# cve.now: Broadcom

The newest entries naming Broadcom as an affected vendor (up to 200), of 95 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-101034](https://cve.now/CVE-2026-101034.md): Security Advisory for offline recovery of Symantec GSS 3.3 RU11 stored domain credentials (CVSS 6.8)
- [CVE-2026-19810](https://cve.now/CVE-2026-19810.md): Cross-Site Scripting (XSS) in Symantec Endpoint Detection and Response Console (CVSS 5.4)
- [CVE-2026-15380](https://cve.now/CVE-2026-15380.md): Local privilege escalation in Symantec ITMS (CVSS 5.1)
- [CVE-2026-15379](https://cve.now/CVE-2026-15379.md): Arbitrary File Read as SYSTEM in Symantec ITMS (CVSS 5.1)
- [CVE-2026-11626](https://cve.now/CVE-2026-11626.md): Local Privilege Escalation in Symantec Endpoint Protection macOS CleanWipe Removal Tool (CVSS 5.4)
- [CVE-2026-11815](https://cve.now/CVE-2026-11815.md): Insecure Deserialization via MITM in Layer 7 Policy Manager (CVSS 5.3)
- [CVE-2026-8370](https://cve.now/CVE-2026-8370.md): Automic Automation Agent Unix privilege escalation (CVSS 8.5)
- [CVE-2026-3991](https://cve.now/CVE-2026-3991.md): Elevation of Privileges in Symantec Data Loss Prevention Windows Endpoint (CVSS 7.8)
- [CVE-2026-3862](https://cve.now/CVE-2026-3862.md): Cross-Site Scripting Vulnerability in SiteMinder Administrative UI (CVSS 4.6)
- [CVE-2025-13919](https://cve.now/CVE-2025-13919.md): Component Object Model (COM) Hijacking in Symantec Endpoint Protection Windows Client (CVSS 4.4)
- [CVE-2025-13918](https://cve.now/CVE-2025-13918.md): Elevation of Privileges in Symantec Endpoint Protection Windows Client (CVSS 6.7)
- [CVE-2025-13917](https://cve.now/CVE-2025-13917.md): Elevation of Privileges in Web Security Services (WSS) Agent (CVSS 7.0)
- [CVE-2025-69276](https://cve.now/CVE-2025-69276.md): Spectrum insecure deserialiation (CVSS 2.3)
- [CVE-2025-69275](https://cve.now/CVE-2025-69275.md): Spectrum outdated java library in class-path (CVSS 7.1)
- [CVE-2025-69274](https://cve.now/CVE-2025-69274.md): Spectrum broken authorization scheme (CVSS 2.3)
- [CVE-2025-69273](https://cve.now/CVE-2025-69273.md): Spectrum broken authentication (CVSS 8.7)
- [CVE-2025-69272](https://cve.now/CVE-2025-69272.md): Spectrum password returned in clear (CVSS 5.3)
- [CVE-2025-69271](https://cve.now/CVE-2025-69271.md): Spectrum basic authentication in use (CVSS 2.3)
- [CVE-2025-69270](https://cve.now/CVE-2025-69270.md): Spectrum session token in URL (CVSS 2.3)
- [CVE-2025-69269](https://cve.now/CVE-2025-69269.md): Spectrum command injection in NCM service (CVSS 7.1)
- [CVE-2025-69268](https://cve.now/CVE-2025-69268.md): Spectrum reflected XSS (CVSS 5.3)
- [CVE-2025-69267](https://cve.now/CVE-2025-69267.md): Spectrum directory path traversal (CVSS 8.8)
- [CVE-2025-31649](https://cve.now/CVE-2025-31649.md): Dell ControlVault3 ControlVault WBDI Driver hard-coded password vulnerability (CVSS 8.7)
- [CVE-2025-31361](https://cve.now/CVE-2025-31361.md): Dell ControlVault3 ControlVault WBDI Driver Broadcom Storage Adapter privilege escalation vulnerability (CVSS 8.7)
- [CVE-2025-36463](https://cve.now/CVE-2025-36463.md): Dell ControlVault3 ControlVault WBDI Driver Broadcom Storage Adapter out-of-bounds write vulnerability (CVSS 7.3)
- [CVE-2025-36462](https://cve.now/CVE-2025-36462.md): Dell ControlVault3 ControlVault WBDI Driver Broadcom Storage Adapter out-of-bounds write vulnerability (CVSS 7.3)
- [CVE-2025-36461](https://cve.now/CVE-2025-36461.md): Dell ControlVault3 ControlVault WBDI Driver Broadcom Storage Adapter out-of-bounds write vulnerability (CVSS 7.3)
- [CVE-2025-36460](https://cve.now/CVE-2025-36460.md): Dell ControlVault3 ControlVault WBDI Driver Broadcom Storage Adapter out-of-bounds write vulnerability (CVSS 7.3)
- [CVE-2025-32089](https://cve.now/CVE-2025-32089.md): Dell ControlVault3 CvManager\_SBI buffer overflow vulnerability (CVSS 8.8)
- [CVE-2025-36553](https://cve.now/CVE-2025-36553.md): Dell ControlVault3 CvManager buffer overflow vulnerability (CVSS 8.8)
- [CVE-2025-10847](https://cve.now/CVE-2025-10847.md): DX UIM Probe Improper ACL Handling RCE (CVSS 8.4)
- [CVE-2025-9059](https://cve.now/CVE-2025-9059.md): Elevation of Privileges Vulnerability in IT Management Suite (CVSS 8.8)
- [CVE-2025-8661](https://cve.now/CVE-2025-8661.md): Stored Cross-Site Scripting in Symantec PGP Encryption 11.0.1 (CVSS 4.6)
- [CVE-2025-8660](https://cve.now/CVE-2025-8660.md): Privilege Escalation in Symantec PGP Encryption 11.0.1 (CVSS 5.6)
- [CVE-2025-7397](https://cve.now/CVE-2025-7397.md): CLI history displays inline passwords (CVSS 6.8)
- [CVE-2025-6391](https://cve.now/CVE-2025-6391.md): JSON Web Token (JWT) Exposure in Log Files (CVSS 7.1)
- [CVE-2025-7398](https://cve.now/CVE-2025-7398.md): Medium Strength Cipher Suites detected on port on ports 9000 and 8036 (CVSS 8.6)
- [CVE-2025-6392](https://cve.now/CVE-2025-6392.md): Daily Data Dump Collector logs database password in cleartext when running docker exec commands (CVE-2025-6392) (CVSS 6.7)
- [CVE-2025-6390](https://cve.now/CVE-2025-6390.md): Cleartext storage of sensitive information in Brocade SANnav server audit logs. (CVSS 5.1)
- [CVE-2025-4662](https://cve.now/CVE-2025-4662.md): Plaintext security passwords are logged in the audit logs while executing openssl cmd (CVSS 5.1)
- [CVE-2025-4663](https://cve.now/CVE-2025-4663.md): Denial-of-Service (DoS) after Unusual or Exceptional Conditions vulnerability (CVSS 6.8)
- [CVE-2025-24508](https://cve.now/CVE-2025-24508.md): Offline Extraction of Account Connectivity Credentials (ACCs) in IT Management Suite (CVSS 6.4)
- [CVE-2025-5333](https://cve.now/CVE-2025-5333.md): Unauthenticated Remote Code Execution in IT Management Suite (CVSS 9.5)
- [CVE-2025-24919](https://cve.now/CVE-2025-24919.md): Dell ControlVault3/ControlVault3 Plus deserialization of untrusted input vulnerability (CVSS 8.1)
- [CVE-2025-25215](https://cve.now/CVE-2025-25215.md): Dell ControlVault3/ControlVault3 Plus cv\_close arbitrary free vulnerability (CVSS 8.8)
- [CVE-2025-25050](https://cve.now/CVE-2025-25050.md): Dell ControlVault3/ControlVault3 Plus cv\_upgrade\_sensor\_firmware out-of-bounds write vulnerability (CVSS 8.8)
- [CVE-2025-24922](https://cve.now/CVE-2025-24922.md): Dell ControlVault3/ControlVault3 Plus securebio\_identify stack-based buffer overflow vulnerability (CVSS 8.8)
- [CVE-2025-24311](https://cve.now/CVE-2025-24311.md): Dell ControlVault3/ControlVault3 Plus cv\_send\_blockdata out-of-bounds read vulnerability (CVSS 8.4)
- [CVE-2025-4971](https://cve.now/CVE-2025-4971.md): Broadcom Automic Automation Agent Unix privilege escalation (CVSS 8.5)
- [CVE-2025-24507](https://cve.now/CVE-2025-24507.md): This vulnerability allows appliance compromise at boot time. (CVSS 8.9)
- [CVE-2025-24506](https://cve.now/CVE-2025-24506.md): A specific authentication strategy allows to learn ids of PAM users associated with certain authentication types. (CVSS 5.3)
- [CVE-2025-24505](https://cve.now/CVE-2025-24505.md): This vulnerability allows a high-privileged authenticated PAM user to achieve remote command execution on the affected PAM system by uploadi (CVSS 8.8)
- [CVE-2025-24504](https://cve.now/CVE-2025-24504.md): An improper input validation the CSRF filter results in unsanitized user input written to the application logs. (CVSS 5.3)
- [CVE-2025-24503](https://cve.now/CVE-2025-24503.md): A malicious actor can fix the session of a PAM user by tricking the user to click on a specially crafted link to the PAM server. (CVSS 9.3)
- [CVE-2025-24502](https://cve.now/CVE-2025-24502.md): An improper session validation allows an unauthenticated attacker to cause certain request notifications to be executed in the context of an (CVSS 5.3)
- [CVE-2025-24501](https://cve.now/CVE-2025-24501.md): An improper input validation allows an unauthenticated attacker to alter PAM logs by sending a specially crafted HTTP request. (CVSS 5.3)
- [CVE-2025-24500](https://cve.now/CVE-2025-24500.md): The vulnerability allows an unauthenticated attacker to access information in PAM database. (CVSS 8.7)
- [CVE-2024-38499](https://cve.now/CVE-2024-38499.md): Improper Privilege Management Vulnerability in CA Client Automation 14.5 (CVSS 7.3)
- [CVE-2024-38496](https://cve.now/CVE-2024-38496.md): Symantec Privileged Access Manager Insecure Direct Object Reference vulnerability (CVSS 5.1)
- [CVE-2024-38495](https://cve.now/CVE-2024-38495.md): Symantec Privileged Access Manager User Enumeration vulnerability (CVSS 5.3)
- [CVE-2024-38494](https://cve.now/CVE-2024-38494.md): Symantec Privileged Access Manager Remote Command Execution vulnerability (CVSS 8.6)
- [CVE-2024-38493](https://cve.now/CVE-2024-38493.md): Symantec Privileged Access Manager Reflected Cross Site Scripting vulnerability (CVSS 6.8)
- [CVE-2024-38492](https://cve.now/CVE-2024-38492.md): Symantec Privileged Access Manager Remote Command Execution vulnerability (CVSS 9.4)
- [CVE-2024-38491](https://cve.now/CVE-2024-38491.md): Symantec Privileged Access Manager SQL Injection vulnerability (CVSS 8.4)
- [CVE-2024-36458](https://cve.now/CVE-2024-36458.md): Symantec Privileged Access Manager Privilege Escalation vulnerability (CVSS 5.1)
- [CVE-2024-36457](https://cve.now/CVE-2024-36457.md): Symantec Privileged Access Manager Authentication Bypass vulnerability (CVSS 5.3)
- [CVE-2024-36456](https://cve.now/CVE-2024-36456.md): Symantec Privileged Access Manager Remote Command Execution vulnerability (CVSS 9.4)
- [CVE-2024-36455](https://cve.now/CVE-2024-36455.md): Symantec Privileged Access Manager Remote Command Execution vulnerability (CVSS 9.4)
- [CVE-2024-36459](https://cve.now/CVE-2024-36459.md): Cross-Site Scripting Vulnerability in Symantec SiteMinder Web Agent (CVSS 8.4)
- [CVE-2023-4324](https://cve.now/CVE-2023-4324.md): Broadcom RAID Controller web interface is vulnerable due to insecure defaults of lacking HTTP Content-Security-Policy headers (no CVSS)
- [CVE-2023-4325](https://cve.now/CVE-2023-4325.md): Broadcom RAID Controller web interface is vulnerable due to usage of Libcurl with LSA has known vulnerabilities (no CVSS)
- [CVE-2023-4326](https://cve.now/CVE-2023-4326.md): Broadcom RAID Controller web interface is vulnerable has an insecure default TLS configuration that supports obsolete SHA1-based ciphersuites (no CVSS)
- [CVE-2023-4327](https://cve.now/CVE-2023-4327.md): Broadcom RAID Controller web interface is vulnerable to exposure of sensitive data and the keys used for encryption are accessible to any local user on Linux (no CVSS)
- [CVE-2023-4328](https://cve.now/CVE-2023-4328.md): Broadcom RAID Controller web interface is vulnerable to exposure of sensitive data and the keys used for encryption are accessible to any local user on Linux (no CVSS)
- [CVE-2023-4329](https://cve.now/CVE-2023-4329.md): Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not safeguard SESSIONID cookie with SameSite attribute (no CVSS)
- [CVE-2023-4331](https://cve.now/CVE-2023-4331.md): Broadcom RAID Controller web interface is vulnerable has an insecure default TLS configuration that support obsolete and vulnerable TLS protocols (no CVSS)
- [CVE-2023-4332](https://cve.now/CVE-2023-4332.md): Broadcom RAID Controller web interface is vulnerable due to Improper permissions on the log file (no CVSS)
- [CVE-2023-4333](https://cve.now/CVE-2023-4333.md): Broadcom RAID Controller web interface doesn’t enforce SSL cipher ordering by server (no CVSS)
- [CVE-2023-4334](https://cve.now/CVE-2023-4334.md): Broadcom RAID Controller Web server (nginx) is serving private files without any authentication (no CVSS)
- [CVE-2023-4335](https://cve.now/CVE-2023-4335.md): Broadcom RAID Controller Web server (nginx) is serving private server-side files without any authentication on Linux (no CVSS)
- [CVE-2023-4336](https://cve.now/CVE-2023-4336.md): Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not safeguard cookies with Secure attribute (no CVSS)
- [CVE-2023-4337](https://cve.now/CVE-2023-4337.md): Broadcom RAID Controller web interface is vulnerable to improper session handling of managed servers on Gateway installation (no CVSS)
- [CVE-2023-4338](https://cve.now/CVE-2023-4338.md): Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not provide X-Content-Type-Options Headers (no CVSS)
- [CVE-2023-4339](https://cve.now/CVE-2023-4339.md): Broadcom RAID Controller web interface is vulnerable to exposure of private keys used for CIM stored with insecure file permissions (no CVSS)
- [CVE-2023-4340](https://cve.now/CVE-2023-4340.md): Broadcom RAID Controller is vulnerable to Privilege escalation by taking advantage of the Session prints in the log file (no CVSS)
- [CVE-2023-4341](https://cve.now/CVE-2023-4341.md): Broadcom RAID Controller is vulnerable to Privilege escalation to root due to creation of insecure folders by Web GUI (no CVSS)
- [CVE-2023-4342](https://cve.now/CVE-2023-4342.md): Broadcom RAID Controller web interface is vulnerable due to insecure defaults of lacking HTTP strict-transport-security policy (no CVSS)
- [CVE-2023-4343](https://cve.now/CVE-2023-4343.md): Broadcom RAID Controller web interface is vulnerable due to exposure of sensitive password information in the URL as a URL search parameter (no CVSS)
- [CVE-2023-4344](https://cve.now/CVE-2023-4344.md): Broadcom RAID Controller web interface is vulnerable to insufficient randomness due to improper use of ssl.rnd to setup CIM connection (CVSS 9.8)
- [CVE-2023-4323](https://cve.now/CVE-2023-4323.md): Broadcom RAID Controller web interface is vulnerable to improper session management of active sessions on Gateway setup (no CVSS)
- [CVE-2023-4345](https://cve.now/CVE-2023-4345.md): Broadcom RAID Controller web interface is vulnerable client-side control bypass (no CVSS)
- [CVE-2019-9502](https://cve.now/CVE-2019-9502.md): Broadcom wl driver is vulnerable to heap buffer overflow (CVSS 7.9)
- [CVE-2019-9501](https://cve.now/CVE-2019-9501.md): Broadcom wl driver is vulnerable to heap buffer overflow (CVSS 7.9)
- [CVE-2019-9503](https://cve.now/CVE-2019-9503.md): Broadcom brcmfmac driver is vulnerable to a frame validation bypass (CVSS 7.9)
- [CVE-2019-9500](https://cve.now/CVE-2019-9500.md): Broadcom brcmfmac driver is vulnerable to a heap buffer overflow (CVSS 7.9)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/broadcom
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.