CVE Tools
Track your stack

Smarsh

8 CVEs tracked since 2025. Since May 2025, 2 of them reached CISA KEV.

Smarsh CVEs per month

May 2025 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Smarsh CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2025-0582
2025-064 or fewer
2025-075 or fewer
2025-084 or fewer
2025-094 or fewer
2025-104 or fewer
2025-114 or fewer
2025-125 or fewer
2026-015 or fewer
2026-025 or fewer
2026-037 or fewer
2026-046 or fewer
2026-057 or fewer
2026-067 or fewer
2026-077 or fewer
2026-088 or fewer
2026-099 or fewer
2026-106 or fewer

Products

The products that kept showing up in Smarsh's monthly top three, with their CVEs summed over those months.

  1. Telemessage81 month

Latest CVEs

The 8 most recently published vulnerabilities affecting Smarsh.

  1. CVE-2025-48929The TeleMessage service through 2025-05-05 implements authentication through a long-lived credential (e.g., not a token with a short expiration time) that can be reused at a later date if discovere...4.0
  2. CVE-2025-48926The admin panel in the TeleMessage service through 2025-05-05 allows attackers to discover usernames, e-mail addresses, passwords, and telephone numbers.4.3
  3. CVE-2025-48925The TeleMessage service through 2025-05-05 relies on the client side (e.g., the TM SGNL app) to do MD5 hashing, and then accepts the hash as the authentication credential.4.3
  4. CVE-2025-48928The TeleMessage service through 2025-05-05 is based on a JSP application in which the heap content is roughly equivalent to a "core dump" in which a password previously sent over HTTP would be incl...4.0
  5. CVE-2025-48931The TeleMessage service through 2025-05-05 relies on MD5 for password hashing, which opens up various attack possibilities (including rainbow tables) with low computational effort.3.2
  6. CVE-2025-48930The TeleMessage service through 2025-05-05 stores certain cleartext information in memory, even though memory content may be accessible to an adversary through various avenues.2.8
  7. CVE-2025-48927The TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an exposed heap dump endpoint at a /heapdump URI, as exploited in the wild in May 2025.5.3
  8. CVE-2025-47730The TeleMessage archiving backend through 2025-05-05 accepts API calls (to request an authentication token) from the TM SGNL (aka Archive Signal) app with the credentials of logfile for the user an...4.8

The record

Peak rank
#101 in May 2025
Busiest month shown
May 2025, 8 CVEs
Months with a KEV entry
1 since May 2025
Monthly snapshots
1 since 2025
Smarsh's full record, month by month