Latest high and critical flaws
- CVE-2026-92808 A server-side request forgery (SSRF) vulnerability exists in the UnifiedLogin service of Altium Enterprise Server.Critical 10 · Sep 16, 2026
- CVE-2026-14439 A path traversal vulnerability exists in the Git Service component shared by Altium Enterprise Server and Altium 365.Critical 9.4 · Jul 1, 2026
- CVE-2026-11431 A path traversal vulnerability exists in the Projects Service download endpoint shared by Altium Enterprise Server and Altium 365.High 8.3 · Jun 5, 2026
- CVE-2026-11429 Two endpoints in the Vault Service ScriptsController, shared by Altium Enterprise Server and Altium 365, accept file uploads where a user-supplied filename compCritical 10 · Jun 5, 2026
- CVE-2026-11424 A server-side request forgery (SSRF) vulnerability exists in a GraphQL service component shared by Altium Enterprise Server and Altium 365.High 8.3 · Jun 5, 2026
- CVE-2026-11423 A path traversal vulnerability exists in the Altium Enterprise Server Collaboration Service due to improper handling of user-supplied filenames in the MCAD and Critical 9.4 · Jun 5, 2026
- CVE-2026-11420 Two path traversal vulnerabilities in the Network Installation Service (NIS) of Altium Enterprise Server allow an unauthenticated network attacker to write arbiCritical 10 · Jun 5, 2026
- CVE-2026-11419 A path traversal vulnerability exists in the Altium Enterprise Server Vault Service UploadController due to improper validation of a user-controlled path componCritical 9.4 · Jun 5, 2026
- CVE-2026-11414 A hard-coded cryptographic key is used by Altium Enterprise Server to sign file download URLs in the Vault service.Critical 10 · Jun 5, 2026
- CVE-2026-9152 A missing authentication vulnerability exists in the Altium 365 SearchService.Critical 10 · May 20, 2026
- CVE-2026-9129 A path traversal vulnerability exists in the Altium Enterprise Server Viewer StorageController due to improper handling of file path route parameters.Critical 9.4 · May 20, 2026
- CVE-2026-9102 A path traversal vulnerability exists in the Altium Enterprise Server ComparisonService due to missing filename sanitization in the Gerber file upload APIs.Critical 9.4 · May 20, 2026
- CVE-2025-27380 HTML injection in Project Release in Altium Enterprise Server (AES) 7.0.3 on all platforms allows an authenticated attacker to execute arbitrary JavaScript in tHigh 7.6 · Jan 21, 2026
- CVE-2025-27378 AES contains a SQL injection vulnerability due to an inactive configuration that prevents the latest SQL parsing logic from being applied.High 8.6 · Jan 21, 2026
- CVE-2026-1181 Altium 365 workspace endpoints were configured with an overly permissive Cross-Origin Resource Sharing (CORS) policy that allowed credentialed cross-origin requCritical 9 · Jan 19, 2026
- CVE-2026-1010 A stored cross-site scripting (XSS) vulnerability exists in the Altium Workflow Engine due to missing server-side input sanitization in workflow form submissionHigh 8 · Jan 15, 2026
- CVE-2026-1009 A stored cross-site scripting (XSS) vulnerability exists in the Altium Forum due to missing server-side input sanitization in forum post content.Critical 9 · Jan 15, 2026
- CVE-2026-1008 A stored cross-site scripting (XSS) vulnerability exists in the user profile text fields of Altium 365.High 7.6 · Jan 15, 2026
Part of our vulnerability database: the whole National Vulnerability Database plus CISA’s exploited list, refreshed twice a day. This is general guidance, not a review of your systems.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.