CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 13/11/2025 |
| CVE-2025-47220 | MOYENNE5.3 | A local file enumeration was found in Keyfactor SignServer versions prior to 7.3.2 .The property VISIBLE_SIGNATURE_CUSTOM_IMAGE_PATH, which exists in the PDFSigner and the PAdESSigner, can be set to any path without any restrictions by an admin user. In the case that the provided path points to an existing file, readab | 13/11/2025 |
| CVE-2024-36066 | FAIBLE3.1 | The CMP CLI client in KeyFactor EJBCA before 8.3.1 has only 6 octets of salt, and is thus not compliant with the security requirements of RFC 4211, and might make man-in-the-middle attacks easier. CMP includes password-based MAC as one of the options for message integrity and authentication (the other option is certifi | 12/09/2024 |
| CVE-2024-42006 | ÉLEVÉE7.5 | Keyfactor AWS Orchestrator through 2.0 allows Information Disclosure. | 20/08/2024 |
| CVE-2024-34458 | ÉLEVÉE7.5 | Keyfactor Command 10.5.x before 10.5.1 and 11.5.x before 11.5.1 allows SQL Injection which could result in information disclosure. | 20/08/2024 |
| CVE-2023-34196 | ÉLEVÉE8.2 | In the Keyfactor EJBCA before 8.0.0, the RA web certificate distribution servlet /ejbca/ra/cert allows partial denial of service due to an authentication issue. In configurations using OAuth, disclosure of CA certificates (attributes and public keys) to unauthenticated or less privileged users may occur. | 03/08/2023 |
| CVE-2022-42954 | MOYENNE5.4 | Keyfactor EJBCA before 7.10.0 allows XSS. | 17/11/2022 |
| CVE-2022-39834 | MOYENNE5.4 | A stored XSS vulnerability was discovered in adminweb/ra/viewendentity.jsp in PrimeKey EJBCA through 7.9.0.2. A low-privilege user can store JavaScript in order to exploit a higher-privilege user. | 17/11/2022 |