CVE-2026-86938 | High | 7.3 | 2026-09-23 | A DLL hijacking vulnerability in the FileMaker Pro installer for Windows allowed a local user to execute arbitrary code with elevated administrator privileges… |
CVE-2026-86934 | Critical | 9.1 | 2026-09-23 | An authorization bypass vulnerability in the FileMaker Server Web Publishing Engine allowed requests containing an extended privilege header to bypass the disa… |
CVE-2026-86930 | Critical | 9.1 | 2026-09-23 | An out-of-bounds read vulnerability in FileMaker Server for Linux allowed an attacker uploading a specially crafted image file to a container field to disclose… |
CVE-2026-86926 | High | 7.8 | 2026-09-23 | A heap buffer overflow vulnerability in the FileMaker Server database engine block parsing routine allowed a maliciously crafted .fmp12 database file to cause… |
CVE-2026-43752 | Medium | 4.9 | 2026-07-09 | An authenticated administrator may be able to achieve arbitrary code execution on the host system by uploading a malicious file through the Open Source LLM set… |
CVE-2026-43685 | High | 7.2 | 2026-05-12 | A Remote Code Execution vulnerability in Claris FileMaker Cloud allowed a user with Admin Console privileges to inject arbitrary operating system commands thro… |
CVE-2026-43680 | High | 7.2 | 2026-05-12 | A Remote Code Execution vulnerability in Claris FileMaker Cloud allowed a user with Admin Console privileges to bypass a front-end restriction on OS Script sch… |
CVE-2025-46320 | Medium | 6.1 | 2026-02-24 | A cross-site scripting (XSS) vulnerability in a FileMaker WebDirect custom homepage could lead to unauthorized access and remote code execution. This vulnerabi… |
CVE-2025-46296 | Medium | 5.4 | 2025-12-16 | An authorization bypass vulnerability in FileMaker Server Admin Console allowed administrator roles with minimal privileges to access administrative features s… |
CVE-2025-46295 | Critical | 9.8 | 2025-12-16 | Apache Commons Text versions prior to 1.10.0 included interpolation features that could be abused when applications passed untrusted input into the text-substi… |
CVE-2025-46294 | Medium | 5.3 | 2025-12-16 | To enhance security, the FileMaker Server 22.0.4 installer now includes an option to disable IIS short filename enumeration by setting NtfsDisable8dot3NameCrea… |
CVE-2024-27790 | High | 7.5 | 2024-05-14 | Claris International has resolved an issue of potentially allowing unauthorized access to records stored in databases hosted on FileMaker Server. This issue ha… |
CVE-2023-42955 | Medium | 4.9 | 2024-05-14 | Claris International has successfully resolved an issue of potentially exposing password information to front-end websites when signed in to the Admin Console… |
CVE-2024-27794 | Medium | 6.1 | 2024-04-15 | Claris FileMaker Server before version 20.3.2 was susceptible to a reflected Cross-Site Scripting vulnerability due to an improperly handled parameter in the F… |
CVE-2023-42954 | Medium | 4.9 | 2024-03-21 | A privilege escalation issue existed in FileMaker Server, potentially exposing sensitive information to front-end websites when signed in to the Admin Console… |
CVE-2023-42920 | High | 7.8 | 2024-03-19 | Claris International has fixed a dylib hijacking vulnerability in the FileMaker Pro.app and Claris Pro.app versions on macOS. |
CVE-2021-44147 | Medium | 5.5 | 2021-11-22 | An XML External Entity issue in Claris FileMaker Pro and Server (including WebDirect) before 19.4.1 allows a remote attacker to disclose local files via a craf… |
CVE-2014-8347 | High | 7.8 | 2020-02-11 | An Authentication Bypass vulnerability exists in the MatchPasswordData function in DBEngine.dll in Filemaker Pro 13.03 and Filemaker Pro Advanced 12.04, which… |