CVE-2026-54368 | High | 8.8 | 2026-07-30 | CentreStack before 17.4 contains a SQL injection vulnerability in GladDBFiles.SearchEx() and SearchExUnder() that allows authenticated attackers to execute arb… |
CVE-2026-54367 | High | 8.6 | 2026-07-30 | CentreStack before 17.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to read, write, or delete arbitrary account setti… |
CVE-2026-54366 | High | 7.5 | 2026-07-30 | CentreStack before 17.4 contains an XML external entity (XXE) injection vulnerability that allows unauthenticated attackers to exfiltrate arbitrary files by su… |
CVE-2026-54365 | High | 7.5 | 2026-07-30 | CentreStack before 17.3 contains an unauthenticated deserialization vulnerability in GSNamespace.dll that allows unauthenticated attackers to create arbitrary… |
CVE-2026-54364 | Medium | 6.5 | 2026-07-30 | CentreStack before 17.4 contains a session variable injection vulnerability that allows unauthenticated attackers to inject arbitrary session variables by embe… |
CVE-2026-54363 | Critical | 9.1 | 2026-07-30 | CentreStack before 17.5 contains a hardcoded cryptographic key vulnerability that allows unauthenticated attackers to forge arbitrary encrypted tokens by explo… |
CVE-2026-8364 | Critical | 9.8 | 2026-05-27 | Gladinet Triofox Cloud Server Agent Access Service (GladServerAgentService.exe) listens on TCP port 7878 and processes remote HTTP messages with URL paths star… |
CVE-2026-8363 | Critical | 9.8 | 2026-05-27 | A stack-based buffer overflow condition exists in WOSDeviceDropFolder.dll when processing a long URL path starting with /resources: |
CVE-2026-8362 | Critical | 9.8 | 2026-05-27 | A stack-based buffer overflow condition exists in WOSDefaultHttpModule.dll when processing a long URL path starting with /woshome |
CVE-2026-8361 | High | 7.5 | 2026-05-27 | A path traversal vulnerability exists in WOSDefaultHttpModule.dll when processing a URL path starting with /woshome |
CVE-2026-8360 | High | 7.5 | 2026-05-27 | Function calls to WOSCommonUtil.dll!WOSSysInfoGetDeviceInterface() in various DLLs (i.e., WOSProfileMgrModule.dll, WOSWebDavModule.dll) can return a NULL point… |
CVE-2026-8359 | High | 7.5 | 2026-05-27 | When processing a request with a URL path starting with /status or /sysinfo, WOSHttpStatusModule.dll is to be loaded to handle such URL patterns. The WOSBin_Lo… |
CVE-2025-14611 | Critical | 9.8 | 2025-12-12 | Gladinet CentreStack and Triofox prior to version 16.12.10420.56791 used hardcoded values for their implementation of the AES cryptoscheme. This degrades secur… |
CVE-2025-12480 | Critical | 9.1 | 2025-11-10 | Triofox versions prior to 16.7.10368.56560, are vulnerable to an Improper Access Control flaw that allows access to initial setup pages even after setup is com… |
CVE-2025-11371 | High | 7.5 | 2025-10-09 | In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended… |
CVE-2025-30406 | Critical | 9.0 | 2025-04-03 | Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal's hardcoded machine… |
CVE-2023-26830 | High | 7.2 | 2023-03-31 | An unrestricted file upload vulnerability in the administrative portal branding component of Gladinet CentreStack before 13.5.9808 allows authenticated attacke… |
CVE-2023-26829 | Critical | 9.8 | 2023-03-31 | An authentication bypass vulnerability in the Password Reset component of Gladinet CentreStack before 13.5.9808 allows remote attackers to set a new password f… |