RE
Vendor
rejetto
15
CVEs
3
On KEV
0
New 30D
Products
HF9.8
HTTP File Server
Rejetto
5 CVEs2 on KEV0 new
HF9.8
HTTP File Server (HFS)
Rejetto
1 CVEs1 on KEV0 new
HF9.8
hfs
rejetto
6 CVEs0 on KEV0 new
HF10.0
hfs2
rejetto
3 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-97362 | HF hfs2 rejetto | 7.5 | Sep 24 | HFS2 2.4.0 Unauthenticated Denial of Service via Hung Serving Thread |
| CVE-2026-97360 | HF hfs2 rejetto | 10.0 | Sep 24 | HFS2 2.4.0 Unauthenticated Arbitrary File Read/Write via Template Engine |
| CVE-2026-97359 | HF hfs2 rejetto | 10.0 | Sep 24 | HFS2 2.4.0 RCE via Multipart Upload Filename Template Injection |
| CVE-2026-61505 | HF hfs rejetto | 5.3 | Jul 13 | Rejetto HFS < 3.2.1 Limited File Disclosure via Path Traversal in lang Parameter |
| CVE-2026-61504 | HF hfs rejetto | 5.4 | Jul 13 | Rejetto HFS < 3.2.1 Stored XSS via File Names in Basic Web Listing |
| CVE-2026-61503 | HF hfs rejetto | 5.3 | Jul 13 | Rejetto HFS < 3.2.1 Username Enumeration via Login Response Differences |
| CVE-2026-61502 | HF hfs rejetto | 4.3 | Jul 13 | Rejetto HFS < 3.2.1 Cross-Site Request Forgery via GET Requests |
| CVE-2026-61501 | HF hfs rejetto | 6.1 | Jul 13 | Rejetto HFS < 3.2.1 Stored XSS in Admin Log Viewer |
| CVE-2026-61500 | HF hfs rejetto | 9.8 | Jul 13 | Rejetto HFS < 3.2.1 Session Forgery via Predictable Signing Key |
| CVE-2024-39943 | HF Http File Server Rejetto | 8.8 | Jul 4 | rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (if they have Upload permissions) |
| CVE-2024-23692 RansomwareIn wildKEV | HF HTTP File Server Rejetto | 9.8 | May 31 | Rejetto HTTP File Server 2.3m Unauthenticated RCE |
| CVE-2020-13432 | HF Http File Server Rejetto | 7.5 | Jun 8 | rejetto HFS (aka HTTP File Server) v2.3m Build #300, when virtual files or folders are used, allows remote attackers to trigger an invalid-pointer write access violation via… |
| CVE-2014-7226 | HF Http File Server Rejetto | – | Oct 10 | The file comment feature in Rejetto HTTP File Server (hfs) 2.3c and earlier allows remote attackers to execute arbitrary code by uploading a file with certain invalid UTF-8 byte… |
| CVE-2014-6287 In wildKEV | HF Http File Server Rejetto | 9.8 | Oct 7 | Rejetto HTTP File Server (HFS) Remote Code Execution Vulnerability |