Search
Find a vulnerability
Search criteria
4 vulnerabilities found for vServer by Velneo
CVE-2026-114462 (GCVE-0-2026-114462)
Vulnerability from nvd – Published: 2026-10-21 15:02 – Updated: 2026-10-21 15:02
VLAI
EPSS
VEX
Title
Arbitrary File Read via Symlink in Velneo vServer HTTP Server
Summary
Improper link resolution before file access ('link following') vulnerability in Velneo vServer. This issue affects vServer: from 32.3 before 36.6 and from 37.1 before 37.2.
Severity
CWE
- CWE-59 - Improper link resolution before file access ('link following')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://velneo.es/avisos-de-seguridad/ | vendor-advisorypatch |
Impacted products
Date Public
2026-10-21 15:02
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "vServer",
"vendor": "Velneo",
"versions": [
{
"lessThan": "36.6",
"status": "affected",
"version": "36.0",
"versionType": "custom"
},
{
"lessThan": "37.2",
"status": "affected",
"version": "37.0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "36.6",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "37.2",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:velneo:vserver:*:*:*:*:*:*:*:*",
"versionEndExcluding": "36.6",
"versionStartIncluding": "36.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:velneo:vserver:*:*:*:*:*:*:*:*",
"versionEndExcluding": "37.2",
"versionStartIncluding": "37.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:velneo:vserver:36.6:*:*:*:*:*:*:*",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:velneo:vserver:37.2:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Luis Sobrecueva"
}
],
"datePublic": "2026-10-21T15:02:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper link resolution before file access (\u0027link following\u0027) vulnerability in Velneo vServer.\u0026nbsp;This issue affects vServer: from 32.3 before 36.6 and from 37.1 before 37.2."
}
],
"value": "Improper link resolution before file access (\u0027link following\u0027) vulnerability in Velneo vServer.\u00a0This issue affects vServer: from 32.3 before 36.6 and from 37.1 before 37.2."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "CWE-59 Improper link resolution before file access (\u0027link following\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T15:02:31.893Z",
"orgId": "6b608899-1da4-4a4d-8cfe-114101467ac1",
"shortName": "Velneo"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://velneo.es/avisos-de-seguridad/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The vulnerability is patched in versions 36.6\u0026nbsp; and 37.2\u0026nbsp;"
}
],
"value": "The vulnerability is patched in versions 36.6\u00a0 and 37.2"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Arbitrary File Read via Symlink in Velneo vServer HTTP Server",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "6b608899-1da4-4a4d-8cfe-114101467ac1",
"assignerShortName": "Velneo",
"cveId": "CVE-2026-114462",
"datePublished": "2026-10-21T15:02:31.893Z",
"dateReserved": "2026-10-21T14:49:51.377Z",
"dateUpdated": "2026-10-21T15:02:31.893Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114405 (GCVE-0-2026-114405)
Vulnerability from nvd – Published: 2026-10-21 12:27 – Updated: 2026-10-21 17:19
VLAI
EPSS
VEX
Title
Denial of Service via Malformed VATP Packet in Velneo vServer
Summary
Improper validation of array index vulnerability in Velneo vServer. This issue affects vServer: from 36.0 before 36.6 and from 37.0 before 37.2.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-21 15:19 UTC
CWE
- CWE-129 - Improper validation of array index
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://velneo.es/avisos-de-seguridad/ | vendor-advisorypatch |
Impacted products
Date Public
2026-10-21 12:08
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-114405",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-21T15:19:10.085763Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T17:19:14.578Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "vServer",
"vendor": "Velneo",
"versions": [
{
"lessThan": "36.6",
"status": "affected",
"version": "36.0",
"versionType": "custom"
},
{
"lessThan": "37.2",
"status": "affected",
"version": "37.0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "36.6",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "37.2",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:velneo:vserver:*:*:*:*:*:*:*:*",
"versionEndExcluding": "36.6",
"versionStartIncluding": "36.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:velneo:vserver:*:*:*:*:*:*:*:*",
"versionEndExcluding": "37.2",
"versionStartIncluding": "37.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:velneo:vserver:36.6:*:*:*:*:*:*:*",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:velneo:vserver:37.2:*:*:*:*:*:*:*",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Luis Sobrecueva"
}
],
"datePublic": "2026-10-21T12:08:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper validation of array index vulnerability in Velneo vServer.\u0026nbsp;This issue affects vServer: from 36.0 before 36.6 and from 37.0 before 37.2."
}
],
"value": "Improper validation of array index vulnerability in Velneo vServer.\u00a0This issue affects vServer: from 36.0 before 36.6 and from 37.0 before 37.2."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-129",
"description": "CWE-129 Improper validation of array index",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:27:00.706Z",
"orgId": "6b608899-1da4-4a4d-8cfe-114101467ac1",
"shortName": "Velneo"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://velneo.es/avisos-de-seguridad/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The vulnerability is patched in versions 36.6\u0026nbsp; and 37.2\u0026nbsp;"
}
],
"value": "The vulnerability is patched in versions 36.6\u00a0 and 37.2"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Denial of Service via Malformed VATP Packet in Velneo vServer",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "6b608899-1da4-4a4d-8cfe-114101467ac1",
"assignerShortName": "Velneo",
"cveId": "CVE-2026-114405",
"datePublished": "2026-10-21T12:27:00.706Z",
"dateReserved": "2026-10-21T11:53:51.579Z",
"dateUpdated": "2026-10-21T17:19:14.578Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114462 (GCVE-0-2026-114462)
Vulnerability from cvelistv5 – Published: 2026-10-21 15:02 – Updated: 2026-10-21 15:02
VLAI
EPSS
VEX
Title
Arbitrary File Read via Symlink in Velneo vServer HTTP Server
Summary
Improper link resolution before file access ('link following') vulnerability in Velneo vServer. This issue affects vServer: from 32.3 before 36.6 and from 37.1 before 37.2.
Severity
CWE
- CWE-59 - Improper link resolution before file access ('link following')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://velneo.es/avisos-de-seguridad/ | vendor-advisorypatch |
Impacted products
Date Public
2026-10-21 15:02
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "vServer",
"vendor": "Velneo",
"versions": [
{
"lessThan": "36.6",
"status": "affected",
"version": "36.0",
"versionType": "custom"
},
{
"lessThan": "37.2",
"status": "affected",
"version": "37.0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "36.6",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "37.2",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:velneo:vserver:*:*:*:*:*:*:*:*",
"versionEndExcluding": "36.6",
"versionStartIncluding": "36.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:velneo:vserver:*:*:*:*:*:*:*:*",
"versionEndExcluding": "37.2",
"versionStartIncluding": "37.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:velneo:vserver:36.6:*:*:*:*:*:*:*",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:velneo:vserver:37.2:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Luis Sobrecueva"
}
],
"datePublic": "2026-10-21T15:02:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper link resolution before file access (\u0027link following\u0027) vulnerability in Velneo vServer.\u0026nbsp;This issue affects vServer: from 32.3 before 36.6 and from 37.1 before 37.2."
}
],
"value": "Improper link resolution before file access (\u0027link following\u0027) vulnerability in Velneo vServer.\u00a0This issue affects vServer: from 32.3 before 36.6 and from 37.1 before 37.2."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "CWE-59 Improper link resolution before file access (\u0027link following\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T15:02:31.893Z",
"orgId": "6b608899-1da4-4a4d-8cfe-114101467ac1",
"shortName": "Velneo"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://velneo.es/avisos-de-seguridad/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The vulnerability is patched in versions 36.6\u0026nbsp; and 37.2\u0026nbsp;"
}
],
"value": "The vulnerability is patched in versions 36.6\u00a0 and 37.2"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Arbitrary File Read via Symlink in Velneo vServer HTTP Server",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "6b608899-1da4-4a4d-8cfe-114101467ac1",
"assignerShortName": "Velneo",
"cveId": "CVE-2026-114462",
"datePublished": "2026-10-21T15:02:31.893Z",
"dateReserved": "2026-10-21T14:49:51.377Z",
"dateUpdated": "2026-10-21T15:02:31.893Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114405 (GCVE-0-2026-114405)
Vulnerability from cvelistv5 – Published: 2026-10-21 12:27 – Updated: 2026-10-21 17:19
VLAI
EPSS
VEX
Title
Denial of Service via Malformed VATP Packet in Velneo vServer
Summary
Improper validation of array index vulnerability in Velneo vServer. This issue affects vServer: from 36.0 before 36.6 and from 37.0 before 37.2.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-21 15:19 UTC
CWE
- CWE-129 - Improper validation of array index
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://velneo.es/avisos-de-seguridad/ | vendor-advisorypatch |
Impacted products
Date Public
2026-10-21 12:08
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-114405",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-21T15:19:10.085763Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T17:19:14.578Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "vServer",
"vendor": "Velneo",
"versions": [
{
"lessThan": "36.6",
"status": "affected",
"version": "36.0",
"versionType": "custom"
},
{
"lessThan": "37.2",
"status": "affected",
"version": "37.0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "36.6",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "37.2",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:velneo:vserver:*:*:*:*:*:*:*:*",
"versionEndExcluding": "36.6",
"versionStartIncluding": "36.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:velneo:vserver:*:*:*:*:*:*:*:*",
"versionEndExcluding": "37.2",
"versionStartIncluding": "37.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:velneo:vserver:36.6:*:*:*:*:*:*:*",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:velneo:vserver:37.2:*:*:*:*:*:*:*",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Luis Sobrecueva"
}
],
"datePublic": "2026-10-21T12:08:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper validation of array index vulnerability in Velneo vServer.\u0026nbsp;This issue affects vServer: from 36.0 before 36.6 and from 37.0 before 37.2."
}
],
"value": "Improper validation of array index vulnerability in Velneo vServer.\u00a0This issue affects vServer: from 36.0 before 36.6 and from 37.0 before 37.2."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-129",
"description": "CWE-129 Improper validation of array index",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:27:00.706Z",
"orgId": "6b608899-1da4-4a4d-8cfe-114101467ac1",
"shortName": "Velneo"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://velneo.es/avisos-de-seguridad/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The vulnerability is patched in versions 36.6\u0026nbsp; and 37.2\u0026nbsp;"
}
],
"value": "The vulnerability is patched in versions 36.6\u00a0 and 37.2"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Denial of Service via Malformed VATP Packet in Velneo vServer",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "6b608899-1da4-4a4d-8cfe-114101467ac1",
"assignerShortName": "Velneo",
"cveId": "CVE-2026-114405",
"datePublished": "2026-10-21T12:27:00.706Z",
"dateReserved": "2026-10-21T11:53:51.579Z",
"dateUpdated": "2026-10-21T17:19:14.578Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}