CVE Program partner

NCSC-NL

National Cyber Security Centre Netherlands (NCSC-NL)

API
CVEs, 365 days840 all time, 0 rejected
Quality70%median 99%
CVSS by the CNA100%share of records
CWE12%share of records
Affected versions100%not n/a or unspecified
CVSS added by CISA0%lower is better
OrganisationNational Cyber Security Centre Netherlands (NCSC-NL)
RoleCNA
TypeVendor
Reports toENISA → mitre
ScopeVulnerabilities in software discovered by NCSC-NL, and vulnerabilities reported to NCSC-NL for coordinated disclosure, which are not in another CNA's scope.
Advisorieshttps://www.ncsc.nl/actueel/beveiligingsadviezen

Latest CVEs · RSS

  • CVE-2026-103316 2026-10-13 · CVSS 7.1
    The macOS version of the DigiD app is not signed with Hardened Runtime. As a result, a local process can load its own dylib into DigiD via DYLD_INSERT_LIBRARIES
  • CVE-2025-59819 2026-02-20 · CVSS 6.5
    This vulnerability allows authenticated attackers to read an arbitrary file by changing a filepath parameter into an internal system path.
  • CVE-2025-59818 2026-02-04 · CVSS 10.0
    This vulnerability allows authenticated attackers to execute arbitrary commands on the underlying system using the file name of an uploaded file.
  • CVE-2025-64093 2026-01-09 · CVSS 10.0
    Remote Code Execution vulnerability that allows unauthenticated attackers to inject arbitrary commands into the hostname of the device.
  • CVE-2025-64092 2026-01-09 · CVSS 7.5
    This vulnerability allows unauthenticated attackers to inject an SQL request into GET request parameters and directly query the underlying database.
  • CVE-2025-64091 2026-01-09 · CVSS 8.6
    This vulnerability allows authenticated attackers to execute commands via the NTP-configuration of the device.
  • CVE-2025-64090 2026-01-09 · CVSS 10.0
    This vulnerability allows authenticated attackers to execute commands via the hostname of the device.
  • CVE-2025-11690 2025-11-04 · CVSS 8.5
    An Insecure Direct Object Reference (IDOR) vulnerability exists in the vehicleId parameter, allowing unauthorized access to sensitive information of other users
  • CVE-2025-59817 2025-09-25 · CVSS 8.4
    This vulnerability allows attackers to execute arbitrary commands on the underlying system. Because the web portal runs with root privileges, successful exploit
  • CVE-2025-59816 2025-09-25 · CVSS 7.3
    This vulnerability allows attackers to directly query the underlying database, potentially retrieving all data stored in the Billing Admin database, including u
  • CVE-2025-59815 2025-09-25 · CVSS 8.4
    This vulnerability allows malicious actors to execute arbitrary commands on the underlying system of the Zenitel ICX500 and ICX510 Gateway, granting shell acces
  • CVE-2025-59814 2025-09-25 · CVSS 8.8
    This vulnerability allows malicious actors to gain unauthorized access to the Zenitel ICX500 and ICX510 Gateway Billing Admin endpoint, enabling them to read th
  • CVE-2023-41928 2024-07-02 · CVSS 5.3
    The device is observed to accept deprecated TLS protocols, increasing the risk of cryptographic weaknesses.
  • CVE-2023-41927 2024-07-02 · CVSS 5.3
    The server supports at least one cipher suite which is on the NCSC-NL list of cipher suites to be phased out, increasing the risk of cryptographic weaknesses.
  • CVE-2023-41926 2024-07-02 · CVSS 8.8
    The webserver utilizes basic authentication for its user login to the configuration interface. As encryption is disabled on port 80, it enables potential eavesd
  • CVE-2023-41923 2024-07-02 · CVSS 7.2
    The user management section of the web application permits the creation of user accounts with excessively weak passwords, including single-character passwords.
  • CVE-2023-41922 2024-07-02 · CVSS 7.2
    A 'Cross-site Scripting' (XSS) vulnerability, characterized by improper input neutralization during web page generation, has been discovered. This vulnerability
  • CVE-2023-41921 2024-07-02 · CVSS 9.8
    A vulnerability allows attackers to download source code or an executable from a remote location and execute the code without sufficiently verifying the origin
  • CVE-2023-41920 2024-07-02 · CVSS 9.8
    The vulnerability allows attackers access to the root account without having to authenticate. Specifically, if the device is configured with the IP address of 1
  • CVE-2023-41919 2024-07-02 · CVSS 9.8
    Hardcoded credentials are discovered within the application's source code, creating a potential security risk for unauthorized access.
  • CVE-2023-41918 2024-07-02 · CVSS 10.0
    A vulnerability allows unauthorized access to functionality inadequately constrained by ACLs. Attackers may exploit this to unauthenticated execute commands pot
  • CVE-2023-41917 2024-07-02 · CVSS 10.0
    Inadequate input validation exposes the system to potential remote code execution (RCE) risks. Attackers can exploit this vulnerability by appending shell comma
  • CVE-2023-43870 2023-12-19 · CVSS 8.1
    When installing the Net2 software a root certificate is installed into the trusted store. A potential hacker could access the installer batch file or reverse en
  • CVE-2022-24403 2023-12-05 · CVSS 4.3
    The TETRA TA61 identity encryption function internally uses a 64-bit value derived exclusively from the SCK (Class 2 networks) or CCK (Class 3 networks). The st
  • CVE-2022-25332 2023-10-19 · CVSS 4.4
    The AES implementation in the Texas Instruments OMAP L138 (secure variants), present in mask ROM, suffers from a timing side channel which can be exploited by a

All CVE Program partners