Vendor
Xerox
748 known vulnerabilities in products by Xerox, 4 of them actively exploited (CISA KEV).
Key figures
748
Vulnerabilities
4
Actively exploited (KEV)
0
Used by ransomware
127
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority.
| Severity | CVE | Title | CVSS | Published |
|---|---|---|---|---|
| Critical | CVE-2025-24813 | Apache Tomcat Path Equivalence Vulnerability In CISA KEV | 9.8 | |
| Critical | CVE-2023-44487 | HTTP/2 Rapid Reset Attack Vulnerability In CISA KEV | 7.5 | |
| Critical | CVE-2026-33824 | Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability In CISA KEV | 9.8 | |
| Critical | CVE-2026-32202 | Windows Shell Spoofing Vulnerability In CISA KEV | 4.3 | |
| Critical | CVE-2024-5535 | SSL_select_next_proto buffer overread | 9.1 | |
| Critical | CVE-2025-62168 | Squid vulnerable to information disclosure via authentication credential leakage in error handling | 10.0 | |
| Critical | CVE-2025-56005 | Dabeaz PLY: Deserialization of Untrusted Data | 9.8 | |
| High | CVE-2025-15467 | Stack buffer overflow in CMS (Auth)EnvelopedData parsing | 8.8 | |
| Critical | CVE-2025-8356 | Path Traversal leading to RCE | 9.8 | |
| High | CVE-2023-24329 | Python Software Foundation CPython: security vulnerability | 7.5 | |
| Medium | CVE-2024-2511 | Unbounded memory growth with session handling in TLSv1.3 | 5.9 | |
| Critical | CVE-2023-3824 | Buffer overflow and overread in phar_dir_read() | 9.4 | |
| Critical | CVE-2023-28879 | Artifex Ghostscript: Buffer Overflow | 9.8 | |
| Critical | CVE-2019-10880 | XEROX ColorQube 8700/8900: OS Command Injection | 9.8 | |
| High | CVE-2024-4741 | Use After Free with SSL_free_buffers | 7.5 | |
| High | CVE-2025-8355 | XXE leading to SSRF | 7.5 | |
| High | CVE-2023-43622 | Apache HTTP Server: DoS in HTTP/2 with initial windows size 0 | 7.5 | |
| High | CVE-2023-36053 | Django: Denial of Service | 7.5 | |
| Critical | CVE-2022-32221 | Https://github.com/curl/curl: Exposure of Sensitive Information to an Unauthorized Actor | 9.8 | |
| High | CVE-2023-40477 | RARLAB WinRAR Recovery Volume Improper Validation of Array Index Remote Code Execution Vulnerability | 7.8 | |
| Medium | CVE-2025-26466 | Openssh: denial-of-service in openssh | 5.9 | |
| Medium | CVE-2026-1207 | Potential SQL injection via raster lookups on PostGIS | 5.4 | |
| High | CVE-2024-6345 | Remote Code Execution in pypa/setuptools | 8.8 | |
| High | CVE-2023-4050 | Mozilla Firefox: security vulnerability | 7.5 | |
| High | CVE-2022-3924 | ISC BIND 9: security vulnerability | 7.5 |
News
- October Patch Tuesday roundup: Over 1,400 Microsoft holes to be plugged, including three zero dayscsoonline,
- 58 hardware vulnerabilities: A guide to the threatscsoonline,
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 32sans-atrisk-mail,
- Unpatched Windows Search URI Vulnerability Lets Attackers Steal NTLMv2 Hashesthehackernews,
- Oracle’s first monthly patch release fixes 35 flaws, including 11 rated ‘critical’csoonline,
- Follow-ups: Colorado Bill to Amend Right-to-Repair Postponed Indefinitely; French Authorities Investigate Suspect in Connection with ANTS Breachsans-newsbites-mail,