Altium

7 results · Clear filters · Feed

• High 7.2
  CVE-2026-123184

  Incorrect Authorization in Altium 365 Git Service Allows Unauthorized Repository Writes

  An incorrect authorization vulnerability exists in the Altium 365 Git Service. The permission check performed when a user pushes to a project repository did not correctly evaluate the required access level, so the check passed for any user holding any level o…

  Altium Altium 365
  Nov 5, 2026
• High 8.3
  CVE-2026-11431

  Path Traversal in Altium Projects Service Allows Arbitrary File Read

  A path traversal vulnerability exists in the Projects Service download endpoint shared by Altium Enterprise Server and Altium 365. An authenticated user can supply a crafted path parameter that bypasses validation, allowing arbitrary files (including entire d…

  Altium Altium Enterprise Server Altium 365
  Jun 5, 2026
• High 8.3
  CVE-2026-11424

  Server-Side Request Forgery in Altium Platform Design GraphQL Service Allows Information Disclosure

  A server-side request forgery (SSRF) vulnerability exists in a GraphQL service component shared by Altium Enterprise Server and Altium 365. An authenticated user can submit a request whose input is treated as a URL by the server and used to issue an outbound …

  Altium Altium Enterprise Server Altium 365
  Jun 5, 2026
• High 7.6
  CVE-2025-27380

  HTML Injection Leading to Script Execution in Altium Enterprise Server

  HTML injection in Project Release in Altium Enterprise Server (AES) 7.0.3 on all platforms allows an authenticated attacker to execute arbitrary JavaScript in the victim’s browser via crafted HTML content.

  Altium AES
  Jan 22, 2026
• High 8.6
  CVE-2025-27378

  SQL Injection in AES Due to Inactive SQL Parsing Configuration

  AES contains a SQL injection vulnerability due to an inactive configuration that prevents the latest SQL parsing logic from being applied. When this configuration is not enabled, crafted input may be improperly handled, allowing attackers to inject and execut…

  Altium AES
  Jan 22, 2026
• High 8.0
  CVE-2026-1010 Public exploit

  Stored Cross-Site Scripting in Altium Enterprise Server Workflow Engine Allows Privilege Escalation

  A stored cross-site scripting (XSS) vulnerability exists in the Altium Workflow Engine due to missing server-side input sanitization in workflow form submission APIs. A regular authenticated user can inject arbitrary JavaScript into workflow data. When an adm…

  Altium Altium Enterprise Server
  Jan 15, 2026
• High 7.6
  CVE-2026-1008

  Stored Cross-Site Scripting in Altium Live User Profile Fields

  A stored cross-site scripting (XSS) vulnerability exists in the user profile text fields of Altium 365. Insufficient server-side input sanitization allows authenticated users to inject arbitrary HTML and JavaScript payloads using whitespace-based attribute pa…

  Altium Altium Live
  Jan 15, 2026