AD
Product
Adserver
19
CVEs
0
On KEV
8.8
Max CVSS
0
New 30D
Severity mix
Critical 0High 4Medium 12Low 0
Watch
Add Adserver to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-50741 | 8.8 | Jun 26 | Bypass to the fix for CVE-2026-34916 Affected: through 6.0.7 |
| CVE-2026-44959 | 8.8 | Jun 23 | A missing validation of user input exists when saving delivery limitations in Revive Adserver 6.0.6 and earlier Affected: through 6.0.6 |
| CVE-2026-34914 | 8.3 | Jun 23 | A missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and earlier Affected: through 6.0.6 |
| CVE-2023-26756 | 7.5 | Apr 14 | The login page of Revive Adserver v5.4.1 is vulnerable to brute force attacks Affected: 5.4.1 |
| CVE-2026-50745 | 6.1 | Jun 26 | A missing sanitisation vulnerability exists with user input in the stats-video.php script Affected: through 6.0.7 |
| CVE-2026-34915 | 6.1 | Jun 23 | A missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and earlier could allow a low‑privileged user to exploit the clientid parameter to… Affected: through 6.0.6 |
| CVE-2026-50743 | 5.4 | Jul 20 | A CSRF vulnerability exists in the `zone-include.php` script in Revive Adserver 6.0.7 Affected: through 6.0.7 |
| CVE-2026-50740 | 5.4 | Jun 26 | A missing sanitisation vulnerability of user input in the zone-include.php script exists in Revive Adserver 6.0.7 and earlier Affected: through 6.0.7 |
| CVE-2026-50742 | 5.4 | Jun 26 | A stored XSS vulnerabilities exists in the `maintenance-acl-check.php` and `maintenance-banners-check.php` tools of Revive Adserver 6.0.7 Affected: through 6.0.7 |
| CVE-2026-44958 | 5.4 | Jun 23 | An access control bypass allows an advertiser‑level user to activate or deactivate a banner in Revive Adserver 6.0.6 and earlier, even when such permissions were not granted Affected: through 6.0.6 |
| CVE-2026-50739 | 4.3 | Jun 26 | A bypass for CVE‑2026‑34913 exists with proper ownership validation that had not been applied to the reverse operation of linking campaigns and trackers through the… Affected: through 6.0.7 |
| CVE-2026-50744 | 4.3 | Jun 26 | A bypass to the admin‑only restriction of the XML‑RPC API in Revive Adserver 6.0.7 Affected: through 6.0.7 |
| CVE-2026-34913 | 4.3 | Jun 23 | A missing access control check when linking trackers to campaigns through the campaign-trackers.php script of Revive Adserver 6.0.6 and earlier could allow a low‑privileged user… Affected: through 6.0.6 |
| CVE-2026-34917 | 4.3 | Jun 23 | Low‑privileged session IDs generated for the web admin console could be reused in the XML‑RPC API, whose authentication is normally restricted to admin users Affected: through 6.0.6 |
| CVE-2026-44957 | 4.3 | Jun 23 | A missing access control check when invoking various modify methods in the XML‑RPC API of Revive Adserver 6.0.6 and earlier Affected: through 6.0.6 |
| CVE-2026-34912 | 4.3 | Jun 23 | A missing access control check when linking banners or campaigns to a zone through the zone-include.php script of Revive Adserver 6.0.6 and earlier, or via its API allows a… Affected: through 6.0.6 |
| CVE-2026-44956 | 0.0 | Jun 23 | Low‑privileged users could use their Full Name as a vector for a stored XSS attack Affected: through 6.0.6 |
| CVE-2026-44961 | 0.0 | Jun 23 | The XML‑RPC API addUser method has a validation bypass introduced in the fix for CVE‑2025‑55129 Affected: through 6.0.6 |
| CVE-2026-44960 | 0.0 | Jun 23 | A stored XSS can be exploited by leveraging the usernames as an attack vector Affected: through 6.0.6 |
Showing 19