Altium

Latest CVEs · RSS

• CVE-2026-92808 2026-09-16 · CVSS 10.0
  A server-side request forgery (SSRF) vulnerability exists in the UnifiedLogin service of Altium Enterprise Server. An unauthenticated network attacker can cause
• CVE-2026-14439 2026-07-01 · CVSS 9.4
  A path traversal vulnerability exists in the Git Service component shared by Altium Enterprise Server and Altium 365. The service accepts a sequence of post-clo
• CVE-2026-11431 2026-06-05 · CVSS 8.3
  A path traversal vulnerability exists in the Projects Service download endpoint shared by Altium Enterprise Server and Altium 365. An authenticated user can sup
• CVE-2026-11429 2026-06-05 · CVSS 10.0
  Two endpoints in the Vault Service ScriptsController, shared by Altium Enterprise Server and Altium 365, accept file uploads where a user-supplied filename comp
• CVE-2026-11424 2026-06-05 · CVSS 8.3
  A server-side request forgery (SSRF) vulnerability exists in a GraphQL service component shared by Altium Enterprise Server and Altium 365. An authenticated use
• CVE-2026-11423 2026-06-05 · CVSS 9.4
  A path traversal vulnerability exists in the Altium Enterprise Server Collaboration Service due to improper handling of user-supplied filenames in the MCAD and
• CVE-2026-11420 2026-06-05 · CVSS 10.0
  Two path traversal vulnerabilities in the Network Installation Service (NIS) of Altium Enterprise Server allow an unauthenticated network attacker to write arbi
• CVE-2026-11419 2026-06-05 · CVSS 9.4
  A path traversal vulnerability exists in the Altium Enterprise Server Vault Service UploadController due to improper validation of a user-controlled path compon
• CVE-2026-11414 2026-06-05 · CVSS 10.0
  A hard-coded cryptographic key is used by Altium Enterprise Server to sign file download URLs in the Vault service. Because the key is identical across all inst
• CVE-2026-9152 2026-05-21 · CVSS 10.0
  A missing authentication vulnerability exists in the Altium 365 SearchService. A legacy SOAP endpoint exposes search index operations without requiring authenti
• CVE-2026-9129 2026-05-20 · CVSS 9.4
  A path traversal vulnerability exists in the Altium Enterprise Server Viewer StorageController due to improper handling of file path route parameters. On on-pre
• CVE-2026-9102 2026-05-20 · CVSS 9.4
  A path traversal vulnerability exists in the Altium Enterprise Server ComparisonService due to missing filename sanitization in the Gerber file upload APIs. A r
• CVE-2025-27380 2026-01-22 · CVSS 7.6
  HTML injection in Project Release in Altium Enterprise Server (AES) 7.0.3 on all platforms allows an authenticated attacker to execute arbitrary JavaScript in t
• CVE-2025-27379 2026-01-22 · CVSS 6.8
  A stored cross-site scripting (XSS) vulnerability in the BOM Viewer in Altium AES 7.0.3 allows an authenticated attacker to inject arbitrary JavaScript into the
• CVE-2025-27378 2026-01-22 · CVSS 8.6
  AES contains a SQL injection vulnerability due to an inactive configuration that prevents the latest SQL parsing logic from being applied. When this configurati
• CVE-2025-27377 2026-01-22 · CVSS 5.3
  Altium Designer version 24.9.0 does not validate self-signed server certificates for cloud connections. An attacker capable of performing a man-in-the-middle (M
• CVE-2026-1181 2026-01-19 · CVSS 9.0
  Altium 365 workspace endpoints were configured with an overly permissive Cross-Origin Resource Sharing (CORS) policy that allowed credentialed cross-origin requ
• CVE-2026-1011 2026-01-15 · CVSS 6.1
  A stored cross-site scripting (XSS) vulnerability exists in the Altium Support Center AddComment endpoint due to missing server-side input sanitization. Althoug
• CVE-2026-1010 2026-01-15 · CVSS 8.0
  A stored cross-site scripting (XSS) vulnerability exists in the Altium Workflow Engine due to missing server-side input sanitization in workflow form submission
• CVE-2026-1009 2026-01-15 · CVSS 9.0
  A stored cross-site scripting (XSS) vulnerability exists in the Altium Forum due to missing server-side input sanitization in forum post content. An authenticat
• CVE-2026-1008 2026-01-15 · CVSS 7.6
  A stored cross-site scripting (XSS) vulnerability exists in the user profile text fields of Altium 365. Insufficient server-side input sanitization allows authe