CVEs published by Switzerland Government Common Vulnerability Program

CVEs published by Switzerland Government Common Vulnerability Program (CVE Numbering Authority). 33 tracked.

• CVE-2025-11183 MEDIUM 6.9 Cross-Site Scripting vulnerability in attribute table in QGIS QWC2 <2025.08.14 allows an authorized attacker t
• CVE-2026-54212 CRITICAL 9.5 Tobit Laboratories AG TeamDavid's Webbox application implements an API endpoint that is vulnerable to a buffe
• CVE-2026-54213 CRITICAL 9.2 Tobit Laboratories AG TeamDavid's Webbox application exposes a functionality that allows the server to be shu
• CVE-2026-54210 CRITICAL 9.5 Tobit Laboratories AG TeamDavid's Webbox application implements various file upload functionalities that are
• CVE-2026-54211 CRITICAL 9.5 Tobit Laboratories AG TeamDavid's Webbox application’s endpoint “//serverClient_close.html” is vulnerable to a
• CVE-2026-54203 CRITICAL 9.2 Memory Leak to an Unauthorized Actor vulnerability in Tobit Laboratories AG TeamDavid's Webbox allows reading
• CVE-2026-54209 HIGH 8.9 Tobit Laboratories AG TeamDavid's Webbox application handles password changes using a function triggered by i
• CVE-2026-54218 HIGH 8.8 Use of hard-coded cryptographic key vulnerability in Tobit Laboratories AG TeamDavid's Webbox
• CVE-2026-54204 HIGH 7.7 Tobit Laboratories AG TeamDavid's Webbox 's search functionality accepts a “pathnameroot” parameter, which ca
• CVE-2026-16022 HIGH 7.8 @oblique/cli 15.4.0 contains an OS command injection vulnerability in the project creation functionality
• CVE-2026-54201 MEDIUM 6.9 Tobit Laboratories AG TeamDavid's Webbox does not enforce authentication or authorization checks when servin
• CVE-2026-54208 HIGH 8.5 Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to arbitrary file write, allowing an unaut
• CVE-2026-54202 HIGH 8.5 Tobit Laboratories AG TeamDavid's Webbox is vulnerable to a path traversal vulnerability in the archive crea
• CVE-2026-12070 HIGH 8.4 Tobit Laboratories AG TeamDavid's Webbox is vulnerable to an arbitrary file deletion vulnerability in the se
• CVE-2026-54200 HIGH 8.4 Tobit Laboratories AG TeamDavid's Webbox is vulnerable to a local file inclusion vulnerability in the send e
• CVE-2025-11184 MEDIUM 6.9 Cross-site scripting vulnerability in QGIS QWC2 Registration GUI <=v2025.03.31 allows an authorized attacker t
• CVE-2026-9169 HIGH 8.8 DLL Search Order Hijacking in LUCID Vision Labs Arena SDK 1.0.80.49 on Windows allows a local attacker to exec
• CVE-2026-54205 MEDIUM 6.3 Tobit Laboratories AG TeamDavid's Webbox 's link storing functionality (//ServerClient_celink.htm) accepts a
• CVE-2026-54206 MEDIUM 6.3 Tobit Laboratories AG TeamDavid's Webbox 's sending email, fax, SMS, etc
• CVE-2026-54207 MEDIUM 6.3 Tobit Laboratories AG TeamDavid's Webbox 's move archive functionality (“!ArcEntryMove”) accepts an arbitrary
• CVE-2026-12071 MEDIUM 5.3 The Webbox of TeamDavid by Tobit Laboratories AG constructs redirect URLs using user-supplied input, which is
• CVE-2026-54199 MEDIUM 5.3 Tobit Laboratories AG TeamDavid's Webbox is vulnerable to HTTP header injection through the request body in
• CVE-2026-54214 MEDIUM 5.3 Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to HTTP header injection through the “cTyp
• CVE-2026-54215 MEDIUM 5.3 Tobit Laboratories AG TeamDavid's Webbox contains an open redirect vulnerability via the “replyUrl” paramete
• CVE-2026-54216 MEDIUM 5.3 Tobit Laboratories AG TeamDavid's Webbox application contains a reflected cross-site scripting (XSS) vulnerab
• CVE-2026-54217 MEDIUM 5.3 Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to a stored XSS vulnerability
• CVE-2026-16458 MEDIUM 5.9 Padding oracle attack vulnerability in Oberon microsystem AG’s ocrypto library in all versions since 3.0.0 and
• CVE-2026-16459 MEDIUM 5.9 Padding oracle attack vulnerability in Oberon microsystem AG’s Oberon PSA Crypto library in all versions since
• CVE-2026-114357 CRITICAL 9.3 Missing authentication for a critical function in the Android Debug Bridge daemon (adbd) in DJI CrystalSky ZS6
• CVE-2026-114355 HIGH 8.6 OS command injection in the root-privileged 'hardware_monitor' helper in DJI CrystalSky ZS600C firmware v0.3.9
• CVE-2026-114354 HIGH 8.6 Missing authorization in the native binder service 'android.dji.server' (transaction code 1018) in DJI Crystal
• CVE-2026-114356 HIGH 7.0 Missing authorization in the system-privileged 'DJIUpdateService' binder in DJI CrystalSky ZS600C firmware v0.
• CVE-2026-114353 HIGH 7.0 Hidden functionality (undocumented backdoor) in the root-privileged 'assistant' daemon in DJI CrystalSky ZS600

← Back to latest CVEs