CVE Program partner

M-Files Corporation

M-Files Corporation

API
CVEs, 365 days1060 all time, 0 rejected
Quality100%median 99%
CVSS by the CNA100%share of records
CWE100%share of records
Affected versions100%not n/a or unspecified
CVSS added by CISA0%lower is better
OrganisationM-Files Corporation
RoleNot in the current partner list
Type-
Reports to-
Scope-

Latest CVEs · RSS

  • CVE-2026-18372 2026-08-19 · CVSS 4.8
    CSS injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated vault administrator to inject arbitrary CSS, affecting the web user inter
  • CVE-2026-18371 2026-08-19 · CVSS 5.1
    HTML injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated attacker to affect web user interface contents displayed to other users.
  • CVE-2026-0931 2026-08-05 · CVSS 6.9
    Denial-of-service vulnerability in M-Files Server versions before 26.5.16015.3 allows an authenticated admin user to cause the M-Files Server process to crash a
  • CVE-2026-0983 2026-05-18 · CVSS 7.1
    Denial-of-service condition in M-Files Server versions before 26.5.16015.0, before 26.2 LTS, and before 25.8 LTS SR3 allows an authenticated user to cause the M
  • CVE-2026-0932 2026-04-01 · CVSS 6.9
    Blind server-side request forgery (SSRF) vulnerability in legacy connection methods of document co-authoring features in M-Files Server before 26.3 allow an una
  • CVE-2026-0663 2026-01-21 · CVSS 6.9
    Denial-of-service vulnerability in M-Files Server versions before 26.1.15632.3 allows an authenticated attacker with vault administrator privileges to crash the
  • CVE-2025-13008 2025-12-19 · CVSS 8.6
    An information disclosure vulnerability in M-Files Server before versions 25.12.15491.7, 25.8 LTS SR3, 25.2 LTS SR3 and 24.8 LTS SR5 allows an authenticated att
  • CVE-2025-14267 2025-12-19 · CVSS 5.6
    Incomplete removal of sensitive information before transfer vulnerability in M-Files Corporation M-Files Server allows data leak exposure affecting versions bef
  • CVE-2025-14318 2025-12-18 · CVSS 5.3
    Improper access checks in M-Files Server before 25.12.15491.7 allows users to download files through M-Files Web using Web Companion despite Print and Download
  • CVE-2025-11681 2025-11-17 · CVSS 7.1
    Denial-of-service condition in M-Files Server versions before 25.11.15392.1, before 25.2 LTS SR2 and before 25.8 LTS SR2 allows an authenticated user to cause t
  • CVE-2025-9826 2025-09-15 · CVSS 7.0
    Stored cross-site scripting vulnerability in M-Files Hubshare before version 25.8 allows authenticated attackers to cause script execution for other users.
  • CVE-2025-2091 2025-06-16 · CVSS 4.8
    An open redirection vulnerability in M-Files mobile applications for Android and iOS prior to version 25.6.0 allows attackers to use maliciously crafted PDF fil
  • CVE-2025-5964 2025-06-15 · CVSS 8.4
    A path traversal issue in the API endpoint in M-Files Server before version 25.6.14925.0 allows an authenticated user to read files in the server.
  • CVE-2025-3087 2025-04-04 · CVSS 5.1
    Stored XSS in M-Files Web versions from 25.1.14445.5 to 25.2.14524.4 allows an authenticated user to run scripts
  • CVE-2025-3086 2025-04-04 · CVSS 6.3
    Improper isolation of users in M-Files Server version before 25.3.14549 allows anonymous user to affect other anonymous users views and possibly cause a denial
  • CVE-2025-2159 2025-04-04 · CVSS 5.1
    Stored XSS in Desktop UI in M-Files Server Admin tool before version 25.3.14681.7 on Windows allows authenticated local user to run scripts via UI
  • CVE-2025-0635 2025-01-23 · CVSS 6.3
    Denial of service condition in M-Files Server in versions before 25.1.14445.5 allows an unauthenticated user to consume computing resources in certain conditi
  • CVE-2025-0619 2025-01-23 · CVSS 4.6
    Unsafe password recovery from configuration in M-Files Server before 25.1 allows a highly privileged user to recover external connector passwords
  • CVE-2025-0648 2025-01-23 · CVSS 5.9
    Unexpected server crash in database driver in M-Files Server before 25.1.14445.5 and before 24.8 LTS SR3 allows a highly privileged attacker to cause denial of
  • CVE-2024-10126 2024-11-20 · CVSS 5.3
    Local File Inclusion vulnerability in M-Files Server in versions before 24.11 (excluding 24.8 SR1, 24.2 SR3 and 23.8 SR7) allows an authenticated user to read s
  • CVE-2024-10127 2024-11-20 · CVSS 9.2
    Authentication bypass condition in LDAP authentication in M-Files server versions before 24.11 supported usage of OpenLDAP configurations that allowed user auth
  • CVE-2024-11176 2024-11-20 · CVSS 5.3
    Improper access control vulnerability in M-Files Aino in versions before 24.10 allowed an authenticated user to access object information via incorrect evaluati
  • CVE-2024-9333 2024-10-02 · CVSS 5.3
    Permissions bypass in M-Files Connector for Copilot before version 24.9.3 allows authenticated user to access limited amount of documents via incorrect access c
  • CVE-2024-9174 2024-10-02 · CVSS 6.9
    Stored HTML Injection in Social Module in M-Files Hubshare before version 5.0.8.6 allows authenticated user to spoof UI
  • CVE-2024-6789 2024-08-27 · CVSS 8.4
    A path traversal issue in API endpoint in M-Files Server before version 24.8.13981.0 and LTS 24.2.13421.15 SR2 and LTS 23.8.12892.0 SR6 allows authenticated use

All CVE Program partners