# cve.now: MBS

The newest entries naming MBS as an affected vendor (up to 200), of 26 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-35085](https://cve.now/CVE-2026-35085.md): Stack buffer overflow in method gdv-serverconfig (CVSS 8.7)
- [CVE-2026-35084](https://cve.now/CVE-2026-35084.md): Stack buffer overflow in method dali-devconfig (CVSS 8.7)
- [CVE-2026-35083](https://cve.now/CVE-2026-35083.md): Stack buffer overflow in method bac-deviceobject (CVSS 8.7)
- [CVE-2026-35082](https://cve.now/CVE-2026-35082.md): Local file inclusion vulnerability and deletion in ugw-logread method (CVSS 8.7)
- [CVE-2026-35081](https://cve.now/CVE-2026-35081.md): Arbitrary process termination vulnerability in method ugw-logstop (CVSS 7.2)
- [CVE-2026-35080](https://cve.now/CVE-2026-35080.md): Arbitrary file delete vulnerability in method ugw-restoreinfo (CVSS 7.2)
- [CVE-2026-35079](https://cve.now/CVE-2026-35079.md): Arbitrary file delete vulnerability in method ugw-restore (CVSS 7.2)
- [CVE-2026-35078](https://cve.now/CVE-2026-35078.md): Arbitrary file delete vulnerability in method ugw-logstop (CVSS 7.2)
- [CVE-2026-35077](https://cve.now/CVE-2026-35077.md): Arbitrary file delete vulnerability in method ugw-delete-file (CVSS 7.2)
- [CVE-2026-35076](https://cve.now/CVE-2026-35076.md): Arbitrary file delete vulnerability in method bac-scanresult (CVSS 7.2)
- [CVE-2026-35075](https://cve.now/CVE-2026-35075.md): Hardcoded default Password for Service Account (CVSS 9.3)
- [CVE-2025-41772](https://cve.now/CVE-2025-41772.md): wwwupdate.cgi Session token in URL (CVSS 7.5)
- [CVE-2025-41767](https://cve.now/CVE-2025-41767.md): Signature bypass on update upload (CVSS 7.2)
- [CVE-2025-41766](https://cve.now/CVE-2025-41766.md): Stack buffer overflow on parsing web request (CVSS 8.8)
- [CVE-2025-41765](https://cve.now/CVE-2025-41765.md): Unchecked role in wwwupload.cgi (CVSS 9.1)
- [CVE-2025-41764](https://cve.now/CVE-2025-41764.md): Unchecked role in wwwupdate.cgi (CVSS 9.1)
- [CVE-2025-41763](https://cve.now/CVE-2025-41763.md): Unchecked role in wwwdnload.cgi (CVSS 6.5)
- [CVE-2025-41762](https://cve.now/CVE-2025-41762.md): Secret leak with wwwdnload.cgi (CVSS 6.2)
- [CVE-2025-41761](https://cve.now/CVE-2025-41761.md): Privilege escalation possible (CVSS 7.8)
- [CVE-2025-41760](https://cve.now/CVE-2025-41760.md): Pass filter with Empty Table (CVSS 4.9)
- [CVE-2025-41759](https://cve.now/CVE-2025-41759.md): Use of wildcard (“\*” or “all”) in Block list (CVSS 4.9)
- [CVE-2025-41758](https://cve.now/CVE-2025-41758.md): Arbitrary Write with wwwupload.cgi (CVSS 8.8)
- [CVE-2025-41757](https://cve.now/CVE-2025-41757.md): Arbitrary Write with ubr-restore (CVSS 8.8)
- [CVE-2025-41756](https://cve.now/CVE-2025-41756.md): Arbitrary Write with ubr-editfile (CVSS 8.1)
- [CVE-2025-41755](https://cve.now/CVE-2025-41755.md): Arbitrary Read with ubr-logread (CVSS 6.5)
- [CVE-2025-41754](https://cve.now/CVE-2025-41754.md): Arbitrary Read with ubr-editfile (CVSS 6.5)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/mbs
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.