GFI Software has 10 CVEs on record. 3 were published in the last 90 days. The busiest recent month was April 2026 with 5. The median CVSS is 5.4 (medium). None have a confirmed exploitation report. The most common weakness class is CWE-79 (8). Most affected products: HelpDesk (5), GFI Archiver (3), GFI Exinda AI (2).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.4
- Publish → KEV
- —
- Last 90 days
- 3 prev 2
Worst active — by depth score
CVE-2026-74237Medium· 6.5GFI Exinda AI and ClearView before 7.6.5 contains an argument injection vulnerability in the Tools Iperf Client functionality36CVE-2026-112333Medium· 5.4GFI Archiver < 15.14 Stored XSS via MailInsights.aspx30CVE-2026-48539Medium· 5.4GFI Archiver < 15.14 Stored XSS via MailInsights.aspx30CVE-2026-48530Medium· 5.4GFI Archiver < 15.14 Stored XSS via CategorizationPolicyWizard.aspx30CVE-2026-23757Medium· 5.4GFI HelpDesk < 4.99.10 Stored XSS via Reports Module30
GFI Software vulnerabilities
CVEs affecting GFI Software, newest first. Open any entry for full detail, references, and exploit status.
10 CVEsRSS
CVE-2026-112333Medium· 5.4GFI Archiver < 15.14 Stored XSS via MailInsights.aspx
GFI Archiver before 15.14 contains a stored cross-site scripting vulnerability in the MailInsights scheduled report configuration that allows authenticated attackers to inject arbitrary web script or HTML via the report name parameter to…
CVE-2026-74237Medium· 6.5GFI Exinda AI and ClearView before 7.6.5 contains an argument injection vulnerability in the Tools Iperf Client functionality
GFI Exinda AI and ClearView before 7.6.5 contains an argument injection vulnerability in the Tools Iperf Client functionality. The web_tools_cmd() function constructs an iperf command using the server and options parameters without sanit…
CVE-2026-74235Medium· 4.9GFI Exinda AI and ClearView before 7.6.5 contains a path traversal vulnerability in the system maintenance configuration download handler
GFI Exinda AI and ClearView before 7.6.5 contains a path traversal vulnerability in the system maintenance configuration download handler. The wcf_handle_download() function accepts parameters prefixed with v_del_ and appends their value…
CVE-2026-48530Medium· 5.4GFI Archiver < 15.14 Stored XSS via CategorizationPolicyWizard.aspx
GFI Archiver before 15.14 contains a stored cross-site scripting vulnerability in the Classification Rules configuration that allows authenticated attackers to inject arbitrary web script or HTML via the rule name and email criteria para…
CVE-2026-48539Medium· 5.4GFI Archiver < 15.14 Stored XSS via MailInsights.aspx
GFI Archiver before 15.14 contains a stored cross-site scripting vulnerability in the MailInsights scheduled report configuration that allows authenticated attackers to inject arbitrary web script or HTML via the report name parameter to…
CVE-2026-23756Medium· 5.4GFI HelpDesk < 4.99.9 Stored XSS via Troubleshooter Step Subject
GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the Troubleshooter module where the subject POST parameter is not sanitized in Controller_Step.InsertSubmit() and EditSubmit() before being rendered by Vi…
CVE-2026-23753Medium· 4.8GFI HelpDesk < 4.99.9 Stored XSS via charset Parameter
GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the language management functionality where the charset POST parameter is passed directly to SWIFT_Language::Create() without HTML sanitization and subseq…
CVE-2026-23758Medium· 5.1GFI HelpDesk < 4.99.9 Stored XSS via editsubject Parameter
GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the ticket subject field that allows authenticated staff members to inject malicious JavaScript by manipulating the editsubject POST parameter. Attackers …
CVE-2026-23757Medium· 5.4GFI HelpDesk < 4.99.10 Stored XSS via Reports Module
GFI HelpDesk before 4.99.10 contains a stored cross-site scripting vulnerability in the Reports module where the title parameter is passed directly to SWIFT_Report::Create() without HTML sanitization. Attackers can inject arbitrary JavaS…
CVE-2026-23752Medium· 4.8GFI HelpDesk < 4.99.9 Stored XSS via companyname Parameter
GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the template group creation and editing functionality that allows authenticated administrators to inject arbitrary JavaScript by manipulating the companyn…