# cve.now: Forcepoint

The newest entries naming Forcepoint as an affected vendor (up to 200), of 27 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-12974](https://cve.now/CVE-2026-12974.md): Security Policy Bypass in Forcepoint Security Engine (NGFW) (CVSS 7.9)
- [CVE-2026-11970](https://cve.now/CVE-2026-11970.md): This vulnerability allows a normal (non-admin) user to disable the Forcepoint One Endpoint SafariExtension and bypass DLP protection in F1E (CVSS 4.8)
- [CVE-2025-12694](https://cve.now/CVE-2025-12694.md): Local Privilege Escalation in VPN Client (CVSS 8.5)
- [CVE-2025-2274](https://cve.now/CVE-2025-2274.md): Stored Cross Site Scripting in Forcepoint Web Security (CVSS 4.8)
- [CVE-2025-12690](https://cve.now/CVE-2025-12690.md): Local Privilege Escalation in NGFW Engine (CVSS 7.3)
- [CVE-2025-14026](https://cve.now/CVE-2025-14026.md): Vulnerable Python version used in Forcepoint One DLP Client (CVSS 7.8)
- [CVE-2025-2272](https://cve.now/CVE-2025-2272.md): Privilege Escalation and Arbitrary code execution in F1E Endpoint (CVSS 7.0)
- [CVE-2024-9103](https://cve.now/CVE-2024-9103.md): Persistent XSS in blocked messages (CVSS 6.1)
- [CVE-2024-2166](https://cve.now/CVE-2024-2166.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Email Security (Real Time M (CVSS 8.8)
- [CVE-2023-6452](https://cve.now/CVE-2023-6452.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Web Security (Transaction V (CVSS 9.6)
- [CVE-2023-5451](https://cve.now/CVE-2023-5451.md): Forcepoint NGFW Security Management Center Management Server has SMC Downloads optional feature to offer standalone Management Client down (CVSS 6.1)
- [CVE-2023-1705](https://cve.now/CVE-2023-1705.md): Missing Authorization vulnerability in Forcepoint F|One SmartEdge Agent on Windows (bgAutoinstaller service modules) allows Privilege Escala (CVSS 8.4)
- [CVE-2023-2080](https://cve.now/CVE-2023-2080.md): Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Forcepoint Cloud Security Gateway (CSG (CVSS 8.5)
- [CVE-2023-26292](https://cve.now/CVE-2023-26292.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Cloud Security Gateway (CSG (CVSS 6.1)
- [CVE-2023-26291](https://cve.now/CVE-2023-26291.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Cloud Security Gateway (CSG (CVSS 6.1)
- [CVE-2023-26290](https://cve.now/CVE-2023-26290.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Cloud Security Gateway (CSG (CVSS 6.1)
- [CVE-2022-1700](https://cve.now/CVE-2022-1700.md): Improper Restriction of XML External Entity Reference ('XXE') vulnerability in the Policy Engine of Forcepoint Data Loss Prevention (DLP), w (CVSS 7.5)
- [CVE-2022-27609](https://cve.now/CVE-2022-27609.md): Forcepoint One Endpoint prior to version 22.01 installed on Microsoft Windows does not provide sufficient anti-tampering protection of servi (CVSS 6.0)
- [CVE-2022-27608](https://cve.now/CVE-2022-27608.md): Forcepoint One Endpoint prior to version 22.01 installed on Microsoft Windows is vulnerable to registry key tampering by users with Administ (CVSS 6.0)
- [CVE-2019-6147](https://cve.now/CVE-2019-6147.md): Forcepoint NGFW Security Management Center (SMC) versions lower than 6.5.12 or 6.7.1 have a rare issue that in specific circumstances can co (no CVSS)
- [CVE-2019-6142](https://cve.now/CVE-2019-6142.md): It has been reported that XSS is possible in Forcepoint Email Security, versions 8.5 and 8.5.3. (no CVSS)
- [CVE-2019-6145](https://cve.now/CVE-2019-6145.md): Forcepoint VPN Client for Windows versions lower than 6.6.1 have an unquoted search path vulnerability. (no CVSS)
- [CVE-2019-6143](https://cve.now/CVE-2019-6143.md): Forcepoint Next Generation Firewall (Forcepoint NGFW) 6.4.x before 6.4.7, 6.5.x before 6.5.4, and 6.6.x before 6.6.2 has a serious authentic (no CVSS)
- [CVE-2019-6140](https://cve.now/CVE-2019-6140.md): A configuration issue has been discovered in Forcepoint Email Security 8.4.x and 8.5.x: the product is left in a vulnerable state if the hyb (no CVSS)
- [CVE-2018-16530](https://cve.now/CVE-2018-16530.md): A stack-based buffer overflow in Forcepoint Email Security version 8.5 allows an attacker to craft malicious input and potentially crash a p (no CVSS)
- [CVE-2018-16529](https://cve.now/CVE-2018-16529.md): A password reset vulnerability has been discovered in Forcepoint Email Security 8.5.x. (no CVSS)
- [CVE-2019-6139](https://cve.now/CVE-2019-6139.md): Forcepoint User ID (FUID) server versions up to 1.2 have a remote arbitrary file upload vulnerability on TCP port 5001. (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/forcepoint
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.