Search vulnerabilities

Expected end of text, found '/' (at char 42), (line:1, col:43)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,775

CVE-2026-118450

Venere loads replaceable unsigned components from a writable installation location

Venere is installed outside Program Files and loads/registers unsigned components from locations where an unprivileged user may create files.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Compugroup Medical
Products
Venere
CVE-2026-118458

AIS shared test login provider contains fixed administrative credentials

The shared AIS login routing selects a production-shipped test DAO and plaintext comparison for the H and V application codes, accepting fixed administrator accounts.

CVSS 4.0 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Compugroup Medical
Products
Phronesis Venere
CVE-2026-118459

AIS PasswordSOS permits authentication without legitimate credentials

A time-derived emergency password can be derived from publicly available application code, enabling authentication without legitimate credentials.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Compugroup Medical
Products
Infantia Phronesis Profim and 1 more
CVE-2026-118460

AIS embedded private keys enable practitioner impersonation

Embedded private keys protected by a shared password can be used to sign practitioner assertions for arbitrary practitioner identifiers, enabling unauthorized practitioner token requests.

CVSS 4.0 · 8 High EPSS < 1% KEV · Not listed
Vendors
Compugroup Medical
Products
Infantia Phronesis Profim and 1 more
CVE-2026-118461

AIS PersonnelService client performs unauthenticated doctor-specific operations

The shared client accepts caller-controlled doctor identifiers for read and write operations without requiring authentication or authorization credentials.

CVSS 4.0 · 8 High EPSS < 1% KEV · Not listed
Vendors
Compugroup Medical
Products
Infantia Phronesis Profim and 1 more
CVE-2026-118462

AIS update mechanism executes unverified code

Update components download and execute code without proper authenticity verification, relying on ignored hashes or forgeable checksums. Some update paths also permit archive traversal or script execution.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Compugroup Medical
Products
Infantia Phronesis Profim and 1 more
CVE-2026-118464

AIS shared cryptographic services use fixed cryptographic secrets

Shared cryptographic services use fixed vendor-wide secrets, deterministic IVs, null salts, and reversible transformations to protect credentials, IPC data, configuration values, and clinical fields.

CVSS 4.0 · 5.8 Medium EPSS < 1% KEV · Not listed
Vendors
Compugroup Medical
Products
Infantia Phronesis Profim and 1 more
CVE-2026-118465

AIS products use vendor-wide hard-coded database credentials

Shared components expose hard-coded Access, workgroup, CCBasic, DBISAM, and related database credentials that are identical across installations.

CVSS 4.0 · 5.8 Medium EPSS < 1% KEV · Not listed
Vendors
Compugroup Medical
Products
Infantia Phronesis Profim and 1 more
CVE-2026-118467

AIS products expose clinical and personal data via logs and telemetry

Shared telemetry and logging components store or transmit patient and doctor identifiers, clinical information, and low-entropy identifiers without adequate pseudonymization or protection.

CVSS 4.0 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Compugroup Medical
Products
Infantia Phronesis Profim and 1 more
CVE-2026-118468

AIS XML parsers allow external entity resolution

XML parsers process attacker-influenced update manifests or network responses with external entity resolution enabled, potentially allowing XML External Entity (XXE) attacks.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Compugroup Medical
Products
Infantia Phronesis Profim and 1 more
CVE-2026-118790

Multiple Hardcoded Credentials

Multiple hardcoded credentials are embedded within product components and administrative functionalities. These credentials may enable unauthorized access to privileged accounts, services, or application features across affected deployments.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Compugroup Medical
Products
Wingesfar
CVE-2026-118791

Insecure software update mechanism

The application implements software update functionality without adequate authenticity and integrity validation, allowing update packages to be accepted without sufficient cryptographic verification.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Compugroup Medical
Products
Wingesfar
CVE-2026-118795

AIS stores authorization state in locally modifiable databases

Administrative roles and module permissions are stored in mutable local database fields, allowing privilege escalation for attackers with database write access.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Compugroup Medical
Products
Infantia Profim Venere
CVE-2026-118798

Multiple sensitive authentication data exposed

Multiple sensitive authentication data, including credentials, OAuth-related secrets, session information, and authentication artifacts, are exposed through application logs and persistent client-side storage, enabling unauthorized access and session compromise.

CVSS 4.0 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Compugroup Medical
Products
Wingesfar
CVE-2026-95648

Privilege Escalation in C-Prot's C-Prot AppDefense

Improperly controlled modification of Dynamically-Determined object attributes vulnerability in C-Prot Inc. C-Prot AppDefense allows Privilege Escalation. This issue affects C-Prot AppDefense: before 1.0.2729.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
C-prot
Products
Appdefense
CVE-2026-16283

Command Injection in Osbil Technology's Ltd's oPanel

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Osbil Technology Ltd.Osbil Technology Ltd. OPanel allows OS Command Injection. This issue affects oPanel: before 1.20.66.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Osbil Technology
Products
Opanel
CVE-2026-95779

Confidential Certificate Exposure in HPE Morpheus

An exposure of the appliance’s confidential certificate information  vulnerability exists in HPE Morpheus manager software.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Hpe
Products
Morpheus Software
CVE-2026-123088

UniPAY Payment Gateway For WooCommerce < 2.4 - Unauthenticated Order Key and Customer PII Disclosure

The UniPAY Payment Gateway For WooCommerce WordPress plugin before 2.4 does not perform any authorization check before returning an order's order-received URL for an attacker-supplied order id, exposing the order's secret key in the redirect and allowing unauthenticated attackers to enumerate orders and disclose customers' personal data (name, email address, phone number and address).

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-111421

Apache Airflow: Execution API: set_xcom skips the reserved-key check, so task-written XComs instantiate airflow.* classes on the API server

Apache Airflow's Task Execution API stored XCom values written by a task without the reserved-key check applied elsewhere, so a Dag author's task could write an XCom that, when a user later viewed it through the API with deserialization enabled, made the API server instantiate classes from the `airflow.*` namespace with arguments the Dag author chose. This is an incomplete fix for CVE-2026-59242: users who applied that fix in apache-airflow 3.3.1 remain affected through this route and should upgrade to apache-airflow 3.4.0 or later.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Airflow