Newell Brands has 3 CVEs on record. 3 were published in the last 90 days. The median CVSS is 4.4 (medium). Most affected products: DYMO ID (2), DYMO Connect Desktop (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 4.4
- Publish → KEV
- —
- Last 90 days
- 3 prev 0
Worst active — by depth score
CVE-2026-102262High· 7.3Newell Brands DYMO ID 1.5.1.71 resolves its plugin Modules directory relative to the process working directory52CVE-2026-76796Medium· 4.0The LoadImageAsPngBase64 endpoint of the Newell Brands DYMO Connect Desktop local web service accepts a file path parameter without adequate validation, allowing a crafted path to read arbitrary image files from the host filesystem outsi…34CVE-2026-101893Medium· 4.4Newell Brands DYMO ID 1.5.1.71 parses job files using XmlDocument.Load() without disabling DTD processing24
Newell Brands vulnerabilities
CVEs affecting Newell Brands, newest first. Open any entry for full detail, references, and exploit status.
3 CVEsRSS
CVE-2026-102262High· 7.3PoCNewell Brands DYMO ID 1.5.1.71 resolves its plugin Modules directory relative to the process working directory
Newell Brands DYMO ID 1.5.1.71 resolves its plugin Modules directory relative to the process working directory. An attacker could store a job file alongside malicious modules / DLL that sets the process working directory to the job file'…
CVE-2026-101893Medium· 4.4Newell Brands DYMO ID 1.5.1.71 parses job files using XmlDocument.Load() without disabling DTD processing
Newell Brands DYMO ID 1.5.1.71 parses job files using XmlDocument.Load() without disabling DTD processing. The PC Job Files view automatically parses every recognized job file extension on folder browse. A crafted file on any browsed net…
CVE-2026-76796Medium· 4.0PoCThe LoadImageAsPngBase64 endpoint of the Newell Brands DYMO Connect Desktop local web service accepts a file path parameter without adequate validation, allowing a crafted path to read arbitrary image files from the host filesystem outsi…
The LoadImageAsPngBase64 endpoint of the Newell Brands DYMO Connect Desktop local web service accepts a file path parameter without adequate validation, allowing a crafted path to read arbitrary image files from the host filesystem outsi…