Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5

Export CSV
CVE-2026-18371

HTML injection in M-Files Web

HTML injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated attacker to affect web user interface contents displayed to other users.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
M-files Corporation
Products
M-files Web
CVE-2026-18372

CSS injection in M-Files Web

CSS injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated vault administrator to inject arbitrary CSS, affecting the web user interface displayed to other vault users.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
M-files Corporation
Products
M-files Web
CVE-2026-0983

Denial of service vulnerability in M-Files Server

Denial-of-service condition in M-Files Server versions before 26.5.16015.0, before 26.2 LTS, and before 25.8 LTS SR3 allows an authenticated user to cause the MFserver process to crash

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
M-files Corporation
Products
M-files Server
CVE-2026-0663

Denial of Service condition in M-Files Server

Denial-of-service vulnerability in M-Files Server versions before 26.1.15632.3 allows an authenticated attacker with vault administrator privileges to crash the M-Files Server process by calling a vulnerable API endpoint.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
M-files M-files Corporation
Products
M-files Server M-files Server
CVE-2025-13008

Session Token Disclosure in M-Files Web

An information disclosure vulnerability in M-Files Server before versions 25.12.15491.7, 25.8 LTS SR3, 25.2 LTS SR3 and 24.8 LTS SR5 allows an authenticated attacker using M-Files Web to capture session tokens of other active users.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
M-files M-files Corporation
Products
M-files Server Server M-files Server