Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (17 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-112172 1 Compugroup Medical 2 Xdent, Xmedical 2026-11-09 N/A
CGM XDent and XMedical expose PHP synchronization endpoints that allow unauthenticated attackers to manipulate session variables and execute arbitrary SQL queries against backend MySQL databases.
CVE-2026-118450 1 Compugroup Medical 1 Venere 2026-11-09 N/A
Venere is installed outside Program Files and loads/registers unsigned components from locations where an unprivileged user may create files.
CVE-2026-118458 1 Compugroup Medical 2 Phronesis, Venere 2026-11-09 N/A
The shared AIS login routing selects a production-shipped test DAO and plaintext comparison for the H and V application codes, accepting fixed administrator accounts.
CVE-2026-118459 1 Compugroup Medical 4 Infantia, Phronesis, Profim and 1 more 2026-11-09 N/A
A time-derived emergency password can be derived from publicly available application code, enabling authentication without legitimate credentials.
CVE-2026-118460 1 Compugroup Medical 4 Infantia, Phronesis, Profim and 1 more 2026-11-09 N/A
Embedded private keys protected by a shared password can be used to sign practitioner assertions for arbitrary practitioner identifiers, enabling unauthorized practitioner token requests.
CVE-2026-118461 1 Compugroup Medical 4 Infantia, Phronesis, Profim and 1 more 2026-11-09 N/A
The shared client accepts caller-controlled doctor identifiers for read and write operations without requiring authentication or authorization credentials.
CVE-2026-118462 1 Compugroup Medical 4 Infantia, Phronesis, Profim and 1 more 2026-11-09 N/A
Update components download and execute code without proper authenticity verification, relying on ignored hashes or forgeable checksums. Some update paths also permit archive traversal or script execution.
CVE-2026-118464 1 Compugroup Medical 4 Infantia, Phronesis, Profim and 1 more 2026-11-09 N/A
Shared cryptographic services use fixed vendor-wide secrets, deterministic IVs, null salts, and reversible transformations to protect credentials, IPC data, configuration values, and clinical fields.
CVE-2026-118465 1 Compugroup Medical 4 Infantia, Phronesis, Profim and 1 more 2026-11-09 N/A
Shared components expose hard-coded Access, workgroup, CCBasic, DBISAM, and related database credentials that are identical across installations.
CVE-2026-118467 1 Compugroup Medical 4 Infantia, Phronesis, Profim and 1 more 2026-11-09 N/A
Shared telemetry and logging components store or transmit patient and doctor identifiers, clinical information, and low-entropy identifiers without adequate pseudonymization or protection.
CVE-2026-118468 1 Compugroup Medical 4 Infantia, Phronesis, Profim and 1 more 2026-11-09 N/A
XML parsers process attacker-influenced update manifests or network responses with external entity resolution enabled, potentially allowing XML External Entity (XXE) attacks.
CVE-2026-118790 1 Compugroup Medical 1 Wingesfar 2026-11-09 N/A
Multiple hardcoded credentials are embedded within product components and administrative functionalities. These credentials may enable unauthorized access to privileged accounts, services, or application features across affected deployments.
CVE-2026-118791 1 Compugroup Medical 1 Wingesfar 2026-11-09 N/A
The application implements software update functionality without adequate authenticity and integrity validation, allowing update packages to be accepted without sufficient cryptographic verification.
CVE-2026-118792 1 Compugroup Medical 1 Wingesfar 2026-11-09 N/A
Default credentials permit access through AcuXDBC.
CVE-2026-118795 1 Compugroup Medical 3 Infantia, Profim, Venere 2026-11-09 N/A
Administrative roles and module permissions are stored in mutable local database fields, allowing privilege escalation for attackers with database write access.
CVE-2026-118798 1 Compugroup Medical 1 Wingesfar 2026-11-09 N/A
Multiple sensitive authentication data, including credentials, OAuth-related secrets, session information, and authentication artifacts, are exposed through application logs and persistent client-side storage, enabling unauthorized access and session compromise.
CVE-2025-48981 1 Compugroup Medical 1 Cgm Medico 2026-04-15 8.6 High
An insecure implementation of the proprietary protocol DNET in Product CGM MEDICO allows attackers within the intranet to eavesdrop and manipulate data on the protocol because encryption is optional for this connection.