Vulnerabilities

TI-2026-78875 CVE-2026-114462 · GHSA-f689-pcwm-j2cm

Velneo vServer HTTP Server follows symlinks to read arbitrary files

LOW 27

Improper link resolution before file access ('link following') vulnerability in Velneo vServer.

CVSS 4.0MEDIUM 6.0 Network Low privileges No interaction EPSS 0.00305 Published 2026-10-21 Fixed in 36.6, 37.2 CWE-59

TI-2026-78786 CVE-2026-114405 · GHSA-f334-8hf4-fmpm

Denial of service via malformed VATP packet in Velneo vServer

MEDIUM 44

Improper validation of array index vulnerability in Velneo vServer.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00344 Published 2026-10-21 Fixed in 36.6, 37.2 CWE-129

TI-2021-20386 CVE-2021-45036 · GHSA-c83p-m9mw-q96q

Velneo vClient improper authentication

MEDIUM 41

Velneo vClient on its 28.1.3 version, could allow an attacker with knowledge of the victims's username and hashed password to spoof the victim's id against the server.

CVSS 3.1HIGH 8.7 Network No auth No interaction EPSS 0.00778 Published 2022-11-28 No fix listed CWE-290

TI-2021-20385 CVE-2021-45035 · GHSA-pv7f-h3w8-w3jh

Velneo vClient Improper authentication

LOW 28

Velneo vClient on its 28.1.3 version, does not correctly check the certificate of authenticity by default.

CVSS 3.1MEDIUM 6.3 Adjacent network No auth User interaction EPSS 0.00464 Published 2022-09-23 No fix listed CWE-287

Vulnerabilities

Filters

Velneo vServer HTTP Server follows symlinks to read arbitrary files

Denial of service via malformed VATP packet in Velneo vServer

Velneo vClient improper authentication

Velneo vClient Improper authentication