Skip to content
OpenAdvisories

Vendor

Gladinet

15 known vulnerabilities.

Gladinet at a glance

Last 12 months
13
Critical · all time
5
Exploited · all time
3
Public exploit · all time
3
New vulnerabilities per month · last 12 months
0 5 10 December 2025: 1 vulnerability Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 6 vulnerabilities, 3 critical June 2026: 0 vulnerabilities Jun July 2026: 6 vulnerabilities, 1 critical August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202600
Jul 202661
Jun 202600
May 202663
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202510
Nov 202500
Oct 202510
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202511
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

CentreStack 7 Triofox 6 CentreStack and TrioFox 2

Latest advisories

  • High max 9.1
    WID-SEC-2026-2607 6 CVEs

    Gladinet CentreStack: Mehrere Schwachstellen

    Ein Angreifer kann mehrere Schwachstellen in Gladinet CentreStack ausnutzen, um beliebigen Programmcode auszuführen,SQL-Injection durchzuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und vertrauliche Informationen offenzulegen.

    Gladinet Linux Windows
  • High max 9.8
    WID-SEC-2026-1698 6 CVEs

    Gladinet Triofox: Mehrere Schwachstellen

    Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Gladinet Triofox ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen und Informationen offenzulegen.

    Gladinet Linux Windows
  • Critical max 7.1
    WID-SEC-2025-2834 1 CVE 1 exploited rev. 2

    Gladinet CentreStack und Triofox: Schwachstelle ermöglicht Codeausführung

    Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Gladinet CentreStack und Gladinet Triofox ausnutzen, um beliebigen Programmcode auszuführen.

    Gladinet Linux Windows
    first Dec 11, 2025
  • High max 9.1
    WID-SEC-2025-2544 1 CVE 1 exploited

    Gladinet Triofox: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen und potenziell Codeausführung

    Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Gladinet Triofox ausnutzen, um Sicherheitsvorkehrungen zu umgehen, und potenziell um beliebigen Programmcode auszuführen.

    Gladinet Linux Windows
  • Medium max 7.5
    WID-SEC-2025-2255 1 CVE 1 exploited rev. 2

    Gladinet CentreStack: Schwachstelle ermöglicht Offenlegung von Informationen

    Ein lokaler Angreifer kann eine Schwachstelle in Gladinet CentreStack ausnutzen, um Informationen offenzulegen.

    Gladinet Linux Windows macOS
    first Oct 12, 2025
All Critical High Medium Low Exploited only Public exploit

15 results · Feed

  • High 8.8
    CVE-2026-54368

    CentreStack < 17.4 SQL Injection via x-glad-filter Header

    CentreStack before 17.4 contains a SQL injection vulnerability in GladDBFiles.SearchEx() and SearchExUnder() that allows authenticated attackers to execute arbitrary SQL statements by supplying a crafted x-glad-filter request header through the jsondir API en…

    Gladinet CentreStack
  • High 8.6
    CVE-2026-54367

    CentreStack < 17.2 Unauthenticated API Authorization Bypass

    CentreStack before 17.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to read, write, or delete arbitrary account settings by exploiting exposed API endpoints that lack authorization checks. Attackers can generate valid…

    Gladinet CentreStack
  • High 7.5
    CVE-2026-54366

    CentreStack < 17.4 XXE via SharePoint Storage Configuration

    CentreStack before 17.4 contains an XML external entity (XXE) injection vulnerability that allows unauthenticated attackers to exfiltrate arbitrary files by supplying a malicious URL to the SharePoint storage configuration handler. Attackers can send a crafte…

    Gladinet CentreStack
  • High 7.5
    CVE-2026-54365

    CentreStack < 17.3 Unauthenticated User Creation via Deserialization in GSNamespace.dll

    CentreStack before 17.3 contains an unauthenticated deserialization vulnerability in GSNamespace.dll that allows unauthenticated attackers to create arbitrary local OS user accounts by supplying a crafted base64-encoded XML string to exposed API endpoints. At…

    Gladinet CentreStack
  • Medium 6.5
    CVE-2026-54364

    CentreStack < 17.4 Session Injection via SelectProvider.aspx

    CentreStack before 17.4 contains a session variable injection vulnerability that allows unauthenticated attackers to inject arbitrary session variables by embedding newline and tab characters into a crafted AccountName parameter posted to the SelectProvider.a…

    Gladinet CentreStack
  • Critical 9.1
    CVE-2026-54363

    CentreStack < 17.5 Hardcoded Key Token Forgery RCE

    CentreStack before 17.5 contains a hardcoded cryptographic key vulnerability that allows unauthenticated attackers to forge arbitrary encrypted tokens by exploiting a static SysNumber value used as entropy for AccessTicket.Encrypt() and AccessTicket.Decrypt()…

    Gladinet CentreStack
  • High 7.5
    CVE-2026-8359

    Gladinet Triofox WOSHttpStatusModule.dll NULL Function Pointer Call DoS

    When processing a request with a URL path starting with /status or /sysinfo, WOSHttpStatusModule.dll is to be loaded to handle such URL patterns. The WOSBin_LoadHttpModule function in the dll would be called to set up a "module" object for that module. Howeve…

    Gladinet Triofox
  • High 7.5
    CVE-2026-8360

    Gladinet Triofox Unchecked Return Value to NULL Pointer Dereference DOS

    Function calls to WOSCommonUtil.dll!WOSSysInfoGetDeviceInterface() in various DLLs (i.e., WOSProfileMgrModule.dll, WOSWebDavModule.dll) can return a NULL pointer (i.e., when no user is logged into the Triofox Server Agent Management Console). The returned NUL…

    Gladinet Triofox
  • High 7.5
    CVE-2026-8361

    Gladinet Triofox Path Traversal in WOSDefaultHttpModule.dll

    A path traversal vulnerability exists in WOSDefaultHttpModule.dll when processing a URL path starting with /woshome

    Gladinet Triofox
  • Critical 9.8
    CVE-2026-8362

    Gladinet Triofox Stack-based Buffer Overflow in WOSDefaultHttpModule.dll

    A stack-based buffer overflow condition exists in WOSDefaultHttpModule.dll when processing a long URL path starting with /woshome

    Gladinet Triofox
  • Critical 9.8
    CVE-2026-8363

    Gladinet Triofox Stack-based Buffer Overflow in WOSDeviceDropFolder.dll

    A stack-based buffer overflow condition exists in WOSDeviceDropFolder.dll when processing a long URL path starting with /resources:

    Gladinet Triofox
  • Critical 9.8
    CVE-2026-8364

    Gladinet Triofox Missing Authentication for Critical Functions

    Gladinet Triofox Cloud Server Agent Access Service (GladServerAgentService.exe) listens on TCP port 7878 and processes remote HTTP messages with URL paths starting with /resources, /status, /sysinfo, /woshome, /Settings, /schedule, or /DavCache.

    Gladinet Triofox
  • High 7.1
    CVE-2025-14611 Exploited Public exploit Scanner template EPSS 53%

    Gladinet CentreStack and TrioFox Hard Coded AES Keys

    Gladinet CentreStack and Triofox prior to version 16.12.10420.56791 used hardcoded values for their implementation of the AES cryptoscheme. This degrades security for public exposed endpoints that may make use of it and may offer arbitrary local file inclusio…

    Gladinet CentreStack and TrioFox
    KEV Dec 15, 2025
  • High 7.5
    CVE-2025-11371 Exploited Public exploit Scanner template EPSS 92%

    Gladinet CentreStack and TrioFox Local File Inclusion Flaw

    In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended disclosure of system files. Exploitation of this vulnerability has been observed in the wild.  This…

    Gladinet CentreStack and TrioFox
    KEV Nov 4, 2025
  • Critical 9.0
    CVE-2025-30406 Exploited Public exploit Scanner template EPSS 95%

    Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to th…

    Gladinet CentreStack
    KEV Apr 8, 2025