CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (2026-10-19 09:00 UTC)

What this means for you

This week: 5,435 CVEs published, 355 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 5,435; Show in the list
Critical, last 7 days: 355; Show in the list
Healthcare-tagged, last 7 days: 4; Show in the list
Known exploited (CISA KEV): 1,747; Show in the list

Showing CVEs that name the product anviz:cx7_firmware. Show all products

9 CVEs, showing 1 to 9

CVE	Severity	Title	Published
CVE-2026-31927	Medium 4.9	Anviz CX7 Firmware is vulnerable to an authenticated CSV upload which allows path traversal to overwrite arbitrary files (e.g., /etc/shadow), enabling unauthorized SSH access when combined with debug…	Apr 17, 2026
CVE-2026-32324	High 7.7	Anviz CX7 Firmware is vulnerable because the application embeds reusable certificate/key material, enabling decryption of MQTT traffic and potential interaction with device messaging channels at scal…	Apr 17, 2026
CVE-2026-32648	Medium 5.3	Anviz CX2 Lite and CX7 are vulnerable to unauthenticated access that discloses debug configuration details (e.g., SSH/RTTY status), assisting attackers in reconnaissance against the device.	Apr 17, 2026
CVE-2026-33093	Medium 5.3	Anviz CX7 Firmware is vulnerable to an unauthenticated POST to the device that captures a photo with the front facing camera, exposing visual information about the deployment environment.	Apr 17, 2026
CVE-2026-33569	Medium 6.5	Anviz CX2 Lite and CX7 administrative sessions occur over HTTP, enabling on‑path attackers to sniff credentials and session data, which can be used to compromise the device.	Apr 17, 2026
CVE-2026-35061	Medium 5.3	Anviz CX7 Firmware is vulnerable to the most recently captured test photo that can be retrieved without authentication, revealing sensitive operational imagery.	Apr 17, 2026
CVE-2026-35546	Critical 9.8	Anviz CX2 Lite and CX7 are vulnerable to unauthenticated firmware uploads.	Apr 17, 2026
CVE-2026-40066	High 8.8	Anviz CX2 Lite and CX7 are vulnerable to unverified update packages that can be uploaded.	Apr 17, 2026
CVE-2026-40461	High 7.5	Anviz CX2 Lite and CX7 are vulnerable to unauthenticated POST requests that modify debug settings (e.g., enabling SSH), allowing unauthorized state changes that can facilitate later compromise.	Apr 17, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.