Kiloview has 9 CVEs on record. Disclosure cadence is accelerating: 9 in the last 90 days against 0 in the 90 before. The busiest recent month was October 2026 with 9. The median CVSS is 7.5 (high), with 3 rated critical. None have a confirmed exploitation report. The most common weakness class is CWE-78 (3).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.5
- Publish → KEV
- —
- Last 90 days
- 9 prev 0
Worst active — by depth score
CVE-2026-110243Critical· 9.9Kiloview E3 NDI Encoder OS Command Injection54CVE-2026-107861Critical· 9.9Kiloview E3 NDI Encoder OS Command Injection54CVE-2026-109122Critical· 9.1Kiloview E3 NDI Encoder OS Command Injection50CVE-2026-92450High· 7.5Kiloview E3 NDI Encoder Use of Hard-coded Credentials41CVE-2026-110825High· 7.5Kiloview E3 NDI Encoder Missing Authentication for Critical Function41
Kiloview vulnerabilities
CVEs affecting Kiloview, newest first. Open any entry for full detail, references, and exploit status.
9 CVEsRSS
CVE-2026-111100Medium· 5.3Kiloview E3 NDI Encoder Missing Authentication for Critical Function
The ONVIF device service on the E3 responds to certain informational requests without requiring authentication. A remote, unauthenticated party can retrieve detailed device identifiers along with a list of configured user accounts and th…
CVE-2026-105265Medium· 5.3Kiloview E3 NDI Encoder Path Traversal
A vulnerability exists in the the time zone parameter and does not properly validate user input, which may allow an authenticated user to cause /etc/localtime to point to a file outside the intended zoneinfo directory .
CVE-2026-96616Medium· 6.5Kiloview E3 NDI Encoder Insufficient Session Expiration
Authentication tokens issued by the E3's web management interface on login are given an expiration time far beyond any reasonable session lifetime, effectively making them non-expiring. A token obtained through interception or device com…
CVE-2026-110491High· 7.5Kiloview E3 NDI Encoder NULL Pointer Dereference
The ONVIF service on the E3 can be rendered unresponsive by sending malformed or incomplete requests to certain operations. The affected service stops accepting new connections while the rest of the device continues operating normally, a…
CVE-2026-92450High· 7.5Kiloview E3 NDI Encoder Use of Hard-coded Credentials
The authentication framework used by affected Kiloview E3 NDI encoder firmware signs session JSON Web Tokens using an HMAC-SHA256 secret hardcoded as a static string within the firmware image, identical across all deployed devices. An at…
CVE-2026-110243Critical· 9.9Kiloview E3 NDI Encoder OS Command Injection
The network management service on affected Kiloview E3 NDI encoder firmware fails to validate the network interface name accepted by its link maintenance address configuration endpoint before passing it to a shell command, unlike sibling…
CVE-2026-107861Critical· 9.9Kiloview E3 NDI Encoder OS Command Injection
The system control service on affected Kiloview E3 NDI encoder firmware fails to sanitize the hostname parameter accepted by its device naming endpoint, passing it unquoted into a shell command. An authenticated web user with access to t…
CVE-2026-110825High· 7.5Kiloview E3 NDI Encoder Missing Authentication for Critical Function
The ONVIF device service on affected Kiloview E3 NDI encoder firmware accepts hostname, DNS, and NTP configuration write operations without requiring authentication, regardless of the device's configured authentication setting for this s…
CVE-2026-109122Critical· 9.1Kiloview E3 NDI Encoder OS Command Injection
The network management service on affected Kiloview E3 NDI encoder firmware fails to sanitize one field used when configuring static routes via the web management API. An authenticated web user with permission to configure static routes …