CVE Program partner

SEC-VLab

SEC Consult Vulnerability Lab

API
CVEs, 365 days61128 all time, 0 rejected
Quality85%median 99%
CVSS by the CNA57%share of records
CWE100%share of records
Affected versions100%not n/a or unspecified
CVSS added by CISA42%lower is better
OrganisationSEC Consult Vulnerability Lab
RoleCNA
TypeResearcher
Reports tomitre
ScopeAll vulnerabilities discovered in third-party hardware/software by SEC Consult Vulnerability Lab (part of SEC Consult, an Eviden business), which are not in another CNA’s scope.
Advisorieshttps://sec-consult.com/vulnerability-lab/

Latest CVEs · RSS

  • CVE-2026-4638 2026-09-24 · CVSS 7.1
    PRTG Network Monitor before version 26.2.120.1449 ships a demo EXE/Script sensor that multiplies two integer parameters using cscript.exe. If a non-numeric valu
  • CVE-2026-4637 2026-09-24 · CVSS 5.1
    Paessler PRTG Network Monitor before version 26.2.120.1449 is affected by a reflected Cross-Site Scripting (XSS) vulnerability. When a request is made for a non
  • CVE-2025-10560 2026-06-18 · CVSS 9.3
    Worksnaps before version 1.6.20260201 contains hardcoded cloud credentials and related secret material in the Worksnaps client application binaries. The exposed
  • CVE-2026-11858 2026-06-17 · CVSS 8.4
    Quanos SCHEMA ST4 on-premises contains a local privilege escalation vulnerability in the Client Update Service. The update service runs as NT AUTHORITY\SYSTEM a
  • CVE-2026-11857 2026-06-17 · CVSS 8.4
    Quanos SCHEMA ST4 on-premises contains a local privilege escalation vulnerability in the Client Update Service due to insecure deserialization in the .NET Remot
  • CVE-2026-12225 2026-06-16 · CVSS 8.7
    syracom AG Secure Login (2FA) for Atlassian Jira, Confluence, and Bitbucket 3.4.0.x contains an authentication bypass vulnerability. An attacker with valid cred
  • CVE-2026-34030 2026-06-15 · CVSS 6.9
    The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, does not sufficiently validate the branch code when a new branch is created. The branch c
  • CVE-2026-34029 2026-06-15 · CVSS 6.8
    The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains a hard-coded cryptographic key in the SafeSystem.Infrastructure.Security.dll com
  • CVE-2026-34028 2026-06-15 · CVSS 6.9
    The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, exposes web-accessible file paths that are not protected by an authorization scheme. An u
  • CVE-2026-34027 2026-06-15 · CVSS 5.3
    The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains insufficient server-side file type validation in the /safe/contract/uploadcustom
  • CVE-2026-34026 2026-06-15 · CVSS 7.1
    Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains a path traversal vulnerability in the documentName parameter of the /safe/selfservic
  • CVE-2026-34025 2026-06-15 · CVSS 5.3
    The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains an IP restriction bypass vulnerability in the login process. The application res
  • CVE-2026-34024 2026-06-15 · CVSS 8.6
    The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains missing authorization checks on multiple web application endpoints. An authentic
  • CVE-2026-34023 2026-06-15 · CVSS 7.1
    The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains an incorrect authorization vulnerability in the WebSocket communication used by
  • CVE-2026-34022 2026-06-15 · CVSS 7.1
    The Wertheim SafeController Family 65000, Controller 65000 - AssemblyVersion 6.11.8130.22319, uses weak custom cryptographic algorithms with hard-coded cryptogr
  • CVE-2026-34021 2026-06-15 · CVSS 8.6
    The Wertheim SafeController 5400, Controller 5400 - AssemblyVersion 6.11.8130.22320, uses RS-485 communication between the server and the microcontroller withou
  • CVE-2026-24067 2026-06-10
    Slate Digital Connect 1.37.0 for macOS installs a privileged helper tool, com.slatedigital.connect.privileged.helper.tool, which exposes the XPC service com.sla
  • CVE-2026-24066 2026-06-10
    Slate Digital Connect 1.37.0 for macOS installs a privileged helper tool, com.slatedigital.connect.privileged.helper.tool, which exposes the XPC service com.sla
  • CVE-2026-24065 2026-06-09
    Waves Central for macOS versions 13.0.9 through 16.5.5 contain a local privilege escalation vulnerability in the privileged helper service. The helper validates
  • CVE-2026-24064 2026-06-09
    Waves Central for macOS versions 13.0.9 through 16.5.5 contain a local privilege escalation vulnerability. A trusted XPC client component included with the prod
  • CVE-2025-10539 2026-04-28
    Due to improper TLS certificate validation in the DeskTime Time Tracking App before version 1.3.674, attackers who can position themselves in the network path b
  • CVE-2025-10549 2026-04-23
    EfficientLab Controlio before v1.3.95 contains a DLL hijacking vulnerability caused by weak folder permissions in the installation directory. A local attacker c
  • CVE-2026-24069 2026-04-14
    Kiuwan SAST improperly authorizes SSO logins for locally disabled mapped user accounts, allowing disabled users to continue accessing the application. Kiuwan Cl
  • CVE-2026-24068 2026-03-26
    The VSL privileged helper does utilize NSXPC for IPC. The implementation of the "shouldAcceptNewConnection" function, which is used by the NSXPC framework to va
  • CVE-2026-24063 2026-03-18
    When a plugin is installed using the Arturia Software Center (MacOS), it also installs an uninstall.sh bash script in a root owned path. This script is written

All CVE Program partners