CVE Program partner

forcepoint

Forcepoint

API
CVEs, 365 days588 all time, 58 rejected
Quality100%median 99%
CVSS by the CNA100%share of records
CWE100%share of records
Affected versions100%not n/a or unspecified
CVSS added by CISA0%lower is better
OrganisationForcepoint
RoleCNA
TypeVendor
Reports tomitre
ScopeForcepoint products only.
Advisorieshttps://support.forcepoint.com/s/knowledge-base#t=All&sort=relevancy&f:@sfrecordtypename=[Security%20Advisory]

Latest CVEs · RSS

  • CVE-2026-12974 2026-09-23 · CVSS 7.9
    A Security Policy Bypass vulnerability exists in Forcepoint Security Engine (NGFW). This issue affects Forcepoint Security Engine (NGFW): from 7.1.0 through 7
  • CVE-2026-11970 2026-08-13 · CVSS 4.8
    This vulnerability allows a normal (non-admin) user to disable the Forcepoint One Endpoint SafariExtension and bypass DLP protection in F1E Mac OS before v26.04
  • CVE-2025-12694 2026-06-04 · CVSS 8.5
    A local privilege escalation vulnerability exists in Forcepoint VPN Client that allows a local non-administrative user to escalate privileges to SYSTEM. This is
  • CVE-2025-2274 2026-03-16 · CVSS 4.8
    Improper Neutralization of Input During Web Page Generation in Forcepoint Web Security (On-Prem) on Windows allows Stored XSS.This issue affects Web Security th
  • CVE-2025-12690 2026-03-11 · CVSS 7.3
    Execution with unnecessary privileges in Forcepoint NGFW Engine allows local privilege escalation.This issue affects NGFW Engine through 6.10.19, through 7.3.0,
  • CVE-2025-2272 2025-05-22 · CVSS 7.0
    Uncontrolled Search Path Element vulnerability in Forcepoint FIE Endpoint allows Privilege Escalation, Code Injection, Hijacking a privileged process.This issue
  • CVE-2024-9103 2025-03-24 · CVSS 6.1
    Improper Neutralization of Script in Attributes in a Web Page vulnerability in Forcepoint Email Security (Blocked Messages module) allows Stored XSS. This issue
  • CVE-2024-2166 2024-09-04 · CVSS 8.8
    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Email Security (Real Time Monitor modules) allo
  • CVE-2023-6452 2024-08-22 · CVSS 9.6
    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Web Security (Transaction Viewer) allows Stored
  • CVE-2023-5451 2024-03-04 · CVSS 6.1
    Forcepoint NGFW Security Management Center Management Server has SMC Downloads optional feature to offer standalone Management Client downloads and ECA confi
  • CVE-2023-1705 2024-01-29 · CVSS 8.4
    Missing Authorization vulnerability in Forcepoint F|One SmartEdge Agent on Windows (bgAutoinstaller service modules) allows Privilege Escalation, Functionality
  • CVE-2023-2080 2023-06-15 · CVSS 8.5
    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Forcepoint Cloud Security Gateway (CSG) Portal on Web Clou
  • CVE-2023-26292 2023-03-29 · CVSS 6.1
    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Cloud Security Gateway (CSG) Portal on Web Clou
  • CVE-2023-26291 2023-03-29 · CVSS 6.1
    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Cloud Security Gateway (CSG) Portal on Web Clou
  • CVE-2023-26290 2023-03-29 · CVSS 6.1
    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Cloud Security Gateway (CSG) Portal on Web Clou
  • CVE-2022-1700 2022-09-12 · CVSS 7.5
    Improper Restriction of XML External Entity Reference ('XXE') vulnerability in the Policy Engine of Forcepoint Data Loss Prevention (DLP), which is also leverag
  • CVE-2022-27609 2022-04-04 · CVSS 6.0
    Forcepoint One Endpoint prior to version 22.01 installed on Microsoft Windows does not provide sufficient anti-tampering protection of services by users with Ad
  • CVE-2022-27608 2022-04-04 · CVSS 6.0
    Forcepoint One Endpoint prior to version 22.01 installed on Microsoft Windows is vulnerable to registry key tampering by users with Administrator privileges. Th
  • CVE-2021-41530 2021-10-04
    Forcepoint NGFW Engine versions 6.5.11 and earlier, 6.8.6 and earlier, and 6.10.0 are vulnerable to TCP reflected amplification vulnerability, if HTTP User Resp
  • CVE-2020-6590 2021-04-08
    Forcepoint Web Security Content Gateway versions prior to 8.5.4 improperly process XML input, leading to information disclosure.
  • CVE-2019-6146 2020-01-22
    It has been reported that cross-site scripting (XSS) is possible in Forcepoint Web Security, version 8.x, via host header injection. CVSSv3.0: 5.3 (Medium) (/AV
  • CVE-2019-6147 2019-12-23
    Forcepoint NGFW Security Management Center (SMC) versions lower than 6.5.12 or 6.7.1 have a rare issue that in specific circumstances can corrupt the internal c
  • CVE-2019-6142 2019-11-05
    It has been reported that XSS is possible in Forcepoint Email Security, versions 8.5 and 8.5.3. It is strongly recommended that you apply the relevant hotfix in
  • CVE-2019-6144 2019-10-23
    This vulnerability allows a normal (non-admin) user to disable the Forcepoint One Endpoint (versions 19.04 through 19.08) and bypass DLP and Web protection.
  • CVE-2019-6145 2019-09-20
    Forcepoint VPN Client for Windows versions lower than 6.6.1 have an unquoted search path vulnerability. This enables local privilege escalation to SYSTEM user.

All CVE Program partners