CVE-2026-118798 | | | 2026-11-09 | Multiple sensitive authentication data, including credentials, OAuth-related secrets, session information, and authentication artifacts, are exposed through ap… |
CVE-2026-118795 | | | 2026-11-09 | Administrative roles and module permissions are stored in mutable local database fields, allowing privilege escalation for attackers with database write access. |
CVE-2026-118792 | | | 2026-11-09 | Default credentials permit access through AcuXDBC. |
CVE-2026-118791 | | | 2026-11-09 | The application implements software update functionality without adequate authenticity and integrity validation, allowing update packages to be accepted withou… |
CVE-2026-118790 | | | 2026-11-09 | Multiple hardcoded credentials are embedded within product components and administrative functionalities. These credentials may enable unauthorized access to p… |
CVE-2026-118468 | | | 2026-11-09 | XML parsers process attacker-influenced update manifests or network responses with external entity resolution enabled, potentially allowing XML External Entity… |
CVE-2026-118467 | | | 2026-11-09 | Shared telemetry and logging components store or transmit patient and doctor identifiers, clinical information, and low-entropy identifiers without adequate ps… |
CVE-2026-118465 | | | 2026-11-09 | Shared components expose hard-coded Access, workgroup, CCBasic, DBISAM, and related database credentials that are identical across installations. |
CVE-2026-118464 | | | 2026-11-09 | Shared cryptographic services use fixed vendor-wide secrets, deterministic IVs, null salts, and reversible transformations to protect credentials, IPC data, co… |
CVE-2026-118462 | | | 2026-11-09 | Update components download and execute code without proper authenticity verification, relying on ignored hashes or forgeable checksums. Some update paths also… |
CVE-2026-118461 | | | 2026-11-09 | The shared client accepts caller-controlled doctor identifiers for read and write operations without requiring authentication or authorization credentials. |
CVE-2026-118460 | | | 2026-11-09 | Embedded private keys protected by a shared password can be used to sign practitioner assertions for arbitrary practitioner identifiers, enabling unauthorized… |
CVE-2026-118459 | | | 2026-11-09 | A time-derived emergency password can be derived from publicly available application code, enabling authentication without legitimate credentials. |
CVE-2026-118458 | | | 2026-11-09 | The shared AIS login routing selects a production-shipped test DAO and plaintext comparison for the H and V application codes, accepting fixed administrator ac… |
CVE-2026-118450 | | | 2026-11-09 | Venere is installed outside Program Files and loads/registers unsigned components from locations where an unprivileged user may create files. |
CVE-2026-112172 | | | 2026-11-09 | CGM XDent and XMedical expose PHP synchronization endpoints that allow unauthenticated attackers to manipulate session variables and execute arbitrary SQL quer… |
CVE-2025-48981 | High | 8.6 | 2025-10-08 | An insecure implementation of the proprietary protocol DNET in Product CGM MEDICO allows attackers within the intranet to eavesdrop and manipulate data on the… |