CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (Oct 28, 2026, 1:50 PM ET)

What this means for you

This week: 3,220 CVEs published, 247 critical, and 3 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 3,220; Show in the list
Critical, last 7 days: 247; Show in the list
Healthcare-tagged, last 7 days: 9; Show in the list
Known exploited (CISA KEV): 1,760; Show in the list

Showing CVEs that name the product gallagher:command_centre_server. Show all products

8 CVEs

Showing 1 to 8.

CVE	Severity	Title	Published
CVE-2026-26053	Medium 5.3	An Incorrect Privilege Assignment (CWE-266) vulnerability in the Command Centre Server allows an authenticated operator with limited privileges to perform some operations that they would not normally… Assigned by Gallagher	Jul 6, 2026
CVE-2026-25193	High 8.1	Insertion of Sensitive Information into Log File (CWE-532) in some Command Centre Service installers could lead to Service Account credentials exposure. Assigned by Gallagher	May 25, 2026
CVE-2026-20757	Low 2.5	Improper Locking vulnerability (CWE-667) in Gallagher Morpho integration allows a privileged operator to cause a limited denial-of-service in the Command Centre Server. Assigned by Gallagher	Mar 2, 2026
CVE-2025-48430	Medium 5.5	Uncaught Exception (CWE-248) in the Command Centre Server allows an Authorized and Privileged Operator to crash the Command Centre Server at will. Assigned by Gallagher	Oct 22, 2025
CVE-2025-48428	Medium 6.7	Cleartext Storage of Sensitive Information (CWE-312) in the Gallagher Morpho integration could allow an authenticated user with access to the Command Centre Server to export a specific signing key wh… Assigned by Gallagher	Oct 22, 2025
CVE-2025-47699	Critical 9.9	Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497) in the Gallagher Morpho integration could allow an authenticated operator with limited site permissions to make cr… Assigned by Gallagher	Oct 22, 2025
CVE-2025-41402	Medium 5.5	Client-Side Enforcement of Server-Side Security (CWE-602) in the Command Centre Server allows a privileged operator to enter invalid competency data, bypassing expiry checks. Assigned by Gallagher	Oct 22, 2025
CVE-2025-35981	Medium 5.5	Exposure of Private Personal Information to an Unauthorized Actor (CWE-359) in the Command Centre Server allows a privileged Operator to view limited personal data about a Cardholder they would not n… Assigned by Gallagher	Oct 22, 2025

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.