CVE Program partner

SRA

Security Risk Advisors (SRA)

API
CVEs, 365 days1315 all time, 0 rejected
Quality100%median 99%
CVSS by the CNA100%share of records
CWE100%share of records
Affected versions100%not n/a or unspecified
CVSS added by CISA0%lower is better
OrganisationSecurity Risk Advisors (SRA)
RoleCNA
TypeResearcher
Reports toicscert → CISA
ScopeVulnerabilities discovered by SRA that are not within the scope of another CNA.
Advisorieshttps://sra.io/advisories/

Latest CVEs · RSS

  • CVE-2026-6881 2026-07-28 · CVSS 9.4
    A SQL Injection in the Giving Reports functionality in Ellucian Advance Web and Legacy Advance allows an authenticated attacker to extract sensitive information
  • CVE-2026-13381 2026-07-20 · CVSS 8.7
    VSee Clinic 7.1.26 and API 1.3.0 contain an Insecure Direct Object Reference (IDOR) vulnerability in the /v1.3.0/api/files endpoint. An authenticated attacker c
  • CVE-2026-13380 2026-07-20 · CVSS 9.0
    VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 exposes cleartext SFTP credentials in the HTTP responses of three unauthenticated endpoints. The credentials are pr
  • CVE-2026-9588 2026-07-17 · CVSS 7.0
    A stored cross-site scripting (XSS) vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997) within the voicemail notification template functionality.
  • CVE-2026-9587 2026-07-17 · CVSS 7.1
    An authenticated local file inclusion vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The play_file functionality accepts user-controlled in
  • CVE-2026-9586 2026-07-17 · CVSS 9.3
    An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with <Poly
  • CVE-2026-9585 2026-07-17 · CVSS 8.6
    An unauthenticated reflected cross-site scripting (XSS) vulnerability exists in Sangoma Switchvox SMB Edition version 8.3 (104997). The application fails to pro
  • CVE-2025-58744 2026-01-20 · CVSS 6.9
    Use of Default Credentials, Hard-coded Credentials vulnerability in C2SGlobalSettings.dll in Milner ImageDirector Capture on Windows allows decryption of doc
  • CVE-2025-58743 2026-01-20 · CVSS 7.2
    Use of a Broken or Risky Cryptographic Algorithm (DES) vulnerability in the Password class in C2SConnections.dll in Milner ImageDirector Capture on Windows al
  • CVE-2025-58742 2026-01-20 · CVSS 8.5
    Insufficiently Protected Credentials, Improper Restriction of Communication Channel to Intended Endpoints vulnerability in the Connection Settings dialog in Mil
  • CVE-2025-58741 2026-01-20 · CVSS 8.5
    Insufficiently Protected Credentials vulnerability in the Credential Field of Milner ImageDirector Capture allows retrieval of credential material and enables d
  • CVE-2025-58740 2026-01-20 · CVSS 8.5
    The use of a hard-coded encryption key in calls to the Password function in C2SGlobalSettings.dll in Milner ImageDirector Capture on Windows allows a local atta
  • CVE-2025-12874 2025-12-19 · CVSS 6.3
    Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Quest Coexistence Manager for Notes (Free/Busy Connector modul
  • CVE-2023-6260 2024-02-19 · CVSS 7.4
    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Brivo ACS100, ACS300 allows OS Command Injection, By
  • CVE-2023-6259 2024-02-19 · CVSS 7.1
    Insufficiently Protected Credentials, : Improper Access Control vulnerability in Brivo ACS100, ACS300 allows Password Recovery Exploitation, Bypassing Physical

All CVE Program partners