# Axis Communications AB AXIS OS. Every CVE that names Axis Communications AB AXIS OS among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first - [Incorrect permission assignment in Axis Communications AB AXIS OS](https://agentprime.io/advisories/CVE-2026-4757.md) `CVE-2026-4757` · CVE record: Axis Communications AB AXIS OS · CVSS 7.2 High · Not analysed yet · Published 11 Aug 2026 · Tags: Broken access control - [Time-of-check time-of-use race condition in Axis Communications AB AXIS OS](https://agentprime.io/advisories/CVE-2026-6505.md) `CVE-2026-6505` · CVE record: Axis Communications AB AXIS OS · CVSS 5.1 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: Race condition - [An ACAP configuration file lacks input validation, which could potentially lead to privilege escalation.](https://agentprime.io/advisories/CVE-2026-5304.md) `CVE-2026-5304` · CVE record: Axis Communications AB AXIS OS · CVSS 5.7 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: CWE-1287 - [Time-of-check time-of-use race condition in Axis Communications AB AXIS OS](https://agentprime.io/advisories/CVE-2026-5303.md) `CVE-2026-5303` · CVE record: Axis Communications AB AXIS OS · CVSS 5.7 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: Race condition - [Authentication bypass by spoofing in Axis Communications AB AXIS OS](https://agentprime.io/advisories/CVE-2026-6181.md) `CVE-2026-6181` · CVE record: Axis Communications AB AXIS OS · CVSS 5.9 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: Authentication bypass - [Incorrect permission assignment in Axis Communications AB AXIS OS](https://agentprime.io/advisories/CVE-2026-1185.md) `CVE-2026-1185` · CVE record: Axis Communications AB AXIS OS · CVSS 5.4 Medium · Not analysed yet · Published 12 May 2026 · Tags: Broken access control - [Path traversal in Axis Communications AB AXIS OS](https://agentprime.io/advisories/CVE-2026-0804.md) `CVE-2026-0804` · CVE record: Axis Communications AB AXIS OS · CVSS 6.7 Medium · Not analysed yet · Published 12 May 2026 · Tags: Path traversal - [An ACAP configuration file lacked sufficient input validation, which could allow command injection and potentially lead to privilege escalation.](https://agentprime.io/advisories/CVE-2026-0802.md) `CVE-2026-0802` · CVE record: Axis Communications AB AXIS OS · CVSS 6.0 Medium · Not analysed yet · Published 12 May 2026 · Tags: CWE-1287 - [Incorrect permission assignment in Axis Communications AB AXIS OS](https://agentprime.io/advisories/CVE-2026-0541.md) `CVE-2026-0541` · CVE record: Axis Communications AB AXIS OS · CVSS 6.7 Medium · Not analysed yet · Published 12 May 2026 · Tags: Broken access control - [OS command injection in Axis Communications AB AXIS OS](https://agentprime.io/advisories/CVE-2025-11142.md) `CVE-2025-11142` · CVE record: Axis Communications AB AXIS OS · CVSS 7.1 High · Not analysed yet · Published 10 Feb 2026 · Tags: Command injection - [Execution with unnecessary privileges in Axis Communications AB AXIS OS](https://agentprime.io/advisories/CVE-2025-9055.md) `CVE-2025-9055` · CVE record: Axis Communications AB AXIS OS · CVSS 6.4 Medium · Not analysed yet · Published 11 Nov 2025 · Tags: Privilege escalation - [External control of a file path in Axis Communications AB AXIS OS](https://agentprime.io/advisories/CVE-2025-8998.md) `CVE-2025-8998` · CVE record: Axis Communications AB AXIS OS · CVSS 3.1 Low · Not analysed yet · Published 11 Nov 2025 · Tags: Path traversal - [The VAPIX API port.cgi did not have sufficient input validation, which may result in process crashes and impact usability.](https://agentprime.io/advisories/CVE-2025-9524.md) `CVE-2025-9524` · CVE record: Axis Communications AB AXIS OS · CVSS 4.3 Medium · Not analysed yet · Published 11 Nov 2025 · Tags: CWE-1287 - [Incorrect permission assignment in Axis Communications AB AXIS OS](https://agentprime.io/advisories/CVE-2025-8108.md) `CVE-2025-8108` · CVE record: Axis Communications AB AXIS OS · CVSS 6.7 Medium · Not analysed yet · Published 11 Nov 2025 · Tags: Broken access control, CWE-1287 - [Incorrect permission assignment in Axis Communications AB AXIS OS](https://agentprime.io/advisories/CVE-2025-6779.md) `CVE-2025-6779` · CVE record: Axis Communications AB AXIS OS · CVSS 6.7 Medium · Not analysed yet · Published 11 Nov 2025 · Tags: Broken access control - [Insufficiently protected credentials in Axis Communications AB AXIS OS](https://agentprime.io/advisories/CVE-2025-6571.md) `CVE-2025-6571` · CVE record: Axis Communications AB AXIS OS · CVSS 6.0 Medium · Not analysed yet · Published 11 Nov 2025 · Tags: Hard-coded credentials - [A malicious ACAP application can gain access to admin-level service account credentials used by legitimate ACAP applications, leading to potential privilege escalation of the malicious ACAP applicati…](https://agentprime.io/advisories/CVE-2025-5452.md) `CVE-2025-5452` · CVE record: Axis Communications AB AXIS OS · CVSS 6.6 Medium · Not analysed yet · Published 11 Nov 2025 · Tags: CWE-214 - [ACAP applications can gain elevated privileges due to improper input validation, potentially leading to privilege escalation.](https://agentprime.io/advisories/CVE-2025-6298.md) `CVE-2025-6298` · CVE record: Axis Communications AB AXIS OS · CVSS 6.7 Medium · Not analysed yet · Published 11 Nov 2025 · Tags: CWE-1287 - [Symlink following in Axis Communications AB AXIS OS](https://agentprime.io/advisories/CVE-2025-5718.md) `CVE-2025-5718` · CVE record: Axis Communications AB AXIS OS · CVSS 6.8 Medium · Not analysed yet · Published 11 Nov 2025 · Tags: Path traversal - [Path traversal in Axis Communications AB AXIS OS](https://agentprime.io/advisories/CVE-2025-5454.md) `CVE-2025-5454` · CVE record: Axis Communications AB AXIS OS · CVSS 6.4 Medium · Not analysed yet · Published 11 Nov 2025 · Tags: Path traversal - [An ACAP configuration file lacked sufficient input validation, which could allow for arbitrary code execution.](https://agentprime.io/advisories/CVE-2025-4645.md) `CVE-2025-4645` · CVE record: Axis Communications AB AXIS OS · CVSS 6.7 Medium · Not analysed yet · Published 11 Nov 2025 · Tags: CWE-1287 - [An ACAP configuration file lacked sufficient input validation, which could allow for arbitrary code execution.](https://agentprime.io/advisories/CVE-2025-30027.md) `CVE-2025-30027` · CVE record: Axis Communications AB AXIS OS · CVSS 6.7 Medium · Not analysed yet · Published 12 Aug 2025 · Tags: CWE-1287 - [Execution with unnecessary privileges in Axis Communications AB AXIS OS](https://agentprime.io/advisories/CVE-2025-3892.md) `CVE-2025-3892` · CVE record: Axis Communications AB AXIS OS · CVSS 6.7 Medium · Not analysed yet · Published 12 Aug 2025 · Tags: Privilege escalation - [Improper privilege management in Axis Communications AB AXIS OS](https://agentprime.io/advisories/CVE-2025-0358.md) `CVE-2025-0358` · CVE record: Axis Communications AB AXIS OS · CVSS 8.8 High · Not analysed yet · Published 2 Jun 2025 · Tags: Privilege escalation - [A Guard Tour VAPIX API parameter allowed the use of arbitrary values and can be incorrectly called, allowing an attacker to block access to the guard tour configuration page in the web interface of t…](https://agentprime.io/advisories/CVE-2025-0325.md) `CVE-2025-0325` · CVE record: Axis Communications AB AXIS OS · CVSS 4.3 Medium · Not analysed yet · Published 2 Jun 2025 · Tags: CWE-628, CWE-1287 - [The VAPIX Device Configuration framework allowed a privilege escalation, enabling a lower-privileged user to gain administrator privileges.](https://agentprime.io/advisories/CVE-2025-0324.md) `CVE-2025-0324` · CVE record: Axis Communications AB AXIS OS · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Jun 2025 · Tags: CWE-791 - [Observable discrepancy in Axis Communications AB AXIS OS](https://agentprime.io/advisories/CVE-2025-0361.md) `CVE-2025-0361` · CVE record: Axis Communications AB AXIS OS · CVSS 4.3 Medium · Not analysed yet · Published 8 Apr 2025 · Tags: Information disclosure - [Axis Communications AB AXIS OS: 51l3nc3, a member of the AXIS OS Bug Bounty Program…](https://agentprime.io/advisories/CVE-2024-47261.md) `CVE-2024-47261` · CVE record: Axis Communications AB AXIS OS · CVSS 4.3 Medium · Not analysed yet · Published 8 Apr 2025 · Tags: CWE-1287 - [Incorrect authorization in Axis Communications AB AXIS OS](https://agentprime.io/advisories/CVE-2025-0360.md) `CVE-2025-0360` · CVE record: Axis Communications AB AXIS OS · CVSS 7.8 High · Not analysed yet · Published 4 Mar 2025 · Tags: Broken access control - [Incorrect authorization in Axis Communications AB AXIS OS](https://agentprime.io/advisories/CVE-2025-0359.md) `CVE-2025-0359` · CVE record: Axis Communications AB AXIS OS · CVSS 8.5 High · Not analysed yet · Published 4 Mar 2025 · Tags: Broken access control - [Axis Communications AB AXIS OS: Dzmitry Lukyanenka, member of the AXIS OS Bug Bounty Program…](https://agentprime.io/advisories/CVE-2024-47262.md) `CVE-2024-47262` · CVE record: Axis Communications AB AXIS OS · CVSS 5.3 Medium · Not analysed yet · Published 4 Mar 2025 · Tags: CWE-1287 - [Axis Communications AB AXIS OS: 51l3nc3, member of the AXIS OS Bug Bounty Program…](https://agentprime.io/advisories/CVE-2024-47260.md) `CVE-2024-47260` · CVE record: Axis Communications AB AXIS OS · CVSS 6.5 Medium · Not analysed yet · Published 4 Mar 2025 · Tags: CWE-641 - [Unrestricted file upload in Axis Communications AB AXIS OS](https://agentprime.io/advisories/CVE-2024-47259.md) `CVE-2024-47259` · CVE record: Axis Communications AB AXIS OS · CVSS 3.5 Low · Not analysed yet · Published 4 Mar 2025 · Tags: Unrestricted file upload - [Axis Communications AB AXIS OS: Erik de Jong, member of the AXIS OS Bug Bounty Program…](https://agentprime.io/advisories/CVE-2024-8160.md) `CVE-2024-8160` · CVE record: Axis Communications AB AXIS OS · CVSS 3.8 Low · Not analysed yet · Published 26 Nov 2024 · Tags: CWE-1286 - [Axis Communications AB AXIS OS: 51l3nc3, member of the AXIS OS Bug Bounty Program…](https://agentprime.io/advisories/CVE-2024-8772.md) `CVE-2024-8772` · CVE record: Axis Communications AB AXIS OS · CVSS 4.3 Medium · Not analysed yet · Published 26 Nov 2024 · Tags: CWE-1286 - [Stack-based buffer overflow in Axis Communications AB AXIS OS](https://agentprime.io/advisories/CVE-2024-7784.md) `CVE-2024-7784` · CVE record: Axis Communications AB AXIS OS · CVSS 6.1 Medium · Not analysed yet · Published 10 Sept 2024 · Tags: Memory corruption - [Incorrect authorization in Axis Communications AB AXIS OS](https://agentprime.io/advisories/CVE-2024-6979.md) `CVE-2024-6979` · CVE record: Axis Communications AB AXIS OS · CVSS 6.8 Medium · Not analysed yet · Published 10 Sept 2024 · Tags: Broken access control - [Axis Communications AB AXIS OS: 51l3nc3, member of the AXIS OS Bug Bounty Program…](https://agentprime.io/advisories/CVE-2024-6173.md) `CVE-2024-6173` · CVE record: Axis Communications AB AXIS OS · CVSS 6.5 Medium · Not analysed yet · Published 10 Sept 2024 · Tags: CWE-1286 - [Resource allocation without limits in Axis Communications AB AXIS OS](https://agentprime.io/advisories/CVE-2024-6509.md) `CVE-2024-6509` · CVE record: Axis Communications AB AXIS OS · CVSS 6.5 Medium · Not analysed yet · Published 10 Sept 2024 · Tags: Denial of service, CWE-155 - [Path traversal in Axis Communications AB AXIS OS](https://agentprime.io/advisories/CVE-2024-0067.md) `CVE-2024-0067` · CVE record: Axis Communications AB AXIS OS · CVSS 4.3 Medium · Not analysed yet · Published 10 Sept 2024 · Tags: Path traversal - [Cleartext transmission of sensitive information in Axis Communications AB AXIS OS](https://agentprime.io/advisories/CVE-2024-0066.md) `CVE-2024-0066` · CVE record: Axis Communications AB AXIS OS · CVSS 5.3 Medium · Not analysed yet · Published 18 Jun 2024 · Tags: Weak cryptography or TLS - [Axis Communications AB AXIS OS: Sandro Poppi, member of the AXIS OS Bug Bounty Program…](https://agentprime.io/advisories/CVE-2024-0055.md) `CVE-2024-0055` · CVE record: Axis Communications AB AXIS OS · CVSS 6.5 Medium · Not analysed yet · Published 19 Mar 2024 · Tags: CWE-155 - [Axis Communications AB AXIS OS: Sandro Poppi, member of the AXIS OS Bug Bounty Program…](https://agentprime.io/advisories/CVE-2024-0054.md) `CVE-2024-0054` · CVE record: Axis Communications AB AXIS OS · CVSS 6.5 Medium · Not analysed yet · Published 19 Mar 2024 · Tags: CWE-155 - [Insufficient input validation in VAPIX API create_overlay.cgi](https://agentprime.io/advisories/CVE-2023-5800.md) `CVE-2023-5800` · CVE record: Axis Communications AB AXIS OS · CVSS 5.4 Medium · Not analysed yet · Published 5 Feb 2024 · Tags: Path traversal - [OS command injection in Axis Communications AB AXIS OS](https://agentprime.io/advisories/CVE-2023-5677.md) `CVE-2023-5677` · CVE record: Axis Communications AB AXIS OS · CVSS 6.3 Medium · Not analysed yet · Published 5 Feb 2024 · Tags: Command injection - [Incorrect authorization in Axis Communications AB AXIS OS](https://agentprime.io/advisories/CVE-2023-5553.md) `CVE-2023-5553` · CVE record: Axis Communications AB AXIS OS · CVSS 7.6 High · Not analysed yet · Published 21 Nov 2023 · Tags: Broken access control - [Path traversal in Axis Communications AB AXIS OS](https://agentprime.io/advisories/CVE-2023-21418.md) `CVE-2023-21418` · CVE record: Axis Communications AB AXIS OS · CVSS 7.1 High · Not analysed yet · Published 21 Nov 2023 · Tags: Path traversal - [Path traversal in Axis Communications AB AXIS OS](https://agentprime.io/advisories/CVE-2023-21417.md) `CVE-2023-21417` · CVE record: Axis Communications AB AXIS OS · CVSS 7.1 High · Not analysed yet · Published 21 Nov 2023 · Tags: Path traversal - [Path traversal in Axis Communications AB AXIS OS](https://agentprime.io/advisories/CVE-2023-21416.md) `CVE-2023-21416` · CVE record: Axis Communications AB AXIS OS · CVSS 7.1 High · Not analysed yet · Published 21 Nov 2023 · Tags: Path traversal - [Path traversal in Axis Communications AB AXIS OS](https://agentprime.io/advisories/CVE-2023-21415.md) `CVE-2023-21415` · CVE record: Axis Communications AB AXIS OS · CVSS 6.5 Medium · Not analysed yet · Published 16 Oct 2023 · Tags: Path traversal - [Stack-based buffer overflow in Axis Communications AB AXIS OS and others](https://agentprime.io/advisories/CVE-2023-21414.md) `CVE-2023-21414` · CVE record: Axis Communications AB AXIS OS and 2 more · CVSS 7.1 High · Not analysed yet · Published 16 Oct 2023 · Tags: Memory corruption - [Remote code execution vulnerability during the installation of ACAP applications on the Axis device](https://agentprime.io/advisories/CVE-2023-21413.md) `CVE-2023-21413` · CVE record: Axis Communications AB AXIS OS · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2023 · Tags: Command injection - [Hard-coded cryptographic key in Axis Communications AB AXIS OS](https://agentprime.io/advisories/CVE-2023-21404.md) `CVE-2023-21404` · CVE record: Axis Communications AB AXIS OS · CVSS 4.1 Medium · Not analysed yet · Published 8 May 2023 · Tags: Hard-coded credentials - [A user controlled parameter related to SMTP test functionality is not correctly validated making it possible to add the Carriage Return and Line Feed (CRLF) control characters and include arbitrary S…](https://agentprime.io/advisories/CVE-2021-31988.md) `CVE-2021-31988` · CVE record: Axis Communications AB AXIS OS · No CVSS score · Not analysed yet · Published 5 Oct 2021 · Tags: CWE-1286 - [A user controlled parameter related to SMTP test functionality is not correctly validated making it possible to bypass blocked network recipients.](https://agentprime.io/advisories/CVE-2021-31987.md) `CVE-2021-31987` · CVE record: Axis Communications AB AXIS OS · No CVSS score · Not analysed yet · Published 5 Oct 2021 · Tags: CWE-1286 - [Heap-based buffer overflow in Axis Communications AB AXIS OS](https://agentprime.io/advisories/CVE-2021-31986.md) `CVE-2021-31986` · CVE record: Axis Communications AB AXIS OS · No CVSS score · Not analysed yet · Published 5 Oct 2021 · Tags: Memory corruption ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .