Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2026-115738

Remote Authenticated SQL Injection in Trellix DLP On‑Prem Extensions

SQL injection vulnerability in DLP on-prem extensions version 11.13.1 and earlier allows a remote authenticated attacker to inject SQL queries without sanitization or parameterized queries.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Trellix
Products
Dlp On-prem Extensions
CVE-2026-115739

Hard‑coded Cryptographic Key Exposure Enables Remote Decryption of Credentials and Evidence

Hard-coded Cryptographic Key vulnerability exists in the DLP on-prem extensions version 11.13.1 and earlier allows a remote attacker to decrypt credentials and evidence files.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Trellix
Products
Dlp On-prem Extensions
CVE-2026-115740

SSRF Vulnerability in Trellix DLP on‑Prem Extensions Allowing Server to Connect to Attacker‑Controlled SMB Share

Server side request forgery vulnerability exists in the DLP on-prem extensions version 11.13.1 and earlier allows the file Prefix parameter in the OpenEventEvidenceFile.do endpoint accepts arbitrary UNC paths without validation. The server-side code attempts to open the specified file path, causing Windows to resolve the hostname and initiate SMB authentication to the attacker-controlled host.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Trellix
Products
Dlp On-prem Extensions