script or HTML via the proxy server address parameter to /Archiver/CallHomeSettingsWizard.aspx. The injected paylo...

CVE-2026-48534

CVE-2026-48534 affects GFI Archiver prior to 15.13. It is a stored XSS in the IMAP Server configuration via the server URL parameter to /Archiver/ImapServerWizard.aspx. The payload is stored by ImapServerWizard.SaveAllConfigSettings() without output encoding and can execute in browsers of users w...

EUVD-2026-48291

GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Retention Policy configuration that allows authenticated attackers to inject arbitrary web script or HTML via the policy name parameter to /Archiver/RetentionPolicyWizard.aspx. The injected payload is stored by...

CVE-2026-48531

CVE-2026-48531 affects GFI Archiver

CVE-2026-48531 GFI Archiver < 15.13 Stored XSS via RetentionPolicyWizard.aspx

GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Retention Policy configuration that allows authenticated attackers to inject arbitrary web script or HTML via the policy name parameter to /Archiver/RetentionPolicyWizard.aspx. The injected payload is stored by...

CVE-2026-65690 Bold Reports Standalone Report Designer < 14.1.12 Path Traversal RCE via File Upload

Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its file upload functionality that allows authenticated attackers to traverse outside the intended directory by supplying a crafted filename. Attackers can exploit this path traversal...

CVE-2026-15404

The Lpagery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in versions up to, and including, 2.5.7. This is due to insufficient input sanitization and output escaping in the lpageryaddfiltertexttemplatepost function, which is hooked to adminfooter and echoes the...

CVE-2026-65013

Onlook through 0.2.32, fixed in commit 423e2e9, contains a broken object level authorization vulnerability that allows authenticated attackers to access and manipulate other users' resources by supplying arbitrary UUID values to tRPC API procedures including project.get, member.remove, and...

CVE-2026-61391

There is a stack-based buffer overflow vulnerability in some Hikvision cameras, which may allow authenticated attackers to cause device malfunction by sending specially crafted packets...

CVE-2026-61391

A vulnerability (CVE-2026-61391) affects some Hikvision cameras. It is a stack-based buffer overflow that may allow an authenticated attacker to cause device malfunction by sending specially crafted packets. CVSS 3.1 metrics assign a base score of 7.2 (HIGH) with NETWORK attack vector, LOW attack...

CVE-2026-61391

There is a stack-based buffer overflow vulnerability in some Hikvision cameras, which may allow authenticated attackers to cause device malfunction by sending specially crafted packets...

EUVD-2026-47627

There is a stack-based buffer overflow vulnerability in some Hikvision cameras, which may allow authenticated attackers to cause device malfunction by sending specially crafted packets...

CVE-2026-61391

There is a stack-based buffer overflow vulnerability in some Hikvision cameras, which may allow authenticated attackers to cause device malfunction by sending specially crafted packets...

CVE-2026-61391

There is a stack-based buffer overflow vulnerability in some Hikvision cameras, which may allow authenticated attackers to cause device malfunction by sending specially crafted packets...

PT-2026-63342

There is a stack-based buffer overflow vulnerability in some Hikvision cameras, which may allow authenticated attackers to cause device malfunction by sending specially crafted packets...