Hyland
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| Alfresco Transformation Service (Enterprise) | 3 | – | Feb 19, 2026 |
| Alfresco Community (Transform Core) | 3 | – | Feb 19, 2026 |
| Alfresco Enterprise | 1 | – | Feb 19, 2026 |
| Alfresco Enterprise Edition | 1 | – | Jan 18, 2025 |
| Desktop Host | 1 | – | Oct 14, 2026 |
| Nuxeo | 1 | – | Jan 5, 2023 |
| OnBase Workflow Timer Service | 1 | – | Feb 13, 2026 |
| PACSgear MediaWriter | 1 | – | Jul 1, 2026 |
| Alfresco Community | 1 | – | Feb 19, 2026 |
| PACSgear PACS Scan | 1 | – | Jul 1, 2026 |
| Alfresco Community Edition | 1 | – | Jan 18, 2025 |
Exploited and recent CVEs
- CVE-2026-110359 Hyland Desktop Host for Windows before 25.1.1 is vulnerable to local privilege escalation. This is caused by a privileged service running from the %PROGRAMDATA%\Hyland\DesktopHost\bin folder with weak 0.1%
- CVE-2026-58127 PACSgear MediaWriter 5.2.1 Unauthenticated RCE via .NET Remoting TCP Service 1.9%
- CVE-2026-58126 PACSgear PACS Scan 5.2.1 Unauthenticated RCE via .NET Remoting TCP Service 1.8%
- CVE-2026-26339 Hyland Alfresco Transformation Service Argument Injection RCE 0.6%
- CVE-2026-26339 Hyland Alfresco Transformation Service Argument Injection RCE 0.6%
- CVE-2026-26338 Hyland Alfresco Transformation Service SSRF 0.4%
- CVE-2026-26338 Hyland Alfresco Transformation Service SSRF 0.4%
- CVE-2026-26337 Hyland Alfresco Transformation Service Absolute Path Traversal Arbitrary File Read and SSRF 0.4%
- CVE-2026-26337 Hyland Alfresco Transformation Service Absolute Path Traversal Arbitrary File Read and SSRF 0.4%
- CVE-2026-26336 Hyland Alfresco Improper Authorization Arbitrary File Read 0.5%
- CVE-2026-26336 Hyland Alfresco Improper Authorization Arbitrary File Read 0.5%
- CVE-2026-26221 Hyland OnBase Timer Service Unauthenticated .NET Remoting RCE 1.3%
- CVE-2025-0557 Hyland Alfresco Community Edition URL s cross site scripting 0.6%
- CVE-2025-0557 Hyland Alfresco Community Edition URL s cross site scripting 0.6%
- CVE-2021-32828 Regular expression Denial of Service in MooTools 0.8%