CVE Program partner

NCSC.ch

Switzerland National Cyber Security Centre (NCSC)

API
CVEs, 365 days110226 all time, 12 rejected
Quality99%median 99%
CVSS by the CNA100%share of records
CWE98%share of records
Affected versions100%not n/a or unspecified
CVSS added by CISA0%lower is better
OrganisationSwitzerland National Cyber Security Centre (NCSC)
RoleCNA
TypeCERT
Reports tomitre
ScopeVulnerabilities in software reported to the NCSC-CH for coordinated disclosure, which are not in another CNA's scope.
Advisorieshttps://www.ncsc.admin.ch/ncsc/en/home/infos-fuer/infos-it-spezialisten/themen/schwachstelle-melden/cve-list.html

Latest CVEs · RSS

  • CVE-2026-104811 2026-10-05 · CVSS 8.4
    DigitalCanion SA has discovered a vulnerability that allows remote attackers to execute arbitrary code on affected installations of the product. Authentication
  • CVE-2026-104810 2026-10-05 · CVSS 8.4
    This vulnerability allows remote attackers to delete sensitive files on vulnerable installations of Mitel MiVoice Office 400. Authentication is required to expl
  • CVE-2026-104809 2026-10-05 · CVSS 8.4
    DigitalCanion has discovered a vulnerability that allows an attacker to cause the system to load an attacker-controlled .so file instead of the expected legitim
  • CVE-2026-104808 2026-10-05 · CVSS 1.9
    DigitalCanion has discovered a stored Cross-Site Scripting (XSS) vulnerability that allows an authenticated malicious user to inject persistent JavaScript or HT
  • CVE-2026-104807 2026-10-05 · CVSS 1.9
    DigitalCanion has discovered a stored Cross-Site Scripting (XSS) vulnerability that allows an authenticated malicious user to inject persistent JavaScript or HT
  • CVE-2026-104806 2026-10-05 · CVSS 5.5
    DigitalCanion has discovered a path traversal vulnerability that allows an attacker to access files outside of the intended directory. The specific flaw exi
  • CVE-2026-104805 2026-10-05 · CVSS 8.5
    DigitalCanion has discovered a vulnerability in the backup restoration functionality that allows an attacker with access to the configured backup repository to
  • CVE-2026-104706 2026-10-05 · CVSS 8.4
    DigitalCanion has discovered a path traversal vulnerability that allows to view or download sensitive system files over the portal https://<ip>:8443 via menus A
  • CVE-2026-104721 2026-10-02 · CVSS 6.3
    Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically, an MDC-bas
  • CVE-2026-104733 2026-10-02 · CVSS 7.4
    User Impersonation in ProcessOnes XMMP Server ejabberd <= 26.04 allows an attacker to impersonate arbitrary users via unvalidated authzid parameter in SASL-PLAI
  • CVE-2026-84830 2026-09-03 · CVSS 8.6
    SEPPmail Secure Email Gateway before 15.0.7 contains a command injection vulnerability that allows authenticated administrators to execute commands with elevate
  • CVE-2026-84832 2026-09-03 · CVSS 8.6
    SEPPmail Secure Email Gateway before 15.0.6 deserializes attacker-controlled data in a privileged REST import workflow without adequate validation. An attacker
  • CVE-2026-84831 2026-09-03 · CVSS 7.7
    SEPPmail Secure Email Gateway before 15.0.7 creates a fully privileged session before required multi-factor authentication enrollment is completed. An attacker
  • CVE-2026-14208 2026-08-21 · CVSS 7.3
    Remote Utilities Host <=7.7.3.0 sets insecure ACLs on all DLL files in the installation directory (C:\Program Files (x86)\Remote Utilities - Host\), granting FU
  • CVE-2026-19880 2026-08-14 · CVSS 6.3
    Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically, an MDC-bas
  • CVE-2026-16458 2026-08-13 · CVSS 5.9
    Padding oracle attack vulnerability in Oberon microsystem AG’s ocrypto library in all versions since 3.0.0 and prior to 4.0.1 allows an attacker to recover plai
  • CVE-2026-16459 2026-08-13 · CVSS 5.9
    Padding oracle attack vulnerability in Oberon microsystem AG’s Oberon PSA Crypto library in all versions since 1.0.0 and prior to 2.1.1 allows an attacker to re
  • CVE-2026-54205 2026-08-07 · CVSS 6.3
    Tobit Laboratories AG TeamDavid's Webbox 's link storing functionality (//ServerClient_celink.htm) accepts a “pathname” parameter, which can be set to network
  • CVE-2026-54218 2026-08-07 · CVSS 8.8
    Use of hard-coded cryptographic key vulnerability in Tobit Laboratories AG TeamDavid's Webbox. For users created locally in David, passwords are stored in vario
  • CVE-2026-54217 2026-08-07 · CVSS 5.3
    Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to a stored XSS vulnerability. An attacker can send an email containing malicious JavaScript
  • CVE-2026-54216 2026-08-07 · CVSS 5.3
    Tobit Laboratories AG TeamDavid's Webbox application contains a reflected cross-site scripting (XSS) vulnerability. By sending a specially crafted link includi
  • CVE-2026-54215 2026-08-07 · CVSS 5.3
    Tobit Laboratories AG TeamDavid's Webbox contains an open redirect vulnerability via the “replyUrl” parameter. An attacker can exploit this vulnerability to
  • CVE-2026-54214 2026-08-07 · CVSS 5.3
    Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to HTTP header injection through the “cType” URL parameter, which allows arbitrary modificat
  • CVE-2026-54213 2026-08-07 · CVSS 9.2
    Tobit Laboratories AG TeamDavid's Webbox application exposes a functionality that allows the server to be shut down when a specific endpoint (/internalRestart)
  • CVE-2026-54212 2026-08-07 · CVSS 9.5
    Tobit Laboratories AG TeamDavid's Webbox application implements an API endpoint that is vulnerable to a buffer overflow condition. By submitting a specially cr

All CVE Program partners