CVE Program partner

NCSC-FI

National Cyber Security Centre Finland (NCSC-FI)

API
CVEs, 365 days1927 all time, 0 rejected
Quality100%median 99%
CVSS by the CNA100%share of records
CWE100%share of records
Affected versions100%not n/a or unspecified
CVSS added by CISA0%lower is better
OrganisationNational Cyber Security Centre Finland (NCSC-FI)
RoleCNA
TypeCERT
Reports toENISA → mitre
ScopeVulnerabilities in software discovered by NCSC-FI, and vulnerabilities reported to NCSC-FI for coordinated disclosure, which are not in another CNA’s scope.
Advisorieshttps://www.kyberturvallisuuskeskus.fi/fi/haavoittuvuudet

Latest CVEs · RSS

  • CVE-2026-80275 2026-10-01 · CVSS 8.8
    Comelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1 and 2.10.0 fail to enforce server-side authorization on an administrative passwo
  • CVE-2026-80276 2026-10-01 · CVSS 7.5
    Comelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1 and 2.10.0 expose a network-accessible management interface that does not requir
  • CVE-2026-85104 2026-09-16 · CVSS 5.3
    In Sooma 2GEN brain stimulator, an attacker within Bluetooth range can make unauthenticated changes to brain stimulation parameters.
  • CVE-2026-6265 2026-04-27 · CVSS 7.3
    Insecure preserved inherited permissions vulnerability in Cerberus FTP Server on Windows allows Privilege Escalation.This issue has been resolved in Cerberus FT
  • CVE-2025-15626 2026-04-27 · CVSS 5.3
    Authenticated user can bypass authorization in Ribblr - Crochet & Knitting iOS application
  • CVE-2025-15625 2026-04-17 · CVSS 9.5
    Unauthenticated user is able to execute arbitrary SQL commands in Sparx Pro Cloud Server database in certain cases.
  • CVE-2025-15624 2026-04-17 · CVSS 9.3
    Plaintext Storage of a Password vulnerability in Sparx Systems Pty Ltd. Sparx Pro Cloud Server.  In a setup where OpenID is used as the primary method of authen
  • CVE-2025-15623 2026-04-17 · CVSS 9.3
    Exposure of Private Personal Information to an Unauthorized Actor, : Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in
  • CVE-2025-15622 2026-04-17 · CVSS 6.2
    Insufficiently Protected Credentials vulnerability in Sparx Systems Pty Ltd. Sparx Enterprise Architect. Client reveals plaintext OAuth2 client secretDesktop cl
  • CVE-2025-15621 2026-04-16 · CVSS 5.7
    Insufficiently Protected Credentials in Sparx Systems Pty Ltd. Sparx Enterprise Architect. Client does not verify the receiver of OAuth2 credentials during Open
  • CVE-2025-15554 2026-03-16 · CVSS 6.0
    Browser caching of LAPS passwords in Truesec’s LAPSWebUI before version 2.4 allows an attacker with access to a workstation to escalate their privileges via dis
  • CVE-2025-15553 2026-03-16 · CVSS 6.0
    Non-working logout functionality in Truesec’s LAPSWebUI before version 2.4 allows an attacker with access to a workstation to escalate their privileges via disc
  • CVE-2025-15552 2026-03-16 · CVSS 6.0
    Insufficient Session Expiration in Truesec’s LAPSWebUI before version 2.4 allows an attacker with access to a workstation to escalate their privileges via discl
  • CVE-2026-3315 2026-03-10 · CVSS 5.8
    Incorrect Default Permissions, : Execution with Unnecessary Privileges, : Incorrect Permission Assignment for Critical Resource vulnerability in ASSA ABLOY Visi
  • CVE-2025-15595 2026-03-03 · CVSS 5.7
    Privilege escalation via dll hijacking in Inno Setup 6.2.1 and ealier versions.
  • CVE-2026-2731 2026-02-19 · CVSS 10.0
    Path traversal and content injection in JobRunnerBackground.aspx in DynamicWeb 8 (all) and 9 (<9.19.7 and <9.20.3) allows unauthenticated attackers to execute c
  • CVE-2025-15577 2026-02-12 · CVSS 8.7
    An unauthenticated attacker can exploit this vulnerability by manipulating URL to achieve arbitrary file read access.This issue affects Valmet DNA Web Tools: C2
  • CVE-2026-1680 2026-01-30 · CVSS 7.1
    Improper access control in the WCF endpoint in Edgemo (now owned by Danoffice IT) Local Admin Service 1.2.7.23180 on Windows allows a local user to escalate the
  • CVE-2025-9427 2026-01-13 · CVSS 8.4
    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Lemonsoft WordPress add on allows Cross-Site Script
  • CVE-2025-10009 2025-09-22 · CVSS 8.6
    Incorrect handling of uploaded files in the admin "Restore" function in Invoice Ninja <= 5.11.72 allows attackers with admin credentials to execute arbitrary co
  • CVE-2025-4377 2025-05-09 · CVSS 8.3
    Improper Limitation of a Pathname caused a Path Traversal vulnerability in Sparx Systems Pro Cloud Server. This vulnerability is present in logview.php and it
  • CVE-2025-4376 2025-05-09 · CVSS 5.3
    Improper Input Validation vulnerability in Sparx Systems Pro Cloud Server's WebEA model search field allows Cross-Site Scripting (XSS). This issue affects Pr
  • CVE-2025-4375 2025-05-09 · CVSS 6.9
    Cross-Site Request Forgery (CSRF) vulnerability in Sparx Systems Pro Cloud Server allows Cross-Site Request Forgery to perform Session Hijacking. Cross-Site Req
  • CVE-2025-0416 2025-04-01 · CVSS 8.9
    Local privilege escalation through insecure DCOM configuration in Valmet DNA versions prior to C2023. The DCOM object Valmet DNA Engineering has permissions tha
  • CVE-2025-0417 2025-04-01 · CVSS 7.0
    Lack of protection against brute force attacks in Valmet DNA visualization in DNA Operate. The possibility to make an arbitrary number of login attempts without

All CVE Program partners