Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
6.9 MEDIUM
CVE-2026-78618 — Dimension Business Logic Flaw Allows Chained Backend Object Operations

A business logic flaw in WatchGuard Dimension allows an authenticated administrator to trigger multiple backend operations within a single logical flow by sending a specially crafted request.

Remote | Authorization
Aug 28, 2026 Aug 28, 2026
Aug 28, 2026
Aug 28, 2026
6.3 MEDIUM
CVE-2026-78617 — WatchGuard Dimension Web UI Authentication Brute-Force Due to Missing Rate Limiting

WatchGuard Dimension's web login endpoint does not enforce effective rate-limiting or account lockout by default allowing a remote attacker to perform automated password guessing against user account…

Remote | Authentication
Aug 28, 2026 Aug 28, 2026
Aug 28, 2026
Aug 28, 2026
4.8 MEDIUM
CVE-2026-78616 — Dimension Stored XSS via Trusted CA Certificate Configuration

A Stored Cross-Site Scripting (XSS) vulnerability in WatchGuard Dimension's Trusted CA certificate configuration allows an authenticated administrator to execute arbitrary JavaScript in another authe…

Remote | Cross-Site Scripting
Aug 28, 2026 Aug 28, 2026
Aug 28, 2026
Aug 28, 2026
4.6 MEDIUM
CVE-2026-78615 — WatchGuard Dimension Reflected DOM-Based XSS in Report Detail Page

A Reflected Cross-Site Scripting (XSS) vulnerability in WatchGuard Dimension's report detail page allows an attacker to execute arbitrary JavaScript in a authenticated user's browser with a specially…

Remote | Cross-Site Scripting
Aug 28, 2026 Aug 28, 2026
Aug 28, 2026
Aug 28, 2026
8.6 HIGH
CVE-2026-78614 — Dimension SQL Injection in Audit Report

WatchGuard Dimension contains an authenticated SQL injection vulnerability in the audit report feature which allows an authenticated user with report administration permissions gain arbitrary command…

Remote | Injection
Aug 28, 2026 Aug 28, 2026
Aug 28, 2026
Aug 28, 2026
8.6 HIGH
CVE-2026-78613 — Dimension SQL Injection in Log Viewer

WatchGuard Dimension contains an authenticated SQL injection vulnerability in the log viewer feature which allows an authenticated user with report administration permissions gain arbitrary command e…

Remote | Injection
Aug 28, 2026 Aug 28, 2026
Aug 28, 2026
Aug 28, 2026
8.6 HIGH
CVE-2026-78612 — Dimension SQL Injection in Scheduled Report

WatchGuard Dimension contains an authenticated SQL injection vulnerability in the scheduled report feature which allows an authenticated user with report administration permissions gain arbitrary com…

Remote | Injection
Aug 28, 2026 Aug 28, 2026
Aug 28, 2026
Aug 28, 2026
8.4 HIGH
CVE-2026-78610 — Dimension CSRF Vulnerability in Administrator Passphrase Change Endpoint

WatchGuard Dimension's Web UI exposes an administrator passphrase change action that lacks CSRF protection. An attacker who can induce an authenticated global administrator's browser to visit a craft…

Remote | Cross-Site Request Forgery
Aug 28, 2026 Aug 28, 2026
Aug 28, 2026
Aug 28, 2026
5.1 MEDIUM
CVE-2026-78500 — Dimension Blind SSRF via Database Test Connection Feature

A blind server-side request forgery (SSRF) vulnerability WatchGuard Dimension Database Server Test configuration allows an authenticated privileged attacker to enumerate exposed network services on a…

Remote | Server-Side Request Forgery
Aug 28, 2026 Aug 28, 2026
Aug 28, 2026
Aug 28, 2026
5.1 MEDIUM
CVE-2026-78499 — Dimension SSRF via FTP Server Test Connection

A server-side request forgery (SSRF) vulnerability WatchGuard Dimension FTP Server Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent net…

Remote | Server-Side Request Forgery
Aug 28, 2026 Aug 28, 2026
Aug 28, 2026
Aug 28, 2026
5.1 MEDIUM
CVE-2026-78498 — Dimension Server-Side Request Forgery via Email Server Test Settings

A server-side request forgery (SSRF) vulnerability WatchGuard Dimension Email Server Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent n…

Remote | Server-Side Request Forgery
Aug 28, 2026 Aug 28, 2026
Aug 28, 2026
Aug 28, 2026
5.3 MEDIUM
CVE-2026-78495 — Dimension Server-Side Request Forgery via Remote Backup Connection Test

A server-side request forgery (SSRF) vulnerability WatchGuard Dimension Remote Backup Connection Test configuration allows an authenticated privileged attacker to enumerate exposed network services o…

Remote | Server-Side Request Forgery
Aug 28, 2026 Aug 28, 2026
Aug 28, 2026
Aug 28, 2026
5.1 MEDIUM
CVE-2026-78195 — Dimension Stored XSS via Backup Historical Data Feature

A Cross-Site Scripting (XSS) vulnerability in the WatchGuard Dimension Backup Historical Data feature allows an authenticated administrator user to execute arbitrary JavaScript in another user's brow…

Remote | Cross-Site Scripting
Aug 28, 2026 Aug 28, 2026
Aug 28, 2026
Aug 28, 2026
9.3 CRITICAL
CVE-2026-78174 — WatchGuard Dimension Session Hijack via Exposed Session Tokens in Diagnostic Logs

WatchGuard Dimension records unredacted session identifiers for logged-in users in its web UI diagnostic log. A low-privileged Dimension Administrator can retrieve this log and extract a Super Admini…

Remote | Information Disclosure
Aug 28, 2026 Aug 28, 2026
Aug 28, 2026
Aug 28, 2026
5.1 MEDIUM
CVE-2026-78103 — Dimension Log Server Configuration Lock Bypass Vulnerability

WatchGuard Dimension provides a client-side lock/unlock UI control for management changes. The server-side configuration endpoint does not enforce this lock/unlock workflow state, allowing an authent…

Remote | Authorization
Aug 28, 2026 Aug 28, 2026
Aug 28, 2026
Aug 28, 2026
5.1 MEDIUM
CVE-2026-78047 — Dimension Stored XSS in Scheduled Report Task

A stored cross-site scripting (XSS) vulnerability in WatchGuard Dimension's task scheduling feature allows a low-privileged authenticated administrator to inject arbitrary HTML/JavaScript into these …

Remote | Cross-Site Scripting
Aug 28, 2026 Aug 28, 2026
Aug 28, 2026
Aug 28, 2026
8.7 HIGH
CVE-2026-78011 — Fireware OS Integer Underflow in Iked Allows Unauthenticated Denial of Service (DoS)

An integer underflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending speci…

fireware_os | Remote | Denial of Service
Aug 28, 2026 Aug 28, 2026
Aug 28, 2026
Aug 28, 2026
8.7 HIGH
CVE-2026-78010 — Fireware OS Stack-Based Buffer Overflow in iked Allows Unauthenticated Denial of Service

A stack-based buffer overflow vulnerability in the WatchGuard Fireware OS iked process iallows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sen…

fireware_os | Remote | Memory Corruption
Aug 28, 2026 Aug 28, 2026
Aug 28, 2026
Aug 28, 2026
8.7 HIGH
CVE-2026-78009 — Fireware OS Out-of-Bounds Read in iked Allows Unauthenticated Denial of Service (DoS)

An out-of-bounds read vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending spec…

fireware_os | Remote | Denial of Service
Aug 28, 2026 Aug 28, 2026
Aug 28, 2026
Aug 28, 2026
8.6 HIGH
CVE-2026-78008 — Fireware OS Authenticated Buffer Overflow in wgagent

A buffer overflow vulnerability in the WatchGuard Fireware OS Management Web UI allows an authenticated administrator with network access to cause a denial of service (DoS) condition or potentially e…

fireware_os | Remote | Memory Corruption
Aug 28, 2026 Aug 28, 2026
Aug 28, 2026
Aug 28, 2026
Showing 20 of 12395 Results