What’s Vulnerable › Vulnerabilities

CVE-2025-58406: Lack of HTTP Response Headers

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-03-02 · updated 2026-06-17
• Weakness: CWE-693

Description

The CGM CLININET application respond without essential security HTTP headers, exposing users to client‑side attacks such as clickjacking, MIME sniffing, unsafe caching, weak cross‑origin isolation, and missing transport security controls.

Affected products

• CGM CLININET: before 2025.ms3 — fixed in 2025.ms3

How to fix

Upgrade to a fixed version: CGM CLININET 2025.ms3. Check the vendor advisory for mitigations.

References

• https://cert.pl/en/posts/2026/03/CVE-2025-10350/
• https://www.cgm.com/pol_pl/products/szpital/cgm-clininet.html

Get alerted when CVE-2025-58406 or the next vulnerability affects your stack