Export limit exceeded: 377266 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (7 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-1696 2 Arcinfo, Arcinformatique 2 Pcvue, Pcvue 2026-04-17 6.1 Medium
Some HTTP security headers are not properly set by the web server when sending responses to the client application.
CVE-2026-1692 2 Arcinfo, Arcinformatique 2 Pcvue, Pcvue 2026-04-16 6.1 Medium
A missing origin validation in WebSockets vulnerability affects the GraphicalData web services used by the WebVue, WebScheduler, TouchVue and SnapVue features of PcVue in version 12.0.0 through 16.3.3 included. It might allow a remote attacker to lure a successfully authenticated user to a malicious website. This vulnerability only affects the following two endpoints: GraphicalData/js/signalR/connect and GraphicalData/js/signalR/reconnect.
CVE-2026-1694 2 Arcinfo, Arcinformatique 2 Pcvue, Pcvue 2026-04-16 4.3 Medium
HTTP headers are added by the default configuration of IIS and ASP.net, and are not removed at the deployment phase of the webservices used by the WebVue, WebScheduler, TouchVue and SnapVue features of PcVue in version 12.0.0 through 16.3.3 included. It unnecessarily exposes sensitive information about the server configuration.
CVE-2026-1698 2 Arcinfo, Arcinformatique 2 Pcvue, Pcvue 2026-04-16 6.1 Medium
A HTTP Host header attack vulnerability affects WebClient and the WebScheduler web apps of PcVue in version 15.0.0 through 16.3.3 included, allowing a remote attacker to inject harmful payloads that manipulate server-side behavior. This vulnerability only affects the endpoints /Authentication/ExternalLogin, /Authentication/AuthorizationCodeCallback and /Authentication/Logout of the WebClient and WebScheduler web apps.
CVE-2026-1693 2 Arcinfo, Arcinformatique 2 Pcvue, Pcvue 2026-04-16 7.5 High
The OAuth grant type Resource Owner Password Credentials (ROPC) flow is still used by the werbservices used by the WebVue, WebScheduler, TouchVue and Snapvue features of PcVue in version 12.0.0 through 16.3.3 included despite being deprecated. It might allow a remote attacker to steal user credentials.
CVE-2026-1695 2 Arcinfo, Arcinformatique 2 Pcvue, Pcvue 2026-04-16 6.1 Medium
An XSS vulnerability affects the OAuth web services used by the WebVue, WebScheduler, TouchVue and SnapVue features of PcVue in version 12.0.0 through 16.3.3 included. It might allow a remote attacker to trick a legitimate user into loading content from another site upon unsuccessful user authentication on an unknown application (unknown client_id). This vulnerability only affects the error page of the OAuth server.
CVE-2026-1697 2 Arcinfo, Arcinformatique 2 Pcvue, Pcvue 2026-04-16 6.5 Medium
The Secure and SameSite attribute are missing in the GraphicalData web services and WebClient web app of PcVue in version 12.0.0 through 16.3.3 included.